Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
252 incidents Clear filters
LNDDeFi ProtocolSonicHyperliquid L1$1.18M
A developer with sole control over deployments introduced a malicious access-control change that reached LND’s production system without review. The change allowed funds to be taken from the protocol.
USPD$1M
An attacker seized administrator control of USPD’s proxy during deployment, hiding malicious code that was later used to mint unauthorized tokens and drain liquidity, including stETH. The team said it is tracing the funds.
US Permissionless DollarDeFi ProtocolEthereum$1M
An attacker claimed the USPD protocol’s admin role during deployment and installed a malicious proxy contract, later minting 98 million USPD and draining about $1 million in stETH.
MoonwellDeFi ProtocolBaseOptimism$1M
An incorrect Chainlink price for wrstETH made it appear worth about $5.8 million, allowing an attacker to use a flash loan and repeatedly borrow against it from Moonwell on Base and Optimism. The attack yielded about $1 million.
Mars PerpsDeFi ProtocolNeutron$960K
An attacker exploited Mars Protocol’s Perps market on Neutron by repeating same-block trades that took advantage of funding rates being applied only between blocks. The attack caused losses of about $973,000.
Nitron$951K
An attacker used token donations to manipulate the price feed for Nitron’s deprecated dGLP vault, taking funds from its lending market.
DemexDeFi ProtocolArbitrum$951K
An attacker donated fsGLP to inflate the redemption rate used to price dGLP in Demex’s Nitron lending market, then used the falsely valued dGLP as collateral to borrow other assets.
Venus Core PoolDeFi ProtocolzkSync Era$902K
On zkSync Era, an attacker sent tokens directly to Venus Core Pool’s cToken contract, distorting exchange-rate calculations and bypassing collateral accounting. The attack caused losses and bad debt.
Orange FinanceDeFi ProtocolArbitrum$840K
An attacker exploited Orange Finance’s misconfigured multisig, took control of its vaults, changed their contract code, and withdrew deposited assets and funds covered by excessive approvals.
HyperdriveDeFi ProtocolHyperliquid L1$782K
A vulnerability in Hyperdrive’s router allowed an attacker to make unauthorized calls and repeatedly withdraw USDT0 and thBILL from its markets. The losses totaled about $782,000, and funds were moved to Ethereum and BNB Chain.
R0ARDeFi ProtocolEthereum$780K
A backdoor in the R0ARStaking contract let someone falsify their recorded balance and withdraw the contract’s funds through its emergency withdrawal function.
SuperRareDeFi ProtocolEthereum$730K
A faulty permission check let anyone change the Merkle root used by SuperRare’s staking contract, enabling fraudulent token claims worth about $730,000. A frontrunner later took over the exploit.
AerodromeDeFi ProtocolEthereumOptimism$700K
Attackers hijacked the Aerodrome and Velodrome website domains through a registrar compromise and redirected visitors to phishing pages that solicited harmful token approvals and signatures. Users lost about $700,000; the smart contracts were not compromised.
Vicuna LendingDeFi ProtocolSonic$700K
An oracle, which supplies price data, was manipulated to exploit Vicuna’s S Market and Stablecoin Market, causing about $700,000 in losses; its Main Protocol market was unaffected. Vicuna removed liquidity from the affected markets and planned to distribute remaining assets among affected users according to their net deposits.
IPC$590K
IPC was suspected of being attacked on BSC, resulting in an estimated loss of about $590,000.
IPC AITokenBinance$590K
An attacker used a flash loan to bypass IPC AI’s flash-loan protections and exploit the token pair’s burn mechanism. The attack drained about $590,000 from the liquidity pool.
Astera.fiDeFi ProtocolLinea$573K
An attacker manipulated a lending market’s liquidity index—a measure used to calculate balances—to inflate collateral values and borrow assets from Astera’s Linea markets. Linea’s security team detected and stopped the attack within minutes.
Silo LabsDeFi ProtocolEthereum$546K
An attacker exploited an unreleased leverage contract deployed for testing, using a manipulated swap parameter and approvals to borrow without proper checks. The stolen 224 ETH belonged to SiloDAO; user funds were not at risk.
Agentic FoFDeFi ProtocolEthereum$531K
A security vulnerability allowed attackers to drain funds from Agentic FoF vaults. The protocol suspended its vaults and paused withdrawals during an investigation.
0G FoundationDeFi Protocol0G$516K
An attacker exploited the emergency-withdrawal function in 0G Foundation’s reward contract to take 0G tokens, ETH, and USDT. The stolen funds were later moved through a crypto-mixing service; the core chain and user funds were reported unaffected.
NUMA.DeFi ProtocolArbitrum$506K
The attacker used flash-minted nuBTC to distort NUMA’s synthetic liabilities and collateral values, exploiting a lack of protection against spot-price manipulation. The stolen assets were swapped for ETH and sent through Tornado Cash.
PolymarketDeFi ProtocolPolygonEthereum$500K
Attackers posted disguised phishing links in Polymarket comments, leading users to fake login pages that captured their credentials. They used compromised email-login accounts to drain user funds.
Zunami ProtocolDeFi ProtocolEthereum$500K
An attacker used a compromised admin key to call a privileged withdrawal function and drain collateral backing Zunami’s zunUSD and zunETH stablecoins. The stolen funds were sent through Tornado Cash, a service that obscures transaction trails.
Cozy V2DeFi ProtocolOptimism$427K
A missing caller check in Cozy V2’s withdrawal function let an attacker complete withdrawals using only a user’s redemption ID, causing a loss of about $427,000.
Evoq FinanceDeFi ProtocolBSC$420K
After stealing Evoq Finance’s owner key, an attacker transferred contract ownership, installed a malicious upgrade, and drained about $420,000 from the protocol and users’ approved token accounts.
CorepoundDeFi ProtocolCORE$400K
Corepound’s team used privileged control of its vaults to withdraw about $400,000 in deposited user funds.
CardexDeFi ProtocolAbstract$400K
A session signer key exposed in Cardex’s frontend let attackers impersonate users’ active sessions and drain funds from wallets that had approved session keys. About 9,000 wallets were affected.
Impermax V3DeFi ProtocolBase$380K
An attacker manipulated the balance of low-liquidity cbBTC-tBTC pools on Impermax V3, causing the exchange rate to collapse and enabling excessive borrowing-token creation. The exploit drained about $380,000.
SIR.trading$355K
An attacker exploited a flaw in SIR.trading’s temporary storage: a value was not cleared after use, allowing a specially constructed address to bypass permission checks and transfer tokens. More than $300,000 in assets was lost.
SIRDeFi ProtocolEthereum$355K
A flaw in SIR.trading’s callback checks let an attacker use an address they controlled instead of the intended Uniswap pool. They exploited this to steal about $355,000.
GoldfinchDeFi ProtocolEthereum$330K
A flaw in Goldfinch’s legacy contract let an attacker use a user’s token approval to transfer funds. The attacker manipulated the share price and withdrew more than they were entitled to, then sent some proceeds to Tornado Cash, a privacy mixer.
The IdolsDeFi ProtocolEthereum$324K
A flaw in The Idols NFT reward logic mishandled transfers where the sender and recipient were the same address. An attacker repeatedly made such transfers to drain 97 stETH from the reward pool.
Voltage FinanceDeFi ProtocolFuse$322K
An attacker replaced Voltage Finance’s SimpleChefStaking contract implementation with malicious code and used it to withdraw USDCE and WETH from its staking pools.
numa.DeFi ProtocolSonic$313K
The attacker used a flash loan to inflate NumaVault’s reported liabilities, driving down the collateral price and allowing them to liquidate under-collateralized positions. They then bridged ETH to Ethereum.
Yearn Finance V1DeFi ProtocolEthereum$300K
An attacker used a donation attack against Yearn’s legacy V1 TUSD vault, depositing tokens to inflate the vault’s share price and minting Yearn TUSD tokens cheaply before the price fell. About $300,000 was lost; the attacker converted the funds to ETH.
CoinbaseCEXEthereum$300K
MEV bots exploited overly broad token approvals that Coinbase’s corporate DEX wallet had granted to a 0x swap contract, using the permissions to drain tokens.
Dexodus FinanceDeFi ProtocolBase$300K returned$300K
An attacker used outdated but accepted Chainlink price data to open a 100-times leveraged ETH long at an artificially low price, then closed it at the correct price in the same transaction. Dexodus recovered all affected liquidity within 24 hours.
ImpermaxDeFi ProtocolBase$300K
An attacker manipulated liquidity-pool prices and fee accounting in Impermax V3, making collateral appear more valuable than it was and borrowing against it. The attack drained V3 liquidity pools.
MoonhackerDeFi ProtocolOptimism$300K
An attacker used a flash loan and passed a malicious contract into MoonHacker’s loan-handling function, which did not validate it. This enabled unauthorized approval to transfer and drain USDC from the vault.
Malda$285K
A flaw in Malda’s Migrator contract let an attacker supply a malicious Comptroller, a contract that manages lending positions. They used it to create a synthetic position and withdraw about $285,000.
