Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Curve Finance MEV BotDeFi ProtocolEthereum$2M
An attacker exploited an access-control flaw in an Ethereum arbitrage bot to call a function that traded wrapped Bitcoin (wBTC) for wrapped Ether (wETH). After using a flash loan to manipulate Curve pool prices, the attacker made the bot buy wBTC at inflated prices.
PatriciaCEX$2M
Hackers compromised Patricia’s retail trading app and took Bitcoin and naira assets. The company said other cryptocurrency balances and customer and merchant assets were unaffected.
pcashDeFi ProtocolEOS$2M
An attacker drained liquidity from pcash’s main swap contract on EOS, taking about 2 million EOS tokens. The team covered users’ losses, and significant funds were recovered through actions by EOS EVM administrators.
0VIXDeFi ProtocolPolygon$2M
The attacker used a flash loan to manipulate the price data used by 0VIX, making collateral appear more valuable and triggering liquidations. The exploit caused about $2 million in losses; some funds were sent to Tornado Cash, and the protocol was suspended.
Hope FinanceDeFi ProtocolArbitrum$2M
Someone modified Hope Finance’s TradingHelper contract to redirect GenesisRewardPool funds to an attacker’s address, stealing about $2 million. About $1.86 million was later laundered through Tornado Cash.
OmmDeFi ProtocolIcon$1.89M
Omm’s redeem function on Icon accepted collateral addresses without checking whether the caller owned a position in those pools. An attacker used this flaw to withdraw collateral, causing losses of about $1.891 million.
Merlin DEXDeFi ProtocolzkSync Era$1.82M
An attacker used the feeTo address in Merlin DEX’s factory contract, which had unrestricted transfer permissions and no multisignature control, to drain about $1.82 million from liquidity pools.
BonqDAO & AllianceBlockDeFi ProtocolPolygon$1.8M
BonqDAO’s oracle accepted an attacker-submitted collateral price without safeguards, allowing the attacker to mint BEUR and trigger liquidations of other users’ positions. The attack created large nominal losses, but the attacker realized only a small portion because the stolen tokens were difficult to sell.
INX$1.6M
An attacker accessed a third-party vendor’s servers and carried out unauthorized trades affecting an INX subsidiary, causing a loss of about $1.6 million. INX said its customers and platforms were not affected.
INX Digital CompanyCEXEthereum$1.6M
An attacker compromised a third-party vendor used by an INX subsidiary and made unauthorized trades on the vendor’s servers, draining funds from the subsidiary.
Flooring ProtocolDeFi ProtocolEthereum$1.6M
A flaw in Flooring Protocol’s multicall contract let attackers use users’ NFT approvals to transfer NFTs without consent. They stole 36 Pudgy Penguins and 14 Bored Apes; the protocol patched the issue, and vault and safebox assets were not affected.
DeFiLabs$1.6M
DeFiLabs used a backdoor function in its BSC staking contract to take $1.6 million from users.
LianGoPayDeFi ProtocolBSC$1.6M
A compromised administrator created a fake staking pool on BNB Chain, and users were tricked into depositing tokens there. The attacker obtained and sold about 6.15 million LGT reward tokens, causing losses of about $1.6 million.
Tender.fiDeFi ProtocolArbitrum$1.59M
Tender.fi’s misconfigured GMX price feed let an attacker borrow crypto using just one GMX token as collateral. The attacker returned the funds, and Tender.fi agreed to pay a bounty.
SOL Big Brain$1.5M
Attackers took over a portfolio company founder’s Telegram account and used it to trick SOL Big Brain into following instructions that allowed a malicious contract to drain his wallets. He lost stablecoins, ETH, and GEAR tokens worth about $1.5 million.
General BytesOtherEthereum$1.5M
Attackers exploited a flaw in General Bytes’ ATM cloud service to run malicious software, access server data and hot-wallet withdrawal keys, and steal user credentials. Cryptocurrency was taken from hot wallets.
Yield Protocol$1.5M
Yield Protocol said the Euler attack affected its mainnet liquidity pool, which held Euler eTokens and Yield fyTokens; borrower collateral held by Yield was reported safe. Yield later claimed recovered funds from Euler and held them in a timelock, a delay-controlled contract.
Block Tower Capital$1.5M
A flaw in Dexible’s smart contracts let attackers withdraw tokens that users had approved for spending. Block Tower Capital was among the victims, losing about $1.5 million in TRU tokens, which the attackers exchanged for ETH and sent through Tornado Cash.
Florence FinanceDeFi ProtocolEthereum$1.45M
A user sent USDC to a lookalike address planted by attackers instead of Florence Finance’s legitimate address, after relying on an autofilled contact. The attackers moved the funds to Ethereum and swapped them for ETH.
MEV Bot$1.4M
The MEV bot jaredfromsubway.eth used sandwich attacks—placing transactions before and after users’ trades to profit from price changes—on buyers and sellers of meme coins, earning more than $1.4 million.
Yearn Finance$1.38M
Some Yearn vaults were indirectly exposed to the Euler Finance hack through Idle and Angle strategies, affecting yvUSDT and yvUSDC. Yearn later said all the affected funds had been recovered.
Swerve FinanceDeFi ProtocolEthereum$1.3M
An attacker tried to use Swerve Finance governance proposals to transfer $1.3 million in stablecoins to their own contract. The attempt failed because they lacked enough voting power.
BlackHole TokenTokenBSC$1.28M
An attacker used a flash loan to manipulate BlackHole Token’s trading-pool price, then drained funds from the protocol. The attack involved swapping 22 million USDT through the pair.
TelcoinPaymentsPolygon$1.25M
An attacker exploited uninitialized wallet proxy contracts on Polygon, setting up malicious versions that could drain funds from wallets that had never made a transaction. Telcoin temporarily froze app use while investigating.
SamudaiDeFi ProtocolEthereum$1.25M
Attackers compromised Samudai’s multisignature wallets and its founder’s personal wallet, stealing ETH. They moved the funds through Tornado Cash, a service that obscures transaction paths.
BH Token (BlackHole token)$1.2M
An attacker exploited BH Token and gained 1.2 million USDT, which they began swapping for BNB and depositing into Tornado Cash.
SteadefiDeFi ProtocolEthereum$1.16M
An attacker stole Steadefi’s deployer wallet key, took ownership of its pools, and used privileged withdrawal functions to drain WBTC, WETH, and USDC. The loss was about $1.15 million, of which the team later recovered about $540,000 from remaining vaults.
Levana$1.14M
An oracle manipulation attack drained about 10% of Levana’s liquidity pool over nearly two weeks. The team said trading positions and profits were unaffected and planned to compensate affected liquidity providers.
Levana PerpsDeFi ProtocolOsmosis$1.1M
Stale Pyth oracle prices, combined with fee-market bugs on Osmosis, let attackers make profitable trades against Levana during volatile periods, taking about $1.1 million.
Swap-LPDeFi ProtocolBSC$1.1M
A flaw in Swap-LP’s factory contract let an attacker manipulate liquidity pools and drain value, taking about $1.1 million. The stolen funds were transferred to Tornado Cash.
LEVEL FinanceDeFi ProtocolBSC$1.1M
Attackers exploited the referral rewards contract’s failure to prevent repeated claims in the same reward period, using flash loans to inflate reward levels. They stole about $1.1 million in referral rewards.
CypherDeFi ProtocolSolana$1.04M
An attacker exploited a flaw in Cypher’s margin system to withdraw more than they had deposited, creating bad debt and taking over $1 million in tokens. About $600,000 was later frozen at centralized exchanges.
FFF$1.03M
The FFF project administrator used a pre-set contract to issue extra tokens, then sold them and transferred some of the proceeds. More than $1.03 million worth of additional FFF tokens was sold.
MiladyDeFi ProtocolEthereum$1M
A developer with access to the Remilia treasury took about $1 million in fees from the Bonkler reserve-backed NFT system and seized project code and social accounts. The project said its core reserves, community vaults, contracts, and NFTs remained safe.
WDZD SwapDeFi ProtocolBinance Smart Chain$1M
An access-control flaw let an attacker move WDZD tokens from trading pairs to the factory contract, distorting the token’s value and enabling trades for LP tokens at favorable rates. Burning those tokens brought in about 609 ETH.
SentimentDeFi ProtocolArbitrum$900K returned$1M
A read-only reentrancy flaw involving Balancer, combined with flash-loan price manipulation, let an attacker drain about $966,000 from Sentiment on Arbitrum. Sentiment later recovered more than $900,000, with about $95,000 left as a reward for the attacker.
swapXDeFi ProtocolBSC$1M
A missing access check in swapX’s contract let an attacker repeatedly manipulate DND token prices and drain funds from user wallets that had approved the contract.
Kevin Rose$1M
A phishing attack tricked Moonbirds founder Kevin Rose into signing a malicious message, allowing the attacker to transfer 25 Chromie Squiggles and other NFTs from his wallet.
Harvest Keeper$933K
Harvest Keeper’s owner authority was used to move users’ pledged USDT out of its contract, while users’ token approvals also enabled repeated transfers from their accounts. About $933,000 was taken.
HarvestDeFi ProtocolEthereum$933K
Reports said Harvest’s USDC, USDT, and WETH vaults were affected, but gave different accounts of what happened. Harvest warned users not to interact with the affected vaults while the issue was unresolved.
