Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
DuelbitsGambling PlatformEthereumBSCBitcoin+1 chains$7M
Duelbits hot wallets were drained across several blockchains in a suspected private-key compromise; the exact cause has not been disclosed. Most stolen assets were bridged and exchanged for ETH, then consolidated in one address, while Duelbits said user balances were unaffected.
Payy NetworkDeFi ProtocolBridgeEthereum$1.83M
Payy’s bridge processed a batch containing an unauthorized USDC withdrawal to the attacker, draining about 1.83 million USDC. The cause—possibly a credentials compromise or a flaw in proof verification—had not been established.
Limit BreakNFTfiEthereumApeChainPolygon+1 chains$1.8M
A flaw in Limit Break’s Payment Processor let attackers use users’ existing token and NFT approvals to take assets without a valid purchase. Whitehats moved thousands of NFTs to safety, but about 660 WETH was stolen along with other tokens.
Meter PassportChainMeterBSCEthereum$2.3M
An attacker exploited a block-validation flaw on Meter to create unbacked tokens, then sold them and bridged proceeds off the network. Meter paused its mainnet and bridge while investigating and planning recovery.
The personal X account of Nano Labs founder Jack KongUndisclosed
An attacker took over Nano Labs founder Jack Kong’s personal X account and used it to promote a fake AI trading token. Nano Labs said it had not issued or endorsed the token and warned users not to follow the posts’ links or send funds.
AstroportDeFi ProtocolNeutron$4.9M
A Neutron governance proposal reassigned control of Astroport contracts, allowing an attacker to replace their code and withdraw their balances. Astroport’s swap and pool logic was not exploited; Terra-side contracts were unaffected.
DropDeFi ProtocolNeutron$4.4M
A malicious Neutron governance proposal transferred control of Drop’s dATOM converter and withdrawal-manager contracts to an attacker, who replaced their code and withdrew their balances. Drop’s liquid-staking and redemption logic was not exploited.
RWC Token$109K
An attacker used a flash loan and an unprotected burn function to destroy RWC tokens in a BNB Chain trading pool and manipulate its reserves before selling. The pool lost about 109,461 USDT; fee logic routed some funds to project wallets, and the attacker kept about 39,964 USDT.
DoinGudNFTfiPolygon$35.5K
A bug in DoinGud’s Polygon NFT offer contract left accepted bids active, letting an attacker replay the same offer and collect its USDC repeatedly. The attacker used a flash loan to fund a self-made offer and drained about $35,486.
GaslessReservoirEnabler$23K
An authorization flaw in Polygon’s GaslessReservoirEnabler contract let an attacker use victims’ existing token allowances to transfer their WETH and ZED. About 997 addresses lost roughly $23,000, which was consolidated and deposited into a bridge.
Internet TokenTokenBase$16.4K
An attacker supplied a fake Uniswap V3 pool to exploit Internet Token’s LiquidityUnifier contract, triggering unauthorized INT minting through a callback. They sold newly minted tokens into the genuine pool for about 5.85 WETH.
BV-7XWalletRobinhood ChainUndisclosed
Phishing approvals compromised two BV-7X team wallets, allowing an attacker to transfer tokens using Permit2, a token-authorization system. An approval remained active and enabled a further large transfer after liquidity was moved into an affected wallet; the team later began a token migration.
SingularityNET$2.29M
An attacker accessed SingularityNET’s cloud infrastructure and used valid bridge signatures to authorize AGIX, WMTX and CGV minting, while minting NTX directly. The attacker also drained 8.72 million FET; about $2.29 million in gross liquid proceeds was traced.
Fetch.aiDeFi ProtocolBridgeEthereum$1.53M
An attacker used a stolen conversion-authorizer signing key to authorize a call that released Fetch.ai’s remaining FET from its Ethereum conversion contract. About 8.72 million FET was drained.
NuNetTokenEthereum$463K
An attacker with NuNet’s deployer and minting key called the NTX token’s mint function to create about 408.5 million unbacked tokens. The contract had no supply cap to prevent minting by someone with that key.
Blink WalletUndisclosed
A software flaw let an attacker access and empty a few dozen Blink Wallet custodial accounts. Blink paused services, patched the flaw and later restored affected balances; non-custodial wallets and most funds were unaffected.
MultiversXChainMultiversXUndisclosed
A virtual-machine flaw allowed invalid state changes on MultiversX. Validators paused the network while preparing a fix and recovery from a known-good checkpoint; a restart attempt failed, leaving the mainnet paused.
Likwid$55.7K
A bug in Likwid’s margin-borrow contract let repeated borrowing reuse stale pool reserves after the attacker manipulated a thinly traded pool. The attacker drained 74.31 BNB from the vault and later sent the funds to Tornado Cash.
NostraDeFi ProtocolStarknet$3.5M
An attacker manipulated the price of NSTR in a thinly traded market, feeding an inflated price to Nostra’s oracle and using the tokens as collateral to borrow about $3.5 million in other assets. Nostra paused its money market while tracing funds.
FlamincomeDeFi ProtocolEthereum$595K
Flamincome’s vault misvalued its Curve position using a manipulable spot price and a reward-pool balance anyone could increase. The attacker used flash-borrowed USDT to inflate the vault’s share price, then redeemed shares for real Aave liquidity, profiting about $345,900.
NimiqDeFi ProtocolPolygon$50.4K
An OpenGSN signature-checking flaw let an attacker forge requests to Nimiq’s Polygon swap contracts, which used a liquidity wallet’s existing token approvals to open payment contracts for the attacker. The attacker then redeemed the funds.
StartaleDeFi ProtocolEthereum$2.88K
A flaw in Startale smart-account initialization let an attacker reinitialize pre-funded accounts during deployment with malicious code and transfer out their assets. About 330 accounts were affected; the Soneium network was not.
Unknown Gnosis Safe Wallet$7.73M
An attacker exploited an authorization bypass in a router’s multicall function to use a Gnosis Safe module to make unauthorized calls. They moved assets through a malicious Uniswap pool and redeemed them for rsETH, draining about $7.73 million.
DCENT Wallet$6.57M
DCENT reported abnormal transfers from its mobile App Wallet and began an investigation. The issue was reported as limited to the software wallet, with no confirmed impact on hardware wallets.
BonfiretokenDeFi ProtocolBSC$47.4K
BonfireSwap let callers transfer BONFIRE from wallets that had already approved its router, without checking that the caller was authorized. The attacker drained about 41 approved holders, sold the tokens for BNB, and caused losses of about $50,000.
Long Bridge$118K
A third-party RPC supplied fabricated withdrawal events to Long Bridge’s keeper, which released 46.7928 WETH from its vault. The team stopped the keeper and refilled the vault the same day; users did not lose funds.
Spiral$26.8K
Spiral’s borrowing hook used a Uniswap V4 pool’s live spot price to value collateral, without safeguards against price manipulation. The attacker bypassed a same-block trading guard using multiple accounts and borrowed against inflated collateral, causing a loss of about 10.7 ETH.
ChainflipDeFi ProtocolBridgeTron$736K
The attacker exploited Chainflip’s handling of TRON transaction memos to make an already processed deposit appear to be a separate failed swap, triggering duplicate refunds. Six of eight attempts succeeded, paying out 736,442 USDT; the network was paused.
ether.fi LiquidDeFi ProtocolEthereum$43.3K
Veda’s AtomicQueue let callers name an unapproved solver, then used existing token approvals to pull liquidETH from that address. The attacker supplied 11 holders as solvers in a crafted request, draining about 15.45 ETH in one transaction.
ORBToken$32.6K
An attacker abused ORBToken’s automatic allowance and a tax-exempt selling path that lacked protection against repeated calls. By combining repeated sells with liquidity-pool reserve manipulation, they extracted about $32,611.
OMNI404$5.92K
OMNI404 mishandled small transfers, treating them as NFT identifiers while still transferring a full token unit. The attacker used flash loans and Uniswap V3 swaps to exploit the mismatch and drain about 2.4 WETH.
SymbiosisDeFi ProtocolBridgeBSCEthereum$336K
A flaw in Symbiosis’s Bitcoin bridge allowed the attacker to mint unbacked syBTC and sell some of it for about 4.39 WBTC on Ethereum. The team paused affected BTC routes; reported total losses for liquidity providers and users were 9.97 BTC.
DominionDeFi ProtocolSolana$238K
An attacker compromised Dominion’s treasury multisig and drained its SILV holdings and loan positions. They sold about 46,909 SILV into thin markets, realizing roughly $238,000 as the token’s peg broke.
Nomic nBTC BridgeDeFi ProtocolBridgeNomic$3.15M
A bug in Nomic’s forwarding mechanism let an attacker double-spend nBTC and send unbacked vouchers to Osmosis. Osmosis and IBC were not compromised; an emergency upgrade froze 22.65 BTC in the attacker’s address.
Balancer V1DeFi ProtocolEthereum$250K
An attacker used flash loans and temporary collateral positions to exploit a previously disclosed pricing flaw in deprecated Balancer V1 pools, extracting about $250,000.
Zentra FinanceDeFi ProtocolCitrea$140K
Zentra’s repayment accounting could clear a borrower’s debt while reducing the corresponding token burn to zero. The attacker exploited this rounding flaw with flash liquidity to withdraw borrowed assets, draining 140,000 ctUSD and 30 USDC.e.
Amnext$116K
An attacker exploited Amnext’s lottery and prize-pool protocol by mass-minting AMC tickets, then drained about 154 WBNB through PancakeSwap, causing losses of roughly $116,100.
BeatXswapDeFi ProtocolBSC$77.5K
BeatXswap’s liquidity contracts priced BTX using a live pool price that could be manipulated. After flash-borrowing and dumping BTX to move that price, the attacker used deposits to extract about 2.98 million BTX, worth roughly $77,500.
WealthManagementV2DeFi ProtocolBSC$26.4K
An attacker gained WealthManagementV2 owner privileges and set extreme investment-plan parameters without delay or limits, generating artificial interest and withdrawing it. The contract lost about 26,414 USDT.
Cozy FinanceDeFi ProtocolOptimism$163K
Cozy Finance’s Optimism protection markets paid claims after the attacker submitted undisputed positive answers to UMA’s oracle, without verifying that the covered events had occurred. The attacker burned protection tokens and claimed USDC, causing about $160,000 in losses.
