Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
PolkatrainDeFi ProtocolPolkadot$3M
A flaw in Polkatrain’s rebate system let an attacker repeatedly trade to claim rewards without limits or checks that the rewards had run out. The contract lost 57,000 DOT.
Deus DAODeFi ProtocolFantom$3M
A flash-loan attack manipulated the USDC/DEI price feed, triggering incorrect liquidations on Deus Finance. The attacker reportedly profited about $3 million.
Colonial Pipeline$2.7M
A ransomware attack hit Colonial Pipeline, which paid a ransom in Bitcoin. The government later recovered 63.7 Bitcoin.
Fetch.ai$2.6M
Fraudsters gained access to Fetch.ai’s Binance account and stole about $2.6 million in assets. A London court ordered Binance to trace and freeze the accounts holding the stolen funds.
Fetch.aiCEXMultiple$2.6M
Fraudsters gained access to Fetch.ai’s Binance account and sold FET tokens at sharply reduced prices to associated parties, extracting about $2.6 million in value. Fetch.ai obtained a court order requiring Binance to trace and freeze the attackers’ accounts.
Turtle DexDeFi ProtocolBSC$2.5M
TurtleDex’s team drained liquidity from its PancakeSwap and ApeSwap pools shortly after raising funds, then converted the proceeds to ETH and withdrew them through Binance.
PancakeBunny$2.4M
An attacker exploited PancakeBunny’s Polygon version, making off with 1,281 WETH. The team suspended its Polygon Sushi vaults; its Polygon and BSC vaults and BUNNY token were reported safe.
BunnyDeFi ProtocolBSC$2.4M
An attacker manipulated QuickSwap’s price and minted 2.1 million unbacked polyBUNNY tokens, causing the token’s price to crash and a reported $2.4 million loss. Bunny said it compensated users with MND tokens.
Neko NetworkDeFi ProtocolBinance Smart Chain$2.2M
A flaw in Neko Network’s lending contract let the attacker use other users’ assets as loan collateral while sending the borrowed funds to their own address. More than $2.2 million in stablecoins was stolen, and the protocol froze its pools.
PolygonDeFi ProtocolPolygon$2.04M
A transfer function in Polygon’s PoS genesis contract lacked balance and allowance checks, enabling theft of MATIC. An attacker stole 801,601 MATIC before the vulnerability was fixed; the larger potential theft was prevented.
Our coverage: 8,01,601 MATIC Stolen Before Polygon Fixes BugSource
Polygon Plasma Bridge$2M
A white-hat researcher reported a Polygon Plasma Bridge flaw that could let someone withdraw the same bridge transaction repeatedly. Polygon fixed the issue before any exploitation was reported.
PancakeSwapDeFi ProtocolBSC$1.8M
Someone with administrator access manipulated PancakeSwap’s lottery by exploiting its predictable block-hash random number generator, taking 59,765 CAKE from the prize pool.
Bent FinanceDeFi ProtocolEthereum$1.75M
An insider added a backdoor—a hidden way to alter contract behavior—to Bent Finance’s contracts and stole 513,000 cvxcrv liquidity-pool tokens. The funds were later returned, with a shortfall covered by the project and community.
8ight FinanceDeFi ProtocolHarmony$1.75M
Attackers obtained 8ight Finance developers’ private keys after they were shared through Facebook chat and Google Drive without encryption, then stole about $1.75 million from the treasury.
Acala NetworkDeFi ProtocolAcala$1.6M
A configuration error in Acala’s iBTC/aUSD pool allowed 1.28 billion unbacked aUSD tokens to be minted. Acala halted swaps and burned the tokens, limiting realized losses to about $1.6 million.
LevyathanDeFi ProtocolBSC$1.5M
An attacker used minting-capable private keys exposed on GitHub to gain control and create 100 quintillion LEV tokens. The massive supply crashed LEV’s price, and the reported loss was about $1.5 million.
BT.FinanceDeFi ProtocolEthereum$1.5M
A flash-loan attack manipulated price oracles used by BT.Finance’s ETH, USDC, and USDT strategies, draining about $1.5 million. A withdrawal-fee protection feature reduced the loss by nearly $140,000.
Growth DeFiDeFi ProtocolEthereum$1.4M
An attacker created a fake token and liquidity pool, then exploited Growth DeFi’s farming contract, which failed to check that the deposited pool shares were the correct ones. This let the attacker drain the pool.
Monkey Kindom$1.3M
Hackers exploited a vulnerability in Grape, a Solana user-authentication service, to take over an administrative account and post a phishing link in Monkey Kingdom’s Discord announcement channel. Community members lost about $1.3 million in SOL.
Monkey KingdomNFTfiSolana$1.3M
Attackers took over Monkey Kingdom’s Discord and impersonated administrators, posting fake minting links that led to malicious sites. Users who connected their wallets and approved transactions lost SOL tokens.
ApeRocket FinanceDeFi ProtocolBSC$1.26M
Attackers used flash loans—temporary loans that are repaid within one transaction—to exploit ApeRocket’s reward calculations on BSC and Polygon, inflate their share of vaults, and sell newly minted SPACE tokens. The attacks caused SPACE’s price to fall sharply.
LNDFi$1.18M
Leaked admin keys were used to change LNDFi’s contracts and drain a pool, taking about $1.18 million.
Phantom GalaxiesNFTfiEthereum$1.1M
Hackers took over Phantom Galaxies’ Discord server and promoted a fake NFT mint, charging users 0.1 ETH and sending the payments to the attackers. They collected 265 ETH before the scam was halted; Animoca Brands later covered the losses.
NowswapDeFi ProtocolEthereum$1.07M
A flaw in Nowswap’s pool-balance checks let an attacker use a flash loan and repeated swaps to take nearly all the USDT and WETH in a liquidity pool, profiting about $536,000 in USDT and 158 WETH.
Vesper Finance$1M
An attacker manipulated the oracle—a source of price data—for Vesper Lend’s beta lending pool and depleted it of DAI, ETH, WBTC and USDC. The funds were taken from the beta pool, not Vesper’s main contracts.
Stazie$1M
A fake CryptoPunks giveaway tricked Hedgie co-founder Stazie into sharing his wallet’s recovery phrase, giving the scammer access to his assets. Sixteen CryptoPunks and some ETH were lost; the scammer sold five of the NFTs for 149 ETH.
EvoDefiDeFi ProtocolBSC$1M
A flaw in EvoDefi’s reward-update logic failed to account for rewards that had already been minted, letting an attacker repeatedly claim excess GEN tokens.
Visor FinanceDeFi ProtocolEthereum$976K
An attacker manipulated the Uniswap V3 price for Visor’s OHM-ETH liquidity pool to exploit its pool-management contract. The targeted funds were recovered, and Visor said user deposits were safe and losses were covered by its treasury.
Wault FinanceDeFi ProtocolBinance Smart Chain$930K
An attacker repeatedly staked USDT to distort WaultSwap’s WUSD pricing mechanism, then traded WEX back for USDT. The exploit brought the attacker about $930,000.
AutoShark FinanceDeFi ProtocolBSC$823K
An attacker used a flash loan to manipulate AutoShark’s SHARK-BNB pool, then sent tokens into SharkMinter to inflate reward calculations and mint SHARK. The attacker sold the tokens, making about $750,000.
ChainswapDeFi ProtocolBridgeEthereumBinance Smart Chain$800K
Attackers exploited a flaw in ChainSwap’s bridge authorization checks to mint tokens across multiple projects and steal assets. Some tokens were recovered, and the remaining reported loss was about $800,000.
Gelato Network$744K
A vulnerability in Sorbet Finance’s G-UNI router, which affected users of its website, allowed attackers to steal $744,000. White-hat hackers moved $27 million in other assets to protect them.
MerlinLabsDeFi ProtocolBSC$680K
A flaw in Merlin Lab’s reward calculation used the contract’s token balance instead of the user’s deposit, allowing an attacker to repeatedly claim excess rewards. A second attack was reported hours later.
ZerogokiDeFi ProtocolEthereum$670K
An attacker exploited Zerogoki’s price-oracle checks by supplying a price report signed with legitimate keys but containing crafted swap amounts. The flaw allowed unauthorized withdrawals; the reported loss was about $670,000.
LeverDeFi ProtocolBSC$652K
Attackers exploited a flaw in Lever’s borrowing and collateral checks, using flash loans and two contracts to borrow assets without valid collateral. They took multiple tokens worth about $653,000.
AutoShark FinanceDeFi ProtocolBSC$580K
An attacker used large trades and flash loans to exploit AutoShark’s swap-mining reward calculation, collecting 3.18 million FINS tokens in one block. The trades bypassed measures intended to limit rewards within a single transaction.
Merlin Labs$550K
Merlin Labs was attacked again about eight hours after an earlier attack, losing roughly 200 ETH. The description does not give details of how the attack worked.
NerveBridgeDeFi ProtocolBridgeBSC$537K
A flaw in Nerve Bridge’s MetaPool swap function undervalued LP tokens, letting an attacker use a flash loan to obtain inflated tokens and then extract extra fUSDT and BUSD liquidity. The attacker profited 900 BNB.
NerveDeFi ProtocolBridgeBSC$537K
An attacker exploited inconsistent pool-value calculations in Nerve Finance’s fUSDT and UST pools, using flash loans—temporary borrowed funds—to drain their liquidity. The attacker made about 900 BNB.
Visor FinanceDeFi ProtocolEthereum$505K
An attacker gained access to an admin account for Visor Finance’s emergency withdrawal functions and took about $505,000 in assets awaiting placement in liquidity pools. The team replaced the withdrawn funds from its treasury.
