Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Skyward FinanceDeFi ProtocolNear$3M
A flaw in Skyward Finance’s treasury redemption process let an attacker buy SKYWARD tokens and redeem them for about 1.08 million NEAR, worth roughly $3 million.
Solend$1.26M
An oracle attack on USDH caused bad debt in isolated pools operated by Stable, Coin98, and Kamino. Solend said its other pools were unaffected.
SaveDeFi ProtocolSolana$1.26M
An attacker drove the price of USDH on Saber from about $1 to $15, inflating its value as collateral on Solend and borrowing from several lending pools. The attack left Solend with about $1.26 million in bad debt.
RubicDeFi ProtocolBridgeEthereum$1.2M
An attacker gained access to the administrator’s private key for Rubic’s bridge and staking rewards, then stole and sold about 34 million RBC/BRBC tokens. Rubic said users’ staked funds were safe and its smart contracts were not exploited.
DeribitCEX$28M
Attackers compromised Deribit’s Bitcoin, Ethereum and USDC hot wallets and stole about $28 million. The exchange covered the loss with company reserves; customer funds in cold storage and Fireblocks vaults were unaffected.
SaveDeFi ProtocolSolana$1.03M
An attacker manipulated the Saber pool price feed used by Solend, pushing USDH from about $1 to $15 through repeated transactions and leaving the protocol with $1.26 million in bad debt.
Eden NetworkUndisclosed
An attacker took control of Eden Network’s deployer account and the EDEN token contract. The attacker said a new token contract would be deployed and offered to return control if Eden Network bought 200 ETH of NEDEN.
FriesDAODeFi ProtocolEthereum$2.3M
An attacker used a flaw in the Profanity vanity-address tool to derive the private key for FriesDAO’s deployer wallet, then stole FRIES governance tokens and other assets from the staking pool. The loss was about $2.3 million.
OpenseaUndisclosed
A flaw in OpenSea’s older Wyvern contracts could let attackers trick users into signing a transaction that handed over control of a proxy contract authorized to withdraw their listed NFTs. The issue did not affect the newer Seaport protocol.
THORChainUndisclosed
A software bug caused THORChain nodes to disagree on transaction memo strings, stopping the network from processing transactions. The network resumed producing blocks after a patch; no funds were lost, though some RUNE exchange deposits and withdrawals were suspended.
Team FinanceDeFi ProtocolEthereum$15.8M
Team Finance’s migration function failed to check that token and trading-pair details matched a user’s locked liquidity. An attacker exploited this to redirect liquidity from four projects into a pool they controlled; some of the stolen funds were later returned.
UvTokenDeFi ProtocolBSC$1.5M
UvToken’s BSC mining pool withdrawal function failed to check caller-supplied addresses, letting an attacker use a malicious contract to drain about 1,078 BNB and 1.16 million BUSD from the vault. Some proceeds were later sent to Tornado Cash.
N00dleSwapDeFi ProtocolEthereum$29K
A reentrancy flaw in N00dleSwap’s ERC777 token-transfer callback let an attacker repeatedly re-enter the contract during transfers and drain about $29,000 in tokens.
ULMEDeFi ProtocolBSC$250K
A flaw in ULME’s access checks let an attacker use a flash loan and manipulate the token price to drain BUSD from authorized spenders. The attacker extracted about 50,646 BUSD after repaying the loan.
QuickSwap MarketDeFi ProtocolPolygon$220K
A flaw in the Curve liquidity-pool price oracle let an attacker use a flash loan to inflate collateral values in QuickSwap’s Market XYZ lending market on Polygon and drain assets, including LDO, MATIC and staked MATIC.
FTX & 3Commas$6M
Phishing websites stole FTX users’ coins and API keys, which were then used with newly created 3Commas accounts; the keys had not come from 3Commas. FTX said it would compensate affected accounts.
Layer2DAODeFi ProtocolOptimism$190K
An attacker gained multisignature access to Layer2DAO’s wallet on Optimism and stole 49.95 million L2DAO tokens, selling some of them. The project later bought back more than 31 million tokens from the attacker.
Gate.ioUndisclosed
Gate.io’s official Twitter account was reportedly compromised and used to post phishing links. The fake site asked users to sign a transaction that could allow their Ethereum assets to be stolen.
VivityUndisclosed
Attackers compromised the Vivity NFT project’s Discord server; the report does not specify any resulting theft or loss.
BlurUndisclosed
A fake Blur account posted a phishing link claiming users could check BLUR token allocations. Blur warned users not to click the link.
Bond ProtocolDeFi ProtocolEthereum$300K
A flaw in Bond Protocol’s Fixed-Expiry Teller let an attacker use counterfeit bond tokens to claim legitimate OHM collateral. About $300,000 was drained, but the attacker returned the funds hours later.
OlympusDAO$292K
An input-validation flaw in OlympusDAO’s BondFixedExpiryTeller contract allowed an exploit of its redeem function, causing a loss of about $292,000. The attacker returned the funds to the DAO.
Ethereum Alarm ClockDeFi ProtocolEthereum$260K
A flaw in Ethereum Alarm Clock’s cancellation refund calculation let attackers claim excessive gas-fee refunds by submitting transactions with inflated fees. They took about 204 ETH.
PetraUndisclosed
A Petra wallet bug could display an incorrect recovery phrase when creating an account in an existing wallet. Petra fixed the issue; the report did not describe any stolen funds.
BitBTCUndisclosed
A bug in the BitBTC–Optimism bridge could let someone create fake tokens on one side and exchange them for real tokens on the other. An attempt to extract 200 billion BitBTC was only a test, and the team fixed the bug.
DataverseUndisclosed
Dataverse reported an attack on its GEO contract on BNB Chain, possibly involving a minting flaw that allowed unlimited tokens to be created. It warned that GEO tokens bought on BNB Chain during the reported period were invalid.
Moola MarketDeFi ProtocolCelo$8.4M
The attacker manipulated the price of low-liquidity MOO tokens to make collateral appear more valuable, then borrowed assets from Moola Market. Most of the proceeds were later returned to the project.
Bitkeep Swap$1.18M
A vulnerability in BitKeep Swap was exploited on BNB Chain, causing about $1 million in losses. The attackers later sent 4,300 BNB to Tornado Cash, a service that obscures the movement of funds.
PLTDUndisclosed
A flash-loan exploit reduced the PLTD balance in a Cake-LP pool to one token, letting the attacker exchange PLTD for all the pool’s BUSD, about 24,497 BUSD in total.
MTDAODeFi ProtocolBSC$702K
A malicious call to MT and ULM token functions bypassed authorization checks and let the attacker extract BNB and BUSD from the MTDAO contracts. The funds were routed through Tornado Cash.
LiveArtXNFTfiEthereum$39K
Attackers compromised LiveArtX’s treasury wallet, whose private key was shared among team members without multi-signature protection, and stole 197 NFTs. They sold the NFTs at low prices and moved some proceeds through other tokens.
Earning.FarmDeFi ProtocolEthereum$1.2M
Attackers exploited EFLeverVault’s flash-loan callback because it did not check who had initiated the loan, enabling unauthorized ETH withdrawals from the collateral pool. One attack was intercepted, while another netted the attacker 268 ETH.
FTXCEXEthereum$70K
FTX’s withdrawal-fee system allowed requests with unusually high gas limits, and the exchange unknowingly paid the extra fees for smart-contract calls that minted XEN tokens for the attacker. The attacker made thousands of such calls without paying the gas costs.
UXD Protocol$20M
UXD Protocol’s funds were exposed to losses from the Mango Markets exploit. UXD said its insurance fund could cover the exposure, paused minting, and said users could redeem UXD once Mango recovered.
Tulip Protocol$2.5M
Tulip Protocol’s exposure to the Mango attack affected part of its USDC/RAY strategy treasury, involving about 2.47 million USDC and 66,722 RAY.
ATK$120K
An attacker used a flash loan to exploit the ATK strategy contract and obtain a large amount of ATK tokens. They exchanged the tokens for about $120,000 in BSC-USD, then began converting and transferring the funds.
MangoDeFi ProtocolSolana$115M
The attacker used large MNGO purchases to inflate the token’s price reported by price feeds, making their collateral appear far more valuable. They then borrowed and withdrew about $100 million in assets from Mango’s lending pools.
TempleDAODeFi ProtocolEthereum$2.3M
TempleDAO’s staking contract failed to restrict access to a function for moving staked funds, allowing an attacker to withdraw xLP tokens and exchange them for TEMPLE and FRAX. The stolen tokens were worth about $2.3 million.
QANplatformDeFi ProtocolEthereum$2M
An attacker recovered the private key to QANplatform’s bridge deployer wallet using a weakness in a vanity-address generator, then withdrew tokens from its Ethereum and BNB bridges. The stolen assets included more than 1.4 billion QANX tokens.
Rabby$190K
A flaw in Rabby Swap let attackers use the contract’s token-swap function to make unchecked external calls. They used it to steal funds from users who had authorized the contract.
