Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
Nomic$3.15M
A flaw in Nomic’s forwarding logic created 40.65 unbacked nBTC, leaving Osmosis’s allBTC pool short by about $3.15 million. Osmosis froze 22.65 allBTC, but roughly 18 BTC-equivalent had already reached Tornado Cash before the issue was discovered.
Fogo FoundationFoundationFogo$3M
An unknown attacker took control of the Fogo Foundation’s token authority and transferred 400 million FOGO to an attacker-controlled address; the specific access method was not disclosed. Fogo halted its network, then restarted it after recovering and permanently removing 237 million tokens.
BounceBitChainBounceBit$3M
An authorization flaw in a BounceBit chain module let an attacker transfer BB from nine accounts without their permission. BounceBit retired the chain and reissued BB on BNB Chain using a snapshot from before the theft.
PolymarketDeFi ProtocolPolygon$3M
A malicious script injected through a third-party vendor’s software appeared on Polymarket’s website and tricked users into approving fraudulent token transfers. It drained about $3 million in PUSD from 11 wallets; the funds were moved from Polygon to Ethereum.
CrossCurveDeFi ProtocolBridge$3M
CrossCurve’s bridge contract failed to verify the origin of cross-chain messages, allowing an attacker to forge messages and unlock tokens without matching deposits on other chains. About $3 million was stolen across multiple networks before the exploit was contained.
TACDeFi ProtocolBridgeTONTAC$2.85M
An attacker used a counterfeit USD₮ wallet on the TON side of the TON–TAC bridge to send a fraudulent message and mint unbacked TAC tokens. The incident drained locked assets, including USDT, BLUM, and tsTON, and the bridge was paused.
StablRDeFi ProtocolEthereum$2.8M
After one of StablR’s three multisig keys was compromised, the attacker minted 8.35 million USDR and 4.5 million EURR without collateral and sold them for about $2.8 million in ETH. Both stablecoins depegged.
Polymarket InternationalPrediction MarketPolygon$2.7M
Malicious code delivered through a compromised third-party monitoring service hijacked Polymarket trading sessions, selling users’ market positions and transferring assets to attacker-controlled wallets. Polymarket paused trading and promised to reimburse affected users.
RetoSwapDeFi ProtocolMonero$2.7M
RetoSwap’s dispute process allowed funds to be released without both sides completing the trade. An attacker won XMR from buy offers after Bitcoin confirmations without sending the corresponding BTC.
RetoSwapDeFi ProtocolMonero$2.7M
RetoSwap failed to verify the source of trade acknowledgment messages, allowing attackers to impersonate arbitrators and redirect multisig wallets to attacker-controlled addresses. About 7,000 XMR was stolen from traders.
Solv ProtocolDeFi ProtocolEthereum$2.7M
A callback during BRO vault deposits minted tokens before the transaction finished, allowing the same deposit to be counted repeatedly and inflating 135 BRO into 567 million. The attacker took about 38 SolvBTC, worth roughly $2.7 million; Solv said it would cover affected users’ losses.
InitiaChainInitia$2.6M
A bug in Initia’s MoveVM, the software that runs its smart contracts, let an attacker mint unbacked tokens and bridge about $2.7 million in assets off the network. Initia halted its L1 blockchain and rollups; native INIT tokens were unaffected.
TSRTokenBSC$2.5M
Inadequate access controls on TesseraDAO’s mint function let the attacker create about 99 million TSR tokens, which they sold for USDT before bridging and laundering the funds.
HyperbridgeDeFi ProtocolBridgeEthereumBaseBSC+1 chains$2.5M
A missing bounds check in Hyperbridge’s proof verification let the attacker forge a cross-chain message and mint 1 billion DOT tokens, which were sold against liquidity pools. The incident caused about $2.5 million in losses across several networks, mainly to incentive pools.
AquiferDeFi ProtocolSolana$2.47M
Aquifer’s Solana swap system was exploited, and about $2.5 million was lost. Reports differ on the cause, so the precise attack method is not established here.
SecondFiWalletCardano$2.4M
A flaw in SecondFi’s Cardano signing code reused transaction nonces, exposing private keys from wallet signatures. Attackers drained about 16 million ADA from 374 wallets; the project secured additional funds through an emergency rescue.
TESSERADeFi ProtocolBNB$2.4M
An attacker took control of TesseraDAO’s core contract, changed its permissions, and minted 99 million TSR tokens without backing. Selling them brought in about $2.4 million in USDT, which was later moved through Tornado Cash.
Meter PassportChainMeterBSCEthereum$2.3M
An attacker exploited a block-validation flaw on Meter to create unbacked tokens, then sold them and bridged proceeds off the network. Meter paused its mainnet and bridge while investigating and planning recovery.
SingularityNET$2.29M
An attacker accessed SingularityNET’s cloud infrastructure and used valid bridge signatures to authorize AGIX, WMTX and CGV minting, while minting NTX directly. The attacker also drained 8.72 million FET; about $2.29 million in gross liquid proceeds was traced.
FOOMCASHDeFi ProtocolEthereumBase$2.26M
A misconfigured verifier on FOOMCASH let attackers submit forged zero-knowledge proofs—cryptographic claims that could not be properly checked—and withdraw about $2.26 million in FOOM tokens. A white-hat recovered about $1.84 million.
ArcusDeFi ProtocolRobinhood Chain$2.23M returned$2.23M
An accounting flaw in Arcus Perps let an attacker inflate a recorded balance through transfers between subaccounts, then withdraw USDG. A bridge rate limit blocked additional withdrawal requests, and Arcus covered the shortfall from its treasury without affecting other users’ balances.
Aztec ConnectDeFi ProtocolBridgeEthereum$2.1M
A flaw in Aztec Connect’s proof checks let an attacker submit transactions whose proofs did not match the Ethereum state updates, creating unbacked balances and withdrawing real assets. The current Aztec Network and AZTEC token were unaffected.
Fake GIWA BridgeDeFi ProtocolBridgeEthereum$2.08M
Scammers created a fake GIWA network and bridge using the chain ID expected for the real network, which had not launched. Users deposited ETH into the counterfeit bridge, and the scammers drained about 766 ETH; the legitimate GIWA contracts were not exploited.
RRWalletWalletBitcoin$2M
Weak random-number generation in RRWallet produced predictable seed phrases, allowing an attacker to derive private keys and steal one user’s bitcoin.
Aztec BridgeDeFi ProtocolBridgeEthereum$2M
A flaw in the proof checks for Aztec’s deprecated bridge escape hatch let an attacker withdraw assets without corresponding deposits. The attacker took 1,158 ETH, 150,000 DAI, and about 0.47 renBTC.
DangoDeFi ProtocolDango$410K returned$1.9M
Dango’s insurance fund accepted negative donation amounts without checking them, letting an attacker manipulate balances and take USDC. About $410,000 was bridged out; the remaining $1.49 million was recovered and returned.
Transit FinanceDeFi ProtocolTron$1.88M
An attacker exploited vulnerabilities in Transit Finance’s discontinued TRON contract, draining about $1.88 million in DAI and other assets. The funds were moved to an Ethereum address; the team said current contracts were unaffected and promised to compensate users.
Payy NetworkDeFi ProtocolBridgeEthereum$1.83M
Payy’s bridge processed a batch containing an unauthorized USDC withdrawal to the attacker, draining about 1.83 million USDC. The cause—possibly a credentials compromise or a flaw in proof verification—had not been established.
Limit BreakNFTfiEthereumApeChainPolygon+1 chains$1.8M
A flaw in Limit Break’s Payment Processor let attackers use users’ existing token and NFT approvals to take assets without a valid purchase. Whitehats moved thousands of NFTs to safety, but about 660 WETH was stolen along with other tokens.
MoonwellDeFi ProtocolBase$1.78M
An oracle configuration error priced cbETH at $1.12 instead of nearly $2,200 on Moonwell, leading liquidation bots to seize 1,096 cbETH. The error left the protocol with about $1.78 million in bad debt.
Notional FinanceDeFi ProtocolEthereum$1.73M
An unchecked 128-bit conversion in Notional V1’s debt check turned a very large liability into zero, making an insolvent account appear solvent. The attacker used fabricated fCash claims to withdraw about $1.73 million in USDC and DAI, then swapped the funds for ETH and deposited it into Tornado Cash.
Maya ProtocolDeFi ProtocolBridgeMayachain$1.7M
A chain of accounting and outbound-tracking bugs credited an almost empty ARB.LINK pool with CACAO that had never been transferred into it. The attacker added liquidity and withdrew about 48.87 million CACAO from Asgard liquidity, converting some into BTC and other assets.
Taiko BridgeChainBridgeTaiko$1.7M
A leaked SGX signing key let the attacker forge proofs and submit fake bridge messages, bypassing Taiko’s checks and draining assets from its Ethereum ERC20 vault. The bridge was paused.
BSC TMM/USDTDeFi ProtocolBSC$1.67M
Insufficient access controls let an attacker use flash loans to burn TMM held in the TMM/USDT pool, leaving its recorded reserve at one token. The distorted price enabled a large USDT withdrawal; the attacker repaid the loans and kept the remaining profit.
Allbridge CoreDeFi ProtocolBridgeSolana$1.65M
The attacker used a flash loan to rapidly swap USDC and USDT in Allbridge Core’s Solana pools, distorting their price ratio. They then withdrew liquidity at the manipulated rate, taking about $1.65 million.
Zilliqa exchange partnerChainZilliqa$1.64M
A flaw in the Zilliqa Ledger app caused signing nonces—values used to authorize transactions—to be generated with predictable bits, letting attackers recover private keys from transaction signatures. They stole about 683.13 million ZIL from an exchange partner’s cold wallet.
BTCPay ServerWalletBitcoinLitecoin$1.63M
A vulnerability in older self-hosted BTCPay Server installations let attackers compromise servers and sweep Bitcoin and Litecoin from hot wallets, whose spending keys were stored on the servers. Wallets using keys held off-server, including hardware wallets, were unaffected.
Token of PowerTokenEthereum$1.58M
An attacker gained majority voting power in the Token of Power DAO and passed a proposal to mint a huge amount of TOP tokens. They used the newly minted tokens to drain about 944 WETH from a Balancer pool; Balancer itself was not exploited.
Fetch.aiDeFi ProtocolBridgeEthereum$1.53M
An attacker used a stolen conversion-authorizer signing key to authorize a call that released Fetch.ai’s remaining FET from its Ethereum conversion contract. About 8.72 million FET was drained.
Gnosis PayOtherGnosis Chain$1.5M
A flawed signature check in Gnosis Pay’s Zodiac Delay Module failed to verify whether a contract call succeeded, allowing unauthorized transactions from affected wallets. The issue affected 5,281 wallets, and Gnosis said users would be fully reimbursed.
