Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
TruflationOther$5.2M
Malware stole private keys from Truflation’s operational systems, allowing attackers to drain treasury and personal wallets across multiple blockchains. They took TRUF tokens, ETH, and DAI worth about $5 million.
ether.fiUndisclosed
A security incident involving domain registrar Gandi.net led to the ether.fi domain being compromised.
Bankroll NetworkDeFi ProtocolBSC$235K
A missing check on an address field in Bankroll Network’s token-sale contract let attackers manipulate dividend calculations and claim dividends without sending WBNB, causing about $230,000 in losses.
Shezmu$4.9M
An attacker exploited a flaw in Shezmu that allowed anyone to create collateral and borrow ShezUSD. After negotiating a bounty with the platform, the attacker returned the funds, which Shezmu said it had recovered.
ImmutableUndisclosed
A community support contractor’s Discord account was compromised, allowing a phishing link to be posted in Immutable’s Discord server. No stolen funds were reported.
BingXCEXEthereum$43.3M
Attackers breached BingX’s hot wallets and drained about $43 million in cryptocurrency. BingX said it would reimburse affected users from its reserves.
Our coverage: BingX Promises User Compensation After $43 Million HackSourceRekt report
OcelotDexDeFi ProtocolEthereum$980K
A vulnerability in Shezmu’s vault let attackers mint ShezUSD without collateral and borrow assets to drain the protocol. After negotiations, 80% of the funds were recovered.
DOGGOTokenEthereum$7K
A flaw in DOGGO’s withdrawal logic let attackers take more from the contract than their share, due to an incorrect calculation or missing balance update. The report did not specify the amount taken.
MasaUndisclosed
The decentralized AI data network Masa was reportedly hacked, suffering losses exceeding six figures; it did not disclose the incident to its community.
CompoundUndisclosed
Compound’s Discord server was hacked. No theft or loss of funds was reported.
Banana GunDeFi ProtocolEthereum$3M returned$3M
A flaw involving Banana Gun’s Telegram message oracle, a system that verifies messages, may have let attackers forge transfer approvals and take funds from 11 users’ wallets. The team reimbursed all affected users from its treasury.
DINUndisclosed
DIN’s official X account was hacked and used to post phishing links.
Ethena LabsUndisclosed
Attackers compromised Ethena Labs’ domain registrar account, prompting the team to disable its website. The protocol was unaffected and its funds remained secure.
DecentralandUndisclosed
Decentraland’s official X account was compromised and used to post a phishing link. No stolen funds were reported.
DeltaPrimeDeFi ProtocolArbitrum$5.98M
An attacker who obtained DeltaPrime Blue’s ProxyAdmin private key used it to replace pool contract code with malicious versions, then drained USDC, WBTC, and WETH pools on Arbitrum.
WXETADeFi ProtocolEthereumBSC$110K
An attacker used WXETA’s unguarded contract setup function to grant themselves permission to mint tokens, then drained liquidity pools holding USDT and WXETA.
Rivus DAODeFi ProtocolEthereumUndisclosed
A developer inserted a backdoor into Rivus DAO’s migration contract and drained its liquid-staking protocol. The team recovered the funds using the developer’s identity documents and relaunched the project.
OTSeaDeFi ProtocolEthereum$26K
A flaw in OTSea’s staking contract let an attacker manipulate reward calculations and repeatedly withdraw more rewards than their stake entitled them to. About $26,000 was stolen.
OmnipusDeFi ProtocolEthereum$30K
A disabled validation check in Omnipus’s presale contract let attackers claim they had overpaid in ETH and receive refunds they were not owed, extracting about $30,000.
IndodaxCEXEthereumPolygonOptimism$25.2M
Attackers stole tokens from Indodax’s hot wallets. Investigators said the private keys did not appear to be compromised, and the breach may instead have involved the exchange’s withdrawal system.
Our coverage: Indodax Loses $22 Million In Major Crypto HackSourceRekt report
Caterpillar CoinTokenBSC$1.4M
The attacker used a flash loan—a temporary loan repaid within one transaction—to manipulate CUT’s price and rewards on PancakeSwap, then drained the trading pool for about $1.4 million.
Jules UrbachUndisclosed
The X account of Render Network founder and CEO Jules Urbach was hacked and used to post fake airdrop information. No fund loss was reported.
FuelUndisclosed
Fuel’s official Discord was attacked. The team warned users against suspicious links and requests for personal information.
Jaylen BrownUndisclosed
Jaylen Brown’s X account was hacked and used to post fake token promotions. No theft or loss of funds was reported.
NEAR ProtocolUndisclosed
NEAR Protocol’s official X account was hijacked and used to post messages attacking the crypto ecosystem.
PenpieDeFi ProtocolEthereum$27M
Penpie was drained after an attacker used fake yield-token markets and flash-loan-funded liquidity to exploit the protocol’s reward-claiming process. The attack resulted in losses reported as nearly $30 million.
SeiUndisclosed
Sei’s official Discord was reportedly compromised and used to post a fake phishing link; no fund loss was reported.
ChainLinkUndisclosed
Chainlink’s official Discord server was reportedly hacked. No further details or stolen funds were reported.
PythiaDeFi ProtocolEthereum$53K
A reentrancy flaw in Pythia’s staking rewards function let an attacker repeatedly claim rewards before balances updated, taking 21 ETH.
UsualUndisclosed
Usual’s official Discord server was hacked. The protocol warned users not to click links; no fund loss was reported.
PowerledgerUndisclosed
Powerledger’s Telegram channel was hacked, and the company warned users not to engage with it or share information.
Witness ChainUndisclosed
Witness Chain’s official Discord server was hacked. No theft or loss of funds was reported.
Orderly NetworkUndisclosed
Orderly Network’s Discord server was compromised; the team warned users not to click links while it addressed the breach.
io.netUndisclosed
io.net’s official Discord was reportedly hacked. No funds were reported taken.
Kylian MbappeUndisclosed
Kylian Mbappé’s X account was compromised and used to promote a token bearing his name. Its market value briefly surged to tens of millions of dollars before falling to zero.
AaveDeFi ProtocolEthereum$56K
A flaw in Aave’s ParaSwap repayment adapter left token allowances too large after failed swaps, letting an attacker exploit unvalidated transaction data and take accumulated tokens. About $56,000 was stolen from peripheral contracts, not Aave’s core protocol.
1inchUndisclosed
1inch’s official Discord appeared to be hacked, and phishing links were posted. No fund loss was reported.
ZkSyncUndisclosed
Hackers took over ZkSync’s official Discord and posted a link to a fake second airdrop, aiming to lure users with a false promise of free ZK tokens.
AvalancheUndisclosed
Avalanche’s Discord server was compromised. No theft or loss of funds was reported.
ArtelaUndisclosed
An attacker took control of Artela’s official Discord and posted fake airdrop messages. The team removed the posts and restored the channel.
