Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
MEV Bot$2.15M
An MEV bot’s arbitrage function had no access check, so an attacker used it to trade the bot’s tokens against a Curve pool and profit from a flash loan, a temporary borrowed sum. The bot lost about 1,000 ETH.
Curve Finance MEV BotDeFi ProtocolEthereum$2M
An attacker exploited an access-control flaw in an Ethereum arbitrage bot to call a function that traded wrapped Bitcoin (wBTC) for wrapped Ether (wETH). After using a flash loan to manipulate Curve pool prices, the attacker made the bot buy wBTC at inflated prices.
TheStandard.ioDeFi ProtocolArbitrum$290K
An attacker used low liquidity in a WBTC/PAXG pool and a swap without slippage protection to manipulate the price after minting EUROs against WBTC collateral. About 243,000 EUROs were later returned to the protocol.
TrustPadDeFi ProtocolBSC$155K
A TrustPad staking-contract flaw let an attacker repeatedly claim pending rewards by manipulating lock periods. The reports did not specify the amount taken.
Fake Ledger Live Web3$588K
A fake Ledger Live app on Microsoft’s official app store stole more than 16.8 BTC from users.
TellorUndisclosed
Tellor’s Twitter account was compromised and used to post a phishing link about a $TRB airdrop.
Onyx ProtocolDeFi ProtocolEthereum$2.1M
An attacker used a flash loan to inflate the exchange rate in Onyx Protocol’s new PEPE lending market, exploiting rounding errors when redeeming assets and taking about $2.1 million.
Monero$460K
Monero’s community crowdfunding wallet was drained of its entire balance. Its separate hot wallet, used to pay contributors, was unaffected.
Frax FinanceUndisclosed
Frax Finance warned users not to visit its websites after its DNS—the system that directs web addresses to sites—was attacked. The report did not say that funds were taken.
UnibotDeFi ProtocolEthereum$640K
A flaw in Unibot’s new router let attackers make the contract transfer tokens that users had approved it to spend, draining about $640,000. The funds were moved through Uniswap and Tornado Cash.
AstridDeFi ProtocolEthereum$228K
A flaw in Astrid Finance’s withdrawal function let an attacker create counterfeit tokens and exchange them for ETH. The attacker later returned about 80% of the stolen funds.
LastPass$4.4M
Funds were drained from more than 25 victims in connection with the LastPass hack, with about $4.4 million taken on the reported day.
Maestro RouterDeFi ProtocolEthereum$465K returned$500K
A flaw in Maestro Router 2 let attackers make the contract call other services and take tokens from wallets that had approved it. Maestro fixed the exploit and paused trading; about $510,000 was stolen.
Coins.ph$6M
The Philippine exchange Coins.ph lost 12 million XRP in a hack.
SynthetifyDeFi ProtocolSolana$230K
An attacker used token-based voting to take control of Synthetify’s inactive DAO and compromise the protocol. The platform was frozen, and the stolen assets were not recovered.
HopeLendDeFi ProtocolEthereum$825K
A precision error in HopeLend’s share calculations let an attacker distort the exchange rate and borrow ETH using rounding errors. A frontrunner took part of the funds, and the Armor Team frontrunner later returned assets.
MicDaoDeFi ProtocolBSC$13K
An attacker manipulated MicDao’s token supply and price, then sold tokens for profit and moved the proceeds to BSC. The reported gain was about $12,263.
Fantom Foundation$657K
Some Fantom Foundation hot-wallet assets were drained. The available report suggested private keys may have been stolen, but did not confirm how.
EverscaleUndisclosed
A large number of EVER tokens were stolen from Everscale. The network worked with exchanges to stop further outflows and temporarily disconnected Octus Bridge.
PlatypusDeFi ProtocolAvalanche$2.2M
Attackers used flash loans—temporary borrowed funds—to manipulate swap-price calculations across Platypus Finance’s liquidity pools and drain about $2.2 million. The project later recovered most of the stolen funds, reducing its reported net loss to about 18,000 AVAX.
WiseLendingDeFi ProtocolEthereum$260K
An attacker used a flash loan and rounding errors in WiseLending’s share calculations to inflate share prices through deposits and withdrawals. A white-hat MEV bot—an automated trader acting to protect users—front-ran the exploit and recovered funds.
Beluga ProtocolDeFi ProtocolArbitrum$175K
An attacker manipulated the token balances in a Beluga Protocol pool on Arbitrum, using a flash loan—borrowed funds repaid in one transaction—to withdraw extra tokens.
BlackHole TokenTokenBSC$1.28M
An attacker used a flash loan to manipulate BlackHole Token’s trading-pool price, then drained funds from the protocol. The attack involved swapping 22 million USDT through the pair.
BH Token (BlackHole token)$1.2M
An attacker exploited BH Token and gained 1.2 million USDT, which they began swapping for BNB and depositing into Tornado Cash.
NOWAIUndisclosed
NOWAI’s Discord server was compromised and directed users to a phishing site designed to trick them into connecting their wallets.
LastPassUndisclosed
LastPass was suspected of a data breach after a user said more than 20 ETH was taken from a hot wallet whose recovery phrase had been stored there. The report said similar losses may have affected others, but did not confirm the breach.
LoozrUndisclosed
A fake Collab.Land verification link in Loozr’s Discord led users to a phishing site with a wallet drainer. The report did not specify any losses.
Wall Street MemeUndisclosed
An attacker posted a phishing link in the announcements channel of Wall Street Meme’s Discord server.
CryptopreneursUndisclosed
An attacker compromised Cryptopreneurs’ Discord server and posted a phishing link.
OrdswapUndisclosed
Ordswap lost control of its website domain, apparently through an issue involving its hosting provider. The compromised site redirected visitors to phishing links.
StarksportUndisclosed
A Starksport community team member’s Discord account was compromised. The report did not describe any stolen funds or further impact.
Lucky Star Currency, FSL$2.79M
Lucky Star Currency was named as one of two BSC token projects rugged that week, with combined losses of $2.79 million. The report did not explain how the project’s funds were taken.
Ethereum Foundation$9.1K
An MEV bot sandwich-attacked the Ethereum Foundation’s sale of 1,700 ETH on Uniswap V3, placing trades around the sale to profit from its price impact. The Foundation lost $9,101, while the bot made $4,060.
pSeudoEth$2.3K
The pSeudoEth token was exploited in a flash-loan attack, causing a loss of about $2,300.
OmniBTCUndisclosed
Attackers took over OmniBTC’s Discord account and posted a phishing link in its announcement channel.
MetaMundoUndisclosed
An attacker posted a phishing link in MetaMundo’s Discord announcements channel.
Arena SocialFiOtherAvalanche$2.97M
An attacker exploited a share-issuance function without protection against repeated calls in one transaction. By manipulating its calculations, they bought one share and sold it for about 274,000 AVAX, draining roughly $2.97 million.
GalxeOtherEthereum$270K
An attacker gained control of Galxe’s domain account and redirected its website to a phishing page. About 1,120 users signed malicious transactions, losing roughly $270,000; Galxe later announced a compensation plan.
MCTUndisclosed
DNS hijacking redirected some MCT wallet users to a fraudulent website that could capture their private keys. MCT advised users who had entered keys on its site to move their funds.
Stars Arena$2.9M
A flaw in Stars Arena’s smart contract allowed an attacker to drain about 266,104 AVAX. The attacker later returned 239,493 AVAX, with 27,610 AVAX paid as a bounty; about 1,000 AVAX was lost in a bridge transfer.
Our coverage: Security Breach Of $3 Million Hits Stars Arena Backed By AvalancheSourceRekt report
