Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
LastPass Users$37M
A wallet-draining campaign linked in the report to the prior LastPass hacks has stolen more than $37 million since December 2022. The report does not explain how the wallets were accessed.
NimbusPlatformDeFi ProtocolBSC$76K
An attacker used a 278 BNB flash loan to manipulate the token ratio in NimbusPlatform’s pool, inflating their share of rewards. The flawed calculation awarded more rewards than expected.
FPRDeFi ProtocolBSC$29K
An access-control flaw in FPR allowed unauthorized users to call privileged functions, draining about $29,000 in protocol assets.
ElasticSwapDeFi ProtocolAvalancheEthereum$521K returned$850K
Inconsistent accounting between ElasticSwap’s liquidity-add and liquidity-removal functions let attackers drain funds from pools on Avalanche and Ethereum.
BGLDTokenBSC$18K
An attacker used a flash loan to artificially raise BGLD’s price and then make a profitable swap on PancakeSwap. The report does not state the amount taken.
Polynomial ProtocolUndisclosed
A flaw in Polynomial Protocol’s Optimism deposit contract let anyone use its swap-and-deposit function to make arbitrary external calls and steal tokens approved to the contract.
3CommasCEXMulti-Chain$20M
Attackers breached and leaked 3Commas’ API-key database, then used stolen keys to access users’ connected exchange accounts and make unauthorized trades that drained cryptocurrency.
Lodestar FinanceDeFi ProtocolArbitrum$6.9M
The attacker manipulated the price of plvGLP, a token used as collateral on Lodestar Finance, then used flash loans—temporary loans repaid in the same transaction—to borrow most of the platform’s available liquidity. The protocol lost about $6.5–$6.9 million.
MU&MUGTokenAvalanche$57K
An attacker used a flash loan to artificially raise MU&MUG’s token price on Avalanche, then made profitable swaps that drained about $57,000.
TiFiTokenBSC$43.5K
A flash loan let an attacker temporarily manipulate TIFIToken’s price on BSC, enabling profitable trades on decentralized exchanges.
NOVATokenTokenBSCUndisclosed
NOVAToken’s administrator used privileged access to mint unlimited tokens and drain value from the protocol.
AESTokenBSC$61.6K
The attacker repeatedly sent AES tokens to the AES–USDT pool and called its skim function to take excess tokens. The cycles burned AES and let the attacker turn small token amounts into large USDT payouts.
PayPalUndisclosed
Attackers used stolen or reused username-and-password combinations from other sites to try to access PayPal accounts; PayPal said the incident could have exposed customer information but that no personal information was stolen.
BBOXTokenBSCUndisclosed
An attacker used a flash loan to manipulate BBOX’s price on a decentralized exchange and make profitable trades.
RFBDeFi ProtocolBSCUndisclosed
The attacker exploited RFB’s predictable random-number system, anticipating its results and manipulating the protocol’s outcomes.
BTC.comWalletBitcoinEthereum$3M
Attackers compromised BTC.com’s custodial systems and stole private keys, taking 32.5 BTC and 1,964 ETH. The stolen funds included about $700,000 in customer assets and $2.3 million belonging to the company; some funds were later recovered.
Ratio FinanceDeFi ProtocolSolanaUndisclosed
A developer private key for Ratio Finance was compromised, allowing an attacker to access protocol accounts and drain user collateral. The exact loss was not disclosed.
Helio$19M
After Ankr’s aBNBc token vulnerability, traders used the flaw to obtain BUSD and drain Helio’s Hay liquidity pool. Helio said users’ staked BNB was safe.
AnkrDeFi ProtocolBSC$5M returned$5M
An access-control flaw in Ankr’s aBNBc staking-token contract let an attacker mint a huge number of tokens and convert about $5 million into USDC. Binance froze some funds, and Ankr said it would reimburse affected users.
Overnight FinanceDeFi ProtocolAvalancheUndisclosed
An attacker used a flash loan—a loan borrowed and repaid within one transaction—to exploit Overnight Finance’s protocol logic and drain funds on Avalanche.
APCTokenBSC$6K
An attacker combined a flash loan with price manipulation to inflate APC’s price and profit from swaps.
SEAMANTokenBSC$7K
A business-logic flaw in SEAMAN’s token mechanics allowed attackers to manipulate token flows. The report did not specify the amount taken or what happened to the funds.
MBC & ZZSHTokenBSC$5.9K
Flaws in permission checks and protocol logic let attackers drain funds from the MBC and ZZSH token projects on BSC.
Ahad Shams$4M
A scammer posing as an investor sent Ahad Shams a suspicious NDA and identity documents, then persuaded him to move funds to a new wallet. About $4 million in cryptocurrency disappeared from his Trust Wallet despite him not sharing his recovery phrase or private key.
Numbers ProtocolDeFi ProtocolBridgeEthereum$13.8K
A flaw in Numbers Protocol’s Multichain bridge integration let an attacker exploit a user’s token approval to transfer NUM from multiple accounts. The attacker took 557,754 NUM and converted them to about 13 ETH.
AUR ProtocolTokenBSC$13K
Missing permission checks in critical AUR token functions let attackers call privileged functions and drain token assets.
sDAOTokenBSC$13K
A flaw in sDAO’s business logic let attackers manipulate how the token protocol worked and extract funds. The reports did not specify how much was taken.
PolynomialDeFi ProtocolOptimism$7K
A missing input check in one Polynomial contract variant affected a limited number of users. The protocol compensated those affected.
Trust Wallet$170K
A vulnerability in Trust Wallet’s browser extension affected private keys for some new wallets created in two versions. Two breaches using the vulnerability caused combined losses of about $170,000.
UEarnPoolDeFi ProtocolBSC$16K
Using a flash loan and repeatedly calling a public function that linked accounts to inviters, an attacker manipulated UEarnPool’s reward calculations and routed rewards to accounts they controlled.
SheepFarmDeFi ProtocolBSC$72K
SheepFarm’s registration function could be called repeatedly without updating user timestamps, letting the attacker increase gem rewards and build yield through village upgrades. They sold the yield for BNB and withdrew about 262 BNB.
FTXCEXEthereumSolana$450M
FTX’s crypto wallets were compromised during the company’s bankruptcy, and more than $600 million in assets was reported stolen. Reports differed on the amount and how the wallets were accessed.
DFXFinance$231K
A flaw in a Curve flash-loan function let the attacker re-enter DFX Finance’s deposit process and exploit how it checked loan repayments, allowing funds to be withdrawn. The attacker made about $231,000.
DFX V2DeFi ProtocolEthereum$4M
A reentrancy flaw in DFX Finance V2’s flash-loan function let the attacker make deposits during a callback without the contract properly accounting for them as debt. The attack resulted in losses, including additional funds extracted through MEV.
brahTOPG$89.9K
A flaw in brahTOPG’s Zapper contract allowed arbitrary external calls, enabling an attacker to steal tokens from users who had approved the contract.
Brahma FinanceDeFi ProtocolEthereum$89.3K
A flaw in Brahma Finance’s Zapper contract let an attacker make an unvalidated external call and drain 89,343 USDC from three users’ authorized accounts.
MooCakeCTXDeFi ProtocolBSC$140K
An attacker used a flash loan to deposit CAKE twice without first settling rewards, then withdrew the funds and repaid the loan, exploiting MooCakeCTX’s reward accounting.
Pando RingsDeFi ProtocolMixin$22M
An attacker manipulated the oracle—a service reporting asset prices—to inflate the value of Pando Rings’ sBTC-WBTC liquidity-pool tokens, then borrowed against them and stole about $20–22 million.
LoopringUndisclosed
A large-scale DDoS attack disrupted Loopring’s service for 11 hours, but users’ funds were not at risk. The wallet service was later restored.
pNetworkDeFi ProtocolBridgeBSC$4.3M
A leaked governance key in pNetwork’s pGALA bridge contract let an attacker mint and sell billions of pGALA tokens on PancakeSwap. The team intervened to remove funds from the exchange and limit losses.
