Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Unnamed BSC DEX Router$46.1K
An unnamed BNB Chain DEX router failed to verify that swap callbacks came from genuine Uniswap V3 pools. Using a fake pool, the attacker used existing token approvals to drain about 62.28 WBNB from 29 wallets.
Liquid NetworkChainBridgeLiquid$320M
A vulnerability in Liquid’s underlying Elements software let an attacker create unbacked L-BTC and use SideSwap’s normal withdrawal service to make the federation release about 3,996 BTC. The attacker later returned 3,400 BTC and retained about 598.5 BTC; no keys were compromised.
RocketDeFi ProtocolRocket$288K returned$288K
An attacker traded against their own accounts in a dormant, illiquid perpetual market, creating artificial profits while bankrupting a disposable account. They withdrew about $287,000 through Rocket’s Bridge, but Rocket later confirmed the funds were returned.
Secured FinanceDeFi ProtocolEthereum$104K
Attackers used flash-loaned funds to make self-trades that distorted Secured Finance’s order-book price, then used the falsely valued lending position as collateral to withdraw assets. The protocol estimated losses at about $180,000; recovery was unconfirmed.
Dream Health ChainDeFi ProtocolBSC$71.8K
A flaw in Dream Health Chain’s reward logic let an attacker reset already-claimed awards with a tiny or zero-effective deposit and claim each fixed payout repeatedly. The attacker drained the contract’s shared balance and sold DHC tokens.
ReddioDeFi ProtocolEthereum$22.8K
RedSonic’s vault counted the same stETH in both its ETH and stETH vaults. The attacker inflated the ETH-vault share price, withdrew excess ETH, then redeemed stETH shares against the same collateral, taking about 9.25 ETH.
Notional FinanceDeFi ProtocolEthereum$1.73M
An unchecked 128-bit conversion in Notional V1’s debt check turned a very large liability into zero, making an insolvent account appear solvent. The attacker used fabricated fCash claims to withdraw about $1.73 million in USDC and DAI, then swapped the funds for ETH and deposited it into Tornado Cash.
XRPH Wallet$452K
About 4,011 XRPH Wallet accounts had unauthorized transactions involving XRPH, XRPHAI, and other assets, with roughly $452,000 stolen. The funds were converted to DAI and remain unmoved in one address; the project said the XRP Ledger itself was not affected.
GebProxyActions$14K
GebProxyActions’ quitSystem function lacked caller checks, allowing an attacker to bypass the safe manager’s permission check and transfer collateral from safes whose owners had previously called the function directly.
AquiferDeFi ProtocolSolana$2.47M
Aquifer’s Solana swap system was exploited, and about $2.5 million was lost. Reports differ on the cause, so the precise attack method is not established here.
RadixChainRadix$1.25M
A flaw in Radix’s execution layer let custom transactions withdraw directly from internal asset vaults without checking authorization. The attacker drained nearly all of six Hyperlane-wrapped assets on Radix and bridged them out through Hyperlane.
AnkrDeFi ProtocolFlow$410K
A flaw in Ankr’s ankrFLOW staking contract let an attacker create unbacked tokens, use them as collateral on MORE Markets and borrow about 15.5 million WFLOW from its lending reserve. MORE Markets’ contracts worked as designed.
Float ProtocolDeFi ProtocolEthereum$28K
Flash-loan-funded trades manipulated a Uniswap pool’s spot price, causing Float’s contracts to misvalue liquidity-pool shares. The attacker repeatedly deposited and withdrew at distorted values, taking 10.71 ETH.
TectonicDeFi ProtocolCronos$124M
The attacker repeatedly borrowed and redeposited TONIC, then sent TONIC directly to its receipt-token contract to inflate the collateral value; an unreliable price feed compounded the effect. Tectonic’s lending markets lost about $120 million, but a Cronos rollback recovered most of it; about $9.19 million remains unrecovered.
Balancer V1DeFi ProtocolEthereum$234K
After pushing a pool’s WBTC reserves close to zero, an attacker exploited rounding in Balancer V1 to mint BPT pool shares for just one satoshi of WBTC. They then redeemed the shares for DPI, USDC, WETH and WBTC.
Weft V2DeFi ProtocolRadix$47.2K
Weft V2 valued HUG at roughly 10 million times its market price because of an incorrect price feed. The attacker used a still-enabled collateral route to deposit HUG and borrow 47.28 million LSULP and 13.1005 million XRD.
Full SailDeFi ProtocolSui$91K
False Switchboard oracle prices distorted Full Sail vault valuations, allowing an attacker to deposit at an artificially low value and withdraw more than they put in. How the false prices bypassed the vault’s safeguards has not been disclosed.
PermapodDeFi ProtocolZIGChainUndisclosed
Permapod said an exploit affected its smart contracts and halted the protocol after securing the affected contracts. It has not disclosed the flaw, how it was exploited, or the amount lost.
Fogo FoundationFoundationFogo$3M
An unknown attacker took control of the Fogo Foundation’s token authority and transferred 400 million FOGO to an attacker-controlled address; the specific access method was not disclosed. Fogo halted its network, then restarted it after recovering and permanently removing 237 million tokens.
VirtueDeFi ProtocolIota$895K
The attacker replaced the signing keys of all 14 production oracles and reported wildly false IOTA prices. This let them mint unbacked VUSD, trigger liquidations, and take collateral worth 16.72 million IOTA.
Ajna V2DeFi ProtocolEthereum$775K
Attackers exploited faulty liquidation accounting across Ajna lending pools, sequencing collateral withdrawals and settlement steps so they took collateral without returning enough of the pool’s loan asset. The reported analysis does not specify the amount taken.
AviciCrypto CardSolana$501K
A flaw in an outdated Rain Solana card contract used by Avici let attackers gain unauthorized control and withdraw about $501,000 from users’ card balances. Around 1,685 users were affected; the contract was upgraded, and refunds were promised.
MoonwellDeFi ProtocolBase$8.7M
The attacker inflated the spot price of illiquid MAMO and used the inflated value as collateral to borrow assets including cbBTC, ETH, USDC and wstETH. This left Moonwell’s lending markets with undercollateralized loans.
CashCowCoin$117K
A flaw in CashCowCoin’s router let repeated sells burn tokens from the trading pool while leaving its reduced WBNB reserves unchanged. The attacker used this mismatch to drain WBNB from the pool over about 80 cycles.
CCCTokenBSC$117K
A flaw in CCC’s sell function let an attacker burn CCC held by the PancakeSwap pool and reset its reserves, distorting the token’s price. The attacker repeatedly sold CCC to extract BNB from the pool.
CometDEXDeFi ProtocolStellar$717K
A CometDEX accounting bug let USDC be swapped for itself, understating the pool’s reserves; the attacker used flash loans to deposit against the false balance and redeem excess LP shares for pool assets. Blend Backstop depositors were exposed through its Comet LP shares.
EnjinNFTfiEthereum$162K
A flaw in Enjin’s legacy Crypto Items system let an attacker take control of a proxy contract and register a malicious adapter. The attacker moved NFTs from about 52 wallets and redeemed their backing, draining approximately 5.24 million ENJ.
FH TokenTokenBSC$20K
A flaw in FH Token’s sell logic caused incorrect token burns during trades. The attacker repeatedly bought and sold FH to drain value from the FH/USDT pool.
NesaChainNesa$50M
Nesa confirmed an exploit involving a Cosmos EVM vulnerability, and reports said an attacker bridged 257.7 million NES to Ethereum. Nesa did not publish transaction-level details of the exploit; the reported mechanism resembles a balance-accounting bug affecting other Cosmos EVM chains.
PacaSwap DEXDeFi ProtocolConstellation$90.8K returned$90.8K
A flaw in Tessellation’s fee accounting let the attacker create SWAP tokens without deposits by triggering an arithmetic underflow. They sold the unbacked tokens into PacaSwap’s SWAP/DAG pool, taking about 12.1 million DAG from liquidity providers.
TermFinance VaultsDeFi ProtocolEthereum$8.5M
An attacker gained majority voting power over Term’s strategy vaults and passed malicious proposals that enabled withdrawals from the vaults. The governance attack drained about $8.5 million in assets.
warp.greenDeFi ProtocolBridgeChiaEthereum$93K
A flaw in warp.green’s Chia-side bridge module let the attacker pass off worthless tokens as burned wUSDC and drain about $93,000 in USDC-denominated assets from bridge contracts on Base and Ethereum. The attacker converted the funds to ETH.
Arrakis V1DeFi ProtocolEthereum$7.1K
An attacker used a flash loan to distort the ENS/WETH pool’s spot price, which the Arrakis vault used to value shares without a price check. After restoring the price, they redeemed the shares for a more valuable mix of tokens, profiting about 2.94 WETH.
Surf LendingDeFi ProtocolCardanoUndisclosed
A machine with access to Surf Lending’s admin key was compromised, though the team said no smart-contract bug was involved. Surf moved user vaults and supplied assets to its multisig treasury while it worked to secure the infrastructure and restore its V1 contracts.
KiiChainChainKiiChain$9.7M
An arithmetic flaw in KiiChain’s Cosmos EVM module let an attacker redirect KII from victim wallets by abusing vesting-account and staking balance handling. The attack was repeated against 18 targets; the network was halted to stop further theft.
TACChainTAC$7.5M
A vulnerability in the shared Cosmos EVM precompile layer let an attacker transfer about 2.985 billion TAC from one account without authorization; no new tokens were created. TAC halted its network to contain the incident.
The SandboxDeFi ProtocolBridgeBaseBSCEthereum$675K
The attacker abused an approval function in The Sandbox’s Base bridge contract to change cross-chain settings, mint unbacked SAND on Base and BNB Chain, and withdraw backed SAND from the Ethereum bridge vault. Bridging on Base and BNB Chain was halted.
MANTRA ChainChainMANTRA$3.6M
An unsigned-integer underflow bug in an upstream Cosmos EVM module let an attacker transfer about 720.9 million MANTRA from two MANTRA-managed wallets. The chain was halted and later patched; reports say user funds and validator keys were not compromised.
BounceBitChainBounceBit$3M
An authorization flaw in a BounceBit chain module let an attacker transfer BB from nine accounts without their permission. BounceBit retired the chain and reissued BB on BNB Chain using a snapshot from before the theft.
AllbridgeDeFi ProtocolBridgeBase$191K
Allbridge accepted a Circle-attested message claiming a USDC transfer that had never happened, then credited the attacker despite no matching deposit. Using a flash loan—a temporary loan repaid within the transaction—the attacker withdrew nearly $999,000; a copycat later took the remaining funds.
