Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
FriesDAODeFi ProtocolEthereum$2.3M
An attacker used a flaw in the Profanity vanity-address tool to derive the private key for FriesDAO’s deployer wallet, then stole FRIES governance tokens and other assets from the staking pool. The loss was about $2.3 million.
TempleDAODeFi ProtocolEthereum$2.3M
TempleDAO’s staking contract failed to restrict access to a function for moving staked funds, allowing an attacker to withdraw xLP tokens and exchange them for TEMPLE and FRAX. The stolen tokens were worth about $2.3 million.
ApolloXDeFi ProtocolBSC$2.15M
A flaw in ApolloX’s trading rewards signature system let an attacker generate signatures and withdraw APX tokens without proper checks. The tokens were exchanged for BUSD.
Gym NetworkDeFi ProtocolBSC$2.1M
A missing caller check in GYM Network’s deposit function let an attacker create deposit records without transferring tokens, inflating balances and draining about 2,476 WBNB. The funds were moved through Tornado Cash.
Revest FinanceDeFi ProtocolEthereum$2.01M
A reentrancy flaw—a bug that lets a contract call back into itself before a transaction finishes—allowed an attacker to create multiple NFTs linked to the same pool and drain about $2 million in tokens.
QANplatformDeFi ProtocolEthereum$2M
An attacker recovered the private key to QANplatform’s bridge deployer wallet using a weakness in a vanity-address generator, then withdrew tokens from its Ethereum and BNB bridges. The stolen assets included more than 1.4 billion QANX tokens.
Mirror Protocol$2M
A price-oracle vulnerability in Mirror Protocol was exploited, exhausting pools tied to Bitcoin, Ethereum and Polkadot and causing more than $2 million in losses.
Mirror ProtocolDeFi ProtocolTerra$2M
A flaw in Mirror Protocol’s collateral-unlock controls let attackers withdraw funds over several months before the issue was found. A separate exploit during the LUNC-LUNA2 transition also caused losses.
MM.finance$2M
A DNS attack let an attacker alter MM.finance’s website to show malicious contract addresses. Users’ assets were stolen and moved to Ethereum, then through Tornado Cash.
MM Finance CronosDeFi ProtocolCronos$2M
Attackers compromised MM.Finance’s website address system and inserted a malicious contract address. Users who swapped tokens or added or removed liquidity had funds siphoned away; about $2 million in CRO was stolen.
OpenSeaNFTfiEthereum$2M
OpenSea users were sent phishing emails posing as official notices about a contract migration. Victims approved malicious transactions that transferred NFTs from 28 wallets to attackers.
Our coverage: Phishing Attack Spells More Trouble For OpenSeaSource
Titano FinanceDeFi ProtocolBSC$1.95M
A contractor used a backdoor in Titano Finance’s PLAY contract to change its prize settings and steal 4,828.7 BNB. The funds were later returned to the treasury.
FEG$1.9M
Attackers used flash loans to exploit FEG’s swapToSwap function, which trusted user-supplied transaction paths without checking them. This let them access and steal assets held by the contracts on BNB Chain and Ethereum.
FEG TokenTokenBinance Smart ChainEthereum$1.9M
Attackers used flash loans to exploit FEG’s swapToSwap function, which did not validate user-supplied transaction paths. This let them gain access to contract funds and drain assets across Ethereum and BNB Chain.
CF$1.9M
A flaw in the CF token contract let anyone transfer tokens from other users’ balances, causing losses and disrupting CF trading.
CF TokenTokenBSC$1.9M
CF Token’s public transfer function did not verify the source address, allowing an attacker to move tokens from holders without permission. The attacker transferred 4.2 million CF tokens, swapped them for more than 4,200 BNB, and sent the proceeds through Tornado Cash.
KLAYswapDeFi ProtocolKlaytn$1.9M
Attackers altered a third-party JavaScript link used by KLAYswap’s website to serve malicious code. It captured users’ transactions and transferred funds to the attackers.
Reaper FarmDeFi ProtocolFantom$1.7M
A flaw in ReaperVaultV2’s withdrawal function let attackers destroy other users’ vault shares and withdraw tokens from multiple vaults, causing more than $1.6 million in losses.
ParaluniDeFi ProtocolBSC$1.7M
Paraluni’s MasterChef contract was exploited through a reentrancy bug in a liquidity-deposit function that did not properly validate the pool and update its state before a token transfer. The attacker took more than $1.7 million.
UvTokenDeFi ProtocolBSC$1.5M
UvToken’s BSC mining pool withdrawal function failed to check caller-supplied addresses, letting an attacker use a malicious contract to drain about 1,078 BNB and 1.16 million BUSD from the vault. Some proceeds were later sent to Tornado Cash.
MEV Bots$1.5M
After a bot earned 800 ETH from a trade involving cUSDC, an attacker exploited a bug in the bot’s contract and withdrew all 1,101 ETH held there.
GERADeFi ProtocolEthereum$1.48M
After GERA’s deployer private key was compromised, an attacker transferred ownership of the token’s smart contract to another address, gaining control of the contract.
RubicDeFi ProtocolBridgeEthereum$1.41M
A mistake in Rubic’s router whitelist, together with missing input checks, let attackers use existing user approvals to call other contracts and drain USDC directly from users’ wallets. More than $1.4 million was stolen.
Omni XDeFi ProtocolEthereum$1.4M
An attacker exploited reentrancy—a contract being called again before its first operation finished—in Omni X’s NFT lending contracts. By making borrowed ETH appear repaid during the exploit, they took 1,300 ETH without clearing the debt; the funds were later sent to Tornado Cash.
OneRingDeFi ProtocolEthereum$1.4M
OneRing’s liquidity pool was drained after an attacker used a flash loan to manipulate the price of its LP token, whose calculation did not average prices over time. The attacker took about 1.45 million USDC.
TreasureDAODeFi ProtocolArbitrum$1.4M
A missing check in TreasureDAO’s marketplace let buyers set an invalid quantity and receive ERC-721 NFTs without paying. Some of the stolen NFTs were later returned.
MultichainDeFi ProtocolEthereum$1.4M
A flaw in token approval calls let an attacker take tokens from users who had previously approved the affected Multichain contracts. About $3 million was lost; a white-hat responder returned some funds and kept a bounty.
FEG$1.3M
FEG was suspected of being attacked, with about 143 ETH and 32,747 BNB taken.
Solend$1.26M
An oracle attack on USDH caused bad debt in isolated pools operated by Stable, Coin98, and Kamino. Solend said its other pools were unaffected.
SaveDeFi ProtocolSolana$1.26M
An attacker drove the price of USDH on Saber from about $1 to $15, inflating its value as collateral on Solend and borrowing from several lending pools. The attack left Solend with about $1.26 million in bad debt.
New Free DaoDeFi ProtocolBSC$1.25M
A reward calculation based only on the caller’s deposited balance let an attacker use flash loans to claim excessive rewards repeatedly. The attack drained about $1.25 million in WBNB.
RubicDeFi ProtocolBridgeEthereum$1.2M
An attacker gained access to the administrator’s private key for Rubic’s bridge and staking rewards, then stole and sold about 34 million RBC/BRBC tokens. Rubic said users’ staked funds were safe and its smart contracts were not exploited.
Earning.FarmDeFi ProtocolEthereum$1.2M
Attackers exploited EFLeverVault’s flash-loan callback because it did not check who had initiated the loan, enabling unauthorized ETH withdrawals from the collateral pool. One attack was intercepted, while another netted the attacker 268 ETH.
BasketDAOOrgDeFi ProtocolEthereum$1.2M
An input-validation flaw in BasketDAO’s BMIZapper contract let an attacker make arbitrary external calls and drain crypto assets the contract was approved to use. Users lost about $1.2 million.
Bitkeep Swap$1.18M
A vulnerability in BitKeep Swap was exploited on BNB Chain, causing about $1 million in losses. The attackers later sent 4,300 BNB to Tornado Cash, a service that obscures the movement of funds.
Float ProtocolDeFi ProtocolEthereum$1.16M
An attacker manipulated the thinly traded FLOAT/USDC pool on Uniswap V3, causing its price feed to report an artificially high FLOAT price. They used FLOAT as inflated collateral to borrow assets from Rari Capital’s pool; some funds were later returned.
SovrynDeFi ProtocolRSK$1.1M
A reentrancy flaw in Sovryn’s old lending pool let an attacker manipulate token prices during withdrawals and take RBTC and rUSDT. The team said half the funds would be recovered and additional losses covered by its treasury.
Rikkei FinanceDeFi ProtocolBSC$1.1M
A missing permission check let an attacker change Rikkei Finance’s price oracle, the service supplying asset prices, and borrow assets from its lending pools using artificially inflated collateral values.
TopGoalGamingBSC$1.1M
Attackers compromised TopGoal’s hot wallet, which held tokens for distributing TopPrize rewards, and stole about 4.8 million TMT. They swapped the tokens for BNB and used Tornado Cash to obscure the transfers; user assets and NFTs were unaffected.
SaveDeFi ProtocolSolana$1.03M
An attacker manipulated the Saber pool price feed used by Solend, pushing USDH from about $1 to $15 through repeated transactions and leaving the protocol with $1.26 million in bad debt.
