Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
uniBTCDeFi ProtocolEthereum$2M
A former employee planted malware in Bedrock’s software files, then exploited a flaw in uniBTC’s minting system to create tokens backed by ETH and drain the liquidity pool.
CoinStats$2M
Malware on an employee’s work computer, after the employee was tricked into downloading it, helped attackers compromise CoinStats’ AWS infrastructure and affect 1,590 CoinStats wallets. Connected wallets and exchange accounts were unaffected.
MozaicDeFi ProtocolArbitrum$2M
A rogue developer obtained a core team member’s private key and used it to access Mozaic’s bridge function, stealing funds; about 90% were later frozen on MEXC.
MangoFarmSolDeFi ProtocolSolana$2M
MangoFarmSol’s website and smart contract were designed to drain users’ wallets after they approved token transfers. The team deleted its social accounts and disappeared.
Dough FinanceDeFi ProtocolEthereum$1.96M
Attackers exploited unchecked call data in a Dough Finance contract, combining it with a flash loan to transfer WETH. About $1.96 million was taken; some ETH was later returned by a white-hat hacker, while much of the rest was deposited into Tornado Cash.
GemPadDeFi ProtocolEthereumBaseBSC$1.9M
Attackers exploited a reentrancy flaw in GemPad’s fee-collection function to repeatedly withdraw tokens from liquidity lockers using a vulnerable contract template deployed by multiple projects. About $2 million was lost across several networks.
Aark Digital$1.9M
During a script-based conversion of GM balances to USDC, an incorrect balance update greatly inflated one user’s recorded value. An attacker exploited the error, costing Aark Digital 1,499,841 USDC and 159.09 ETH.
AARK (Aark Digital)DeFi ProtocolArbitrum$1.9M
A decimal-calculation flaw in AARK’s Arbitrum vault contracts let an attacker inflate conversion values, causing a loss of about $1.9 million.
pump.funDeFi ProtocolSolana$1.9M
A former pump.fun employee retained access to a service account and used that access to obtain withdrawal permissions. The attacker used flash loans—short-term loans repaid within one transaction—to drain about 12,300 SOL in liquidity, then began sending some funds to other wallets.
DolomiteDeFi ProtocolEthereum$1.8M
An attacker exploited reentrancy in an old Dolomite contract, using a trading contract without adequate protection to repeatedly drain funds from users who had approved it. Dolomite later recovered most of the stolen assets.
Wilder World$1.8M
An attacker took control of the Wilder World NFT marketplace deployer wallet, transferred ownership to themselves, then used a malicious contract upgrade to withdraw and sell WILD and MEOW tokens for about $1.8 million.
Concentric FinanceDeFi ProtocolArbitrum$1.72M
A social-engineering attack compromised a Concentric Finance team member’s deployer key. The attacker upgraded vault contracts, minted unauthorized liquidity-provider tokens, and drained assets from the platform.
XT ExchangeCEXEthereum$1.7M
An attacker compromised XT’s hot wallet and drained 12 types of tokens, then swapped them for 461.58 ETH. XT halted withdrawals and said user funds were covered by reserves.
Grand BaseDeFi ProtocolBase$1.7M
After a developer’s computer was compromised, an attacker gained access to Grand Base’s deployer wallet, minted GB tokens and sold them, draining liquidity and crashing the token price.
Goledo FinanceDeFi ProtocolConflux$1.7M
An attacker used a flash loan—a short-term loan repaid in one transaction—to buy PPI tokens and inflate their price, then used them as collateral to borrow 7.9 million CFX from Goledo Finance. The attacker later contacted the protocol to negotiate.
Pike Finance$1.68M
Pike Finance reported an attack on its beta protocol caused by weak checks in contract functions handling CCTP transfers, with losses of 99,970.48 ARB, 64,126 OP, and 479.39 ETH. The report also noted an earlier attack on its USDC pool that caused about $300,000 in losses.
Pike FinanceDeFi ProtocolEthereumOptimismArbitrum$1.6M
A Pike Finance contract exploit let attackers bypass controls and drain funds from its cross-chain lending pools. The reports differ on the precise flaw and assets taken.
Shoebill FinanceDeFi ProtocolBOB$1.52M
An oracle configuration error—affecting how asset values were supplied to the lending platform—let attackers borrow with little collateral. They moved 19.512 wBTC and 1.597 tBTC across multiple bridges.
YOLO GamesDeFi ProtocolBlast$1.5M
YOLO Games’ Bazaar liquidity pool on Blast lacked an ownership check in its exit function, letting an attacker impersonate liquidity providers and withdraw assets. A white-hat hacker returned 353 ETH, about 90% of the stolen funds.
XBridgeDeFi ProtocolBridgeEthereumBSC$1.44M
Unprotected functions in XBridge’s Ethereum and BNB Chain contracts let an attacker claim token-owner access and drain assets held by the bridge.
Caterpillar CoinTokenBSC$1.4M
The attacker used a flash loan—a temporary loan repaid within one transaction—to manipulate CUT’s price and rewards on PancakeSwap, then drained the trading pool for about $1.4 million.
MinterestDeFi ProtocolMantle$1.4M
An attacker used a flash loan—a temporary loan repaid in one transaction—and a reentrancy flaw to manipulate Minterest’s exchange rates and liquidate users’ mETH and WETH positions. The protocol lost about $1.4 million.
SolareumDeFi ProtocolSolana$1.4M
Wallets linked to Solareum’s Telegram trading bot were among those drained, with reports linking the thefts to the bot; the cause was not definitively established.
Blueberry ProtocolDeFi ProtocolEthereum$1.34M
A lending-market flaw let an attacker use a flash loan to manipulate Blueberry Protocol’s oracle prices and borrow too much. A white-hat intervened and returned most of the ETH taken.
MonoSwapDeFi ProtocolBlast$1.3M
A MonoSwap developer installed a fake video-call app that stole private keys, which an attacker used to withdraw about $1.3 million in staked liquidity and protocol funds.
RiskOnBlastDeFi ProtocolBlast$1.3M
After raising 420 ETH in its presale, RiskOnBlast’s team drained the project’s balances and moved funds through MEXC, Bybit, and ChangeNOW.
GNUS$1.27M
An attacker exploited GNUS on Fantom to mint fake tokens, bridge them to Ethereum and Polygon, and sell them into liquidity pools.
GeniusAIDeFi ProtocolFantomEthereum$1.27M
A breach of Gnus.AI’s Discord exposed the private key to the team’s deployment wallet. The attacker minted 100 million fake GNUS tokens on Fantom, bridged them to Ethereum, and sold them, crashing the price 95%.
Vow$1.2M
A vulnerability in Vow’s contract was exploited, causing a loss of about $1.2 million. Further details were not reported.
VowcurrencyDeFi ProtocolEthereum$1.2M
An address able to set Vowcurrency’s exchange rate changed it from 1 to 100 without validation. A bot used the inflated rate to mint vUSD and swap VOW for ETH and USDT, taking about $1.2 million.
HolographDeFi ProtocolEthereum$1.2M
A former Holograph contractor exploited weak access controls on the token-minting functions to create 1 billion extra HLG tokens, which were then sold. The token’s price fell sharply after the exploit.
BasketDAODeFi ProtocolEthereum$1.2M
A flaw in BasketDAO’s approval process allowed attackers to make external contract calls and drain funds users had approved. The reports differed on the loss amount.
FegexDeFi ProtocolBridgeEthereumBSCBase$1.07M
An attacker forged cross-chain messages that FEG’s SmartBridge accepted as withdrawal requests without verifying their source, draining funds across Ethereum, BSC, and Base.
AirDAODeFi ProtocolEthereum$1.05M
A malicious email attachment impersonating a known partner infected an AirDAO partner’s device, giving attackers access to liquidity-pool keys. They drained AMB and ETH from the pool.
FEG$1M
FEG was attacked through an integration issue involving the Wormhole cross-chain bridge, which handles messages and token transfers between blockchains. The attack caused losses of about $1 million.
Unverified Contracts$1M
An attacker manipulated prices in unverified Base lending contracts and borrowed excessive amounts, gaining about $1 million in tokens.
Base LendingDeFi ProtocolBase$1M
A flaw in deposit verification let an attacker exploit Base Lending, an unverified lending protocol on Base, causing about $1 million in losses.
DeltaPrimeDeFi ProtocolArbitrum$1M
A misconfiguration let an attacker transfer ownership of 13 DeltaPrime accounts to themselves and withdraw collateral, causing about $1 million in losses. The attacker later returned $900,000.
Zest ProtocolDeFi ProtocolStacks$1M
An attacker manipulated Zest Protocol’s collateral list on Stacks by repeating collateral entries, making their collateral appear more valuable and enabling excess borrowing. They removed about 324,000 STX; the protocol said it would reimburse users from its treasury.
OcelotDexDeFi ProtocolEthereum$980K
A vulnerability in Shezmu’s vault let attackers mint ShezUSD without collateral and borrow assets to drain the protocol. After negotiations, 80% of the funds were recovered.
