Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Hector LendingDeFi ProtocolBridgeFantom$653K
An unlimited USDC approval on Hector Lending’s beta bridge contract was exploited to drain about 650,000 USDC. The network later voted to liquidate $16 million from its treasury.
CosmWasmUndisclosed
A stack overflow bug in CosmWasm could stop new smart contracts from functioning on Cosmos-based blockchains. The report describes a vulnerability, not a theft or confirmed disruption.
DD Coin$126K
DD Coin was attacked and lost about 126,000 USDT.
Cellframe NetworkDeFi ProtocolBSC$76.1K
A flash-loan attack exploited calculation errors during Cellframe’s liquidity migration, manipulating pools and extracting value through a new CELL-BUSD pool. The attacker made about 245 BNB, and CELL’s price fell sharply.
unshETHDeFi ProtocolEthereum$375K
A developer’s leaked deployment key let an attacker take ownership of unshETH contracts and drain about $375,000 from the staking protocol. Withdrawals were paused, and the keys were secured; ETH deposits were protected by multisignature controls and a time lock.
Sashimi Swap$3.5K
A bot used a flash loan to attack Sashimi Swap’s investment and slETH contracts, taking the small amounts left in them—about $3,500 in total.
EDE$580K
El Dorado Exchange was reportedly exploited through its Arbitrum pool, with losses estimated at about $580,000. The attacker returned more than $400,000, reportedly keeping a 10% fee; the attacker alleged the protocol had a backdoor that enabled forced liquidations.
El Dorado ExchangeDeFi ProtocolArbitrum$120K
An attacker manipulated prices through a vulnerable El Dorado Exchange oracle, a service that supplies price data, and liquidated positions. The attacker returned more than $400,000 after the team acknowledged code vulnerabilities.
TRONUndisclosed
A vulnerability in TRON’s multisignature accounts could have put assets at risk, depending on the account’s signer settings. The flaw was disclosed and fixed before any user assets were reported at risk.
AleoUndisclosed
A contributor found an inflation flaw in the Aleo network and used it to halt block production, then contacted the team. Aleo fixed the bug.
Polygon zkEVMUndisclosed
Flaws in Polygon zkEVM’s deposit-claim processing could let attackers overload network operators or block legitimate claims, making the network unusable for new users. The team fixed the bugs; no funds were at risk.
Jimbos ProtocolDeFi ProtocolArbitrum$7.5M
An attacker used a flash loan to distort JIMBO’s price and exploit liquidity operations that lacked protection against unfavorable trades. The attack took about 4,090 ETH from the protocol.
PatriciaCEX$2M
Hackers compromised Patricia’s retail trading app and took Bitcoin and naira assets. The company said other cryptocurrency balances and customer and merchant assets were unaffected.
Arthur MadridUndisclosed
Hackers took over The Sandbox CEO Arthur Madrid’s Twitter account and posted a phishing link advertising a fake SAND token airdrop.
MultichainUndisclosed
Some Multichain cross-chain routes became unavailable, and users reported delays in receiving funds from transfers. Multichain said pending transactions would be credited when service resumed and promised compensation; the report did not describe a theft.
TrezorUndisclosed
Unciphered demonstrated that physical access and specialized equipment could exploit a Trezor Model T vulnerability to extract its recovery phrase, which can restore access to a wallet. Trezor said a strong passphrase can prevent the attack from working.
CS Token$714K
An attacker stole 714,000 USDT from CS Token. The attacker later moved funds through Tornado Cash.
Local TradersDeFi ProtocolBSC$118K
An attacker called a function with no access protection to take ownership of the Local Traders contract, then manipulated token prices to buy LCT cheaply and resell it. The report did not state the amount taken.
Celer NetworkUndisclosed
A flaw in Celer Network’s State Guardian Network could have let a malicious validator submit many fake votes and change network state. Celer patched it before it was publicly accessible; no funds were lost.
LunaFiDeFi ProtocolPolygon$35K
A flaw in LunaFi’s reward-claiming logic let an attacker deposit, claim rewards and withdraw in one transaction, repeatedly draining the reward pool. The attack used a malicious contract.
Tornado CashDAOEthereum$2.17M
A malicious Tornado Cash governance proposal gave its attacker enough voting power to take control of governance. The attacker withdrew 483,000 TORN from governance vaults and later proposed reversing the attack.
Swap-LPDeFi ProtocolBSC$1.1M
A flaw in Swap-LP’s factory contract let an attacker manipulate liquidity pools and drain value, taking about $1.1 million. The stolen funds were transferred to Tornado Cash.
AaveUndisclosed
A contract incompatibility on Polygon left about $110 million in Aave V2 assets temporarily unable to be withdrawn, borrowed, or repaid. Funds were not at risk, and a fix was submitted for a vote.
SwaprumDeFi ProtocolArbitrum$3M
Swaprum’s founders used a backdoor function in the smart contract to take users’ deposited liquidity-pool tokens. The stolen funds were laundered through Tornado Cash.
WDZD SwapDeFi ProtocolBinance Smart Chain$1M
An access-control flaw let an attacker move WDZD tokens from trading pairs to the factory contract, distorting the token’s value and enabling trades for LP tokens at favorable rates. Burning those tokens brought in about 609 ETH.
StacksUndisclosed
A report highlighted recurring problems on Stacks, including issues with its STX stacking mechanism and more frequent block reorganizations, in which the chain’s recent transaction history is changed.
MirrorUndisclosed
Mirror’s publishing app was unavailable because it was experiencing heavy load. No funds were reported stolen.
EOS EVMUndisclosed
EOS EVM released an update to fix a serious security vulnerability. The upgrade was required for EOS EVM contracts, network nodes and RPC components; no stolen funds were reported.
OpenSeaUndisclosed
A reported OpenSea royalty-setting issue appeared to prevent NFT projects from setting or changing royalties after a change to how ownership was identified. No theft or financial loss was reported.
land$150K
The DeFi protocol land was reportedly attacked because its contract did not restrict who could mint tokens. The incident caused losses of about $150,000.
LW TokenDeFi ProtocolBinance Smart Chain$50K
An attacker used a flash loan to distort the LW token’s price in a PancakeSwap trading pair, then extracted about 48,415 USDT. The token’s price fell sharply after the exploit.
LW$48.4K
The LW token on BSC was attacked, causing a loss of 48,415 USDT and a sharp drop in its price. The attackers later sent about 150 BNB to Tornado Cash.
SNK (Snooker)DeFi ProtocolBinance Smart Chain$198K
The attacker used SNKMiner’s referral function to link multiple contracts and inflate staking rewards based on linked accounts’ SNK balances, then claimed the excess rewards.
SNK$190K
The attacker exploited SNK’s invitation-reward system to generate rewards and make a profit.
FLOKI$50K
FLOKI suffered a flash-loan attack that caused losses of more than $50,000.
WEEBUndisclosed
An attacker used WEEB’s performUpkeep function to burn tokens held in a trading pair, pushing up WEEB’s price and making a profit of 16 ETH.
MChainCapital$18.9K
MChainCapital suffered a flash loan attack, a temporary loan used within one transaction to exploit a contract, losing about $18,871.
Art CoinDeFi ProtocolEthereum$331K
A misconfigured Art Coin presale and Uniswap V3 liquidity pool let an attacker buy ART cheaply and sell it at a favorable rate, extracting 181 ETH from the pool.
DEI$6.3M
A bug in DEI’s token contract allowed attackers to destroy tokens improperly, causing losses across Arbitrum and BSC. The attackers later returned about 1.07 million DAI and 2,023 ETH, according to the reports.
MeloDeFi ProtocolBinance Smart Chain$90K
An access-control flaw in Melo’s BSC protocol let an attacker use sensitive functions without authorization and drain about $90,000 from user accounts.
