Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Lottie PlayerUndisclosed
Lottie Player suffered a supply-chain attack that affected projects including 1inch and Movement.
SUNRAY FINANCEDeFi ProtocolArbitrum$2.86M
A compromised private key let an attacker upgrade SUNRAY FINANCE’s contracts and mint a huge supply of SUN tokens. The attacker sold tokens for USDC, while SUN and ARC funds were also drained from decentralized exchange pools.
Shoebill FinanceDeFi ProtocolBOB$1.52M
An oracle configuration error—affecting how asset values were supplied to the lending platform—let attackers borrow with little collateral. They moved 19.512 wBTC and 1.597 tBTC across multiple bridges.
KeystoneUndisclosed
Keystone’s official X account was suspected of being hacked; the report warned users about possible risks but did not describe any stolen funds.
BUBAITokenEthereum$131K
BUBAI’s liquidity was removed from Ethereum, leaving users with reported losses of about $131,000.
Andy AyreyUndisclosed
Truth Terminal founder Andy Ayrey announced a new token on X, but it was suspected that his account may have been hacked.
Aark Digital$1.9M
During a script-based conversion of GM balances to USDC, an incorrect balance update greatly inflated one user’s recorded value. An attacker exploited the error, costing Aark Digital 1,499,841 USDC and 159.09 ETH.
AARK (Aark Digital)DeFi ProtocolArbitrum$1.9M
A decimal-calculation flaw in AARK’s Arbitrum vault contracts let an attacker inflate conversion values, causing a loss of about $1.9 million.
Unverified Contracts$1M
An attacker manipulated prices in unverified Base lending contracts and borrowed excessive amounts, gaining about $1 million in tokens.
Base LendingDeFi ProtocolBase$1M
A flaw in deposit verification let an attacker exploit Base Lending, an unverified lending protocol on Base, causing about $1 million in losses.
U.S. Government-Controlled WalletOtherEthereum$20M
An attacker compromised the private key to a U.S. government-controlled wallet and took about $20 million in cryptocurrency. About $19.3 million was later returned; roughly $700,000 went to instant exchanges.
CryptobottleTokenPolygon$490K
A flaw in Cryptobottle’s Polygon swap contract let an attacker bypass a balance check and make arbitrary swaps to acquire NAS tokens. They sold the tokens and drained USDT.
Ramses ExchangeDeFi ProtocolArbitrum$93K
A flaw in Ramses Exchange’s rewards system let attackers claim the same incentives repeatedly across multiple NFT positions, draining accumulated rewards and fees.
Vista FinanceDeFi ProtocolBSC$28K
Vista Finance’s staking integration did not distinguish staked tokens from freely available balances. This let its flash-mint feature miscalculate how many tokens were available for loans.
Erc20transferTokenEthereum$14.8K
An Ethereum token-transfer utility had no access checks in a function that moves tokens users have approved, allowing anyone to drain USDC from multiple users.
TransakUndisclosed
A phishing attack gave someone access to a Transak employee’s laptop and credentials for a third-party identity-checking vendor. The attacker then accessed some user information in the vendor’s dashboard.
MuratiAIUndisclosed
MuratiAI’s X account was suspected of being hacked and used to post phishing links.
Tapioca DAODeFi ProtocolArbitrum$4.7M
An attacker obtained a Tapioca DAO contributor’s private keys through social engineering and malware, then used them to control vesting contracts and drain funds from stablecoin pools. Some funds were recovered.
EigenlayerUndisclosed
EigenLayer’s official X account was suspected of being hacked and used to post a fake phishing link.
KabosumamaUndisclosed
Kabosumama’s Instagram account was reportedly hacked and used to promote a fake update and a new memecoin. The attacker pulled out funds after drawing people into the coin.
LagrangeUndisclosed
Lagrange’s X account was reportedly compromised and used to post a scam link related to its LGR token. No stolen funds were reported.
Ambient FinanceDeFi ProtocolEthereumUndisclosed
Attackers used compromised domain-registrar credentials to redirect Ambient Finance’s website to a fake site, where users were tricked into approving token transfers. Ambient recovered the domain and reimbursed affected users; its smart contracts were not affected.
Radiant CapitalDeFi ProtocolBSCArbitrum$50M
Attackers used malware to compromise devices belonging to three Radiant contributors, then deceived multisig signers into approving malicious transactions that gave the attackers control of lending markets on BNB Chain and Arbitrum, which they drained.
KalaxDeFi ProtocolBlast$350K
Kalax’s founders drained the protocol’s vaults, then deleted its website and social accounts and abandoned the project.
LeadBlock's Morpho Blue MarketDeFi ProtocolEthereum$250K
A misconfigured price oracle valued gold far too highly in a Morpho Blue PAXG/USDC market. An attacker used the pricing error and a mismatch in token decimal places to withdraw funds after depositing a small amount of PAXG.
Zulu NetworkUndisclosed
Zulu Network’s official X account appeared to be compromised and used to post a fake phishing link.
KOR ProtocolUndisclosed
KOR Protocol’s official X account appeared to be compromised and posted a fake phishing link.
SPX6900Undisclosed
SPX6900’s official X account was hacked. Users were warned not to click its links.
Ordinals WalletUndisclosed
Ordinals Wallet’s X account was hacked and used to post a phishing link, which was later deleted.
HYDT$58K
A suspicious attack involving HYDT tokens on BSC caused losses of about $58,000.
Spot On ChainUndisclosed
Spot On Chain’s X account was reportedly compromised and used to post a fake EIGEN airdrop link. No stolen funds were reported.
EigenLayer InvestorDeFi ProtocolEthereum$5.7M
An attacker compromised an email thread about an investor’s token custody and impersonated a legitimate party to redirect 1,673,645 EIGEN tokens to an attacker-controlled address. The tokens were sold, and some proceeds were frozen; the incident did not involve a flaw in the protocol or token contracts.
LEGO GroupUndisclosed
Hackers briefly altered LEGO’s homepage to display a fraudulent “LEGO Coin” token promotion, which was removed after about 75 minutes.
SymbioticUndisclosed
Symbiotic’s official X account was suspected of being hacked and posted a fake phishing link.
Fire (FIRE)$24K
Attackers exploited a flaw in the FIRE token’s burn mechanism, which runs when tokens are transferred, and stole 9 ETH.
FireTokenTokenEthereum$20K
FireToken’s transfer function burned tokens sent to Uniswap pools and immediately changed the pool’s recorded balances. Attackers exploited this to make ETH appear overpriced and swap FireToken for it.
Bedrock$2M
A flaw in Bedrock’s uniBTC exchange-rate logic allowed uniBTC to be minted at a 1:1 rate with the native token, leading to an estimated theft of about $2 million.
Our coverage: Bedrock Exploit Lets Users Swap 1 ETH For 1 BTCSourceRekt report
OnyxDeFi ProtocolEthereum$3.8M
Onyx’s attacker manipulated exchange rates in its low-liquidity VUSD market using a flash loan, a temporary loan that is repaid in one transaction. They also exploited missing checks in the NFTLiquidation contract to inflate rewards from self-liquidations and drain funds.
uniBTCDeFi ProtocolEthereum$2M
A former employee planted malware in Bedrock’s software files, then exploited a flaw in uniBTC’s minting system to create tokens backed by ETH and drain the liquidity pool.
ReHoldDeFi ProtocolEthereum$700K
ReHold’s CEO withdrew more than $700,000 from the protocol’s smart contracts without the co-founder’s approval and then took control of company infrastructure and domain access.
