Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
SharedStakeDeFi ProtocolEthereum$500K
An insider used a known flaw in SharedStake’s time-locked contracts—contracts that restrict when tokens can be withdrawn—to take 500,000 SGT tokens in several withdrawals. The tokens were later sold or used as collateral.
Impossible FinanceDeFi ProtocolBSC$500K
An attacker used a flash loan and a fake token pair to manipulate pool prices because Impossible Finance’s swap function lacked a key price check. The attacker made about $497,000; roughly $252,000 was later returned.
PolyDEXDeFi ProtocolPolygon$500K
A flaw in PolyDEX’s token-locker contract let an attacker repeatedly call its withdrawal function and take about $500,000 in assets. The attacker moved the funds to Ethereum before the team could apply a fix.
SeascapeNetworkDeFi ProtocolEthereum$500K
An attacker stole an early SeascapeNetwork investor’s private key and took 18,750 CWS from the investor’s wallet. The tokens were exchanged for ETH and sent through the Tornado Cash mixing service.
Dot.FinanceDeFi ProtocolBinance Smart Chain$430K
An attacker used a flash loan to manipulate token pricing in Dot.Finance’s VaultPinkBNB contract, allowing it to mint excess PINK tokens. The attacker profited about 900.89 BNB, worth roughly $430,000.
RAI Finance$414K
A vulnerability in ChainSwap’s contract exposed RAI Finance’s connected access and payment permissions, allowing attackers to steal 2.9 million RAI. The attackers later returned 2.2 million, leaving a loss of 670,000 RAI.
WePiggy$400K
A temporary error in WePiggy’s CHE price feed made the asset appear far more valuable than its market price. This caused abnormal liquidations of users who had borrowed CHE.
Force DAODeFi ProtocolEthereum$367K
Attackers exploited Force DAO’s xFORCE vault, which failed to check whether a token transfer had succeeded, allowing them to claim FORCE without a valid transfer. About $367,000 in FORCE was taken.
Ploutoz FinanceDeFi ProtocolBSC$365K
An attacker manipulated the DOP token price used by Ploutoz Finance and used DOP as collateral to borrow CAKE, ETH, BTCB and other assets. The borrowed tokens were exchanged for BNB and sent through Tornado Cash.
THORChainDeFi ProtocolBridgeEthereum$350K
A logic flaw in THORChain’s cross-chain system treated ERC-20 tokens with the symbol “ETH” as genuine ETH. Attackers used the fake ETH to obtain other tokens, and the network isolated the issue and repaired it.
Merlin LabDeFi ProtocolBSC$330K
A flaw in Merlin Lab’s Alpaca-BNB strategy counted BNB sent by a user as mining revenue, inflating MERL rewards. The attacker repeatedly exploited the calculation and made about $300,000.
Glide FinanceDeFi ProtocolElastos$300K
A fee-setting error in Glide Finance’s contract allowed attackers to drain funds from its matching contract: the team changed the fee parameter but left the contract using the old value. The loss was about $300,000.
Saddle Finance$276K
No attack or loss of funds is described; the report criticizes Saddle Finance for raising money to build a copy of Curve with no innovation.
xWin FinanceDeFi ProtocolBSC$270K
An attacker used a flash loan to manipulate prices and exploit faulty slippage checks in xWin’s reward system, extracting 303,998 XWIN tokens.
PolyYeld FinanceDeFi ProtocolPolygon$250K
A flaw in PolyYeld’s MasterChef contract mishandled xYELD transfer-tax rewards, allowing attackers to mint billions of YELD tokens and sell some for ETH. The token price then collapsed.
SafeDollarDeFi ProtocolPolygon$248K
An attacker exploited SafeDollar’s staking pool, where deflationary-token behavior left the contract’s actual balance low while its deposit records stayed inflated. The flaw enabled the attacker to create and sell SDO tokens for about $248,000 in stablecoins.
dYdX$211K
A vulnerability in dYdX’s deposit contract put user funds at risk. The team moved about $2 million to an escrow contract for owners to reclaim; an MEV bot took about $211,000 during the rescue, and users were compensated.
SashimiSwapDeFi ProtocolEthereum$210K
A flaw in SashimiSwap’s swap logic let an attacker use a flash loan—a temporary loan repaid in the same transaction—to exploit token pairings and extract value. The attacker made nearly $200,000 in tokens.
Pinecone FinanceDeFi ProtocolBinance Smart Chain$200K
An attacker bypassed Pinecone Finance’s website and directly called its staking contract, which failed to check account balances correctly and recorded deposits that had not been made. This allowed the attacker to withdraw extra PCT tokens before the project stopped the contract.
DAFI Protocol$200K
An attack on the ChainSwap cross-chain bridge led to about $200,000 worth of DAFI being sold. DAFI Protocol said its token contract and Super Staking were safe.
XDX SwapDeFi ProtocolBridgeHuobi Eco Chain$176K
A suspected backdoor in XDX Swap’s cross-chain exchange code let an attacker take about 85 ETH. Most of the funds were later recovered with help from security groups.
Iron FinanceDeFi ProtocolPolygon$170K
An error in Iron Finance’s reward-rate settings inflated farming rewards 365-fold, allowing an attacker to drain all SIL rewards from two pools. The loss was about $170,000.
Fractal$150K
A hacker took over Fractal’s Discord server and tricked 373 members into sending 800 SOL, worth about $150,000. Fractal said it would fully compensate those affected.
Alpha FinanceDeFi ProtocolEthereum$147K
A flaw in how Alpha Homora V2 and Uniswap V2 handled liquidity additions let a MEV bot bypass slippage checks and extract value through a sandwich attack. Twenty Alpha Homora addresses lost a total of 40.93 ETH.
DeFiPieDeFi ProtocolEthereumBinance Smart Chain$125K
An attacker used a malicious token with a modified transfer function to exploit reentrancy in DeFiPie’s lending contract, borrowing more than their collateral allowed. The attack drained liquidity and valuable collateral.
SushiSwapDeFi ProtocolEthereum$104K
An attacker created a fake, thinly traded DIGG/WETH pool and manipulated its price to exploit SushiSwap’s fee-conversion process. The attacker took 81 ETH in fees meant for xSUSHI holders.
Badger DAODeFi ProtocolEthereum$104K
An attacker exploited a missing fee-conversion setup for the DIGG/WBTC pool on SushiSwap, routing protocol fees through a pool with little liquidity and taking 81 ETH in excess slippage fees intended for xSUSHI holders.
Formation.Fi$100K
Formation.Fi was attacked using flash loans. Its swapIn function did not properly account for fees and differences in token decimal precision; the report does not say how much was taken.
OpenSea$100K
A vulnerability in OpenSea’s NFT transfer process sent at least 42 NFTs, including an ENS domain, to an uncontrolled burn address, where they could no longer be moved. OpenSea reportedly fixed the flaw.
THORChain$76K
Attackers sent malicious UniH tokens to Ethereum addresses as bait; selling them or approving their sale on a decentralized exchange could let the attackers steal RUNE from users’ wallets. About $76,000 in tokens was stolen.
T-Mobile$55K
A SIM-swap scam at T-Mobile let someone take control of a customer’s phone account and steal 1.63 Bitcoin. The customer sued the company, accusing it of failing to protect his information.
Cryptopia$45K
A dormant wallet controlled by Cryptopia’s liquidator was accessed, and attackers took about NZ$62,000 worth of XSN tokens.
CryptopiaCEXMultiple$45K
During Cryptopia’s liquidation, attackers compromised a dormant wallet holding XSN tokens and took about NZ$62,000 worth. The wallet was under the liquidators’ control.
Dora Factory$42.4K
A vulnerability in the ChainSwap bridge contract allowed attackers to withdraw DORA tokens that had been locked there, which they then sold through Uniswap.
My Farm Pet$31.4K
My Farm Pet was suspected of being hit by a flash-loan attack, in which borrowed funds are used within a single transaction to manipulate a market or contract. Its token price fell about 80%; the report does not specify funds stolen.
Chivo$22.7K
Cristosal received 755 reports from Salvadorans who said their Chivo Wallet identities had been stolen. The report does not say how much money, if any, was taken.
Bitcoin.org$17K
Attackers changed Bitcoin.org’s homepage to display a fake offer promising to double Bitcoin sent to a listed address. Reports say they stole more than $17,000.
SolendDeFi ProtocolSolana$16K
A flaw in Solend’s admin function let an attacker change lending settings without a valid signature, causing users’ accounts to be wrongly liquidated. About $16,000 in losses for five users was being refunded, and no funds were stolen.
Banksy$5K
A scammer used a page on Banksy’s website to advertise a fake NFT auction, persuading a user to send 100 ETH. The scammer returned the ETH, but the user lost $5,000 in transaction fees.
CoinMarketCapUndisclosed
A data error caused CoinMarketCap to display incorrect prices for multiple cryptocurrencies. No theft or loss of funds was reported.
