Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Maison GhostUndisclosed
Maison Ghost’s Discord was compromised, and the attacker posted a fake minting link. About 300 NFTs were stolen and sold for 128 ETH; the proceeds were sent to Tornado.
Ronin NetworkDeFi ProtocolBridgeEthereum$624M
Attackers obtained enough Ronin validator keys to approve fake bridge withdrawals, taking 173,600 ETH and 25.5 million USDC. The breach was discovered six days later.
Our coverage: Largest-Ever DeFi Hack: $624M Stolen From Ronin NetworkSourceRekt report
CashioDeFi ProtocolSolana$52.8M
Missing account checks let an attacker use fake collateral to mint about 2 billion CASH tokens, which were exchanged for stablecoins. The exploit caused losses of more than $50 million and sent CASH’s price sharply down.
VEVEUndisclosed
VEVE reported that its system had been exploited, allowing a large number of gems to be obtained illegally.
MekaVerseUndisclosed
Attackers compromised MekaVerse’s official Discord. Community members reported that bots’ wallets may have been stolen, but users were not reported affected.
ArthurUndisclosed
A hot wallet linked to Defiance Capital founder Arthur was suspected of being stolen. On-chain records showed 60 NFTs transferred from the wallet, worth about 310 ETH in total.
OneRingDeFi ProtocolEthereum$1.4M
OneRing’s liquidity pool was drained after an attacker used a flash loan to manipulate the price of its LP token, whose calculation did not average prices over time. The attacker took about 1.45 million USDC.
Li.financeDeFi ProtocolEthereum$600K
Attackers exploited unchecked external calls in LI.FI’s swap contract to take tokens from 29 wallets whose owners had granted unlimited spending approvals. The project fixed the flaw and compensated most affected users.
Umbrella NetworkDeFi ProtocolEthereumBSC$700K
An unchecked flaw in Umbrella Network’s withdrawal function on Ethereum and BNB Chain let attackers withdraw funds without having a balance. They drained liquidity tokens and took about $700,000 from the affected pools.
HubspotUndisclosed
An unauthorized party accessed BlockFi customer data stored by its vendor Hubspot, including names, email addresses and phone numbers. Passwords, government-issued IDs and Social Security numbers were not stored there.
ApeCoinTokenEthereum$820K
An attacker briefly borrowed BAYC NFTs using flash loans, then claimed the ApeCoin airdrop meant for those NFTs because the distribution did not check who owned them before the loan. The attacker sold the tokens for about $820,000 in profit.
APE$500K
An arbitrage bot used a flash loan to temporarily obtain BAYC tokens, redeem them for NFTs, and claim APE airdrop tokens before returning the loan. The loophole let it claim more than 60,000 APE.
Hundred FinanceDeFi ProtocolGnosis Chain$6.2M
An attacker exploited a reentrancy flaw in Hundred Finance’s callback handling, repeatedly borrowing before the contract updated the debt. The attack drained more than $6 million across several markets.
AgaveDeFi ProtocolGnosis Chain$5.5M
Attackers exploited a reentrancy flaw in Agave’s Gnosis Chain contracts, using flash-loaned collateral and a callback to borrow assets before balances were updated. They withdrew assets far exceeding their collateral.
Deus FinanceDeFi ProtocolFantom$3M
Attackers used a flash loan to manipulate prices in trading pools, causing the Muon price oracle to report inflated values. They exploited the resulting price data to steal about $3 million in assets.
ParaluniDeFi ProtocolBSC$1.7M
Paraluni’s MasterChef contract was exploited through a reentrancy bug in a liquidity-deposit function that did not properly validate the pool and update its state before a token transfer. The attacker took more than $1.7 million.
ActiveCampaign（AC）Undisclosed
An attacker accessed information held by email provider ActiveCampaign, which served Unchained Capital. Customer contact and account details, and possibly IP addresses, may have been exposed; Unchained’s own systems were not affected.
Fantasm FinanceDeFi ProtocolFantom$2.62M
A flaw in Fantasm Finance’s mint function let attackers create XFTM without providing the required collateral. They drained about 1,008 ETH from the reserve and converted the proceeds to ETH.
Pirate XDeFi ProtocolBSC$78K
An attacker exploited a flaw in Pirate X’s staking and withdrawal process to sell 9.6 million PXP tokens, making about 212 BNB. The team said a vulnerable token-conversion feature had launched without a security review.
Bacon ProtocolDeFi ProtocolEthereum$1M
An attacker exploited a reentrancy flaw in Bacon Protocol’s lending function, repeatedly calling it before earlier transactions finished and draining about $1 million.
TreasureDAODeFi ProtocolArbitrum$1.4M
A missing check in TreasureDAO’s marketplace let buyers set an invalid quantity and receive ERC-721 NFTs without paying. Some of the stolen NFTs were later returned.
Flurry FinanceDeFi ProtocolBSC$293K
An attacker manipulated Flurry Finance’s rhoToken share accounting to inflate their apparent balance, then redeemed the inflated shares for stablecoins from a strategy vault. About $293,000 in assets was stolen.
OpenSeaNFTfiEthereum$2M
OpenSea users were sent phishing emails posing as official notices about a contract migration. Victims approved malicious transactions that transferred NFTs from 28 wallets to attackers.
Our coverage: Phishing Attack Spells More Trouble For OpenSeaSource
MOXUndisclosed
MOX was hacked because its transferFrom function did not check whether the caller was authorized to transfer the tokens.
RigoBlockDeFi ProtocolEthereum$464K
A missing owner-only restriction let attackers change token allowances in RigoBlock’s Dragos contracts and drain 160.86 ETH from liquidity pools. The attacker later returned 90% of the funds, keeping the rest as a bounty.
TopGoalGamingBSC$1.1M
Attackers compromised TopGoal’s hot wallet, which held tokens for distributing TopPrize rewards, and stole about 4.8 million TMT. They swapped the tokens for BNB and used Tornado Cash to obscure the transfers; user assets and NFTs were unaffected.
Build FinanceDeFi ProtocolEthereum$470K
An attacker took control of Build Finance’s governance, minted more than a billion BUILD tokens and drained liquidity pools and treasury assets, including METRIC tokens. The DAO lost control of key contracts and funds.
Titano FinanceDeFi ProtocolBSC$1.95M
A contractor used a backdoor in Titano Finance’s PLAY contract to change its prize settings and steal 4,828.7 BNB. The funds were later returned to the treasury.
GeminiCEXEthereum$36M
Attackers obtained IRA Financial’s master API key from unencrypted emails with Gemini and used it to move funds from customer subaccounts. They withdrew about $36 million in Bitcoin and Ether before Gemini froze the accounts.
FutureSwapUndisclosed
Human error exposed access credentials for a FutureSwap account holding about 300,000 FST in reward reserves. The attacker used the account to transfer the available tokens to themselves.
Dego FinanceDeFi ProtocolEthereumBSCCronos$10M
Attackers compromised Dego Finance’s deployer private key and used it to drain DEGO liquidity pools on Uniswap and PancakeSwap across Ethereum, BSC and Cronos.
SuperfluidDeFi ProtocolPolygon$8.7M
A flaw in Superfluid’s context checks let an attacker submit forged transaction details naming other users as senders, allowing agreement contracts to transfer their funds. About $8.7 million was taken, affecting Superfluid users and other DAOs.
PayBitoUndisclosed
The LockBit ransomware group said it stole PayBito customer records, email data, password hashes, and administrator data, and published some of the material. It demanded a ransom and threatened to release more data.
Meter.ioDeFi ProtocolBridgeEthereum$7.7M
An attacker exploited a flaw in Meter’s cross-chain bridge deposit function to create fake token deposits and drain about $4.3 million. The incident also caused about $3.3 million in losses to Hundred Finance’s collateral pools.
KLAYswapDeFi ProtocolKlaytn$1.9M
Attackers altered a third-party JavaScript link used by KLAYswap’s website to serve malicious code. It captured users’ transactions and transferred funds to the attackers.
WormholeDeFi ProtocolBridgeSolana$326M returned$326M
Attackers exploited outdated signature verification on Wormhole to mint 120,000 wrapped ETH on Solana without locking equivalent ETH on Ethereum, then exchanged it for real ETH.
The Heart ProjectUndisclosed
Scammers took over The Heart Project’s Discord server, deleted channels, and posted fraudulent links. Users who clicked them reported losing assets, and the project said it would reimburse them.
Bitbns$7.5M
Bitbns later acknowledged that it had been hacked on February 1, but its CEO did not confirm how much was stolen. Reports disagreed on the amount and on whether the exchange initially concealed the incident.
BNSCEX$7.5M
Misconfigured AWS cloud storage exposed backups of BitBNS private keys, which attackers used to drain the exchange’s hot wallets. The theft was reportedly concealed until March 2023.
QubitDeFi ProtocolBridgeBSC$80M
Qubit’s QBridge was exploited because its deposit function accepted a zero-address token without verifying the transfer. The attacker minted fake qXETH collateral and borrowed assets from the lending pools, draining about $80 million.
