Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
ZEEDDeFi ProtocolBSC$1M
An arithmetic error in ZEED’s reward calculations let an attacker manipulate the distribution and extract about $1 million. The funds remained in the attack contract, according to the report.
Bacon ProtocolDeFi ProtocolEthereum$1M
An attacker exploited a reentrancy flaw in Bacon Protocol’s lending function, repeatedly calling it before earlier transactions finished and draining about $1 million.
OpenSeaNFTfiEthereum$1M
A bug left some NFTs listed through OpenSea’s API after they appeared delisted. Attackers bought them at old, below-market prices and resold them, extracting more than $1 million in total.
CrosswiseDeFi ProtocolBSC$879K
A publicly accessible privileged function in Crosswise’s MasterChef contract let an attacker take control of owner permissions and withdraw 692,000 CRSS tokens. The attacker swapped them for WBNB and moved some funds through Tornado Cash.
ElasticSwapDeFi ProtocolAvalancheEthereum$521K returned$850K
Inconsistent accounting between ElasticSwap’s liquidity-add and liquidity-removal functions let attackers drain funds from pools on Avalanche and Ethereum.
ApeCoinTokenEthereum$820K
An attacker briefly borrowed BAYC NFTs using flash loans, then claimed the ApeCoin airdrop meant for those NFTs because the distribution did not check who owned them before the loan. The attacker sold the tokens for about $820,000 in profit.
SudoRareDeFi ProtocolEthereum$800K
After operating for six hours, SudoRare’s founders used their admin privileges to drain 519 ETH from the platform’s liquidity pool and disappeared.
LUNC$800K
A faulty LUNC price feed showed a price far above the market price, letting an Anchor user deposit Lido-bonded Luna tokens and borrow UST against them. The user withdrew the funds and profited.
AnchorDeFi ProtocolTerra$800K
A frozen Chainlink price feed left Anchor valuing bLUNA collateral at an outdated minimum price. An attacker used the inflated collateral value to borrow UST, making a profit before Anchor froze the markets.
Crypto BurgerGamingBSC$770K
Crypto Burger’s BURG token contract let anyone burn tokens in its PancakeSwap liquidity pool, distorting the token’s price. Attackers used flash loans—temporary borrowed funds—to exploit the flaw and take BNB from the protocol.
AuctusDeFi ProtocolEthereum$726K
An attacker used a beta Auctus contract that allowed arbitrary calls to drain funds from users’ wallets if they had given the contract unlimited spending approval.
QANX BridgeDeFi ProtocolBridgeEthereum$707K
Attackers used compromised QANX Bridge credentials to withdraw QANX tokens and sell them for ETH, which was then transferred through Tornado Cash.
MTDAODeFi ProtocolBSC$702K
A malicious call to MT and ULM token functions bypassed authorization checks and let the attacker extract BNB and BUSD from the MTDAO contracts. The funds were routed through Tornado Cash.
Umbrella NetworkDeFi ProtocolEthereumBSC$700K
An unchecked flaw in Umbrella Network’s withdrawal function on Ethereum and BNB Chain let attackers withdraw funds without having a balance. They drained liquidity tokens and took about $700,000 from the affected pools.
Dogechain$600K
Reports said attackers exploited Dogechain to mint 9.7 million DOGE tokens and moved some funds through a cross-chain bridge; Dogechain’s official account said no funds were lost during maintenance.
Blur FinanceDeFi ProtocolBSCPolygon$600K
Blur Finance’s developers withdrew $600,000 from its BSC and Polygon contracts, deleted the project’s social media accounts, and disappeared in an exit scam. The token’s price collapsed.
Li.financeDeFi ProtocolEthereum$600K
Attackers exploited unchecked external calls in LI.FI’s swap contract to take tokens from 29 wallets whose owners had granted unlimited spending approvals. The project fixed the flaw and compensated most affected users.
DaoSwap$580K
A flaw in DaoSwap’s swap rewards let users name themselves as their own referrer without verification, earning rewards that exceeded swap fees. The attack took 580,000 USDT.
DAO SwapDeFi ProtocolBinance Smart Chain$580K
DaoSwap’s reward system let users name themselves as their own referrer and claim referral bonuses. Attackers exploited the flaw to collect unauthorized mining rewards; the report does not state the amount taken.
Curve FinanceDeFi ProtocolEthereum$575K returned$575K
A hijacked DNS provider redirected Curve users to a fake site that prompted them to approve malicious token transfers; Curve’s smart contracts were not affected. At least 362 ETH was stolen, and FixedFloat said it froze some of the funds.
GMX V1 EVMDeFi ProtocolArbitrum$565K
Wash trades on centralized exchanges manipulated oracle-reported prices for GMX V1’s AVAX/USD perpetuals, letting an attacker profit from trades with no slippage.
Feminist MetaverseDeFi ProtocolBinance Smart Chain$540K
An attacker used a flash loan to exploit the FM token’s skim mechanism, route 75.15 million FM tokens through a trading pair and sell them. The attacker extracted 1,838 BNB and sent it to Tornado Cash.
APE$500K
An arbitrage bot used a flash loan to temporarily obtain BAYC tokens, redeem them for NFTs, and claim APE airdrop tokens before returning the loan. The loophole let it claim more than 60,000 APE.
Build FinanceDeFi ProtocolEthereum$470K
An attacker took control of Build Finance’s governance, minted more than a billion BUILD tokens and drained liquidity pools and treasury assets, including METRIC tokens. The DAO lost control of key contracts and funds.
RigoBlockDeFi ProtocolEthereum$464K
A missing owner-only restriction let attackers change token allowances in RigoBlock’s Dragos contracts and drain 160.86 ETH from liquidity pools. The attacker later returned 90% of the funds, keeping the rest as a bounty.
PREMINTNFTfiEthereum$375K
Attackers compromised PREMINT’s website and inserted malicious JavaScript that tricked users into approving access to all their NFTs. They stole 314 NFTs, including Bored Apes and Moonbirds.
NereusDeFi ProtocolAvalanche$371K
The attacker used a flash loan and manipulated token prices through trading pools, exploiting the lack of price protection for newly added collateral. They took about $371,000 in USDC from Nereus Finance.
WonderHeroGamingBSC$320K
Attackers compromised WonderHero’s hot-wallet keys, reportedly through phishing for the wallet’s recovery phrase, and stole about $320,000 in BNB.
ShadowFiDeFi ProtocolBinance Smart Chain$301K
A flaw let anyone burn SDF tokens in ShadowFi’s liquidity pool. The attacker burned the pool’s tokens and drained its liquidity, making about 1,078 BNB.
AmunDeFi ProtocolPolygon$300K
An attacker took control of Amun’s unprotected rebalance manager and shifted its PECO and DFI indices into a worthless token they controlled. They minted a huge supply and sold it on decentralized exchanges, causing losses.
Bond ProtocolDeFi ProtocolEthereum$300K
A flaw in Bond Protocol’s Fixed-Expiry Teller let an attacker use counterfeit bond tokens to claim legitimate OHM collateral. About $300,000 was drained, but the attacker returned the funds hours later.
SethGreenNFTfiEthereum$300K
A phishing site impersonating Gutter Cat Gang compromised Seth Green’s wallet, and a scammer sold four NFTs, including a Bored Ape. Green later recovered the Bored Ape through negotiation.
Flurry FinanceDeFi ProtocolBSC$293K
An attacker manipulated Flurry Finance’s rhoToken share accounting to inflate their apparent balance, then redeemed the inflated shares for stablecoins from a strategy vault. About $293,000 in assets was stolen.
OlympusDAO$292K
An input-validation flaw in OlympusDAO’s BondFixedExpiryTeller contract allowed an exploit of its redeem function, causing a loss of about $292,000. The attacker returned the funds to the DAO.
RES TokenDeFi ProtocolBSC$290K
An attacker used a flash loan to manipulate RES Token’s pool price and repeatedly traded at the inflated price, extracting about $290,000.
Kyber NetworkDeFi ProtocolPolygon$265K
Attackers injected malicious code into the KyberSwap website through its Google Tag Manager setup, tricking users into approving transfers from their wallets. Two wallets lost a total of about $265,000.
Ethereum Alarm ClockDeFi ProtocolEthereum$260K
A flaw in Ethereum Alarm Clock’s cancellation refund calculation let attackers claim excessive gas-fee refunds by submitting transactions with inflated fees. They took about 204 ETH.
BAYC&OthersideNFTfiEthereum$257K
Attackers took over a BAYC community manager’s Discord account and posted fake giveaway links that led users to approve malicious contracts. They stole 32 NFTs and more than $257,000 in ETH.
ULMEDeFi ProtocolBSC$250K
A flaw in ULME’s access checks let an attacker use a flash loan and manipulate the token price to drain BUSD from authorized spenders. The attacker extracted about 50,646 BUSD after repaying the loan.
CelerDeFi ProtocolBridgeMulti-Chain$240K
A DNS attack redirected cBridge users to a fake site with malicious contracts, and users who approved token access had funds drained. Celer’s contracts were unaffected, and the company said affected users would be compensated.
