Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Decrypt$3K
An attacker took over Decrypt’s email newsletter account and sent subscribers a phishing email. The attacker made money from recipients who were tricked by the scam.
MunchablesGamingBlast$62.5M
A developer used control of Munchables’ upgradeable proxy—a contract that can be updated—to assign themselves funds and drain about $62.5 million. The developer later returned the funds, which were secured in a multisig wallet.
Curio EcosystemDeFi ProtocolEthereum$16M
An attacker exploited a voting-power flaw in Curio’s Ethereum contracts to gain enough authority to call a malicious contract and mint about 1 billion CGT. The tokens were valued at approximately $16 million.
ZongZiFaDeFi ProtocolBSC$229K
An attacker used a flash loan to manipulate ZongZi’s token price and collect invitation rewards, taking about 391 WBNB.
Super Sushi SamuraiGamingBlast$4.8M
A flaw in Super Sushi Samurai’s token minting let an attacker exploit token transfers and drain the game’s liquidity pool. The attacker later returned the funds, keeping a 5% bounty.
AirDAODeFi ProtocolEthereum$1.05M
A malicious email attachment impersonating a known partner infected an AirDAO partner’s device, giving attackers access to liquidity-pool keys. They drained AMB and ETH from the pool.
TICKER$900K
A developer hired to run TICKER’s presale sold most of the 15% token supply entrusted to them for an airdrop, taking about $900,000 instead of distributing the tokens.
DolomiteDeFi ProtocolEthereum$1.8M
An attacker exploited reentrancy in an old Dolomite contract, using a trading contract without adequate protection to repeatedly drain funds from users who had approved it. Dolomite later recovered most of the stolen assets.
ParaSwapDeFi ProtocolEthereum$300K
A flaw in ParaSwap’s Augustus V6 contract exposed wallets that had approved it, allowing funds to be taken. Most of the stolen funds were recovered or secured for return.
LayerSwapDeFi ProtocolEthereum$100K
Attackers compromised LayerSwap’s GoDaddy account and redirected its domain to a phishing site, tricking about 50 users into losing roughly $100,000. LayerSwap began refunding affected users with additional compensation.
TrezorUndisclosed
Trezor’s X account was hacked.
TONUndisclosed
The TON Blockchain account on X was compromised, according to an on-chain investigator.
RemiliaNFTfiEthereum$6M
Attackers breached Remilia’s wallets and multisignature treasury after credentials stored in a password manager were reportedly compromised. They stole about 490 ETH, USDC, and more than 130 Milady NFTs, along with other NFTs and tokens; the assets were valued at over $6 million.
Fake Ansem$2.6M
An account impersonating Solana personality Ansem used phishing to steal funds, reportedly making more than $2.6 million.
Wilder World$1.8M
An attacker took control of the Wilder World NFT marketplace deployer wallet, transferred ownership to themselves, then used a malicious contract upgrade to withdraw and sell WILD and MEOW tokens for about $1.8 million.
NFPromptNFTfiEthereum$3M
Attackers compromised NFPrompt treasury and administrator wallets, taking NFP treasury and ecosystem funds as well as funds belonging to other victims. The net realized loss was about $3 million.
MozaicDeFi ProtocolArbitrum$2M
A rogue developer obtained a core team member’s private key and used it to access Mozaic’s bridge function, stealing funds; about 90% were later frozen on MEXC.
MOBOXDeFi ProtocolOptimism$750K
An attacker repeatedly borrowed and redeemed funds from MOBOX, using referral rewards to inflate each subsequent loan. The process extracted USDT from the protocol.
Introspection Token$15.2K
An attacker exploited the IT token’s transfer function to increase the pool’s token reserves, manipulate its price, and repeatedly trade against the pool for profit.
Cloud AI$360K
Hackers compromised Cloud AI’s deployer and treasury accounts, taking 58,900 CloudAI tokens and some ETH. They exchanged all the tokens for ETH, with total losses estimated at about $360,000.
PolyhedraDeFi ProtocolBSC$760K
After an administrator’s private key was compromised, an attacker maliciously upgraded Polyhedra’s contract and took THENA tokens, swapping them for BNB.
beobleUndisclosed
Beoble’s Twitter account was compromised and used to post phishing links.
BBTDeFi ProtocolEthereumUndisclosed
Attackers exploited a business-logic flaw in BBT’s core smart-contract functions. The specific method and amount lost were not disclosed.
BLASTOFFDeFi ProtocolBlast$600K
An attacker stole about 150 ETH from BLASTOFF’s Future Yield Minter vault on Blast. The team disabled staking in the affected pool and offered a bounty for recovered funds.
Juice FinanceDeFi ProtocolEthereum$54K
An attacker exploited a flaw in Juice Finance’s staking reward calculations to drain tokens, then sold them for about 54 ETH. The team later compensated stakers with their stake plus a 10% bonus.
UnizenDeFi ProtocolEthereum$2.1M returned$2.1M
A vulnerability in an upgraded Unizen contract let attackers make unauthorized external calls and steal about $2.1 million, mainly in USDT and DAI. Some funds were recovered, and the CEO began reimbursing affected users.
GHTDeFi ProtocolEthereumUndisclosed
GHT’s smart contract was exploited through a business-logic flaw. Public reports did not specify how the exploit worked or how much was lost.
TGBS (TGBS)$151K
TGBS was exploited through a flash-loan attack, resulting in a loss of about $151,000.
ALPDeFi ProtocolBSC$10K
A function intended for internal use in ALP’s contract was left publicly accessible, allowing unauthorized calls. The amount lost was not disclosed.
WOOFiDeFi ProtocolArbitrum$8.75M
An attacker used flash loans to manipulate WOO’s price on WOOFi’s Arbitrum exchange and profit from trades, repeating the exploit three times.
SherlockUndisclosed
An attacker took over security company Sherlock’s Twitter account and used it to post phishing links.
ShidoOtherEthereum$3.3M
An attacker used a compromised private key to take control of Shido’s staking contract, add a hidden withdrawal function, and drain 4.3 billion SHIDO tokens, converting some into ETH.
Grayscale CapitalUndisclosed
The hacker group Capital Killer said it attacked Grayscale’s official website, which became inaccessible; the Grayscale Bitcoin ETF page remained available. No stolen funds were reported.
SenecaDeFi ProtocolEthereumArbitrum$6.4M
A flaw in Seneca’s token approvals let an attacker use crafted transaction data to transfer tokens authorized to the protocol’s contract, taking more than 1,900 ETH and senUSD. About 80% of the funds were later returned.
Serenity ShieldTokenEthereum$586K
A phishing attack compromised a Serenity Shield project wallet, giving the attacker access to its keys and enabling the theft of 6.9 million SERSH tokens. Selling the tokens yielded about $586,000.
SmoofsDeFi ProtocolPolygonUndisclosed
A reentrancy flaw in Smoofs’ staking contract let attackers manipulate its state during external calls and drain funds.
MicroStrategy$440K
MicroStrategy’s X account appears to have been compromised and used to post phishing airdrop links. The incident reportedly led to about $440,000 in stolen assets.
AleoUndisclosed
A copy-and-paste error in Aleo’s email metadata sent private identification documents, including selfies and government ID photos, to the wrong recipients. The company said ten people were affected.
RiskOnBlastDeFi ProtocolBlast$1.3M
After raising 420 ETH in its presale, RiskOnBlast’s team drained the project’s balances and moved funds through MEXC, Bybit, and ChangeNOW.
Tornado CashUndisclosed
A governance attack passed malicious proposals that enabled backdoor code in Tornado Cash’s frontend to hijack deposit certificates.
