Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
REI NetworkUndisclosed
REI Network’s official Twitter account was hacked and posted airdrop-related information. The network warned users not to trust the airdrop claims.
DEUS FinanceDeFi ProtocolArbitrumBSCEthereum$6.5M
A parameter-ordering error in DEI’s burn function let an attacker misuse token approvals and steal about $6.5 million across several networks. DEI’s price fell by more than 80%.
Neverfall protocol$75K
Neverfall protocol was hacked, and attackers deposited the stolen funds into Tornado Cash.
Daniel AlegreUndisclosed
Hackers took control of Yuga Labs CEO Daniel Alegre’s Twitter account. Yuga Labs warned users about minting links and accounts impersonating him; no stolen funds were reported.
pcashDeFi ProtocolEOS$2M
An attacker drained liquidity from pcash’s main swap contract on EOS, taking about 2 million EOS tokens. The team covered users’ losses, and significant funds were recovered through actions by EOS EVM administrators.
LEVEL FinanceDeFi ProtocolBSC$1.1M
Attackers exploited the referral rewards contract’s failure to prevent repeated claims in the same reward period, using flash loans to inflate reward levels. They stole about $1.1 million in referral rewards.
0VIXDeFi ProtocolPolygon$2M
The attacker used a flash loan to manipulate the price data used by 0VIX, making collateral appear more valuable and triggering liquidations. The exploit caused about $2 million in losses; some funds were sent to Tornado Cash, and the protocol was suspended.
Merlin DEXDeFi ProtocolzkSync Era$1.82M
An attacker used the feeTo address in Merlin DEX’s factory contract, which had unrestricted transfer permissions and no multisignature control, to drain about $1.82 million from liquidity pools.
KucoinCEX$22.6K
Scammers took over KuCoin’s Twitter account and used it to promote a fake giveaway, leading users to send BTC and ETH to a fraudulent address. KuCoin said it would reimburse verified losses.
UniSat MarketplaceUndisclosed
A code flaw in the newly launched UniSat Marketplace enabled double-spend attacks, in which the same funds could be spent more than once. Of 383 transactions, 70 were identified as affected, and UniSat said it would investigate and compensate users for losses.
FilDADeFi ProtocolElastosREI Network$700K
Attackers exploited old, zero-balance lending markets on Elastos and REI, manipulating deposit and borrowing operations through FilDA’s bridging mechanism. About $700,000 was lost; other FilDA deployments were unaffected.
MEV Bot$1.4M
The MEV bot jaredfromsubway.eth used sandwich attacks—placing transactions before and after users’ trades to profit from price changes—on buyers and sellers of meme coins, earning more than $1.4 million.
Tales of ElleriaGamingArbitrum$280K
An attacker forged signatures for Tales of Elleria’s Arbitrum bridge, a system for moving assets between networks, and minted 5 billion ELM tokens. They took about 140 ETH from the linked liquidity pool before the project froze operations.
zkLinkUndisclosed
zkLink’s Discord server was compromised, and attackers posted phishing links. The incident report does not mention any funds being stolen.
KyberSwapUndisclosed
KyberSwap found a potential vulnerability in KyberSwap Elastic and urged liquidity providers to withdraw their funds. No user assets had been lost at the time.
Swapos V2DeFi ProtocolEthereum$468K
A broken pricing rule in Swapos V2’s swap pool let attackers manipulate trades and drain about $468,000 from the protocol.
Hundred FinanceDeFi ProtocolOptimism$7.4M
The attacker used a flash loan to donate WBTC to an empty Hundred Finance pool, distorting its exchange rate through rounding errors. This let a tiny amount of hWBTC drain funds from the lending pools.
BitrueCEX$23M
Attackers compromised a Bitrue hot wallet and withdrew about $23 million in ETH, QNT, GALA, SHIB, HOT and MATIC. The exchange said it stopped further withdrawals from the wallet and would compensate affected users.
Yearn FinanceDeFi ProtocolEthereum$11.5M
A misconfigured oracle reference in Yearn’s yUSDT vault pointed to a USDC contract, letting an attacker distort share prices and mint far more yUSDT than their deposit warranted. They sold the tokens for about $11.5 million.
MetaPointDeFi ProtocolBSC$820K
A public approval function in MetaPoint deposit contracts let attackers authorize transfers of users’ tokens and drain their deposits. The loss was about $920,000.
ParibusDeFi ProtocolArbitrum$67.8K
An attacker exploited a reentrancy flaw in Paribus’s Compound V2-based lending contracts, using flash loans to borrow against the same collateral twice. The attack drained USDT, WBTC, and ETH, with reported losses of about $100,000.
TerraportDeFi ProtocolTerra Classic$4M
An access-control flaw let the attacker manipulate DND token pricing and drain Terraport’s liquidity pools. LUNC, USTC and TERRA tokens were taken.
SushiSwapDeFi ProtocolEthereumArbitrumOptimism+1 chains$3.3M returned$3.3M
SushiSwap’s RouteProcessor2 contract failed to check swap-route details, letting an attacker direct trades through pools they controlled and steal about $3.3 million across several networks. About 885 ETH was later refunded.
GDACCEX$13.9M
Attackers accessed GDAC’s hot wallet and transferred about $13 million in BTC, ETH, WEMIX and USDT to an unidentified wallet. The stolen ETH was later laundered through Tornado Cash.
SentimentDeFi ProtocolArbitrum$900K returned$1M
A read-only reentrancy flaw involving Balancer, combined with flash-loan price manipulation, let an attacker drain about $966,000 from Sentiment on Arbitrum. Sentiment later recovered more than $900,000, with about $95,000 left as a reward for the attacker.
MEV Bots$25M
A flaw in a block relay let an attacker view transaction contents before a block was finalized, then construct an invalid block to target MEV bots—automated traders that seek profit from transaction ordering. The bots lost about $25 million.
MEV-Boost RelayOtherEthereum$20M
A flaw in MEV-Boost Relay let a malicious validator submit an invalid block header and view block contents, then replace MEV bot transactions with its own. The attacker took about $20 million across 24 transactions.
AllbridgeDeFi ProtocolBridgeBSC$573K
An attacker acted as both a liquidity provider and trader on Allbridge’s BNB Chain pools, manipulating swap prices to drain BUSD and USDT. The owner of one attack address later returned 1,500 BNB, with the rest treated as a bounty.
zkSyncUndisclosed
zkSync stopped producing blocks after a failure in its block-queue database. Its API remained available, and transactions continued entering the queue, but block generation was halted.
Degen ZooUndisclosed
Degen Zoo suspended its game and began investigating a suspected hack involving Binance Oracle. The team had not identified a vulnerability or confirmed how funds were affected.
Patricio Worthalter$3.83M
A phishing attack on POAP founder Patricio Worthalter’s address led to the transfer of 85,898 RPL to decentralized exchanges, where the tokens were sold for 1,802 ETH.
Rocket PoolTokenEthereum$3.8M
A phishing attack tricked a major Rocket Pool token holder into losing 85,900 RPL tokens. The attacker exchanged them for ETH and spread the proceeds across multiple addresses.
SafemoonDeFi ProtocolBSC$8.9M
A publicly accessible token-burning function let the attacker destroy SFM tokens, inflate their price and withdraw excess BNB from SafeMoon’s liquidity pool. The attacker later returned 80% of the funds and kept the remainder as a claimed bug bounty.
Kokomo FinanceDeFi ProtocolOptimism$4M
Kokomo Finance developers carried out an exit scam, changing the cBTC reward token contract to a malicious version and halting borrowing before taking about $4 million in user funds. The project then removed its website and social media.
Swerve FinanceDeFi ProtocolEthereum$1.3M
An attacker tried to use Swerve Finance governance proposals to transfer $1.3 million in stablecoins to their own contract. The attempt failed because they lacked enough voting power.
FASTSWAPUndisclosed
FASTSWAP on BNB Chain was attacked using a flash loan, and lost 26.77 BNB.
Archive of PEACEMINUSONEUndisclosed
The Archive of PEACEMINUSONE NFT series was reported to contain a previously known software vulnerability that might be exploitable. No attack or loss was confirmed.
Circle's Chief Strategy OfficerUndisclosed
A scammer took over the Twitter account of Circle’s chief strategy officer and used it to promote a fake USDC rewards offer. The tweet was deleted, and Circle said it was investigating.
Indexed FinanceDeFi ProtocolEthereum$9.93K
An error in the ORCL5 token’s calculation of output amounts let an attacker use a flash loan to drain approximately $9,925 from Indexed Finance.
Harvest Keeper$933K
Harvest Keeper’s owner authority was used to move users’ pledged USDT out of its contract, while users’ token approvals also enabled repeated transfers from their accounts. About $933,000 was taken.
