Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
GeniusAIDeFi ProtocolFantomEthereum$1.27M
A breach of Gnus.AI’s Discord exposed the private key to the team’s deployment wallet. The attacker minted 100 million fake GNUS tokens on Fantom, bridged them to Ethereum, and sold them, crashing the price 95%.
Pike Finance$1.68M
Pike Finance reported an attack on its beta protocol caused by weak checks in contract functions handling CCTP transfers, with losses of 99,970.48 ARB, 64,126 OP, and 479.39 ETH. The report also noted an earlier attack on its USDC pool that caused about $300,000 in losses.
Pike FinanceDeFi ProtocolEthereumOptimismArbitrum$1.6M
A Pike Finance contract exploit let attackers bypass controls and drain funds from its cross-chain lending pools. The reports differ on the precise flaw and assets taken.
Yield ProtocolDeFi ProtocolArbitrum$181K
An accounting flaw in Yield Protocol’s Arbitrum pools let an attacker use flash-loaned assets to create a mismatch between token balances and recorded supply, then withdraw excess tokens. About $181,000 was stolen.
DuneUndisclosed
Dune’s social media account was compromised and used to post a fake airdrop message for about 15 minutes. The team regained control of the account.
RainCEXBitcoinEthereumXRP+1 chains$14.8M
Attackers compromised Rain’s exchange wallet keys on Bitcoin, Ethereum, Solana and XRP, then moved the stolen assets through instant exchanges and converted them into Bitcoin and Ether.
Ember Sword NFT$195K
A vulnerability in Ember Sword’s unverified NFT auction contract let an attacker take 60 WETH from 159 people who had approved the contract.
BNBXTokenBSCUndisclosed
A precision-loss flaw in the BNBX token’s arithmetic let attackers manipulate its accounting and extract value; the amount taken was not disclosed.
FENGSHOU (NGFS)TokenBSC$191K
An attacker exploited the FENGSHOU token’s publicly callable `delegateCallReserves` function to set a malicious contract as its Uniswap proxy and run code in the vulnerable contract, extracting funds.
io.netUndisclosed
Attackers exploited exposed links between user and device IDs in io.net’s metadata APIs to make unauthorized updates. GPU access was not compromised, but information shown to users on the frontend was affected.
XBridgeDeFi ProtocolBridgeEthereumBSC$1.44M
Unprotected functions in XBridge’s Ethereum and BNB Chain contracts let an attacker claim token-owner access and drain assets held by the bridge.
X Bridge$824K
X Bridge saw multiple suspicious transactions, including a withdrawal of 482 million STC, worth about $824,000, from its proxy contract. The activity was reported as ongoing.
YIEDLDeFi ProtocolBSC$150K
YIEDL’s redeem function did not properly validate a user-supplied parameter controlling asset exchanges. An attacker manipulated it to bypass share requirements and repeatedly exchange tokens, taking an estimated $150,000 to $300,000.
MerlinUndisclosed
A compromised Merlin Chain Discord management account posted a phishing link.
Magpie ProtocolDeFi ProtocolEthereumPolygonBSC+7 chains$129K
A flaw in Magpie Protocol’s router let attackers bypass access controls by placing selectors—function identifiers—in unexpected positions in call data. They used it to transfer tokens from 221 wallets, stealing $129,000.
Velvet CapitalUndisclosed
Velvet Capital users reported abnormal activity on the platform: connecting to its website prompted them to approve wallet access for the protocol. The report did not confirm any funds stolen.
Z123TokenBSC$136K
An attacker used a flash loan and repeatedly called a vulnerable token function to burn tokens and inflate Z123’s trading price, extracting funds before repaying the loan.
ZKasino$33M
ZKasino was reported to have carried out a rug pull, taking about $33 million.
RicoDeFi ProtocolArbitrumUndisclosed
A flaw in Rico’s contract allowed an attacker to make unauthorized external calls and take funds. The amount was not disclosed.
HedgeyDeFi ProtocolArbitrumEthereum$44.7M
Attackers exploited missing checks in Hedgey’s `createLockedCampaign` function, using flash loans to bypass access controls and create fraudulent approvals. Vault funds were stolen from the Ethereum and Arbitrum networks.
Meson FinanceUndisclosed
A phishing link was posted from Meson Finance’s Twitter account after a third-party API issue; the project said the post was deleted.
Mars$98K
The Mars token issuance protocol was attacked, losing about 1 million MARS and 137 WBNB.
Grand BaseDeFi ProtocolBase$1.7M
After a developer’s computer was compromised, an attacker gained access to Grand Base’s deployer wallet, minted GB tokens and sold them, draining liquidity and crashing the token price.
Chainge FinanceDeFi ProtocolBSC$716K
A flaw in Chainge Finance’s BSC swap function let attackers control external contract calls and use transferFrom to take tokens from accounts that had approved them.
GFA token$15K
Attackers exploited GFA contracts that let anyone calculate and issue rewards, then used the resulting tokens to drain assets. The stolen funds were later moved through Tornado Cash.
Zest ProtocolDeFi ProtocolStacks$1M
An attacker manipulated Zest Protocol’s collateral list on Stacks by repeating collateral entries, making their collateral appear more valuable and enabling excess borrowing. They removed about 324,000 STX; the protocol said it would reimburse users from its treasury.
Sumer MoneyDeFi ProtocolBase$350K
An attacker used a flash loan and a reentrancy flaw—where a contract is called again before its first operation finishes—to manipulate exchange rates and withdraw collateral worth about $310,000.
JupiterUndisclosed
Jupiter reported that spam bots were flooding its Solana RPC services, disrupting access amid unusually heavy network activity. The team limited the bots; no stolen funds were reported.
xBlastTokenEthereum$84.5K
An attacker compromised xBlast’s main wallet, took XBL tokens worth about 22 ETH, and sold them. The project said it planned to issue a replacement token and compensate affected users.
Squid Game (SQUID)TokenBSC$87K
An attacker used a flash loan and a flaw in the SQUID swap contract’s interaction with PancakeSwap to exploit unintended trades and drain funds from the pool.
UPS$30K
UPS on BNB Chain was attacked and lost funds.
Wall Street Memes$18K
Wall Street Memes’ presale contract was attacked, resulting in the theft of about 2.5 million WSM tokens, worth approximately $18,000.
Robinson BurkeyUndisclosed
An attacker took over Wormhole co-founder Robinson Burkey’s Twitter account and posted a suspicious link.
OpenLeverageDeFi ProtocolBSC$236K
An attacker used a flash loan to exploit a business-logic flaw and manipulate OpenLeverage’s accounting, extracting about $260,000. The protocol mobilized insurance and buyback funds to compensate users and planned to shut down.
FixedFloatCEX$3M
An attacker breached FixedFloat’s hosting infrastructure through a vulnerability at its hosting provider. FixedFloat suspended operations to rebuild its security systems; the report said company and user funds were unaffected.
Pendle FinanceUndisclosed
Hackers took control of Pendle Finance’s official X account and posted phishing links. The team later regained access.
SolareumDeFi ProtocolSolana$1.4M
Wallets linked to Solareum’s Telegram trading bot were among those drained, with reports linking the thefts to the bot; the cause was not definitively established.
LavaDeFi ProtocolArbitrum$340K
A calculation flaw in Lava Lending’s liquidation system let an attacker use a flash loan to miscalculate collateral and debt, causing losses of about $340,000. The lending markets were paused.
ETHFINDeFi ProtocolBSC$1.2K
An access-control flaw in ETHFIN’s BSC smart contract allowed unauthorized calls to privileged functions. The report did not specify whether funds were stolen.
Prisma FinanceDeFi ProtocolEthereum$11.6M
An attacker used a flash loan to exploit Prisma Finance’s migration process, which did not check where callback requests came from. This let them take over loan positions and withdraw their collateral.
