Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
GMEE$7M
Unauthorized access to GMEE’s GitLab was used to steal 600 million GMEE tokens from its Polygon token contract. The attacker exchanged them for ETH and MATIC.
GameeDeFi ProtocolPolygon$7M
An attacker obtained Gamee’s deployer key through an unsecured GitLab environment, then used it to bypass protections in the `recoverERC721s()` function and steal GMEE tokens from Polygon.
Concentric FinanceDeFi ProtocolArbitrum$1.72M
A social-engineering attack compromised a Concentric Finance team member’s deployer key. The attacker upgraded vault contracts, minted unauthorized liquidity-provider tokens, and drained assets from the platform.
Bullran Index$310K
An MEV bot exploited missing permission checks in Bullran Index’s custom safe contract, burning a user’s deposited BUI tokens and extracting 136 ETH.
HTXUndisclosed
HTX and HTX_DAO reported denial-of-service attacks, which overload systems and can disrupt access. HTX’s app experienced interruptions while its technical team worked to resolve the issue.
Rosa Finance$44.8K
Arbitrum liquidity protocol Rosa Finance was exploited, and about $45,000 was lost. The reports did not explain how the attack worked.
Miguel MorelUndisclosed
A SIM-swap attack took over Arkham CEO Miguel Morel’s Twitter account.
Manta PacificUndisclosed
Manta Pacific faced a distributed denial-of-service (DDoS) attack, which overwhelmed its RPC nodes with more than 135 million requests. The reports did not specify any funds lost.
BasketDAODeFi ProtocolEthereum$1.2M
A flaw in BasketDAO’s approval process allowed attackers to make external contract calls and drain funds users had approved. The reports differed on the loss amount.
TrezorUndisclosed
An intruder accessed Trezor’s third-party support portal and may have exposed the names or nicknames and email addresses of some customers. Trezor reported no loss of customer assets.
Socket$3.3M
A flaw in a newly added Socket token-swapping module let attackers use two Ethereum transactions to take funds from users who had granted the Gateway contract unlimited token spending permission. Socket later recovered 1,032 ETH and said it would issue a distribution plan.
BungeeDeFi ProtocolBridgeEthereum$3.3M
A missing check on data supplied with a swap allowed attackers to insert unauthorized token-transfer instructions into Socket’s Bungee bridge aggregator. More than 700 users lost funds.
Hector NetworkDeFi ProtocolEthereum$2.7M
An attacker exploited Hector Network’s token-holder compensation contract, using a function that allowed arbitrary wallets to be marked eligible, then withdrew treasury assets. The attacker reportedly swapped the stolen USDC for ETH.
Wise LendingDeFi ProtocolEthereum$464K
A precision flaw in Wise Lending’s share accounting, exploited with a flashloan, let an attacker accumulate extra shares and withdraw more than they deposited. The market lost about 177 ETH.
ZKFairUndisclosed
ZKFair’s official Discord server was hacked. The report warned users not to click links posted there until the team regained control.
CoinGeckoUndisclosed
A team member clicked a fake Calendly link, giving a hacker unauthorized access to an app; the hacker then took over CoinGecko’s and GeckoTerminal’s Twitter accounts and posted from them.
SECUndisclosed
An attacker took control of the phone number linked to the SEC’s Twitter account through a SIM-swap attack, then reset its password and gained access. The phone number was accessed through the telecommunications provider, not the SEC’s systems.
MangoFarmSolDeFi ProtocolSolana$2M
MangoFarmSol’s website and smart contract were designed to drain users’ wallets after they approved token transfers. The team deleted its social accounts and disappeared.
Orange Finance$844K
Attackers exploited Orange Finance’s single-signature setup, which was described as a multisig, and a private key was reported leaked. The incident resulted in about $843,500 in losses.
CoinspaidCEXEthereumBinance Smart Chain$7.5M
An attacker with access to CoinsPaid wallets stole assets on Ethereum and BNB Chain, including USDT, USDC, CPD, and BNB. The stolen assets were swapped for ETH and distributed to other wallets and exchanges.
OlafUndisclosed
Hackers took over Polychain Capital CEO Olaf Carlson-Wee’s Twitter account and posted fake airdrop links to phish users. Polychain warned people not to interact with the account.
CertiKUndisclosed
Attackers took over CertiK’s Twitter account and posted false claims about a Uniswap vulnerability alongside phishing links. The report says the attackers had first phished a CertiK employee; it does not report stolen funds.
GammaDeFi ProtocolArbitrum$4.5M
A flaw in Gamma’s deposit settings let an attacker manipulate asset prices and mint too many liquidity-provider tokens, draining about $4.5 million from vaults.
Our coverage: Gamma Strategies Response To The Security BreachSourceRekt report
Chronos$148K
Chronos’s concentrated-liquidity pools managed by Dyson Money were exploited in a way likened to the Gamma exploit. Chronos said other V2 pools were unaffected and the remaining funds were secure.
Radiant CapitalDeFi ProtocolArbitrum$4.5M
Attackers used flash loans to exploit a rounding flaw in Radiant Capital’s burn function shortly after a USDC market opened on Arbitrum. They extracted about 1,900 ETH beyond legitimate deposits.
Atomicals MarketUndisclosed
Atomicals Market reported that it was under a denial-of-service attack, in which systems are overloaded to disrupt access.
Wizz WalletUndisclosed
Wizz Wallet and other builders in the Atomicals ecosystem reported distributed denial-of-service attacks, which overwhelm a service with traffic.
Wabalaba LandUndisclosed
Wabalaba Land’s Discord server was compromised. The team warned users not to click links while it worked to regain control.
NFPromptUndisclosed
NFPrompt reported problems with its Web2 wallet service and said users’ funds were secure. The reports did not describe a confirmed theft.
Orbit ChainDeFi ProtocolBridgeEthereum$81.7M
Attackers compromised seven of Orbit Bridge’s ten multisig signers’ private keys, allowing them to forge withdrawal approvals and drain the Ethereum vault. Orbit Chain asked exchanges to freeze the stolen assets.
Locus FinanceDeFi ProtocolEthereumArbitrum$321K
An attacker obtained a Locus Finance developer’s private key during a leadership transition and used administrative access to drain vaults. The vaults lacked multisignature security.
Channels FinanceDeFi ProtocolBSC$320K
An accounting flaw in Channels Finance’s old Compound V2-based contracts let an attacker mint tokens that were not backed by real assets, then drain funds.
OKXUndisclosed
A vulnerability in OKX Wallet’s BRC20 marketplace caused fake sats to appear in its order book, putting buyers at risk of acquiring false assets. OKX restored trading and said it would compensate users who mistakenly bought affected tokens.
Compound LabsUndisclosed
An attacker took control of Compound Labs’ account for about four hours and posted spam messages. The team regained control and removed them.
INSC NFTUndisclosed
A vulnerability in the INSC NFT contract let multiple attackers steal NFTs and transfer them to Blur and OpenSea for sale.
Levana PerpsDeFi ProtocolOsmosis$1.1M
Stale Pyth oracle prices, combined with fee-market bugs on Osmosis, let attackers make profitable trades against Levana during volatile periods, taking about $1.1 million.
ThunderCEXEthereumSolana$240K
Attackers compromised Thunder Terminal’s MongoDB connection details and used stolen session tokens to make unauthorized withdrawals from 114 user wallets. They took 86.5 ETH and 439 SOL; users’ private keys were not compromised.
TelcoinPaymentsPolygon$1.25M
An attacker exploited uninitialized wallet proxy contracts on Polygon, setting up malicious versions that could drain funds from wallets that had never made a transaction. Telcoin temporarily froze app use while investigating.
Pine ProtocolDeFi ProtocolEthereum$95K
A flaw caused Pine Protocol’s old and new contract versions to share liquidity pools. The attacker used the mismatch to borrow NFT collateral while recording repayment as a flash loan, repeatedly draining vault assets.
UniSat WalletUndisclosed
UniSat Wallet’s official Twitter account appeared to be compromised and posted a promotion containing a suspected malicious link.
