Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Liquid NetworkUndisclosed
A block-signature problem after a Liquid Network upgrade stopped new blocks from being produced for more than seven hours. The network said user funds were safe and unaffected.
Compound$68.8M
Compound’s liquidity-mining token distribution contract had a known flaw, and a call to its drip() function triggered another distribution of COMP tokens while the team was trying to fix the issue.
pNetworkDeFi ProtocolBridgeBSCBitcoin$13M
An attacker forged withdrawal event records for pNetwork’s cross-chain bridge, and its software processed them without checking that they came from authorized contracts. The attacker took 277 BTC, worth about $13 million, in wrapped form on BSC.
AutoShark FinanceUndisclosed
An attacker used flash loans to exploit AutoShark Finance’s exchange-mining function, collecting FINS rewards while occupying most of the mining pool. They exchanged the 3.18 million FINS gained for 1,388 BNB.
POAPUndisclosed
Hackers compromised POAP’s badge-minting system and fraudulently issued NFTs associated with artists XCOPY and Polygonal Mind. At the artist’s request, POAP burned the affected NFTs.
CoinbaseCEXUndisclosed
Attackers exploited a flaw in Coinbase’s SMS account recovery to bypass two-factor authentication and drain customer accounts. Coinbase fixed the process and reimbursed affected users.
CompoundDeFi ProtocolEthereum$147M
An off-by-one error in Compound V2’s COMP distribution logic caused users to claim far more tokens than intended after a governance proposal took effect. Deposits and borrowed funds were reported not to be at risk.
BitfinexUndisclosed
A transaction from a Bitfinex wallet was mistakenly charged 7,676.62 ETH in gas fees because of a software and display issue. Miners returned 7,626 ETH, keeping 50 ETH as a refund fee.
Bitcoin.org$17K
Attackers changed Bitcoin.org’s homepage to display a fake offer promising to double Bitcoin sent to a listed address. Reports say they stole more than $17,000.
Vee.FinanceDeFi ProtocolAvalanche$34M
An attacker manipulated prices on the Pangolin exchange, which Vee Finance relied on as its only price source, then used the distorted prices to steal BTC and ETH. The platform suspended its contracts and deposits and withdrawals; its stablecoin funds were reported unaffected.
pNetworkUndisclosed
An attacker exploited the pBTC-on-BSC bridge and stole 277 BTC from its collateral. Other pToken bridges were also targeted but were reported unaffected.
JayPegs AutomartDeFi ProtocolEthereum$3.1M
Malicious code added to the MISO frontend redirected proceeds from JayPegs Automart’s DONA auction to the attacker’s wallet. The $3.1 million in funds was later recovered.
DefiboxUndisclosed
An incompatibility between Defibox’s swap contract and the EMOON token caused the EOS–EMOON pool to lose about 4,863 EOS. Defibox suspended the swap contract, fixed the issue, and said its foundation would pay the loss to the EMOON community.
MISOUndisclosed
Malicious code on the MISO launchpad’s website changed the DONA auction’s payment address to the attacker’s wallet, diverting 865 ETH. The attacker later returned the funds to SushiSwap in three transactions.
NowswapDeFi ProtocolEthereum$1.07M
A flaw in Nowswap’s pool-balance checks let an attacker use a flash loan and repeated swaps to take nearly all the USDT and WETH in a liquidity pool, profiting about $536,000 in USDT and 158 WETH.
Secret NetworkUndisclosed
A vulnerability in a SecretSwap smart contract let an attacker take funds from the SEFI staking contract. Secret Network upgraded its mainnet to prevent further losses; its SCRT token and cross-chain bridge contract were not affected.
Klondike FinanceUndisclosed
Klondike Finance was attacked, losing about 35,281.71 KXUSD, reported as equivalent to 6.5629 WETH.
SolanaUndisclosed
A surge of automated transactions during a token sale overwhelmed Solana’s network, causing validator computers to crash and the blockchain to stop confirming new blocks. The network was restarted and restored; no financial loss was reported.
Arbitrum OneUndisclosed
A bug caused Arbitrum One’s transaction sequencer to stall when it received many transactions at once, interrupting service for 45 minutes. Funds were not at risk, and the team deployed a fix.
Zabu FinanceDeFi ProtocolAvalanche$3.2M
Zabu Finance’s farm contract failed to account for token transfer fees, crediting the attacker with more ZABU than was actually transferred. The attacker withdrew 4.5 billion ZABU and sold it into liquidity pools, with losses estimated at $3.2 million.
OpenSea$100K
A vulnerability in OpenSea’s NFT transfer process sent at least 42 NFTs, including an ENS domain, to an uncontrolled burn address, where they could no longer be moved. OpenSea reportedly fixed the flaw.
dYdXUndisclosed
An error during deployment of dYdX’s staking contract changed the conversion rate so users received no stkDYDX when staking DYDX. Funds remained locked in the contract, and the project proposed restoring access and compensating affected users for missed rewards.
DAO MakerDeFi ProtocolEthereum$4M
An unprotected initialization function let an attacker reset DAO Maker’s vesting contracts and take ownership, then use an emergency withdrawal function to steal tokens intended for distribution. The tokens were exchanged for about $4 million in DAI.
Banksy$5K
A scammer used a page on Banksy’s website to advertise a fake NFT auction, persuading a user to send 100 ETH. The scammer returned the ETH, but the user lost $5,000 in transaction fees.
ETCUndisclosed
A vulnerability in the Geth Ethereum software caused a fork in the Ethereum Classic network, creating competing versions of the chain. The report does not describe funds being stolen.
SirenDeFi ProtocolPolygon$3.5M
A reentrancy flaw in Siren’s withdrawal function let an attacker withdraw repeatedly before balances were updated. The exploit drained assets from several Polygon liquidity pools and affected 26 liquidity-provider addresses.
OpenZeppelinUndisclosed
A security researcher found a serious re-entry flaw in OpenZeppelin’s TimelockController contract, which could let an operation be called again before the first one finished. The affected project patched the flaw, and no stolen funds were reported.
Tomb FinanceUndisclosed
A third party used Tomb Finance’s Gatekeeper fee mechanism, prompting panic selling and a sharp drop in TOMB’s price. The project said it was not attacked and no funds were stolen.
Cream FinanceDeFi ProtocolEthereum$18.8M
A reentrancy flaw in the AMP token callback handler let an attacker repeatedly borrow against collateral and withdraw more than they had deposited. AMP tokens and ETH were stolen; some ETH was later recovered.
Our coverage: Cream Finance Hacked For 27 Million USDSourceRekt report
BilaxyCEXEthereum$21.7M
Bilaxy’s hot wallet was compromised, and an attacker stole about $21.7 million in tokens, including USDT, USDC and UNI. The attacker later sent 200 ETH to Tornado Cash, a service that mixes cryptocurrency transactions.
xTokenDeFi ProtocolEthereum$4.5M
An attacker used a flash loan to push down SNX’s price, then exploited an access-control flaw in xToken’s xSNX contract to buy SNX cheaply. The loss was estimated at $4.5 million.
Dot.FinanceDeFi ProtocolBinance Smart Chain$430K
An attacker used a flash loan to manipulate token pricing in Dot.Finance’s VaultPinkBNB contract, allowing it to mint excess PINK tokens. The attacker profited about 900.89 BNB, worth roughly $430,000.
Sentinel$40M
About $40 million in DVPN tokens was stolen after a mnemonic phrase associated with HitBTC was reportedly exposed. Sentinel and HitBTC disputed whether the leak resulted from an exchange issue or a vulnerability in Sentinel’s software.
LiquidCEXEthereum$91.4M
Attackers compromised Liquid Global’s warm wallets, using information from a previous breach to break into its MPC wallet system. They stole various cryptocurrencies, and the exchange suspended deposits and withdrawals while investigating.
Pinecone FinanceDeFi ProtocolBinance Smart Chain$200K
An attacker bypassed Pinecone Finance’s website and directly called its staking contract, which failed to check account balances correctly and recorded deposits that had not been made. This allowed the attacker to withdraw extra PCT tokens before the project stopped the contract.
SolendDeFi ProtocolSolana$16K
A flaw in Solend’s admin function let an attacker change lending settings without a valid signature, causing users’ accounts to be wrongly liquidated. About $16,000 in losses for five users was being refunded, and no funds were stolen.
XSURGE$5M
XSURGE’s SurgeBNB contract was attacked after the project warned of an unfixable vulnerability and urged users to leave. The attacker stole $5 million.
SurgeBNBDeFi ProtocolBSC$5M
A reentrancy flaw in SurgeBNB’s sell function let an attacker repeatedly withdraw value before balances were updated. The attack was funded by a 10,000 BNB flash loan.
Ref.FinanceDeFi ProtocolNEAR$3.2M
A faulty Ref Finance contract update failed to check users’ liquidity-token balances when they removed funds from pools, allowing attackers to withdraw more than they should have. About 507,000 NEAR and 1 million REF tokens were taken.
Fetch.ai$2.6M
Fraudsters gained access to Fetch.ai’s Binance account and stole about $2.6 million in assets. A London court ordered Binance to trace and freeze the accounts holding the stolen funds.
