Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
OpenSeaUndisclosed
Attackers compromised OpenSea’s Discord and posted fake links to a supposed limited NFT mint in bot accounts. No stolen funds were reported.
MM.finance$2M
A DNS attack let an attacker alter MM.finance’s website to show malicious contract addresses. Users’ assets were stolen and moved to Ethereum, then through Tornado Cash.
MM Finance CronosDeFi ProtocolCronos$2M
Attackers compromised MM.Finance’s website address system and inserted a malicious contract address. Users who swapped tokens or added or removed liquidity had funds siphoned away; about $2 million in CRO was stolen.
Rainbow BridgeUndisclosed
An attacker submitted forged blocks to Rainbow Bridge, but an automatic watchdog stopped the attempt and the attacker lost 2.5 ETH.
Fei Protocol & Rari CapitalDeFi ProtocolEthereumArbitrum$80M
An attacker exploited a reentrancy flaw—a bug that lets a contract call itself before finishing an earlier transaction—in Rari Capital’s Fuse lending pools. Using a flash loan, they borrowed and withdrew funds before the records updated, taking about 28,380 ETH and other assets.
SolanaUndisclosed
Metaplex reportedly discontinued part of its program, and a test transaction was described as charging 0.01 SOL in labor fees, with collected penalties going to the Candy Machine instance’s configuration account. The report does not describe a theft.
Saddle FinanceDeFi ProtocolEthereum$11M
A flaw in Saddle Finance’s stablecoin pool pricing let an attacker use flash loans—temporary loans repaid in one transaction—to manipulate swaps and drain funds.
Babylon Finance$3.4M
Babylon Finance lost about $3.4 million when attackers exploited a vulnerability in Rari Capital, its main lending pool. The project later announced it would shut down and distribute its remaining funds to holders.
Deus FinanceDeFi ProtocolFantom$13.4M
An attacker used a flash loan to manipulate the DEI price reported by an oracle reading a Solidly trading pool, then used the inflated price to borrow and drain funds from Deus Finance.
BAYCUndisclosed
Attackers took over Bored Ape Yacht Club’s official Instagram account and stole 91 NFTs, including BAYC, MAYC and BAKC items.
Wiener DOGEDeFi ProtocolBSC$30K
A flash-loan attacker exploited Wiener DOGE’s transfer fees, which were also charged on liquidity-pool trades, to drain tokens from the pools and unbalance their prices. The attacker profited about 78 BNB.
Last Kilometer$26.5K
Last Kilometer was exploited in a flash-loan attack, resulting in a loss of $26,495.
PI-DAO$6.45K
PI-DAO was exploited in a flash loan attack, resulting in a loss of $6,445.
Medamon$3.16K
A flash-loan attack exploited Medamon and resulted in a loss of $3,159.
AkutarsUndisclosed
Code flaws in Akutars’ auction contract permanently locked 11,539.5 ETH, preventing withdrawals. The report said problems with bidder and auction counts, as well as the withdrawal function, left the funds stuck.
TerraChainTerra$4.31M
Scammers placed fake Google ads for Terra projects that led users to phishing sites asking for wallet recovery phrases. The attackers used those phrases to drain about 52 wallets, taking roughly $4.31 million.
ZEEDDeFi ProtocolBSC$1M
An arithmetic error in ZEED’s reward calculations let an attacker manipulate the distribution and extract about $1 million. The funds remained in the attack contract, according to the report.
BeanstalkDeFi ProtocolEthereum$181M
An attacker borrowed funds to gain enough temporary voting power to pass malicious Beanstalk proposals, then drained protocol assets. They also sent funds to a Ukraine charity; reports differ on the total stolen and how much the attacker kept.
Our coverage: Can Beanstalk Recover From The Most Recent DeFi Hack?SourceRekt report
Ugly PeopleUndisclosed
Attackers compromised the Ugly People NFT project’s Discord and used it to spread fake minting links. No losses were reported.
MetaconzUndisclosed
A malicious bot installed on a Metaconz team administrator’s Discord account led 79 users to lose 11.9 ETH. The attacker used a wallet-approval function to take control of victims’ wallets; the team said it would compensate users.
FaceDAOUndisclosed
An unauthorized account transferred and sold FACE tokens held by the FaceDAO team. The amount was not reported.
Rikkei FinanceDeFi ProtocolBSC$1.1M
A missing permission check let an attacker change Rikkei Finance’s price oracle, the service supplying asset prices, and borrow assets from its lending pools using artificially inflated collateral values.
Elephant MoneyDeFi ProtocolBSC$22.2M
An attacker used flash loans and a manipulable price feed to raise ELEPHANT’s price, then exploited weak safeguards in Elephant Money’s TRUNK redemption process. The attack resulted in a loss of about $22.2 million.
CF$1.9M
A flaw in the CF token contract let anyone transfer tokens from other users’ balances, causing losses and disrupting CF trading.
CF TokenTokenBSC$1.9M
CF Token’s public transfer function did not verify the source address, allowing an attacker to move tokens from holders without permission. The attacker transferred 4.2 million CF tokens, swapped them for more than 4,200 BNB, and sent the proceeds through Tornado Cash.
Marvin InuUndisclosed
Marvin Inu’s cross-chain bridge was exploited, and tokens worth 110 ETH were stolen and sold, sharply lowering the token’s price. The project closed the bridge and fixed the vulnerability.
UGCUndisclosed
Hackers took over India’s Education Grants Council Twitter account, changed its profile to impersonate an Azuki NFT creator, and posted a fake airdrop link. The agency recovered the account after six hours.
Starstream Finance & AgoraDeFi ProtocolEthereum$4M
An unprotected function in Starstream Finance’s treasury contract let attackers withdraw tokens. They then used those tokens as collateral to borrow about $8.2 million from Agora.
WonderHeroGamingBSC$320K
Attackers compromised WonderHero’s hot-wallet keys, reportedly through phishing for the wallet’s recovery phrase, and stole about $320,000 in BNB.
Vires Finance$530M
Vires Finance suffered reported losses exceeding $530 million, but the description does not establish how the funds left. Its founder denied allegations that his wallet was linked to the outflow.
Our coverage: “Infamous” Vires Finance Governance Vote FailedSource
Inverse FinanceDeFi ProtocolEthereum$15.6M
An attacker manipulated INV’s price feed by adding ETH to a SushiSwap trading pool, making INV appear more valuable. They used the inflated token as collateral to borrow DOLA, ETH, WBTC and YFI from Inverse Finance.
Multiple NFT projectsUndisclosed
Discord servers for several NFT projects were attacked, and the source code for the Captcha verification bot was leaked; the Ticket tool for private messages was also attacked. The reports do not describe any stolen funds.
Ola FinanceDeFi ProtocolFuse$4.67M
A reentrancy flaw let an attacker repeatedly withdraw collateral without repaying loans, draining Ola Finance’s markets. The stolen assets were moved to Ethereum and BNB Chain.
Voltage Finance$4M
Voltage Finance was exploited through its partner Ola Finance, resulting in losses of about $4 million. The reports do not specify how the exploit worked.
BasketDAOOrgDeFi ProtocolEthereum$1.2M
An input-validation flaw in BasketDAO’s BMIZapper contract let an attacker make arbitrary external calls and drain crypto assets the contract was approved to use. Users lost about $1.2 million.
Jet ProtocolUndisclosed
A flaw in Jet Protocol could have allowed attackers to withdraw tokens from accounts they did not control. The team fixed it; no actual theft was reported.
CryptovoxelGamingEthereum$171K
An attacker used a vulnerable Cryptovoxels Discord bot to post a phishing link, tricking users into approving malicious wallet transactions. The approvals let the attacker steal NFTs, which were then sold on OpenSea.
Revest FinanceDeFi ProtocolEthereum$2.01M
A reentrancy flaw—a bug that lets a contract call back into itself before a transaction finishes—allowed an attacker to create multiple NFTs linked to the same pool and drain about $2 million in tokens.
AuctusDeFi ProtocolEthereum$726K
An attacker used a beta Auctus contract that allowed arbitrary calls to drain funds from users’ wallets if they had given the contract unlimited spending approval.
InuSaitamaUndisclosed
InuSaitama reportedly suffered an arbitrage attack: an attacker swapped SAITAMA tokens through Saitamask and Uniswap, then converted them to ETH and transferred the proceeds.
