Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
252 incidents Clear filters
ZothDeFi ProtocolEthereum$285K
An attacker used flash loans to manipulate Uniswap V3 prices and exploit a flaw in Zoth’s collateral calculations, creating excess collateral value and borrowing ZeUSD against it.
FutureswapDeFi ProtocolEthereum$270K
An attacker used flash loans—temporary borrowed funds—to gain voting power and pass a malicious Futureswap proposal, granting an attack contract permission to transfer tokens from users.
Debot$255K
DeBot users’ private keys were reportedly compromised, allowing an attacker to steal funds; theft was still ongoing when reported. The team later said it had processed compensation applications.
ZEROBASEDeFi ProtocolBSC$250K
A malicious BSC contract impersonating ZEROBASE tricked users into approving USDT transfers, then used those approvals to drain hundreds of wallets. The stolen funds were moved to an Ethereum address.
HackenOther$250K
A leaked private key with minting privileges let an attacker create about 900 million HAI tokens on Ethereum and BNB Chain and sell them, sharply driving down the token’s price.
MEV Bot$210K
A MEV bot lost approximately 116.7 ETH because its system lacked access controls.
Peapods FinanceDeFi ProtocolEthereum$207K
A misconfigured oracle in a user-created Peapods pod let an attacker manipulate the WETH/aspLONGsUSDe price and inflate collateral values. The pod lost about $207,000.
RANTTokenBSC$204K
A flaw in RANT’s token burn function let attackers manipulate the burn process and steal about $204,000 from the protocol.
UniLendDeFi ProtocolEthereum$198K
An attacker used a flash loan to manipulate UniLend’s health-factor calculation, exploiting outdated balance data to withdraw stETH. The protocol lost about $197,000.
Four.MemeDeFi ProtocolBSC$183K
Four.Meme’s migration process accepted an attacker-created PancakeSwap pool with a fake, inflated token price and did not check the price before adding liquidity. The attacker exploited the imbalance to drain WBNB.
DoodiPalsTokenSolana$171K
An attacker used a leaked DoodiPals private key to sell tokens from multiple wallets for about 917 SOL. The team said it planned to relaunch after an audit and compensate affected holders at a 1:1 rate.
FilDADeFi ProtocolElastos$167K
An attacker manipulated prices used by FilDA’s lending oracle on Elastos, distorting asset values and draining more than 140,000 ELA and 5,800 USDC. FilDA suspended its Elastos deployment and said it would shut it down permanently.
Port3 NetworkDeFi ProtocolBridgeBSC$166K
A flaw in Port3’s cross-chain bridge allowed an attacker to mint 1 billion unauthorized PORT3 tokens. The attacker sold some for about 199.5 BNB, while the remaining unsold tokens were burned after the project removed liquidity.
D3X AI$159K
An attacker manipulated the d3xat token’s spot price in a Uniswap V2 trading pair, which the D3X AI exchange contract relied on. The attack caused a loss of funds.
Sharwa.FinanceDeFi ProtocolArbitrum$146K
Attackers exploited a flaw in Sharwa Finance’s margin-trading swaps by sandwiching their own trades—placing trades around a swap to manipulate its outcome—after borrowing assets with leverage. Two attackers took about $61,000 and $85,000 before the platform paused.
Pond.funDeFi ProtocolLinea$145K
Pond.fun’s lead software engineer was suspected of abusing privileged access to manipulate withdrawal functions and drain 64.8 ETH from liquidity pools. The funds were moved through Railgun and then to centralized exchanges.
DMT 空投(@dexmaxai)$130K
During the DMT airdrop, users were tricked into signing token approvals that let attackers transfer their assets. More than $130,000 was stolen and bridged to Ethereum; most of it flowed to HitBTC.
Dexmax AITokenEthereum$130K
Attackers tricked people claiming the DMT airdrop into signing extra approvals, allowing transfers from their wallets. They stole more than $130,000 and bridged the assets to Ethereum, with most flowing through HitBTC.
Meta PoolDeFi ProtocolEthereum$130K
An unprotected public mint function in Meta Pool’s staking contract let an attacker create mpETH without depositing collateral. Low liquidity limited how much they could sell, and most of the minted tokens were not converted into funds.
MSCSTDeFi ProtocolBSC$130K
A missing permission check in MSCST’s reward-release function let an attacker use a flash loan to manipulate the GPC token’s price on PancakeSwap. The attacker made about $130,000 in BNB.
Cashverse$108K
Cashverse appeared to be attacked on BSC, according to security monitoring. No further details were reported.
DRLVaultV3DeFi ProtocolEthereum$100K
The attacker borrowed USDC, bought WETH to inflate its Uniswap price, then triggered DRLVaultV3 to buy WETH at that price and sold the attacker’s WETH for a profit. A whitehat captured about $100,000 in USDC that was expected to be recoverable.
QuantMasterDeFi ProtocolEthereum$100K
A malicious backdoor in QuantMaster’s smart contract let an insider developer extract funds, causing losses of several hundred thousand dollars. Project developer Thomson said code submissions pointed to a specific employee.
Jake Gallen$100K
After a suspicious Zoom interview, an attacker posing as a YouTube creator used Zoom’s remote-access settings to install malware on Jake Gallen’s computer. More than $100,000 in Bitcoin and Ethereum was stolen.
ODOS$100K
A lack of input checks in ODOS’s executor contract let attackers steal revenue held in the contract across multiple chains, causing about $100,000 in losses. ODOS said user funds were not affected.
AlkimiyaDeFi ProtocolEthereum$95.5K
An attacker used a flash loan to exploit Alkimiya’s SilicaPools contract, where a conversion error made it record fewer shares than were issued. This allowed the attacker to redeem more collateral than they had deposited.
BerallyDeFi ProtocolBerachain$90K
A compromised Berally deployer key let the attacker sell vesting tokens and withdraw funds from a liquidity pool. The core dApp contracts were unaffected.
StepHeroNFTsDeFi ProtocolBSC$90K
A reentrancy flaw in StepHeroNFTs’ referral-claim function let an attacker trigger repeated transfers before the contract updated its records, draining funds.
Four.MemeDeFi ProtocolBSC$80K
Four.Meme’s pre-launch transfer restrictions could be bypassed using a low-level function to create a PancakeSwap trading pair for tokens not yet launched. The attacker added liquidity at an unintended price and took pool funds.
Hegic(old contract)DeFi ProtocolEthereum$80K
An attacker exploited an old Hegic WBTC options pool withdrawal function that failed to reduce share balances. They deposited liquidity, bought put options, withdrew their liquidity, then exercised the options.
WebKeyDAOTokenBSC$73K
An unprotected function let an attacker set WKEYDAO’s token price artificially low, buy tokens at one-tenth of market price, then sell them on a decentralized exchange for profit. A built-in cap limited how many tokens could be sold.
IRYS AITokenBinance Smart Chain$69.6K
A backdoor admin function in the IRYS AI token contract let its deployer bypass normal permission checks and use the tax wallet to drain funds directly from users’ wallets.
Bankroll NetworkDeFi ProtocolBinance Smart Chain$65K
Attackers exploited an integer underflow in the sell() function of abandoned BankrollStack contracts, manipulating dividend accounting through old token approvals. They drained funds from users who had previously used the contracts.
AST$64.7K
AST was allegedly attacked on BSC, according to security monitoring. No further details were reported.
Equilibria Finance$62.5K
A transferability setting in Equilibria’s stk-ePENDLE contract let an attacker repeatedly move tokens between addresses, triggering reward claims each time and draining about 13.36 ETH in unclaimed rewards.
GrizzifiDeFi ProtocolBSC$61K
An attacker used multiple wallets to exploit Grizzifi’s reward calculations, which counted past investments rather than active ones, and claimed extra staking and referral rewards.
dTRINITYDeFi ProtocolSonic$56K
A missing authorization check in dTRINITY’s swap adapter let the attacker use addresses that had previously approved it. Malicious swap routes sent team members’ collateral to the attacker while returning just enough to pass checks.
LIFE Protocol$51K
SlowMist reported that LIFE Protocol had been attacked and funds were lost. The report did not describe the attack method or what happened to the funds.
LAURA$48.2K
LAURA was suspected of a contract attack on Ethereum, causing an estimated loss of about $48,200.
Stepp2pDeFi ProtocolBSC$43K
A logic flaw in Stepp2p’s core smart-contract functions was exploited, causing a loss of about $43,000.
