Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Solana$8M
More than 8,000 Solana wallets were accessed without their owners’ knowledge, and SOL and other Solana tokens were transferred out. The cause was not identified in the reports.
Slope FinanceWalletSolana$4.1M
Slope Finance’s mobile apps sent users’ recovery phrases or private keys in plaintext to an external logging service, exposing credentials linked to 9,231 Solana wallets. Attackers drained the affected wallets.
NomadDeFi ProtocolBridgeEthereum$190M
A setup error made Nomad’s bridge accept messages without verifying them, allowing attackers to forge instructions and drain about $190 million. More than $36 million was later returned.
ZBCEXMulti-Chain$4.8M
ZB Exchange’s hot wallet was compromised, and multiple cryptocurrencies, including USDT, were stolen and exchanged for about 2,224 ETH. The exchange suspended deposits and withdrawals, citing a sudden failure.
Reaper FarmDeFi ProtocolFantom$1.7M
A flaw in ReaperVaultV2’s withdrawal function let attackers destroy other users’ vault shares and withdraw tokens from multiple vaults, causing more than $1.6 million in losses.
NirvanaDeFi ProtocolSolana$3.5M
The attacker used a flash loan and manipulated a price feed to buy ANA tokens at an artificially low price, then sold tokens for USDT and repaid the loan. The attack drained about $3.5 million and ANA’s price fell sharply.
AudiusDeFi ProtocolEthereum$6M
A missing safeguard in Audius’s governance contracts let an attacker repeatedly call a function and drain 18 million AUDIO tokens from the community treasury. The attacker exchanged the tokens for about 705 ETH.
LPCDeFi ProtocolBinance Smart Chain$45K
A flash-loan attacker exploited LPC’s transfer function, which miscalculated balances when tokens were sent from an address to itself, and extracted value from the protocol.
NeopetsUndisclosed
Neopets reported a customer-data breach, and a hacker offered the website’s source code and database for sale. The breach may affect 69 million users.
Tableland$45.8K
Attackers compromised Tableland’s Discord, impersonated moderators and directed members to a fake mint website. People who granted the site wallet permissions lost Tableland Rigs and other NFTs.
TablelandUndisclosed
Attackers stole Tableland Discord administrators’ permissions after members ran a malicious script hidden in a bookmark. They used an admin account to post a fake site link that could give them access to visitors’ NFTs.
PREMINTNFTfiEthereum$375K
Attackers compromised PREMINT’s website and inserted malicious JavaScript that tricked users into approving access to all their NFTs. They stole 314 NFTs, including Bored Apes and Moonbirds.
Impermax FinanceDeFi ProtocolEthereumPolygon$9M
Stolen private keys gave an attacker access to Impermax team wallets, from which about 9 million IMX tokens and most protocol-owned liquidity were taken. The team sold tokens and carried out a swap recovery plan; the lending protocol itself was not vulnerable.
DeeKay$150K
Hackers took over NFT artist DeeKay’s Twitter account and used it to direct followers to a fake airdrop site. A victim lost four Cool Cats and three Azuki NFTs, and the stolen NFTs were worth about $150,000.
SpaceGodzillaDeFi ProtocolBSC$25.4K
Using a flash loan, an attacker inflated the price of SpaceGodzilla tokens on PancakeSwap and then swapped them back for BUSD, making a profit of about 25,000 BUSD. The proceeds were converted to BNB and sent through Tornado Cash.
Citizen FinanceDeFi ProtocolBSCPolygon$94.3K
An attacker gained access to Citizen Finance’s private keys on BNB Chain and Polygon and transferred BNB, MATIC and USDC from the protocol.
UniswapDeFi ProtocolEthereum$8M
A phishing campaign airdropped malicious tokens to Uniswap users and lured them to approve transactions that gave attackers access to their assets. The attackers stole cryptocurrency and NFTs, including ETH moved through Tornado Cash.
Omni XDeFi ProtocolEthereum$1.4M
An attacker exploited reentrancy—a contract being called again before its first operation finished—in Omni X’s NFT lending contracts. By making borrowed ETH appear repaid during the exploit, they took 1,300 ETH without clearing the debt; the funds were later sent to Tornado Cash.
BiFiUndisclosed
An attacker exposed the key for BiFi’s server that issued Bitcoin deposit addresses, then signed a fake deposit address. BiFi mistakenly credited the fake deposit, allowing the attacker to borrow 1,852 ETH.
The British ArmyUndisclosed
The British Army’s official Twitter and YouTube accounts were hacked and used to post cryptocurrency and NFT promotions. The posts and video were later removed.
Crema FinanceDeFi ProtocolSolana$8.8M
An attacker bypassed Crema Finance’s checks by creating a fake account used for pool fee calculations, then used flash loans and manipulated price data to drain about $8.78 million. Most funds were later returned after negotiations, with the attacker keeping a bounty.
QuixoticNFTfiOptimism$100K
A missing check on buyers’ signatures in Quixotic’s marketplace contract let an attacker use fake NFT sell orders to take tokens from users who had authorized the marketplace. The team paused activity and reimbursed affected users.
Polygon & FantomUndisclosed
A DNS hijack—redirecting a website through its domain settings—affected RPC interfaces for Polygon and Fantom and was reportedly aimed at stealing users’ seed phrases. Ankr restored the service, and no funds were reported lost.
Quint$130K
A flaw in Quint’s restaking function left reward amounts unchanged, letting an attacker claim the same LP-token rewards repeatedly and steal about $130,000.
MAD$116K
A missing access check let anyone call a sensitive function in the contract holding MAD tokens and transfer those tokens out. The attacker profited by selling the tokens for 556 BNB.
XCarnivalDeFi ProtocolEthereum$3.8M
A flaw in XCarnival’s NFT collateral tracking let an attacker reuse a BAYC NFT to repeatedly borrow funds after withdrawing it, draining 3,087 ETH. The attacker later returned 1,467 ETH after negotiations.
ConvexFinanceDeFi ProtocolEthereum$14K
An attacker hijacked Convex Finance’s website address and redirected visitors to a phishing site with malicious contracts. Some users approved transactions and lost tokens; Convex reimbursed affected users.
Ribbon FinanceDeFi ProtocolEthereum$12K
A DNS hijack sent Ribbon Finance users to a phishing site that prompted them to approve malicious contracts. Two users approved the contracts, and one lost 16.5 WBTC; the team said its contracts remained safe.
HarmonyDeFi ProtocolBridgeEthereumBSC$100M
Attackers obtained and decrypted Harmony Horizon Bridge validator keys, then used unauthorized signatures to steal tokens across Ethereum and BSC. The bridge’s two-of-five signature requirement allowed the theft.
DeFiSaverUndisclosed
DeFiSaver reported an attempted DNS attack, but said its analysis found that no users were affected.
pandorachainDAODeFi ProtocolBSC$128K
A flash-loan attack manipulated asset prices on pandorachainDAO, letting the attacker make profitable trades and take about $128,000 in assets.
whaleswap.financeUndisclosed
A flaw in whaleswap.finance’s trading checks let an attacker use a flash loan—borrowed funds repaid in the same transaction—to exploit the contract and take at least 5,946 BUSD and 5,964 USDT.
SNOODUndisclosed
A reentrancy attack on the SNOOD ERC-777 contract drained the Uniswap V2 pair’s liquidity, taking 104 ETH.
LACOSTEUndisclosed
LACOSTE’s Discord account was hacked, and scammers posted phishing links in its announcements channel.
Babel FinanceUndisclosed
Babel Finance suspended customer withdrawals amid market turmoil. Documents later said proprietary trading losses and liquidations cost the firm about 8,000 BTC and 56,000 ETH.
Inverse FinanceDeFi ProtocolEthereum$5.8M
An attacker used a flash loan to inflate the reported value of collateral in Inverse Finance, then borrowed DOLA against it. The attack caused about $1.3 million in direct losses and $5.8 million in total protocol losses.
KnownOriginUndisclosed
KnownOrigin reported that its Discord server had been attacked and warned users not to click links. The report did not describe any stolen funds.
FswapUndisclosed
The attacker borrowed funds through Biswap and used them to attack Fswap in a malicious loan transaction, making about 1,751 WBNB worth around $500,000.
treasure swapUndisclosed
A missing trading check in two Treasure Swap contracts let an attacker exchange a tiny amount of WETH for all the WETH in the pools. The attacker made 3,945 BNB.
Osmosis$3M
Attackers exploited a liquidity-provider flaw on Osmosis to steal about $5 million, prompting the network to shut down. Two members of a validator’s team said they exploited the bug for about $2 million and would return the funds.
