Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Aave fork$930K
An attacker gained control of an Aave fork’s governance on Pulse chain by buying tokens, then used that authority to target contracts holding users’ authorized tokens. They moved the stolen assets through a bridge and made about 483 ETH.
PalmswapDeFi ProtocolBSC$900K
A flaw in Palmswap’s vault pricing let an attacker use flash loans to manipulate the pool’s value and withdraw funds at an inflated rate, taking about $901,000. Palmswap later said 80% had been returned, with the rest kept as a bug bounty.
Mark Cuban$870K
Mark Cuban lost about $870,000 across 10 cryptocurrencies in a wallet hack. He moved his remaining funds to Coinbase custody.
RocketSwapDeFi ProtocolBase$865K
Attackers brute-forced RocketSwap’s server and took control of a proxy contract, whose permissions let them transfer assets from the farm. They drained 471 ETH and moved the stolen assets to Ethereum.
Inverse Finance$860K
The Euler attack affected Inverse Finance’s DOLA pool on Balancer. Inverse said it quickly reduced most of the impact, but the pool still suffered losses and the team planned to work with Balancer to recover the remaining funds.
XaiTokenEthereum$846K
Scammers impersonated the Xai gaming project and tricked holders into sending 374 ETH to a fake scheme.
HopeLendDeFi ProtocolEthereum$825K
A precision error in HopeLend’s share calculations let an attacker distort the exchange rate and borrow ETH using rounding errors. A frontrunner took part of the funds, and the Armor Team frontrunner later returned assets.
PawnfiDeFi ProtocolEthereum$820K
Pawnfi’s ApeStaking contract failed to verify NFT transfers, letting an attacker use the same staked NFT as collateral repeatedly and borrow APE tokens without providing proper collateral.
MetaPointDeFi ProtocolBSC$820K
A public approval function in MetaPoint deposit contracts let attackers authorize transfers of users’ tokens and drain their deposits. The loss was about $920,000.
BalancerDeFi ProtocolEthereum$800K
Attackers manipulated token conversion rates in Balancer V2 boosted pools to drain liquidity. Balancer said it secured most affected funds through emergency measures, but some remained at risk; pools on several networks were affected.
Gutter Cat Gang$800K
Attackers took over Gutter Cat Gang’s and its co-founders’ Twitter accounts to promote a fake NFT airdrop. Users who approved the malicious contract had their wallets drained; stolen NFTs were estimated to be worth $750,000 to $900,000.
SturdyDeFi ProtocolEthereum$775K
A flash-loan-funded reentrancy attack manipulated Balancer pool prices used by Sturdy Finance’s lending protocol, allowing the attacker to drain about $800,000. The stolen funds included 442.6 ETH later sent to Tornado Cash.
GMBL COMPUTERDeFi ProtocolArbitrum$770K
A flaw in GMBL.COMPUTER’s referral system let attackers claim rewards without making deposits, draining funds from the contract. The attackers later returned 235 ETH, reported as half the stolen funds.
DungeonSwapDeFi ProtocolBSC$728K
An attacker abused weak access controls in DungeonSwap and Launch Zone’s implementation contracts to manipulate DND token pricing and drain liquidity pools. More than 2,400 BNB, worth about $728,000, was stolen.
CS Token$714K
An attacker stole 714,000 USDT from CS Token. The attacker later moved funds through Tornado Cash.
Vitalik Buterin$700K
An attacker used Vitalik Buterin’s compromised X account to post a phishing link posing as an NFT claim. The link led to about $700,000 in reported theft.
FilDADeFi ProtocolElastosREI Network$700K
Attackers exploited old, zero-balance lending markets on Elastos and REI, manipulating deposit and borrowing operations through FilDA’s bridging mechanism. About $700,000 was lost; other FilDA deployments were unaffected.
LaunchZoneDeFi ProtocolBSC$700K
A missing access check in LaunchZone’s Bscex SwapX contract let the attacker make unauthorized token transfers from liquidity pools and manipulate LZ’s price. About 80% of the pool’s funds were drained.
Midas CapitalDeFi ProtocolPolygon$660K
The attacker used a flash loan and a read-only reentrancy flaw involving a recently added collateral token to drain MATIC from Midas Capital’s Jarvis pool on Polygon.
Fantom Foundation$657K
Some Fantom Foundation hot-wallet assets were drained. The available report suggested private keys may have been stolen, but did not confirm how.
Hector LendingDeFi ProtocolBridgeFantom$653K
An unlimited USDC approval on Hector Lending’s beta bridge contract was exploited to drain about 650,000 USDC. The network later voted to liquidate $16 million from its treasury.
UnibotDeFi ProtocolEthereum$640K
A flaw in Unibot’s new router let attackers make the contract transfer tokens that users had approved it to spend, draining about $640,000. The funds were moved through Uniswap and Tornado Cash.
LeetSwapDeFi ProtocolBase$620K
An externally callable function in LeetSwap’s trading pool let an attacker move most of a pool’s tokens, distort its balance, then trade back for extra ETH. About 342.5 ETH was taken, and the exchange paused trading while investigating.
HashflowDeFi ProtocolEthereumArbitrumAvalanche+2 chains$605K
A vulnerable Hashflow contract function let attackers transfer tokens from users who had approved the contract, across five chains. The attacker later provided a way to recover the funds, and affected users retrieved their assets.
HederaDeFi ProtocolHedera$600K
A bug in Hedera’s token service let an attacker impersonate accounts used by liquidity pools on several decentralized exchanges and transfer their tokens. About $600,000 was drained before Hedera halted the network; bridge operators also disabled transfers to prevent further losses.
Fake Ledger Live Web3$588K
A fake Ledger Live app on Microsoft’s official app store stole more than 16.8 BTC from users.
EDE$580K
El Dorado Exchange was reportedly exploited through its Arbitrum pool, with losses estimated at about $580,000. The attacker returned more than $400,000, reportedly keeping a 10% fee; the attacker alleged the protocol had a backdoor that enabled forced liquidations.
AllbridgeDeFi ProtocolBridgeBSC$573K
An attacker acted as both a liquidity provider and trader on Allbridge’s BNB Chain pools, manipulating swap prices to drain BUSD and USDT. The owner of one attack address later returned 1,500 BNB, with the rest treated as a bounty.
Starkware$550K
Users who did not upgrade their Starkware wallets before a required change were locked out of their accounts and funds. About $550,000 in accounts was affected; Starkware later re-enabled wallet upgrades.
Earning.FarmDeFi ProtocolEthereum$540K
A reentrancy flaw in Earning.Farm’s withdrawal function let an attacker repeatedly withdraw funds before the contract correctly updated users’ shares. The attacker drained about 286 ETH from the protocol.
BitBrowser$520K
An intrusion into BitBrowser’s server may have exposed cached data, including wallet private keys for users who enabled extended data synchronization. The incident reportedly caused at least $520,000 in losses.
FCN-TRUST (FCN)$504K
A flash-loan attack exploited the FCN-TRUST token on BNB Chain, causing its price to fall by 99%. The loss was reported at more than $504,000.
Maestro RouterDeFi ProtocolEthereum$465K returned$500K
A flaw in Maestro Router 2 let attackers make the contract call other services and take tokens from wallets that had approved it. Maestro fixed the exploit and paused trading; about $510,000 was stolen.
Paxos$500K
A vulnerability in a single Paxos transfer led to nearly 20 BTC being paid as transaction fees. Paxos said customer funds were safe and that it was seeking to recover the fees.
BNODeFi ProtocolBNB Chain$500K
BNO’s emergency withdrawal function did not account for NFT stake records. An attacker deposited NFTs and tokens, withdrew the tokens while bypassing reward checks, and claimed undeserved mining rewards, causing about $500,000 in losses.
Ledger Connect KitWalletEthereum$484K
Attackers used a phishing attack to compromise a former Ledger employee’s npm account and publish malicious Ledger Connect Kit versions. The code redirected users’ transaction approvals through rogue WalletConnect services, enabling theft before it was removed.
Exzo Network$470K
A compromised Exzo admin account let attackers take ownership of the XZO token contract, mint XZO, and drain 169 ETH from its Uniswap liquidity pool. They also took 69 ETH and the remaining XZO from the admin wallet.
Swapos V2DeFi ProtocolEthereum$468K
A broken pricing rule in Swapos V2’s swap pool let attackers manipulate trades and drain about $468,000 from the protocol.
Monero$460K
Monero’s community crowdfunding wallet was drained of its entire balance. Its separate hot wallet, used to pay contributors, was unaffected.
Arcadia FinanceDeFi ProtocolEthereumOptimism$455K
An attacker used a malicious contract and reentered Arcadia’s liquidation process, bypassing a collateral check to withdraw liquidity-pool tokens on Ethereum and Optimism. The reported loss was about $400,000 to $460,000.
