Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
BadgerDAODeFi ProtocolEthereum$120M
An attacker used a compromised Cloudflare API key to add malicious code to BadgerDAO’s website, tricking users into approving token transfers. Assets were taken from about 200 accounts, including bitcoin and ether.
Saddle Finance$11M
Saddle Finance lost $11 million in a theft, and a further $3.8 million was taken during a rescue effort by BlockSec. The available report does not describe how the attack occurred.
MonoXDeFi ProtocolEthereumPolygon$31.4M
An attacker exploited MonoX’s swap function to manipulate the price of its MONO token, then drained about $31 million in assets, including WETH and MATIC, across Ethereum and Polygon.
Visor FinanceDeFi ProtocolEthereum$976K
An attacker manipulated the Uniswap V3 price for Visor’s OHM-ETH liquidity pool to exploit its pool-management contract. The targeted funds were recovered, and Visor said user deposits were safe and losses were covered by its treasury.
LeverDeFi ProtocolBSC$652K
Attackers exploited a flaw in Lever’s borrowing and collateral checks, using flash loans and two contracts to borrow assets without valid collateral. They took multiple tokens worth about $653,000.
dYdX$211K
A vulnerability in dYdX’s deposit contract put user funds at risk. The team moved about $2 million to an escrow contract for owners to reclaim; an MEV bot took about $211,000 during the rescue, and users were compensated.
SnowdogDeFi ProtocolAvalanche$18.1M
SnowdogDAO moved its liquidity into a private pool that required a secret key to use, leaving most holders unable to sell. Three addresses took large amounts of liquidity, while $18.1 million was blocked from holders.
Ploutoz FinanceDeFi ProtocolBSC$365K
An attacker manipulated the DOP token price used by Ploutoz Finance and used DOP as collateral to borrow CAKE, ETH, BTCB and other assets. The borrowed tokens were exchanged for BNB and sent through Tornado Cash.
OlympusDAOUndisclosed
A flaw in OlympusDAO’s bond contract let a user claim 1,697 OHM for bonds that should have paid 59 OHM. The project closed the contract after discovering the issue.
Optics BridgeUndisclosed
Optics Bridge’s recovery mode was activated through its Ethereum GovernanceRouter, allowing a recovery account to take control of the protocol and replace its multisignature permissions. The report said current bridge funds were not at risk.
Formation.Fi$100K
Formation.Fi was attacked using flash loans. Its swapIn function did not properly account for fees and differences in token decimal precision; the report does not say how much was taken.
Phantom GalaxiesNFTfiEthereum$1.1M
Hackers took over Phantom Galaxies’ Discord server and promoted a fake NFT mint, charging users 0.1 ETH and sending the payments to the attackers. They collected 265 ETH before the scam was halted; Animoca Brands later covered the losses.
NerveDeFi ProtocolBridgeBSC$537K
An attacker exploited inconsistent pool-value calculations in Nerve Finance’s fUSDT and UST pools, using flash loans—temporary borrowed funds—to drain their liquidity. The attacker made about 900 BNB.
Curve Finance$30M
Mochi’s USDM project used governance voting to increase rewards and liquidity in its Curve pool, then exchanged 46 million USDM for DAI. This left users providing USDM liquidity on Curve facing potential losses estimated at $30–40 million.
MediaMarktUndisclosed
Ransomware affected MediaMarkt stores across Europe, especially in the Netherlands. The attackers demanded payment in Bitcoin, but the reports do not say that funds were taken or that a ransom was paid.
RobinhoodUndisclosed
An intruder accessed Robinhood’s systems and stole personal information from millions of users, including more detailed account data for some. Robinhood said the breach caused no customer financial losses.
Farmers World$15.7M
Farmers World players reported being unable to obtain RAM after pledging WAXP. Project discussions said a game plug-in may have changed the pledge address to one not controlled by the game; no smart-contract or wallet flaw was identified.
ChainSwapDeFi ProtocolBridgeEthereumBSC$4.4M
A flaw in ChainSwap’s cross-chain bridge authorization checks let an attacker use addresses that were not approved to take control of projects’ Binance Smart Chain contracts. The attacker minted tokens and sold them.
Synapse ProtocolUndisclosed
An attacker manipulated the virtual price of Synapse’s nUSD pool and attempted to move funds through the bridge. Validators rejected the transfer, so about $8.2 million in nUSD was not issued to the attacker and was to be returned to affected Avalanche liquidity providers.
bZxDeFi ProtocolPolygonBSC$55M
A bZx developer opened a phishing document containing malware, which exposed the private keys for the project’s Polygon and BSC deployments. The attacker used the keys to take about $55 million; the Ethereum deployment was unaffected.
Squid GamesGamingBSC$3.38M
The SQUID token allowed purchases but blocked most holders from selling. Its developers withdrew the SQUID/BNB liquidity pool and abandoned the project, leaving buyers with tokens they could not sell.
Vesper FinanceDeFi ProtocolEthereum$3.37M
An unbounded price reported by a Uniswap v3 oracle let an attacker claim excessive VUSD collateral in Vesper Lend’s Rari Fuse pool and borrow other assets. The attacker took about $3.37 million.
Chivo$22.7K
Cristosal received 755 reports from Salvadorans who said their Chivo Wallet identities had been stolen. The report does not say how much money, if any, was taken.
BXHDeFi ProtocolBSC$139M
An attacker obtained BXH’s administrative private key and used it to authorize a transaction transferring tokens from the protocol’s Binance Smart Chain assets to the attacker’s account. The reported amount was $139 million.
AnubisDAODeFi ProtocolEthereum$60M
After raising 13,556 ETH from investors, AnubisDAO redirected the funds to attacker-controlled wallets within 20 hours. The ETH was later laundered through Tornado Cash.
Our coverage: Rug Pull Or Phishing Attack? AnubisDAO Investors Lose 58 Million USD
AutoShark FinanceDeFi ProtocolBSC$580K
An attacker used large trades and flash loans to exploit AutoShark’s swap-mining reward calculation, collecting 3.18 million FINS tokens in one block. The trades bypassed measures intended to limit rewards within a single transaction.
Cream FinanceDeFi ProtocolEthereum$130M
Attackers used flash loans to manipulate the price of yUSD and exploit accounting across Cream Finance’s connected lending and trading protocols. They created unbacked tokens and took about $130 million in assets.
Youtube channelsUndisclosed
Hackers took over YouTube channels, replaced their content, and used them to impersonate technology companies and crypto exchanges in fraud attempts. Some channels were also offered for sale.
Alpha FinanceDeFi ProtocolEthereum$147K
A flaw in how Alpha Homora V2 and Uniswap V2 handled liquidity additions let a MEV bot bypass slippage checks and extract value through a sandwich attack. Twenty Alpha Homora addresses lost a total of 40.93 ETH.
CoinMarketCapUndisclosed
A breach exposed 3,117,548 CoinMarketCap users’ email addresses. Passwords were not included.
Polygon Plasma Bridge$2M
A white-hat researcher reported a Polygon Plasma Bridge flaw that could let someone withdraw the same bridge transaction repeatedly. Polygon fixed the issue before any exploitation was reported.
Avaterra FinanceUndisclosed
Anyone could call Avaterra Finance’s token-minting function, allowing an attacker to create and sell thousands of tokens. The project’s contract was described as a modified fork of Goose Finance.
Pancake HunnyUndisclosed
Pancake Hunny was hit by a flash-loan attack, and the HUNNY token’s price fell sharply. The incident involved hundreds of transfers, many related to Alpaca tokens; the report does not give a confirmed amount stolen.
Glide FinanceDeFi ProtocolElastos$300K
A fee-setting error in Glide Finance’s contract allowed attackers to drain funds from its matching contract: the team changed the fee parameter but left the contract using the old value. The loss was about $300,000.
Indexed FinanceDeFi ProtocolEthereum$16M
An attacker used flash loans to distort the balances of Indexed Finance’s DEFI5 and CC10 pools, buy their component tokens at discounted prices, and drain the pools in one transaction. The loss was about $16 million.
OpenSeaUndisclosed
A security researcher found a vulnerability in OpenSea that could have let hackers steal users’ entire crypto wallets. OpenSea said it fixed the issue within an hour; the report does not describe any funds taken.
Mirror ProtocolDeFi ProtocolTerra$90M
Attackers exploited a flaw in Mirror Protocol’s collateral-unlock logic, using duplicate IDs to unlock more collateral than they were entitled to. They drained about $89.7 million before the exploit was detected.
StarkWareUndisclosed
StarkWare confirmed an urgent security issue affecting a specific user, but said it was not a vulnerability in dYdX. The issue’s details and any loss of funds were not disclosed.
My Farm Pet$31.4K
My Farm Pet was suspected of being hit by a flash-loan attack, in which borrowed funds are used within a single transaction to manipulate a market or contract. Its token price fell about 80%; the report does not specify funds stolen.
Lido FinanceUndisclosed
Lido found a contract flaw that could have allowed whitelisted node operators to steal a small portion of user funds. The team applied short-term fixes; no theft was reported.
