Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
INX$1.6M
An attacker accessed a third-party vendor’s servers and carried out unauthorized trades affecting an INX subsidiary, causing a loss of about $1.6 million. INX said its customers and platforms were not affected.
INX Digital CompanyCEXEthereum$1.6M
An attacker compromised a third-party vendor used by an INX subsidiary and made unauthorized trades on the vendor’s servers, draining funds from the subsidiary.
Transit FinanceDeFi ProtocolBSCEthereum$110K
Transit Finance’s router did not check user-supplied swap paths. An attacker supplied a forged pool address, causing the router to transfer more tokens than intended during swaps.
MetakeyUndisclosed
Metakey’s Discord account was compromised, and malicious links were posted in announcements. The report did not specify any theft.
0xKofiUndisclosed
The @0xKofi Twitter account was hacked and used to share a scam link. The report does not describe any stolen funds.
Flooring ProtocolDeFi ProtocolEthereum$1.6M
A flaw in Flooring Protocol’s multicall contract let attackers use users’ NFT approvals to transfer NFTs without consent. They stole 36 Pudgy Penguins and 14 Bored Apes; the protocol patched the issue, and vault and safebox assets were not affected.
NFT TraderDeFi ProtocolEthereum$3M
Reentrancy flaws—where a contract can be called again before a transaction finishes—in NFT Trader’s old contracts let attackers steal valuable NFT collateral. Some stolen NFTs were later recovered and returned to victims.
GoodDollarDeFi ProtocolEthereum$2M
A reentrancy flaw in GoodDollar’s reserve contract let an attacker repeat withdrawals before the contract updated its records. The protocol paused contracts and set a 100% transaction fee on tokens held by the attacker.
Ledger Connect KitWalletEthereum$484K
Attackers used a phishing attack to compromise a former Ledger employee’s npm account and publish malicious Ledger Connect Kit versions. The code redirected users’ transaction approvals through rogue WalletConnect services, enabling theft before it was removed.
OKX$2.7M
An upgraded OKX DEX proxy allowed attackers to call a function that transferred users’ authorized tokens. The reports said a Proxy Admin owner’s private key may have been leaked; the proxy was later removed from the trusted list.
OKX DEXDeFi ProtocolEthereum$2.7M
An attacker obtained OKX DEX’s proxy administrator key and used it to replace the contract’s code with a malicious version. This let them take ETH, USDT, and USDC from wallets that had previously approved the contract to spend their tokens.
Levana$1.14M
An oracle manipulation attack drained about 10% of Levana’s liquidity pool over nearly two weeks. The team said trading positions and profits were unaffected and planned to compensate affected liquidity providers.
Peapods FinanceDeFi ProtocolEthereum$231K
A reentrancy flaw in Peapods Finance’s WeightedIndex contract, exploited using flashloans, let an attacker extract PEAS tokens. The white-hat hacker returned about 90% of the funds.
Hypr Network$220K
An exploit in Hypr Network’s bridge, which moves assets between blockchains, led to funds being taken.
Venus ProtocolDeFi ProtocolBSC$274K
A malfunctioning Binance price feed reported an incorrect snBNB price, leading to unintended liquidations and a shortfall for Venus Protocol. The protocol said its core pool and XVS were unaffected.
XaiTokenEthereum$846K
Scammers impersonated the Xai gaming project and tricked holders into sending 374 ETH to a fake scheme.
TimeTokenEthereum$190K
A flaw in the TIME token’s multicall setup let an attacker spoof addresses and run malicious contract code. They burned tokens from a liquidity pool, raising the token price and extracting about $190,000.
ElephantStatusDeFi ProtocolBSC$165K
An attacker used a flash loan to manipulate WBNB’s price in ElephantStatus’s liquidity pool, enabling them to extract value they were not entitled to. The report does not give a loss amount.
thirdwebUndisclosed
Thirdweb disclosed a security flaw in several pre-built smart contracts, including DropERC20, ERC721, ERC1155, and AirdropERC20. The report did not say that funds had been stolen.
Stargate SnapshotDeFi ProtocolEthereum$43K
A malicious Stargate Snapshot proposal linked to a fake eligibility-check site that stole users’ credentials and private keys. More than 1,000 users were affected, with about $43,000 in losses reported.
FCN-TRUST (FCN)$504K
A flash-loan attack exploited the FCN-TRUST token on BNB Chain, causing its price to fall by 99%. The loss was reported at more than $504,000.
Florence FinanceDeFi ProtocolEthereum$1.45M
A user sent USDC to a lookalike address planted by attackers instead of Florence Finance’s legitimate address, after relying on an autofilled contact. The attackers moved the funds to Ethereum and swapped them for ETH.
VelodromeDeFi ProtocolOptimism$250K
Attackers used social engineering to take over the domain registrar accounts for Velodrome and Aerodrome, then redirected their websites to fake protocol pages. Users who approved transactions on the fake contracts lost funds.
AerodromeUndisclosed
Aerodrome reported that its website frontend was compromised and warned users not to interact with it while the team investigated. The report did not specify any losses.
TheNFTV2DeFi ProtocolEthereum$19K
A flaw in TheNFTV2’s withdrawal calculations let an attacker withdraw more assets than their share of the protocol.
InfStonesUndisclosed
A vulnerability at InfStones may have exposed root-level access to 25 validator servers, potentially including key material. It was unclear whether Lido-related servers or keys were affected, and the report does not confirm any funds were stolen.
HTX & HecoDeFi ProtocolBridgeEthereum$86.6M
The HECO Chain bridge to Ethereum and HTX were hacked after an operator account was compromised, allowing unauthorized withdrawals. Reports differed on the combined losses, and the funds’ destination is not specified.
Kyber NetworkDeFi ProtocolEthereumBasePolygon+2 chains$48M
A double-rounding flaw in KyberSwap Elastic’s swap calculations let trades pass a price boundary without updating liquidity, enabling attackers to drain funds across multiple networks. About $5.17 million was later returned by operators of frontrunning bots.
HTXCEXEthereum$13.6M
An attacker accessed private keys for three HTX hot wallets stored on exchange servers and transferred assets out after converting them to Ether. The breach also had additional losses tied to the HECO Chain bridge.
LoopringUndisclosed
Loopring’s Twitter account was hacked and used to post a phishing link.
Kronos ResearchOtherEthereum$26M
Attackers used compromised Kronos Research API keys—credentials that let software access services—to make unauthorized transactions and drain trading wallets.
dYdXDeFi ProtocolEthereum$9M
A coordinated attack manipulated prices in dYdX V3’s less-liquid SUSHI and YFI markets, triggering liquidations that drained $9 million from its insurance fund. The attacker built leveraged positions and drove up spot-market prices.
SpookySwapDeFi ProtocolFantom$5K
Malicious code injected into SpookySwap’s frontend replaced its router with a fraudulent contract, diverting users’ swap funds to the attacker. The attack caused about $5,000 in losses.
Trader JoeUndisclosed
Trader Joe said an analytics plugin used by its website may have been hacked to inject malicious JavaScript code into the site.
Exzo Network$470K
A compromised Exzo admin account let attackers take ownership of the XZO token contract, mint XZO, and drain 169 ETH from its Uniswap liquidity pool. They also took 69 ETH and the remaining XZO from the admin wallet.
SamudaiDeFi ProtocolEthereum$1.25M
Attackers compromised Samudai’s multisignature wallets and its founder’s personal wallet, stealing ETH. They moved the funds through Tornado Cash, a service that obscures transaction paths.
PoloniexCEXTronEthereumBitcoin$126M
Attackers compromised Poloniex hot-wallet private keys, draining funds across Ethereum, Tron, and Bitcoin. The cause was reported as possibly malware or social engineering, and Justin Sun committed to full reimbursement.
Raft ProtocolDeFi ProtocolEthereum$3.3M
A rounding error in Raft’s share-token minting let an attacker use a flash loan to create unbacked R tokens. The exploit caused a net loss of about $3.3 million.
CoinSpotCEXEthereum$2.4M
An attacker used a compromised private key for CoinSpot hot wallets—online wallets used for quick access—to take ETH, then converted it to BTC and spread it across multiple wallets.
Mirage Finance$12K
Mirage Finance was exploited for about $12,000. The reports did not explain how the attack worked.
