Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
HarvestDeFi ProtocolEthereum$933K
Reports said Harvest’s USDC, USDT, and WETH vaults were affected, but gave different accounts of what happened. Harvest warned users not to interact with the affected vaults while the issue was unresolved.
Zircon GammaDeFi ProtocolBSCMoonriver$350K
Attackers manipulated Zircon’s pools on Moonriver and BSC by donating tokens to inflate reserves, then withdrew shares using faulty calculations. The exploit drained about $350,000.
ParaSpaceNFTfiEthereum$5M returned$5M
A price manipulation flaw in ParaSpace’s AutoCompoundApe contract could have let an attacker borrow against too little NFT collateral. BlockSec stopped the attack and recovered about 2,900 ETH worth of BAYC NFTs; ParaSpace said no NFTs were lost and losses were minimal.
General BytesOtherEthereum$1.5M
Attackers exploited a flaw in General Bytes’ ATM cloud service to run malicious software, access server data and hot-wallet withdrawal keys, and steal user credentials. Cryptocurrency was taken from hot wallets.
Poolz FinanceDeFi ProtocolBSC$390K
An integer overflow—a calculation error— in Poolz’s LockedDeal contract let an attacker exploit its pool-creation function and obtain tokens after depositing very little. The stolen assets included POOLZ and other tokens.
Idle Finance$11M
Euler Finance’s attack exposed Idle Finance’s Yield Tranches and Best Yield vaults to losses; the reported exposure across both was about $11 million.
Sherlock$4.5M
After Euler Finance was attacked, Sherlock—Euler’s auditor and insurance partner—approved a payment of $4.5 million to Euler.
Yield Protocol$1.5M
Yield Protocol said the Euler attack affected its mainnet liquidity pool, which held Euler eTokens and Yield fyTokens; borrower collateral held by Yield was reported safe. Yield later claimed recovered funds from Euler and held them in a timelock, a delay-controlled contract.
Yearn Finance$1.38M
Some Yearn vaults were indirectly exposed to the Euler Finance hack through Idle and Angle strategies, affecting yvUSDT and yvUSDC. Yearn later said all the affected funds had been recovered.
Sense FinanceUndisclosed
Sense Finance was indirectly affected by the Euler Finance attack. No specific loss or impact on Sense Finance was reported.
Euler FinanceDeFi ProtocolEthereum$240M returned$197M
An attacker used flash loans and a flaw in Euler’s reserve-donation and liquidation logic to drain DAI, USDC, stETH, and WBTC. The attacker later returned all the stolen funds.
Angle Protocol$17.6M
Angle Protocol was affected because it had deposited 17.6 million USDC into Euler. It suspended the protocol, set its debt ceiling to zero, and closed its Euler AMO; the report does not state how much of the deposit was lost.
Balancer$11.9M
During the Euler Finance attack, about $11.9 million from Balancer’s bbeUSD liquidity pool was sent to Euler, representing roughly 65% of that pool’s value. Four other pools containing bbeUSD were also affected.
SwissBorg$4.5M
SwissBorg’s Earn strategy suffered partial losses in ETH and USDT due to the Euler Finance attack. SwissBorg said it would cover the losses.
Inverse Finance$860K
The Euler attack affected Inverse Finance’s DOLA pool on Balancer. Inverse said it quickly reduced most of the impact, but the pool still suffered losses and the team planned to work with Balancer to recover the remaining funds.
OpynUndisclosed
Opyn’s Zen Bull strategy was exposed to losses from the Euler Finance attack because it may have used Euler for loans backed by collateral. Opyn had not disclosed the loss amount or its response.
HederaDeFi ProtocolHedera$600K
A bug in Hedera’s token service let an attacker impersonate accounts used by liquidity pools on several decentralized exchanges and transfer their tokens. About $600,000 was drained before Hedera halted the network; bridge operators also disabled transfers to prevent further losses.
PeopleDAODAOEthereum$120K
An attacker edited a shared Google Sheets payment form to add a hidden fraudulent payment, which PeopleDAO’s multisig signers approved when distributing contributor rewards. About 76 ETH was stolen, and the funds were later traced to HitBTC and Binance.
DKPTokenBSC$80K
The attacker used a flash loan to manipulate DKP’s price by exploiting an oracle that relied on the USDT-DKP pair’s ratio, then profited through trading.
Tender.fiDeFi ProtocolArbitrum$1.59M
Tender.fi’s misconfigured GMX price feed let an attacker borrow crypto using just one GMX token as collateral. The attacker returned the funds, and Tender.fi agreed to pay a bounty.
ArbiSwapDeFi ProtocolArbitrum$100K
ArbiSwap’s team used admin functions to drain 85 ETH and more than $112,000 in tokens after promoting a fake high-yield staking scheme. The report describes this as a rug pull.
iTokenUndisclosed
Former employees reportedly installed a backdoor in cryptocurrency wallet software to obtain users’ recovery phrases and private keys. More than 27,000 recovery phrases and 10,000 private keys were obtained, and users’ wallet credentials were leaked.
MyAlgoWalletAlgorand$9.2M
MyAlgo users with large balances lost funds from accounts whose keys were stored in browser-based mnemonic wallets. The cause was unclear, with a website compromise or phishing cited as possibilities; ChangeNow froze some funds.
swapXDeFi ProtocolBSC$1M
A missing access check in swapX’s contract let an attacker repeatedly manipulate DND token prices and drain funds from user wallets that had approved the contract.
DungeonSwapDeFi ProtocolBSC$728K
An attacker abused weak access controls in DungeonSwap and Launch Zone’s implementation contracts to manipulate DND token pricing and drain liquidity pools. More than 2,400 BNB, worth about $728,000, was stolen.
LaunchZoneDeFi ProtocolBSC$700K
A missing access check in LaunchZone’s Bscex SwapX contract let the attacker make unauthorized token transfers from liquidity pools and manipulate LZ’s price. About 80% of the pool’s funds were drained.
HideYoApes$208K
HideYoApes reported a phishing incident, after which an attacker sold the holder’s Yuga Labs NFTs, including a Bored Ape and related collectibles, for 127.3 wETH.
The SandboxUndisclosed
An attacker accessed a Sandbox employee’s computer and used the account to send a fake email containing links to malware that could take control of recipients’ computers and access personal information. The employee’s access was disabled, and no further impact was identified.
SolanaUndisclosed
A fork in the Solana network sharply reduced its transaction capacity, preventing users from carrying out on-chain transactions and transfers.
Earning.farm$5.15M
Earning.farm’s USDC vault was exploited, losing about 5.15 million USDC. The report does not give details of how the attack worked.
DexibleDeFi ProtocolEthereumArbitrum$2.05M
A flaw in Dexible V2’s selfSwap function let an attacker make unauthorized token transfers from wallets that had approved Dexible, draining 17 users’ accounts on Ethereum and Arbitrum.
Hope FinanceDeFi ProtocolArbitrum$2M
Someone modified Hope Finance’s TradingHelper contract to redirect GenesisRewardPool funds to an attacker’s address, stealing about $2 million. About $1.86 million was later laundered through Tornado Cash.
Revert FinanceDeFi ProtocolEthereum$29K
An access-control flaw in Revert Finance’s V3Utils contract let attackers make unauthorized contract calls and transfer users’ approved tokens. The team deployed a refund bot to recover the affected users’ funds.
BABYDOLL$7.9K
The Baby Doll project was hit by a flash-loan attack, and the attacker took 25 BNB.
Block Tower Capital$1.5M
A flaw in Dexible’s smart contracts let attackers withdraw tokens that users had approved for spending. Block Tower Capital was among the victims, losing about $1.5 million in TRU tokens, which the attackers exchanged for ETH and sent through Tornado Cash.
PlatypusDeFi ProtocolAvalanche$223K returned$8.5M
An attacker used a flash loan to exploit Platypus Finance’s solvency check, which compares assets with liabilities, and withdraw funds they were not entitled to. The reported loss was about $8.5 million, and at least $2.4 million was later recovered.
MultichainDeFi ProtocolBridgeEthereum$130K
An attacker exploited missing signature checks in Multichain’s permit-based transfer process, front-running a user’s transaction to move WETH from the router contract. About 87 ETH was taken.
NamecheapUndisclosed
Hackers compromised Namecheap’s email account and used it to send phishing emails posing as MetaMask and DHL. A fake MetaMask page sought users’ seed phrases or private keys to steal wallet assets.
fcdep(EPMAX)DeFi ProtocolBSC$350K
The attacker used a flash loan and faulty balance accounting to manipulate token balances and extract funds from the fcdep (EPMAX) protocol.
OneKeyUndisclosed
A security researcher demonstrated that a weakness in the OneKey Mini hardware wallet could expose its recovery phrase, which can restore access to a wallet. OneKey said it patched the flaw and that no users were affected.
