Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
dForceDeFi ProtocolArbitrumOptimism$3.65M
A read-only reentrancy flaw in dForce’s Curve vaults on Arbitrum and Optimism let the attacker manipulate a pool’s displayed price during withdrawals and liquidate users’ wstETH/ETH positions. The attacker returned the funds, and dForce said affected users would be compensated.
SushiSwap$26K
A delayed Chainlink price update in SushiSwap’s Kashi lending system created a mismatch between the collateral and loan prices. The attacker used the gap to liquidate positions and take USDT.
SheepTokenBSC$3K
An attacker repeatedly used the SHEEP token’s burn function and synchronized its trading pair, manipulating its reflection accounting and extracting about $3,000.
LianGoPayDeFi ProtocolBSC$1.6M
A compromised administrator created a fake staking pool on BNB Chain, and users were tricked into depositing tokens there. The attacker obtained and sold about 6.15 million LGT reward tokens, causing losses of about $1.6 million.
CoWSwapDeFi ProtocolEthereum$180K
A flaw in CoW Swap’s SwapGuard contract allowed an attacker to make unauthorized calls, approve a malicious contract, and transfer DAI from the settlement contract.
SperaxUSDTokenArbitrum$250K
A flaw in SperaxUSD’s balance calculation let an attacker mint 9.7 billion unbacked USDs after sending tokens to a precomputed Safe address. The attacker exchanged about $250,000 before the contract was paused.
Orion ProtocolDeFi ProtocolBSC$3M
A reentrancy flaw in Orion Protocol’s swap logic let the attacker use a fake token to interfere with deposit handling and extract assets. The loss was contained to an internal broker account; Orion said user funds were safe.
BonqDAO & AllianceBlockDeFi ProtocolPolygon$1.8M
BonqDAO’s oracle accepted an attacker-submitted collateral price without safeguards, allowing the attacker to mint BEUR and trigger liquidations of other users’ positions. The attack created large nominal losses, but the attacker realized only a small portion because the stolen tokens were difficult to sell.
BEVOTokenBSC$45K
An attacker used a flash loan and BEVO’s deliver function to manipulate its deflationary balance calculations, then used the pair’s skim function to take the extra tokens. The attack brought about $45,000 in profit.
AzukiUndisclosed
Azuki’s Twitter account was compromised and used to post fake virtual-land claim links. The team regained control; the report does not mention any funds being taken.
Kevin Rose$1M
A phishing attack tricked Moonbirds founder Kevin Rose into signing a malicious message, allowing the attacker to transfer 25 Chromie Squiggles and other NFTs from his wallet.
RobinhoodCEXBSC$8.2K
Attackers took over Robinhood’s social media accounts and used them to promote a fake BNB Chain token, leading users to buy it. The accounts were reportedly compromised through a third-party vendor.
OmmDeFi ProtocolIcon$1.89M
Omm’s redeem function on Icon accepted collateral addresses without checking whether the caller owned a position in those pools. An attacker used this flaw to withdraw collateral, causing losses of about $1.891 million.
FFF$1.03M
The FFF project administrator used a pre-set contract to issue extra tokens, then sold them and transferred some of the proceeds. More than $1.03 million worth of additional FFF tokens was sold.
Thoreum FinanceDeFi ProtocolBSC$65.5K
A flaw in Thoreum Finance’s token transfer logic let an attacker repeatedly transfer tokens to themselves and inflate their balance. The attacker profited about 2,000–2,260 BNB.
Midas CapitalDeFi ProtocolPolygon$660K
The attacker used a flash loan and a read-only reentrancy flaw involving a recently added collateral token to drain MATIC from Midas Capital’s Jarvis pool on Polygon.
OMNI Real Estate Token$70.7K
A suspected contract-code vulnerability was exploited in the OMNI Real Estate Token project on BSC. The attacker made more than 236 BNB, worth about $57.
OmniEstateDeFi ProtocolBSC$70.7K
A flaw in OmniEstate’s BSC staking pool let an attacker bypass checks by setting the staking duration to zero, then repeatedly withdraw and claim rewards to extract BNB.
LendHubDeFi ProtocolHeco$6M
LendHub’s old and replacement lBSV tokens were both active and priced, creating an accounting flaw across its lending markets. An attacker exploited it to redeem collateral in one market and borrow in another, taking nearly $6 million.
NFT GodUndisclosed
Malware downloaded through a sponsored link gave attackers access to NFT God’s computer, where a wallet recovery phrase had been used online. They stole crypto assets and NFTs and posted fraudulent links through compromised accounts.
RoeFinance$80K
A price manipulation attack emptied a RoeFinance pool, resulting in a loss of about $80,000.
Roe FinanceDeFi ProtocolEthereumPolygon$80K
An attacker used a flash loan to distort a Uniswap pool’s price, which Roe Finance’s oracle failed to check for freshness, then traded against the manipulated price and took funds.
Google ChromeUndisclosed
A Chrome and Chromium browser flaw could let attackers follow a symbolic link—a file-system shortcut—to steal sensitive files, including encrypted wallet files. The report says phishing sites could be used to target victims but does not describe a specific theft.
BRATokenBSC$225K
A flaw in BRA’s transfer tax logic added the tax to trading pools twice, creating excess tokens that could be claimed. An attacker sold the extra BRA for about 820 WBNB.
ChimpersUndisclosed
Chimpers’ official Twitter account was hacked and used to post links to fake websites that lured users into attempting fraudulent NFT mints.
Sui Name ServiceUndisclosed
A former employee attacked Sui Name Service’s Discord server and posed as an administrator. The service said it was restoring users’ role labels.
TwityUndisclosed
Twity said a technician’s Telegram account was compromised, exposing chat records that included project information and a wallet private key. Administrator account details were also exposed; the team said it was investigating, with no specific asset loss reported.
Mycelium$300K
Problems with Mycelium’s ETH-USD price feeds left the MLP pool relying on faulty price data, which arbitrage bots exploited. The team fixed the issue and resumed trading.
CyberKongz$50K
Hackers took over CyberKongz’s official Twitter account, replaced its links with phishing links and posted false mint information. The account was renamed and placed under protection.
GDSDeFi ProtocolBSC$187K
A flash loan—a temporary loan repaid in the same transaction—was used to manipulate GDS’s liquidity-pool mining reward calculation. The attacker withdrew excessive rewards through multiple contracts and kept about $187,000 after repaying the loan.
Nikhil Gopalani$173K
A phisher tricked RTFKT executive Nikhil Gopalani into giving up confidential information, possibly while posing as an Apple representative. He lost more than $173,000 in NFTs and other digital assets.
Luke DashjrUndisclosed
Attackers compromised Bitcoin developer Luke Dashjr’s wallets after bypassing two-factor authentication and stole more than 216 BTC. A leaked PGP key was initially suspected as part of the breach.
JaypeggersDeFi ProtocolEthereum$18.5K
A flaw in Jaypeggers’ buy function let an attacker use a malicious NFT contract to re-enter the sell function and exploit an incorrect price calculation, stealing about 15.32 ETH.
Kevin O’LearyUndisclosed
A hacker took over Kevin O’Leary’s Twitter account and used it to promote a fake Bitcoin and Ethereum giveaway with a link to participate. Twitter removed the posts; no stolen funds were reported.
BitKeep$9M
BitKeep users reported stolen funds after allegedly hijacked APK wallet downloads were installed. The team said multiple chains were affected, with more than $3 million lost on BNB Chain alone.
AmunDeFi ProtocolPolygon$300K
An attacker took control of Amun’s unprotected rebalance manager and shifted its PECO and DFI indices into a worthless token they controlled. They minted a huge supply and sold it on decentralized exchanges, causing losses.
RubicDeFi ProtocolBridgeEthereum$1.41M
A mistake in Rubic’s router whitelist, together with missing input checks, let attackers use existing user approvals to call other contracts and drain USDC directly from users’ wallets. More than $1.4 million was stolen.
LastPassUndisclosed
A hacker accessed LastPass’s cloud storage using information from an earlier incident, stealing source code and technical details. The stolen information was used to target an employee and obtain credentials and keys that could access and decrypt some cloud-stored data.
Defrost FinanceDeFi ProtocolAvalanche$6M returned$12M
Defrost Finance suffered two attacks: a flash-loan price manipulation drained funds from V2, while a compromised V1 admin key enabled fake collateral and oracle prices to drain funds. The stolen funds were later returned.
RaydiumDeFi ProtocolSolana$4.4M
A Trojan horse compromised Raydium pool owners’ private keys, giving the attacker administrator access to withdraw trading fees from liquidity pools. About $4.4 million was taken before Raydium patched the issue.
