Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
OpenSeaNFTfiEthereum$1M
A bug left some NFTs listed through OpenSea’s API after they appeared delisted. Attackers bought them at old, below-market prices and resold them, extracting more than $1 million in total.
MetaMaskUndisclosed
MetaMask automatically loaded NFT image URLs, allowing an attacker who sent a target an NFT with a URL they controlled to learn the target’s IP address from server logs. No funds were reported stolen.
Crypto.comCEXEthereumBitcoin$33.7M
Attackers made unauthorized withdrawals from 483 Crypto.com accounts, taking ETH, BTC and other currencies. Crypto.com said it blocked most withdrawals and reimbursed users for the rest.
MultichainDeFi ProtocolEthereum$1.4M
A flaw in token approval calls let an attacker take tokens from users who had previously approved the affected Multichain contracts. About $3 million was lost; a white-hat responder returned some funds and kept a bounty.
CrosswiseDeFi ProtocolBSC$879K
A publicly accessible privileged function in Crosswise’s MasterChef contract let an attacker take control of owner permissions and withdraw 692,000 CRSS tokens. The attacker swapped them for WBNB and moved some funds through Tornado Cash.
Crypto BurgerGamingBSC$770K
Crypto Burger’s BURG token contract let anyone burn tokens in its PancakeSwap liquidity pool, distorting the token’s price. Attackers used flash loans—temporary borrowed funds—to exploit the flaw and take BNB from the protocol.
wxBTRFLYUndisclosed
A flaw in the wxBTRFLY token’s transferFrom function incorrectly changed spending permissions, putting affected users’ assets at risk. The project responded by moving those assets to a multisignature wallet, which requires several authorized signers.
Float ProtocolDeFi ProtocolEthereum$1.16M
An attacker manipulated the thinly traded FLOAT/USDC pool on Uniswap V3, causing its price feed to report an artificially high FLOAT price. They used FLOAT as inflated collateral to borrow assets from Rari Capital’s pool; some funds were later returned.
CityDAODAOEthereum$95K
An attacker hijacked a CityDAO Discord administrator account and posted a fake land airdrop linking to a phishing site. Users who connected their wallets and approved fraudulent transactions lost 29.67 ETH.
LooksRareUndisclosed
LooksRare was hit by a denial-of-service attack, which briefly took the NFT marketplace offline and prevented some users from connecting wallets or listing NFTs. The team restored the site.
LympoNFTfiEthereum$18.7M
Attackers compromised Lympo’s hot wallets and stole 165.2 million LMT tokens, then swapped them for ETH. The token price fell sharply; cold-wallet reserves remained secure.
Arbitrum OneUndisclosed
Arbitrum One stopped producing new blocks and processing transactions for more than two hours, and MetaMask could not connect to the network.
LCXDeFi ProtocolEthereum$7.94M
Attackers gained unauthorized access to LCX’s Ethereum hot wallets and stole nearly $8 million in tokens and stablecoins. About 60% of the funds were frozen or recovered with law enforcement’s help.
StoboxCompanyUndisclosed
StoboxCompany said an attacker obtained the private key for its token deployer address, enabling the theft or liquidation of reserve funds on Ethereum and BSC.
Arbix FinanceDeFi ProtocolBSC$10M
Arbix Finance’s administrators used their token-minting privileges to drain about $10 million in user funds, then moved the money through AnySwap. The team’s website and social accounts disappeared.
SolanaUndisclosed
Solana experienced heavy congestion and failed transactions for about four hours. A DDoS attack was debated as a possible cause, but co-founder Anatoly Yakovenko denied that one occurred; no theft was reported.
DefiChainChainBridgeDefiChainUndisclosed
A fee-calculation flaw in DeFiChain’s atomic swaps let attackers substitute BTC for DFI while keeping the same numerical fee, causing excessive fees to be paid in BTC-denominated assets. The flaw also allowed unbacked dBTC to enter circulation.
Tinyman PoolsDeFi ProtocolAlgorand$3M
A flaw in Tinyman’s liquidity withdrawal process let attackers receive the same token twice instead of one of each pool token, extracting more liquidity than authorized. Others copied the attack, causing losses across multiple pools.
Vesper Finance$1M
An attacker manipulated the oracle—a source of price data—for Vesper Lend’s beta lending pool and depleted it of DAI, ETH, WBTC and USDC. The funds were taken from the beta pool, not Vesper’s main contracts.
SashimiSwapDeFi ProtocolEthereum$210K
A flaw in SashimiSwap’s swap logic let an attacker use a flash loan—a temporary loan repaid in the same transaction—to exploit token pairings and extract value. The attacker made nearly $200,000 in tokens.
Monkey Kindom$1.3M
Hackers exploited a vulnerability in Grape, a Solana user-authentication service, to take over an administrative account and post a phishing link in Monkey Kingdom’s Discord announcement channel. Community members lost about $1.3 million in SOL.
Monkey KingdomNFTfiSolana$1.3M
Attackers took over Monkey Kingdom’s Discord and impersonated administrators, posting fake minting links that led to malicious sites. Users who connected their wallets and approved transactions lost SOL tokens.
Visor Finance$8.2M
An attacker exploited a permissions flaw in Visor Finance’s RewardsHypervisor contract to create fake staking credentials and mint more than 8.8 million VISR tokens. The attacker sold the tokens and moved proceeds through Tornado Cash.
GammaDeFi ProtocolEthereum$4.5M
An infinite-mint flaw in Gamma Strategies let an attacker create unlimited tokens and exchange them for other assets, causing losses of at least $4.5 million.
Bent FinanceDeFi ProtocolEthereum$1.75M
An insider added a backdoor—a hidden way to alter contract behavior—to Bent Finance’s contracts and stole 513,000 cvxcrv liquidity-pool tokens. The funds were later returned, with a shortfall covered by the project and community.
Fractal$150K
A hacker took over Fractal’s Discord server and tricked 373 members into sending 800 SOL, worth about $150,000. Fractal said it would fully compensate those affected.
GrimFinanceDeFi ProtocolFantom$30M
A missing reentrancy guard in Grim Finance’s vault let attackers make nested calls during deposits and repeatedly count false collateral. The attack drained more than $30 million from the protocol.
WePiggy$400K
A temporary error in WePiggy’s CHE price feed made the asset appear far more valuable than its market price. This caused abnormal liquidations of users who had borrowed CHE.
CoinMarketCapUndisclosed
A data error caused CoinMarketCap to display incorrect prices for multiple cryptocurrencies. No theft or loss of funds was reported.
NerveBridgeDeFi ProtocolBridgeBSC$537K
A flaw in Nerve Bridge’s MetaPool swap function undervalued LP tokens, letting an attacker use a flash loan to obtain inflated tokens and then extract extra fUSDT and BUSD liquidity. The attacker profited 900 BNB.
Vulcan ForgedDeFi ProtocolEthereumPolygon$140M
An attacker compromised Venly’s semi-custodial servers and obtained credentials to access Vulcan Forged users’ wallets, stealing more than 4.5 million PYR. The project later returned most or all of the stolen tokens to affected wallets.
DharmaUndisclosed
Dharma Wallet experienced a service outage, then reported that service had returned to normal and all funds were safe.
DefinerUndisclosed
Definer’s oracle on OEC used the balance of a single liquidity pool at one moment to set token prices, making those prices vulnerable to manipulation. The report does not specify what funds, if any, were taken.
AscendEXCEXEthereumBSCPolygon$77M
Attackers used compromised private keys to make unauthorized transfers from AscendEX hot wallets across Ethereum, BSC, and Polygon, stealing about $77.7 million in tokens. The exchange’s cold wallets were not affected.
Gelato Network$744K
A vulnerability in Sorbet Finance’s G-UNI router, which affected users of its website, allowed attackers to steal $744,000. White-hat hackers moved $27 million in other assets to protect them.
ONUSUndisclosed
Attackers exploited a Log4j vulnerability in ONUS’s payment system to steal a database containing nearly two million users’ personal and identity-verification data, along with hashed passwords. They later sold customer data after ONUS did not pay the full ransom.
8ight FinanceDeFi ProtocolHarmony$1.75M
Attackers obtained 8ight Finance developers’ private keys after they were shared through Facebook chat and Google Drive without encryption, then stole about $1.75 million from the treasury.
PIZZADeFi ProtocolEOS$5M
An integer overflow in PIZZA’s eCurve let an attacker create Tripool tokens without backing. They used the tokens as collateral to borrow assets from the protocol, causing about $5 million in losses.
BitMartCEXEthereumBSC$196M
Attackers compromised BitMart’s Ethereum and BNB Chain hot wallets and stole cryptocurrency from them. Other wallets were reported unaffected.
Our coverage: BSC Wallets Compromised As Well – Damages In The Bitmart Hack Grow To 196 Million USDSourceRekt report
PolygonDeFi ProtocolPolygon$2.04M
A transfer function in Polygon’s PoS genesis contract lacked balance and allowance checks, enabling theft of MATIC. An attacker stole 801,601 MATIC before the vulnerability was fixed; the larger potential theft was prevented.
Our coverage: 8,01,601 MATIC Stolen Before Polygon Fixes BugSource
