Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
PurrlendDeFi ProtocolMegaETHHyperliquid L1$1.5M
Attackers compromised Purrlend’s 2-of-3 admin multisig, gave themselves bridge permissions, and minted unbacked tokens to borrow real assets from liquidity pools. The losses were about $1.52 million across HyperEVM and MegaETH.
MeteoraDeFi ProtocolSolana$1.5M
Meteora lost $1.5 million in USDC after its team sent funds for a token buyback to a fake OTC escrow counterparty posing as a legitimate buyer. The counterparty never delivered the tokens.
USDGambit and TLPDeFi ProtocolArbitrum$1.5M
Attackers compromised the shared deployer account for USDGambit and TLP, then changed ProxyAdmin permissions to take control of both protocols and drain about $1.5 million. They bridged the funds to Ethereum and deposited them into Tornado Cash.
b14gDeFi ProtocolCORE$1.47M
Attackers withdrew about 97 million CORE tokens staked through b14g and sent them to addresses they controlled. Some CORE remained on the Core network and some was frozen by exchanges; staked Bitcoin was unaffected.
Ekubo ProtocolDeFi ProtocolEthereum$1.4M
A flaw in Ekubo’s swap extension let attackers use users’ existing token approvals to transfer tokens to themselves without authorization. They stole 17 wBTC, worth about $1.4 million, and laundered the funds through Tornado Cash.
TMX$1.4M
A vulnerability in a contract related to TMX on Arbitrum was exploited in a loop involving minting and staking LP tokens, swapping USDT for USDG, then unstaking and selling more USDG. Estimated losses were around $1.4 million.
TMXTribeDeFi ProtocolArbitrum$1.4M
A flaw in TMXTribe’s calculation of its assets ignored USDG liabilities. The attacker repeatedly minted, staked and swapped tokens to inflate redemptions, draining funds from the protocol.
Polkadot$1.38M
A bug in Polkadot Asset Hub’s XCM executor let an attacker reduce dotUSD’s recorded supply without changing account balances, distorting its price in a DOT trading pool. Arbitrage trades cost the Treasury, the pool’s sole liquidity provider, about $1.381 million in DOT value; users lost no funds.
CascadeDeFi ProtocolArbitrum$1.34M
The attacker manipulated prices in a low-liquidity market, triggering liquidations of Cascade short positions and enabling a withdrawal of about $1.34 million USDC. The funds were largely recovered and affected users were to be compensated.
RaydiumDeFi ProtocolSolana$1.34M
A flaw in Raydium’s deprecated AMM V3 program let the attacker use a fake liquidity-pool token address to bypass withdrawal checks and drain five inactive pools. The pools held about $1.34 million in assets, including USDC, SOL and RAY.
QubicWalletQubic$1.3M
Weak randomness made some Qubic wallet recovery seeds predictable, allowing an attacker to drain 1,404 wallets of about 2.94 trillion QU. The network was halted, most stolen funds were frozen, and seed generation was fixed in a wallet update.
GiddyDeFi ProtocolEthereum$1.3M
Attackers exploited GiddyVaultV3’s incomplete signature checks: key swap details were not covered by the signed authorization, allowing them to substitute malicious transaction parameters and take protocol assets worth about $1.3 million.
PapertradeDeFi ProtocolHyperliquid L1$1.28M
An attacker moved ETH prices on Hyperliquid’s order book while trading highly leveraged positions on Papertrade, which settled against the live midpoint price without safeguards against manipulation. The trades extracted about $1.28 million from Papertrade’s shared USDC liquidity pool.
RadixChainRadix$1.25M
A flaw in Radix’s execution layer let custom transactions withdraw directly from internal asset vaults without checking authorization. The attacker drained nearly all of six Hyperlane-wrapped assets on Radix and bridged them out through Hyperlane.
CowSwapDeFi ProtocolEthereum$1.2M
Attackers hijacked the cow.fi domain through social engineering at its registrar and sent visitors to a fake CoW Swap site. Users who signed malicious transactions lost funds; CoW Swap later regained control of the domain.
Aftermath FinanceDeFi ProtocolSui$1.14M
A fee-accounting flaw let an attacker set negative builder fees to inflate synthetic collateral and withdraw funds from Aftermath’s perpetuals vault. They drained about $1.14 million in USDC; other products were unaffected.
LABUBU/OLPCLiquidity PoolBSC$1.1M
A misconfigured decimals setting in the OLPC token caused large unintended token burns and desynchronized PancakeSwap pool reserves. An attacker used the resulting pricing error to drain LABUBI and swap it for about 1.115 million USDT.
AffluentDeFi ProtocolTON$1.05M
A vulnerability in Affluent’s lending vaults let attackers mint shares without depositing assets, then redeem vault funds. The incident caused losses of about $1.053 million, and extracted assets were reportedly moved through exchanges, swaps, and cross-chain services.
TranchePool$1.01M
A settlement flaw in a TranchePool on Avalanche treated a scheduled principal payment as received at the start of a new UTC day. This wrongly restored the attacker’s borrowing capacity, letting them draw the same USDC a second time.
Fence FinanceDeFi ProtocolAvalanche$1.01M
An attacker used a flash loan to obtain an inflated share of a Fence Finance tranche vault, then redeemed those shares to withdraw about $1.01 million in USDC.
Hifi FinanceDeFi ProtocolEthereum$1M
An attacker used last-minute votes to pass a malicious Hifi Finance governance proposal to change the protocol’s contract, transfer collateral, and mint 25 million HIFI tokens. Reports differed on whether the proposal had been executed at the time.
OraichainChainBridgeOraichain$1M
A flaw in Oraichain’s cross-chain transfer path let an attacker mint ORAI without matching collateral on the originating chain. The network halted cross-chain services and was preparing to burn the unauthorized tokens and reconcile its supply.
Bloom TradingWalletSolana$953K
A remote code execution flaw in a third-party module used by Bloom Trading’s infrastructure enabled unauthorized transfers from users’ Solana wallets, draining about 9,408 SOL. Bloom said it would reimburse affected users and paused some services while investigating.
LML/USDT staking protocolDeFi ProtocolBSC$950K
The attacker used flash loans to distort LML’s market price and exploit a staking contract that calculated rewards using an outdated price, claiming oversized LML rewards and selling them. The attack netted about $950,000 and caused LML’s price to fall 99.6%.
Haedal Vault$915K
A cross-version logic flaw let the attacker use an old deposit route to mint inflated LP shares, then redeem them through newer routes for excess underlying assets. The Haedal Vault losses were about $915,000.
Sovryn LendDeFi ProtocolRootstock$914K
Attackers exploited Sovryn’s lending and margin contracts on Rootstock, taking XUSD and WRBTC. A 24-hour withdrawal delay helped the team block additional XUSD withdrawals before those funds reached the attackers.
42DAODeFi ProtocolBSC$912K
The attacker fed 42DAO’s oracle an abnormally low BTCB price, triggering forced liquidation of BTCB vaults at far below-market prices. The attack caused Balance Coin to lose nearly all of its value.
MOKELiquidity PoolBSC$907K
MOKE was exploited through a smart-contract flaw that let the attacker repeatedly claim tokens from an internal reserve without an eligibility check. The attacker converted the tokens into about 1,546 BNB, for a loss of roughly $907,000.
Solido CashDeFi ProtocolSupra$900K
A misconfigured price feed treated SOLID collateral as nearly as valuable as CASH, despite SOLID’s much lower market value. The attacker minted excess CASH against the collateral and sold it for SUPRA; the losses fell mainly on liquidity providers and protocol reserves, not users.
VirtueDeFi ProtocolIota$895K
The attacker replaced the signing keys of all 14 production oracles and reported wildly false IOTA prices. This let them mint unbacked VUSD, trigger liquidations, and take collateral worth 16.72 million IOTA.
Aave V3DeFi ProtocolEthereum$862K returned$862K
A misconfigured price oracle undervalued wstETH on Aave V3, triggering wrongful liquidations of 34 healthy positions and about $862,000 in losses. The Aave DAO fully compensated affected users; no protocol funds were stolen.
Solana MEV Bot King$856K
An attacker emptied the Solana MEV bot King’s main wallet using transfers signed with its private key. Some stolen funds were frozen after being bridged to Ethereum; the rest remained in an Ethereum address.
NEM（NemTokenV2）$822K
A flaw in the NEM token contract counted transfers to its liquidity pool as sales without checking whether swaps settled. The attacker repeatedly used this accounting error to drain pool reserves, then sold NEM at an inflated price for about $821,920 in USDT.
Echo ProtocolDeFi ProtocolBridgeMonad$821K
An attacker who obtained Echo Protocol’s admin key minted 1,000 unbacked eBTC on Monad, then used some as collateral to borrow WBTC and swap it for ETH. About 384 ETH was sent to Tornado Cash, while most of the minted eBTC remained under the attacker’s control.
HinkalDeFi ProtocolEthereum$820K
A flaw in Hinkal’s deprecated note format allowed unauthorized deposits without proof verification and bypassed checks on withdrawals. The attack drained about $820,000 in USDC from one Ethereum pool.
Alephium BridgeDeFi ProtocolBridgeEthereum$815K
A backend flaw in Alephium TokenBridge’s message checks let attackers forge transfer approvals and drain about $815,000 in assets across Ethereum and BNB Chain. They also minted unbacked wrapped ALPH tokens.
zkLink NovaDeFi ProtocolBridgeEthereum$783K
A flaw in zkLink’s bridge let an attacker reuse an already authenticated message to install a false record of Layer 2 transactions. They then used forged withdrawal proofs to take ETH and other tokens from the Ethereum bridge.
BarnBridgeDeFi ProtocolEthereum$776K
An attacker passed a malicious governance proposal, took control of BarnBridge’s DAO, and replaced its SMART Yield contract with a malicious version. They used existing USDC spending approvals from about 50 users to take roughly $776,000.
Ajna V2DeFi ProtocolEthereum$775K
Attackers exploited faulty liquidation accounting across Ajna lending pools, sequencing collateral withdrawals and settlement steps so they took collateral without returning enough of the pool’s loan asset. The reported analysis does not specify the amount taken.
WEMIXDeFi ProtocolWEMIX3.0$737K
After gaining administrative control of the WEMIX$ contract, the attacker minted about 5.23 million counterfeit tokens and swapped them for real WEMIX and USDC.e. The funds were then moved across Ethereum and BNB Chain.
