Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
SteadefiDeFi ProtocolEthereum$1.16M
An attacker stole Steadefi’s deployer wallet key, took ownership of its pools, and used privileged withdrawal functions to drain WBTC, WETH, and USDC. The loss was about $1.15 million, of which the team later recovered about $540,000 from remaining vaults.
CypherDeFi ProtocolSolana$1.04M
An attacker exploited a flaw in Cypher’s margin system to withdraw more than they had deposited, creating bad debt and taking over $1 million in tokens. About $600,000 was later frozen at centralized exchanges.
Tim BeikoUndisclosed
Ethereum developer Tim Beiko’s Twitter account was compromised and used to post fake airdrop offers linking to a phishing site. Users were warned not to click the links; no stolen funds were reported.
BALD on BaseDeFi ProtocolBase$23M
The anonymous BALD token deployer removed the liquidity they had supplied on Base, causing the token’s price to crash by about 90%.
Uwerx networkOtherEthereum$327K
The attacker used Uwerx’s 1% token-burn rule and Uniswap pool functions to distort WERX’s price, then traded back to extract ETH for profit.
InsurAceUndisclosed
An unauthorized user breached InsurAce’s Discord server and promoted a phishing website. SlowMist attributed the site to PinkDrainer; no stolen amount was reported.
LeetSwapDeFi ProtocolBase$620K
An externally callable function in LeetSwap’s trading pool let an attacker move most of a pool’s tokens, distort its balance, then trade back for extra ETH. About 342.5 ETH was taken, and the exchange paused trading while investigating.
Neutra FinanceDeFi ProtocolArbitrum$36.5K
An attacker exploited Neutra Finance’s convert function, which valued liquidity-pool tokens using spot prices. Tokens with the same name from different pools could be swapped, letting the attacker profit from their price difference.
GYM NetworkDeFi ProtocolBSC$1.19K
A flaw in GYM Network’s deposit function let an attacker record deposits without transferring tokens. The attacker repeatedly created false deposits of 8 million GYMNET and withdrew the credited balance.
Curve FinanceDeFi ProtocolEthereum$61.7M
A bug in Vyper’s reentrancy locks, which are meant to block repeated contract calls, let attackers drain several Curve pools. Some of the stolen funds were later returned.
Alchemix$35.3M
A Vyper bug let an attacker drain about 5,000 ETH from Curve’s alETH/ETH pool while Alchemix was withdrawing its liquidity. Alchemix said its own contracts were not compromised.
JPEG'd$11.4M
A reentrancy flaw in JPEG’d’s PETH-ETH liquidity pool let the attacker add liquidity during a withdrawal and exploit incorrect price calculations; the NFT vault and treasury were reported safe. The DAO later received 5,494.4 WETH, with 610.6 WETH paid as a white-hat bounty.
Kannagi FinanceDeFi ProtocolzkSync EraEthereum$2.13M
Kannagi Finance’s deployed contracts contained malicious code that drained nearly all value from the protocol, leaving about $0.17 in total value locked. The team then deleted its online presence.
VyperUndisclosed
A reentrancy-prevention bug in certain Vyper compiler versions left multiple Curve liquidity pools vulnerable to exploits. The bug affected versions 0.2.15, 0.2.16, and 0.3.0; the report did not specify the total funds taken.
Pond0xTokenEthereum$2.2M
Pond0x’s directTransfer function lacked authorization checks, allowing anyone to move tokens from other users’ accounts to their own. Traders lost tokens as people exploited the flaw.
DeFiLabs$1.6M
DeFiLabs used a backdoor function in its BSC staking contract to take $1.6 million from users.
AlphapoCEXEthereumTron$60M
Alphapo’s hot-wallet keys were compromised, and attackers drained funds across Ethereum, Tron and Bitcoin. The stolen cryptocurrency was moved between networks, and the total reported loss reached about $60 million.
CarsonDeFi ProtocolBSC$150K
An attacker used flash loans to manipulate Carson token prices on BSC, repeatedly trading to create a temporary price imbalance and extract value. About $145,000 was lost; the attacker exchanged the assets for BNB and sent them to Tornado Cash.
EralendDeFi ProtocolzkSync Era$3.4M
A read-only reentrancy flaw let attackers manipulate EraLend’s internal price oracle and drain its USDC pool on zkSync. Loss estimates ranged from about $2.76 million to $3.4 million; other pools were reported unaffected.
MetaLabzDeFi ProtocolBSCUndisclosed
An unprotected emergency withdrawal function in MetaLabz’s token locker let an attacker bypass stake accounting and withdraw tokens. A subsequent liquidity attack brought the total loss to slightly over 400 BNB.
PalmswapDeFi ProtocolBSC$900K
A flaw in Palmswap’s vault pricing let an attacker use flash loans to manipulate the pool’s value and withdraw funds at an inflated rate, taking about $901,000. Palmswap later said 80% had been returned, with the rest kept as a bug bounty.
CoinListUndisclosed
An attacker took over CoinList’s Twitter account and promoted a scam token sale through a malicious website. CoinList shut down the site and investigated the incident; the report does not say that funds were stolen.
CoinsPaidOther$37.3M
Attackers posing as recruiters tricked a CoinsPaid employee into installing malware, gaining access to company systems and wallets and stealing $37.3 million in cryptocurrency. CoinsPaid said customer funds were safe.
Conic FinanceDeFi ProtocolEthereum$300K
A read-only reentrancy flaw let attackers manipulate the price readings used by Conic Finance’s ETH omnipool and drain funds. A separate, unrelated attack on the crvUSD omnipool also generated a profit for the attacker.
Conic FinanceDeFi ProtocolEthereum$3.3M
A flaw involving reentrant price checks in Conic Finance’s Curve pool oracle let attackers manipulate prices and drain its ETH and crvUSD omnipools. The two attacks caused about $4.2 million in losses.
Hayden AdamsUndisclosed
Uniswap founder Hayden Adams’ Twitter account was hacked and used to post links to scam websites. The Uniswap Foundation warned users not to open them; no stolen funds were reported.
UtopiaTokenBSC$119K
A flaw in Utopia’s swap or price-calculation logic let an attacker extract 492 BNB from the BSC token protocol.
FFISTTokenBSC$110K
A flaw in FFIST’s airdrop function let attackers exploit predictable token distributions and imbalances in the liquidity pool. They swapped small amounts of FFIST for disproportionate value, sending the token’s price sharply down.
PleasrDAOUndisclosed
Attackers took over PleasrDAO’s official Twitter account and used it to promote a fake PLEASR token. No stolen funds were reported.
Shell ProtocolUndisclosed
Shell Protocol’s official Twitter account was compromised and used to post false claims about a SHELL token application. Reports linked the takeover to a SIM-card hack affecting the founder’s account as well.
BNODeFi ProtocolBNB Chain$500K
BNO’s emergency withdrawal function did not account for NFT stake records. An attacker deposited NFTs and tokens, withdrew the tokens while bypassing reward checks, and claimed undeserved mining rewards, causing about $500,000 in losses.
APEDAO$7K
An attacker repeatedly transferred APEDAO tokens into the pair contract, then used its skim function to withdraw excess tokens and its godead function to destroy tokens held there. The attack raised the token price and caused about $7,000 in losses.
Ethscriptions.comNFTfiEthereum$2.83K
A flaw in the Ethscriptions.com marketplace contract let users withdraw inscriptions they did not own; about 202 inscriptions were taken from roughly 123 addresses. The Ethscriptions protocol itself was not affected.
WGPT Token$82.5K
WGPT Token suffered a flash-loan attack, causing losses of about $82,500.
PlatypusDeFi ProtocolAvalanche$50K
A flaw in Platypus’s liquidity conversion logic treated USDC and USDC.e as having the same value, despite price differences between them. This let traders deposit one token and withdraw more value in another, extracting about $50,000.
KleverUndisclosed
Wallets imported into Klever K5 were affected because they had been created with an old, weak random-number generator, making their recovery phrases easier to predict. The report did not specify how much, if any, was taken.
LibertiVault$450K
A reentrancy flaw in LibertiVault’s deposit function let attackers repeatedly call it before balances were updated, leading the contract to issue excess tokens. Funds worth more than $450,000 were taken across Polygon and Ethereum.
LibertifyDeFi ProtocolEthereumPolygon$230
A reentrancy flaw in LibertiVault’s deposit function let attackers call the function again before the contract updated its share totals, creating excess shares and allowing them to claim inflated rewards. They used flash loans to fund the attack.
Arcadia FinanceDeFi ProtocolEthereumOptimism$455K
An attacker used a malicious contract and reentered Arcadia’s liquidation process, bypassing a collateral check to withdraw liquidity-pool tokens on Ethereum and Optimism. The reported loss was about $400,000 to $460,000.
CivFundDeFi ProtocolEthereum$180K
An attacker used a callback function in CivFund’s Ethereum contract to transfer funds that users had approved for the contract, then sent them to Uniswap to sell. The attack caused about $180,000 in losses.
