Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Blueberry ProtocolDeFi ProtocolEthereum$1.34M
A lending-market flaw let an attacker use a flash loan to manipulate Blueberry Protocol’s oracle prices and borrow too much. A white-hat intervened and returned most of the ETH taken.
ZoomerCoinTokenEthereum$41K
A flash-loan attack exploited crafted transaction data to make ZoomerCoin’s contract transfer tokens that had already been approved for it. The attacker exchanged the tokens for ETH, and the reported loss was 14.06 ETH.
BitForex$56.5M
BitForex experienced suspicious fund outflows across multiple blockchains, after which the exchange restricted access and stopped processing withdrawals. The reports describe a suspected exit scam, but do not confirm who took the funds or what happened to them.
Jihoz$10M
Axie Infinity co-founder Jihoz said two of his personal crypto addresses were compromised. The incident did not affect Ronin’s operations or Sky Mavis’s keys.
Compound$660K
A sudden rise in UNI’s price left Compound using an outdated price from Uniswap’s time-weighted average, allowing users to borrow UNI against collateral valued too low and leaving the protocol with $660,000 in bad debt.
AvalancheUndisclosed
A bug in Avalanche’s mempool gossip logic caused validators to exchange excessive transaction messages, delaying their checks with other validators and stalling consensus. Block production was interrupted, and an upgrade was issued to disable the faulty logic.
Swarm MarketsDeFi ProtocolEthereum$473K
A flaw in Swarm Markets’ xTokenWrapper contract allowed unauthorized withdrawals. A MEV bot intercepted most attempts, but an attacker took SMT tokens as well as DAI and USDC.
TectonicDeFi ProtocolCronos$250K
An attacker used a flash loan to manipulate deposit logic in a newly added Tectonic lending market that lacked protection, taking about $250,000.
GainTokenEthereum$3.01M
Attackers used an unauthorized mint function to create GAIN tokens and immediately sell them, causing the token’s price to crash.
DeezNutz 404TokenEthereum$170K
A flaw in DeezNutz 404’s token contract let attackers exploit self-transfers to mint unlimited tokens. They sold the newly minted tokens for about $170,000.
ARPAUndisclosed
ARPA’s official Twitter account was compromised and used to post fake token-claim links.
Rugged ArtDeFi ProtocolEthereum$32.4K
A reentrancy flaw in Rugged Art’s contract let attackers exploit unsafe external calls to drain 11 ETH.
FixedFloatDeFi ProtocolEthereumBitcoin$26.1M
Attackers compromised the private keys for FixedFloat’s hot wallets—the online wallets used to handle transactions—and stole Bitcoin and Ether. The Ethereum funds were routed through eXch, while the Bitcoin was spread across addresses.
StarcoinUndisclosed
Starcoin detected abnormal network activity and temporarily suspended its network while investigating.
xPET$254K
A vulnerability in xPET’s newly launched PvP feature was exploited, and hackers stole 91.5 ETH.
ParticleTradeDeFi ProtocolEthereum$140K
A flaw in ParticleTrade’s handling of user input let attackers manipulate the contract’s state and steal funds.
Miner（MINER）TokenEthereum$466K
Attackers exploited a double-transfer flaw in Miner’s token contract, caused by missing validation in its update function, to transfer ETH from the project.
DualPoolsDeFi ProtocolBSC$41K
A flaw in DualPools’ share calculations truncated values, letting attackers turn a tiny amount of dLINK into large amounts of LINK. They then drained pools holding WBNB, BTC, ETH, ADA, and BUSD.
DuelbitsCEXEthereum$4.6M
Attackers compromised Duelbits’ hot-wallet keys on Ethereum and BNB Chain, stealing USDT, APE, and SHIB. They converted the tokens to ETH and laundered the funds through Tornado Cash.
PlayDappDeFi ProtocolEthereum$290M
After PlayDapp’s deployer key was compromised, an attacker added themselves as a PLA token minter and minted large quantities of tokens in two transactions. PlayDapp later paused the token contract.
Keith GrossmanUndisclosed
Keith Grossman’s X account was compromised and used to share links designed to drain users’ wallets.
Starlay FinanceDeFi ProtocolAcala$2.1M
A rounding flaw in the liquidity-index calculation for Starlay’s USDC lending pool on Acala EVM let an attacker withdraw far more than they had deposited after borrowing LDOT.
PhantomUndisclosed
Phantom reported a denial-of-service attack, in which someone tried to overload its systems and disrupt services. User assets were reported secure.
Affine ProtocolDeFi ProtocolEthereum$88K
Attackers exploited Affine Protocol’s flash-loan callback, which did not check untrusted input, to trigger a contract upgrade path and steal collateral.
Chris Larsen$113M
Unauthorized access to Chris Larsen’s personal XRP accounts led to the theft of 213 million XRP. Some affected addresses were frozen after exchanges were notified.
ZeroLendUndisclosed
ZeroLend’s lending market experienced a distributed denial-of-service attack, which overwhelms a service with traffic.
KlaytnUndisclosed
Klaytn’s official Discord server was compromised, and the team warned users not to interact with its posts or links while it worked to regain control.
AbracadabraDeFi ProtocolEthereum$6.5M
A rounding flaw in collateral calculations let attackers bypass borrowing checks in specific Abracadabra Cauldrons and borrow MIM without authorization. The protocol reported about $6.5 million in losses, and MIM fell below its intended dollar peg.
MasaUndisclosed
Masa’s official Twitter account was suspected of being compromised and used to post fake airdrop links. The report does not describe any stolen funds.
Barley FinanceDeFi ProtocolEthereum$130K
An attacker exploited a flaw in Barley Finance’s newly deployed wBARL pod contract to mint a large share of the BARL supply. The project said most of the affected tokens came from team allocations, with little impact on users.
Andrei GrachevUndisclosed
DWF Labs said its managing partner Andrei Grachev’s Twitter account had been compromised.
Goledo FinanceDeFi ProtocolConflux$1.7M
An attacker used a flash loan—a short-term loan repaid in one transaction—to buy PPI tokens and inflate their price, then used them as collateral to borrow 7.9 million CFX from Goledo Finance. The attacker later contacted the protocol to negotiate.
Wall Street MemesUndisclosed
Attackers exploited a vulnerability in Wall Street Memes’ staking provider to access the $WSM staking contract.
SomesingDeFi ProtocolEthereum$11.6M
A vulnerability in Somesing led to the theft of 730 million SSX tokens, including tokens held by the foundation and tokens that had not yet been distributed.
Citadel Finance$93K
An attacker manipulated the prices of assets used by Citadel Finance on Arbitrum and stole funds from the protocol.
Citadel.oneDeFi ProtocolArbitrum$93K
A smart-contract access-control flaw in Citadel.one let attackers withdraw users’ WETH and USDC, taking about $93,000.
AltLayerUndisclosed
AltLayer’s Twitter account experienced a disruption, with past tweets disappearing from its timeline; the account was restored after about three hours. The cause was described as possibly an organized attack.
Staci WardenUndisclosed
The Twitter account of Algorand Foundation CEO Staci Warden was compromised. The reports did not specify any resulting theft.
Nebula RevelationDeFi ProtocolOptimism$180K
A reentrancy flaw in Nebula Revelation’s Optimism staking contract let an attacker withdraw tokens without authorization. The project later announced a compensation plan for affected users.
Saga DAODeFi ProtocolSolana$65.8K
A compromised personal wallet let an attacker drain 750 SOL from Saga DAO and its treasury; the DAO’s multisig required only one of 12 approvals to transfer funds. The stolen funds were later returned.
