Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
TokenPocketUndisclosed
Abnormal traffic disrupted access to TokenPocket’s official website, prompting emergency maintenance. The report said user assets were not affected.
Xave FinanceDeFi ProtocolEthereum$635
A fake verification message allowed four malicious proposals to pass Xave Finance’s governance module, minting a huge amount of RNBW tokens. The attacker converted them to xRNBW.
BNB BridgeDeFi ProtocolBridgeBSC$570M
An incomplete check of Merkle proofs in BNB Chain’s Token Hub bridge let an attacker forge proofs and mint 2 million BNB. The chain was paused; about $137 million was moved out before the attack was contained, while $433 million remained frozen.
RES TokenDeFi ProtocolBSC$290K
An attacker used a flash loan to manipulate RES Token’s pool price and repeatedly traded at the inflated price, extracting about $290,000.
BNBChainUndisclosed
Attackers forged proofs submitted to Binance Bridge by exploiting a flaw in how it checked block data, allowing them to claim BNB twice. They stole 1 million BNB in each of two transactions.
SovrynDeFi ProtocolRSK$1.1M
A reentrancy flaw in Sovryn’s old lending pool let an attacker manipulate token prices during withdrawals and take RBTC and rUSDT. The team said half the funds would be recovered and additional losses covered by its treasury.
Transit SwapDeFi ProtocolEthereumBSC$28.9M
A missing check in Transit Swap’s claimTokens function let an attacker pull tokens from wallets that had approved the contract. About $29 million was taken, and some funds were later returned.
MEV Bots$1.5M
After a bot earned 800 ETH from a trade involving cUSDC, an attacker exploited a bug in the bot’s contract and withdrew all 1,101 ETH held there.
BXHUndisclosed
The attacker used a flash loan to manipulate the token price that BXH’s staking contract read from its liquidity pool, then exploited that price to take funds. The contract lost 40,085 USDT, and the attacker kept 31,794 USDT after repaying the loan and fee.
BXH$2.5M
A suspected stolen private key let an attacker call a function in BXH’s VaultPool contract to transfer its assets to their address, including $2.5 million in assets and 38 million BXH tokens. The attacker later moved the funds across chains and sent them to Tornado Cash.
WintermuteOtherEthereum$160M
Attackers derived Wintermute’s DeFi wallet key by exploiting a weak seed used by the Profanity vanity-address generator, which creates custom wallet addresses. The compromised wallet held funds for DeFi operations; other operations were not affected.
GMX V1 EVMDeFi ProtocolArbitrum$565K
Wash trades on centralized exchanges manipulated oracle-reported prices for GMX V1’s AVAX/USD perpetuals, letting an attacker profit from trades with no slippage.
Dogechain$600K
Reports said attackers exploited Dogechain to mint 9.7 million DOGE tokens and moved some funds through a cross-chain bridge; Dogechain’s official account said no funds were lost during maintenance.
New Free DaoDeFi ProtocolBSC$1.25M
A reward calculation based only on the caller’s deposited balance let an attacker use flash loans to claim excessive rewards repeatedly. The attack drained about $1.25 million in WBNB.
Ragnarok Online InvasionGamingBSC$44K
Ragnarok Online Invasion’s ROI token contract left its ownership-transfer function unprotected, allowing an attacker to take control and steal about 158 BNB.
GERADeFi ProtocolEthereum$1.48M
After GERA’s deployer private key was compromised, an attacker transferred ownership of the token’s smart contract to another address, gaining control of the contract.
NereusDeFi ProtocolAvalanche$371K
The attacker used a flash loan and manipulated token prices through trading pools, exploiting the lack of price protection for newly added collateral. They took about $371,000 in USDC from Nereus Finance.
DaoSwap$580K
A flaw in DaoSwap’s swap rewards let users name themselves as their own referrer without verification, earning rewards that exceeded swap fees. The attack took 580,000 USDT.
DAO SwapDeFi ProtocolBinance Smart Chain$580K
DaoSwap’s reward system let users name themselves as their own referrer and claim referral bonuses. Attackers exploited the flaw to collect unauthorized mining rewards; the report does not state the amount taken.
ShadowFiDeFi ProtocolBinance Smart Chain$301K
A flaw let anyone burn SDF tokens in ShadowFi’s liquidity pool. The attacker burned the pool’s tokens and drained its liquidity, making about 1,078 BNB.
Bad Guys by RPFNFTfiEthereumUndisclosed
Bad Guys’ free-mint function failed to enforce its one-NFT-per-wallet limit, letting two accounts mint about 450 of the 1,221 free NFTs.
Kyber NetworkDeFi ProtocolPolygon$265K
Attackers injected malicious code into the KyberSwap website through its Google Tag Manager setup, tricking users into approving transfers from their wallets. Two wallets lost a total of about $265,000.
CUPIDUndisclosed
A flash-loan attack on BNB Chain made about $78,622 and caused CUPID’s price to fall by more than 90%; VENUS rose sharply before falling back.
Bill Murray$174K
Bill Murray’s personal wallet was apparently compromised through a leaked recovery phrase, and about 112 wETH raised for his charity NFT was stolen. The funds were converted to ETH and transferred through several wallets to Binance.
DDC$105K
A flaw that allowed pool fees to be deducted arbitrarily was exploited against DDC, resulting in a loss of about $104,600.
OptiFiUndisclosed
An operational error during an upgrade shut down OptiFi’s Solana mainnet program, and it could not be recovered. About 661,000 USDC was locked, and the team said it would compensate users.
SuiUndisclosed
Sui’s Discord server was reportedly compromised and used to post links. Some users said they lost money after clicking the attackers’ links.
KaoyaswapDeFi ProtocolBinance Smart Chain$118K
A flaw in Kaoyaswap’s swap function let an attacker manipulate token calculations using a flash loan and take 37,294 BUSD and 271.2 WBNB.
SudoRareDeFi ProtocolEthereum$800K
After operating for six hours, SudoRare’s founders used their admin privileges to drain 519 ETH from the platform’s liquidity pool and disappeared.
Rainbow BridgeUndisclosed
An attacker’s attempt to steal funds from Rainbow Bridge was stopped within 31 seconds. The attacker lost 5 ETH in the process.
CelerDeFi ProtocolBridgeMulti-Chain$240K
A DNS attack redirected cBridge users to a fake site with malicious contracts, and users who approved token access had funds drained. Celer’s contracts were unaffected, and the company said affected users would be compensated.
AcalaDeFi ProtocolAcala$52M
A misconfigured incentive mechanism in Acala’s iBTC/aUSD pool allowed aUSD to be minted instead of LP tokens, creating more than 1.2 billion aUSD. The network was paused, and the funds were recovered.
Blur FinanceDeFi ProtocolBSCPolygon$600K
Blur Finance’s developers withdrew $600,000 from its BSC and Polygon contracts, deleted the project’s social media accounts, and disappeared in an exit scam. The token’s price collapsed.
XSTABLE ProtocolDeFi ProtocolEthereumUndisclosed
Incorrect checks in XSTABLE’s smart contract were exploited, causing the XST token price to fall sharply. The protocol’s website and social media channels were taken down.
Curve FinanceDeFi ProtocolEthereum$575K returned$575K
A hijacked DNS provider redirected Curve users to a fake site that prompted them to approve malicious token transfers; Curve’s smart contracts were not affected. At least 362 ETH was stolen, and FixedFloat said it froze some of the funds.
DragomaDeFi ProtocolPolygon$3.5M
Dragoma’s team reportedly used admin privileges to withdraw funds after the token was listed on MEXC, then abandoned the project; the token’s price collapsed.
EGD FinanceDeFi ProtocolBinance Smart Chain$36K
An attacker used a flash loan to manipulate EGD’s price on PancakeSwap, exploiting the protocol’s price-based reward calculation to claim excessive rewards. Funds were unexpectedly withdrawn from the project’s pool.
Steven Galanis$231K
A hacker compromised Cameo CEO Steven Galanis’s wallet and took ApeCoin, ETH, a Bored Ape NFT, Otherside land plots, and other NFTs. The Bored Ape and other NFTs were subsequently sold.
GenomesDAOUndisclosed
A flaw let attackers repeatedly reset key settings in GenomesDAO’s LPSTAKING contract, draining the collateral held there.
VelodromeUndisclosed
A Velodrome team member stole funds from a team-operated wallet, including $350,000 and an earlier $56,000; no user funds were lost. Velodrome later confirmed it had recovered all the stolen money.
