Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
OptimismUndisclosed
Optimism sent 20 million OP tokens to a multisignature address that Wintermute could not control on Optimism, allowing an attacker to take them. The attacker returned 17 million; another 1 million was sent to Vitalik and returned.
OsmosisDeFi ProtocolOsmosis$5M
A flaw in Osmosis’s JoinPoolNoSwap function let liquidity providers withdraw 50% more than they had added, putting the pools at risk of being drained. The chain halted to limit losses, and Osmosis Labs said strategic reserves would cover them.
ApolloXDeFi ProtocolBSC$2.15M
A flaw in ApolloX’s trading rewards signature system let an attacker generate signatures and withdraw APX tokens without proper checks. The tokens were exchanged for BUSD.
Gym NetworkDeFi ProtocolBSC$2.1M
A missing caller check in GYM Network’s deposit function let an attacker create deposit records without transferring tokens, inflating balances and draining about 2,476 WBNB. The funds were moved through Tornado Cash.
Equalizer FinanceDeFi ProtocolEthereumBSCPolygon+1 chains$50K
Flash loans were used to manipulate Equalizer vault balances and exploit a flawed withdrawal calculation across four chains, allowing more assets to be withdrawn than the attacker was entitled to. Equalizer said it covered all losses, while another report said some funds remained unaccounted for.
ElrondDeFi ProtocolElrond$113M
A newly added blockchain function let an attacker create and take nearly 1.65 million EGLD, converting some into unbacked WEGLD. The team recovered and burned the illegal tokens, and said nearly all stolen funds were recovered.
WintermuteDeFi ProtocolOptimism$17.6M
Wintermute’s Optimism token deposit was sent to an address whose multisignature wallet contract had not yet been deployed on Optimism. An attacker deployed the contract first and took control of the address, stealing 20 million OP tokens.
BAYC&OthersideNFTfiEthereum$257K
Attackers took over a BAYC community manager’s Discord account and posted fake giveaway links that led users to approve malicious contracts. They stole 32 NFTs and more than $257,000 in ETH.
fomo-dao$110K
The fomo-dao project was reportedly attacked, and the attacker made about $110,000, which was transferred to Tornado Cash.
Homeless FriendsUndisclosed
Homeless Friends’ Discord was compromised, and the attacker used it to promote a phishing website.
CoFiXProtocol$140K
Attackers manipulated prices on CoFiXProtocol on BNB Chain and made about $140,000.
Mirror Protocol$2M
A price-oracle vulnerability in Mirror Protocol was exploited, exhausting pools tied to Bitcoin, Ethereum and Polkadot and causing more than $2 million in losses.
Mirror ProtocolDeFi ProtocolTerra$2M
A flaw in Mirror Protocol’s collateral-unlock controls let attackers withdraw funds over several months before the issue was found. A separate exploit during the LUNC-LUNA2 transition also caused losses.
NovoUndisclosed
Novo was suspected of an attack; 280 BNB were transferred to Tornado Cash, a service that obscures cryptocurrency transactions.
LUNC$800K
A faulty LUNC price feed showed a price far above the market price, letting an Anchor user deposit Lido-bonded Luna tokens and borrow UST against them. The user withdrew the funds and profited.
AnchorDeFi ProtocolTerra$800K
A frozen Chainlink price feed left Anchor valuing bLUNA collateral at an outdated minimum price. An attacker used the inflated collateral value to borrow UST, making a profit before Anchor froze the markets.
HackDaoDeFi ProtocolBinance Smart Chain$65K
An attacker used flash loans and HackDao’s flawed token-fee accounting to repeatedly borrow and liquidate against themselves without repaying, extracting 200 BNB before the theft was detected.
bDollarUndisclosed
An attacker manipulated bDollar’s price and exploited a flaw in its CommunityFund liquidity function, which could use the project’s own funds after the price was raised. The attacker made a profit of 2,381 WBNB.
LlamascapeNFTfiEthereum$70K
Attackers phished Llamascape staff accounts on Discord and used them to post a fake mint link. Users who interacted with the malicious contracts lost about 30–40 ETH.
Kronos DAOUndisclosed
Kronos DAO used users’ DAI deposited in its vaults to invest in Kairos Cash; the investment resulted in a reported loss of 6 million DAI. The project described it as a strategic investment, while investors questioned the lack of advance notice.
QANX BridgeDeFi ProtocolBridgeEthereum$707K
Attackers used compromised QANX Bridge credentials to withdraw QANX tokens and sell them for ETH, which was then transferred through Tornado Cash.
Feminist MetaverseDeFi ProtocolBinance Smart Chain$540K
An attacker used a flash loan to exploit the FM token’s skim mechanism, route 75.15 million FM tokens through a trading pair and sell them. The attacker extracted 1,838 BNB and sent it to Tornado Cash.
SethGreenNFTfiEthereum$300K
A phishing site impersonating Gutter Cat Gang compromised Seth Green’s wallet, and a scammer sold four NFTs, including a Bored Ape. Green later recovered the Bored Ape through negotiation.
Alien FrensUndisclosed
Alien Frens’ Discord was attacked, and the project warned users not to click minting links. No stolen funds were reported.
Lazy LionsUndisclosed
The Lazy Lions Discord server was hacked. Reports said the incident may have involved MEE6 staff being able to assign themselves roles remotely across servers; no stolen funds or assets were specified.
Axie InfinityUndisclosed
Attackers compromised the Mee6 bot on Axie Infinity’s main Discord server and used it to give a fake Jiho account permission to post a fraudulent mint announcement. The announcement was removed; no stolen funds were reported.
FEG$1.9M
Attackers used flash loans to exploit FEG’s swapToSwap function, which trusted user-supplied transaction paths without checking them. This let them access and steal assets held by the contracts on BNB Chain and Ethereum.
FEG TokenTokenBinance Smart ChainEthereum$1.9M
Attackers used flash loans to exploit FEG’s swapToSwap function, which did not validate user-supplied transaction paths. This let them gain access to contract funds and drain assets across Ethereum and BNB Chain.
天穹Undisclosed
Hackers used false balances on the Tianqiong digital collectibles platform to buy and steal users’ collections, which were then sold at sharply inflated prices.
Scream$35M
Scream continued valuing FUSD and DEI at $1 after their market prices fell, allowing users to deposit them cheaply and withdraw other stablecoins from the lending platform. This left about $35 million in bad debt and blocked withdrawals for users with deposits in the drained stablecoins.
FEG$1.3M
FEG was suspected of being attacked, with about 143 ETH and 32,747 BNB taken.
QuickswapDeFi ProtocolPolygon$108K
Attackers took control of QuickSwap’s GoDaddy-hosted DNS and redirected users’ swaps through attacker-controlled contracts, causing users to lose about $107,600 before the domain was recovered.
SpiritSwapDeFi ProtocolFantom$18K
Attackers tricked a GoDaddy employee into giving them control of SpiritSwap’s domain, then used a fake site with altered swap settings to redirect users’ funds. About $18,000 was stolen before the site was shut down.
CoinGecko&Etherscan&DeFi PulseUndisclosed
Malicious pop-ups on cryptocurrency websites prompted visitors to connect their MetaMask wallets. The CoinGecko founder suspected a malicious ad script, and the pop-up promoted a fake Bored Ape Yacht Club site; no losses were reported.
Blizz FinanceDeFi ProtocolAvalanche$8.3M
When Chainlink’s LUNA price feed stayed at $0.10 during Terra’s collapse, attackers deposited LUNA and borrowed other assets against its overstated value from Blizz Finance. They drained the protocol’s funds.
Venus ProtocolDeFi ProtocolBinance Smart Chain$11.2M
When Chainlink stopped updating LUNA prices during extreme volatility, Venus’s lending market kept valuing LUNA far above its market price. Attackers used LUNA as collateral to borrow other assets, leaving the protocol with about $11.2 million in losses.
Drift TradeDeFi ProtocolSolana$14.5M returned$14.5M
Bugs in Drift Protocol’s withdrawal, leverage and insurance-fund rules were exposed during the LUNA collapse. Users withdrew more than the protocol could cover, leaving a shortfall.
X2Y2NFTfiEthereum$200K
Scammers used Google Ads to direct users to fake X2Y2 websites that appeared to match the legitimate address, then tricked them into connecting their wallets to phishing contracts. About 100 ETH was stolen from users.
OWNLYDeFi ProtocolBinance Smart Chain$37K
A missing claim-status check in OWNLY’s unstaking function let an attacker repeatedly claim tokens from the staking contract, then exchange them for 115 BNB.
Fortress ProtocolDeFi ProtocolBSC$2.98M
An attacker passed a Fortress governance proposal with insufficient voter support to sharply raise the value of FTS collateral, then manipulated an oracle—a price data source—and borrowed against it. They took about 1,048 ETH and 400,000 DAI.
