Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
CIVNFTDeFi ProtocolEthereum$180K
CIVNFT’s fund-transfer functions had no access controls, allowing an attacker to trigger callbacks that sent CIV and USDT to Uniswap, where the tokens were sold.
MultichainDeFi ProtocolBridgeMoonriverBSCFantom$126M
About $126 million in assets were withdrawn from Multichain bridge reserves on Fantom, Moonriver and Dogechain. The team said it did not know what had happened and urged users to stop using the service.
Gutter Cat Gang$800K
Attackers took over Gutter Cat Gang’s and its co-founders’ Twitter accounts to promote a fake NFT airdrop. Users who approved the malicious contract had their wallets drained; stolen NFTs were estimated to be worth $750,000 to $900,000.
Aptos FoundationUndisclosed
Hackers took over the Aptos Foundation’s Twitter account and used it to direct people to a fake airdrop website.
Bryan PellegrinoUndisclosed
LayerZero CEO Bryan Pellegrino’s Twitter account was stolen. No funds taken were reported.
MIKE & SID$171K
A backdoor function in the MIKE and SID token contracts allowed unlimited token minting. The attacker profited 87.9 ETH.
Rodeo FinanceDeFi ProtocolArbitrum$90K
Rodeo Finance was exploited through a flaw in its reserve-minting logic and later through manipulation of its price oracle, a source of asset prices. The attacks caused about $1.7 million in losses, of which about $816,000 was recovered as unshETH.
AzukiDaoDeFi ProtocolEthereum$68K
AzukiDAO’s token-claim contract failed to check whether a signature had already been used, letting an attacker replay one valid signature to claim BEAN tokens repeatedly. About 1.79 million tokens were stolen, and the claim contract was suspended.
NFT TraderUndisclosed
NFT Trader’s website was reportedly altered with malicious code on its front end, the part users see and interact with. The site was taken offline while the team investigated; no stolen funds were reported.
Poly NetworkDeFi ProtocolBridgeEthereumBSCPolygon$5M
Attackers forged Relay Chain block headers and validator signatures to create cross-chain transactions across 11 blockchains, minting tokens and taking over $10 million in mainstream assets. Limited liquidity and a Tether freeze of $33 million in USDT restricted further cash-outs.
Aave fork$930K
An attacker gained control of an Aave fork’s governance on Pulse chain by buying tokens, then used that authority to target contracts holding users’ authorized tokens. They moved the stolen assets through a bridge and made about 483 ETH.
BiswapDeFi ProtocolBNB Chain$72K
A flaw in Biswap’s liquidity migration contract let an attacker exploit users’ approvals of their liquidity-provider tokens and steal funds. Biswap said its V2 and V3 pool assets were safe.
Manta NetworkUndisclosed
Manta Network’s Twitter account was stolen and used to post fake airdrop offers. The account was later restored.
ThemisDeFi ProtocolArbitrum$370K
Attackers used flash loans—temporary borrowed funds—to distort the price of pool tokens used as collateral, then borrowed assets against the inflated value. The attack drained about 317 WETH from the lending protocol.
Entangle ProtocolUndisclosed
Entangle Protocol’s Discord account was hacked.
ZigZagUndisclosed
ZigZag’s Discord account was hacked, and users were warned not to follow fake airdrop links. No stolen funds were reported.
ShidoDeFi ProtocolBNB Chain$239K
A configuration error in Shido on BNB Chain led to the loss of about 976 BNB. The attacker moved the funds through Tornado Cash and bridged some to Ethereum.
AstariaUndisclosed
A flaw in Astaria’s BeaconProxy code let an attacker point the contract to malicious code that could destroy it. Astaria paused new loans and used a recovery script to move users’ funds and NFTs to multisignature wallets; no assets were reported missing.
SlingshotUndisclosed
Scammers took control of Slingshot’s Twitter account and used it to post links to fake websites promoting a supposed token airdrop. The report did not say that funds were stolen.
AraDeFi ProtocolBSC$125K
An attacker used a flash loan, a loan borrowed and repaid in one transaction, against Ara Finance’s swap contract, which lacked access controls and had broad token approvals. The attacker stole cryptocurrency worth about $124,000.
PawnfiDeFi ProtocolEthereum$820K
Pawnfi’s ApeStaking contract failed to verify NFT transfers, letting an attacker use the same staked NFT as collateral repeatedly and borrow APE tokens without providing proper collateral.
Midas CapitalDeFi ProtocolBSC$340K
A rounding error in Midas Capital’s lending protocol let an attacker use tiny deposits and borrowed collateral to withdraw far more than they were entitled to. The HAY/BUSD pool lost more than $600,000.
HashflowDeFi ProtocolEthereumArbitrumAvalanche+2 chains$605K
A vulnerable Hashflow contract function let attackers transfer tokens from users who had approved the contract, across five chains. The attacker later provided a way to recover the funds, and affected users retrieved their assets.
DEP/USDT, LEV/USDC$106K
The DEP/USDT and LEV/USDC pools were drained of stablecoins. The report lists 36,000 USDC and 69,960,000 USDT as stolen.
HyperliquidDeFi ProtocolArbitrum$37K
The attacker manipulated SNX prices on centralized exchanges and exploited Hyperliquid’s vault system, which relied on those spot prices, by trading against the inflated price.
CFCDeFi ProtocolBSC$16K
An attacker repeatedly sent tokens to CFC’s trading pool and triggered a function that burned tokens, manipulating the pool’s token supply and balances. They used the imbalance to extract value; the amount was not reported.
Move VMUndisclosed
A stack overflow flaw in Move VM allowed deeply nested recursive calls, which could shut down a network or prevent new validators from joining. The issue was reported as a vulnerability; no attack or stolen funds were described.
Tropykus RSKDeFi ProtocolRootstock$150K
A rounding error in Tropykus RSK’s redemption counter affected interest calculations and was exploited, causing losses of about $150,000.
SturdyDeFi ProtocolEthereum$775K
A flash-loan-funded reentrancy attack manipulated Balancer pool prices used by Sturdy Finance’s lending protocol, allowing the attacker to drain about $800,000. The stolen funds included 442.6 ETH later sent to Tornado Cash.
Keep3r NetworkDeFi ProtocolEthereum$200K
An attacker compromised Keep3r Network’s governor private key, reset pool governors, then used a reentrancy attack—a way to repeatedly call a contract before an earlier action finishes—to take about 4,084 KP3R.
FPG$20M
Floating Point Group suffered a cyberattack that resulted in a reported loss of $15 million to $20 million in cryptocurrency. The company froze third-party accounts and took protective measures for its wallets.
Floating Point GroupCEX$15M
Attackers gained unauthorized access to Floating Point Group’s systems and took cryptocurrency from custody accounts. The company froze third-party accounts and moved funds to secure wallets.
TrustTheTrident$95K
TrustTheTrident’s $SELLC contract was attacked, causing approximately $95,000 in losses. The attack method was not reported.
Ben ArmstrongUndisclosed
Hackers took over Ben Armstrong’s Twitter account and used it to promote a scam aimed at stealing users’ NFT assets.
Atlantis LoansDeFi ProtocolBSC$2.5M
An attacker passed a malicious governance proposal to gain control of Atlantis Loans’ contract, then added a backdoor to transfer assets from users who had approved the contract. The losses were about $1 million.
FranklinUndisclosed
Franklin said his Twitter account had been taken over and warned that posts from the morning of June 9 were not his. The report did not mention stolen funds.
ArbitrumUndisclosed
A bug in Arbitrum’s sequencer temporarily stopped batches of transactions from being submitted to the main chain, preventing those transactions from being confirmed there. The bug was fixed and batch submissions resumed.
XverseUndisclosed
A bug left Xverse wallet helper words unencrypted on users’ devices. Xverse fixed it and said the issue did not affect its iOS or Android apps; no funds were reported stolen.
ColeUndisclosed
The Twitter account of Cole, co-founder of Pudgy Penguins, appeared to be compromised, with reports linking the incident to the PinkDrainer group.
AtomicWalletEthereumTronBSC+3 chains$100M
Atomic Wallet users lost funds after the wallet application was compromised. Reports described about 5,500 affected wallets, but the cause had not been officially confirmed.
