Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Neko NetworkDeFi ProtocolBinance Smart Chain$2.2M
A flaw in Neko Network’s lending contract let the attacker use other users’ assets as loan collateral while sending the borrowed funds to their own address. More than $2.2 million in stablecoins was stolen, and the protocol froze its pools.
Acala NetworkDeFi ProtocolAcala$1.6M
A configuration error in Acala’s iBTC/aUSD pool allowed 1.28 billion unbacked aUSD tokens to be minted. Acala halted swaps and burned the tokens, limiting realized losses to about $1.6 million.
DAO MakerDeFi ProtocolEthereum$7M
An attacker exploited a vesting system whose init() function lacked access controls, resetting settings on four token contracts and using emergencyExit to drain tokens. The tokens were sold on decentralized exchanges, and about $7 million was taken before the outflow was stopped.
Poly NetworkDeFi ProtocolBridgeEthereumBSCPolygon$611M
Attackers exploited access-control and cryptography flaws in Poly Network’s cross-chain bridge contracts, taking over $610 million across Ethereum, BSC and Polygon. The attacker later returned nearly all the funds, keeping only transaction fees.
Punk ProtocolDeFi ProtocolEthereum$8.95M
An attacker reused an unguarded contract initialization function to change the address controlling withdrawals, draining stablecoins from Punk Protocol. A white-hat hacker recovered about $5 million; the remaining funds were reported sent to Tornado Cash.
ZerogokiDeFi ProtocolEthereum$670K
An attacker exploited Zerogoki’s price-oracle checks by supplying a price report signed with legitimate keys but containing crafted swap amounts. The flaw allowed unauthorized withdrawals; the reported loss was about $670,000.
Wault FinanceDeFi ProtocolBinance Smart Chain$930K
An attacker repeatedly staked USDT to distort WaultSwap’s WUSD pricing mechanism, then traded WEX back for USDT. The exploit brought the attacker about $930,000.
Popsicle FinanceDeFi ProtocolEthereum$20.7M
A flaw in Popsicle Finance’s Uniswap V3 optimizer pool let the same fee rewards be claimed repeatedly after users transferred their pool shares. The exploit drained about $20.7 million.
BSVUndisclosed
BSV suffered a 51% attack, meaning one party controlled most of the network’s computing power, and three competing versions of the chain were mined at once. The report does not specify stolen funds.
Stazie$1M
A fake CryptoPunks giveaway tricked Hedgie co-founder Stazie into sharing his wallet’s recovery phrase, giving the scammer access to his assets. Sixteen CryptoPunks and some ETH were lost; the scammer sold five of the NFTs for 149 ETH.
LevyathanDeFi ProtocolBSC$1.5M
An attacker used minting-capable private keys exposed on GitHub to gain control and create 100 quintillion LEV tokens. The massive supply crashed LEV’s price, and the reported loss was about $1.5 million.
PolyYeld FinanceDeFi ProtocolPolygon$250K
A flaw in PolyYeld’s MasterChef contract mishandled xYELD transfer-tax rewards, allowing attackers to mint billions of YELD tokens and sell some for ETH. The token price then collapsed.
THORChain$76K
Attackers sent malicious UniH tokens to Ethereum addresses as bait; selling them or approving their sale on a decentralized exchange could let the attackers steal RUNE from users’ wallets. About $76,000 in tokens was stolen.
THORChainDeFi ProtocolBridgeEthereum$8M
An attacker used a custom contract to make THORChain’s Bifrost protocol accept fake deposits and refund real assets through its Ethereum router. The attacker limited the losses and requested a bug bounty.
Sanshu InuUndisclosed
An attacker used the deflationary KEANU token to exploit a reward flaw in Sanshu Inu’s Memestake contract and profit in ETH.
Array FinanceUndisclosed
An attacker used a flash loan to exploit Array Finance’s pricing mechanism, which relied on aBPT’s total supply. The attacker made about 272.94 ETH.
PancakeBunny$2.4M
An attacker exploited PancakeBunny’s Polygon version, making off with 1,281 WETH. The team suspended its Polygon Sushi vaults; its Polygon and BSC vaults and BUNNY token were reported safe.
BunnyDeFi ProtocolBSC$2.4M
An attacker manipulated QuickSwap’s price and minted 2.1 million unbacked polyBUNNY tokens, causing the token’s price to crash and a reported $2.4 million loss. Bunny said it compensated users with MND tokens.
Bondly FinanceDeFi ProtocolEthereum$5.9M
A phishing attack exposed Bondly’s CEO’s admin credentials, allowing an attacker to mint 373 million BONDLY tokens and sell them into liquidity pools, crashing the token’s price.
THORChainDeFi ProtocolBridgeEthereum$5M
A flaw in THORChain’s Bifrost bridge let an attacker manipulate reported deposit amounts and repeatedly extract value from liquidity pools. About 4,000 ETH was lost.
T-Mobile$55K
A SIM-swap scam at T-Mobile let someone take control of a customer’s phone account and steal 1.63 Bitcoin. The customer sued the company, accusing it of failing to protect his information.
ApeRocket FinanceDeFi ProtocolBSC$1.26M
Attackers used flash loans—temporary loans that are repaid within one transaction—to exploit ApeRocket’s reward calculations on BSC and Polygon, inflate their share of vaults, and sell newly minted SPACE tokens. The attacks caused SPACE’s price to fall sharply.
pSPACEUndisclosed
A flash-loan attack exploited a profit-inflation bug in Polygon Space Token (pSPACE). The report does not specify how much was taken.
DeFiPieDeFi ProtocolEthereumBinance Smart Chain$125K
An attacker used a malicious token with a modified transfer function to exploit reentrancy in DeFiPie’s lending contract, borrowing more than their collateral allowed. The attack drained liquidity and valuable collateral.
Axie InfinityUndisclosed
A denial-of-service attack flooded Axie Infinity’s marketplace server with spam in an attempt to make it unusable. The project said funds were safe.
ChainswapDeFi ProtocolBridgeEthereumBSC$4.4M
A flaw in ChainSwap’s cross-chain quota code let invalid, non-whitelisted addresses increase bridge limits without authorization. Attackers minted tokens for multiple projects and stole about $4 million across Ethereum and BSC.
Our coverage: Second ChainSwap Exploit Incurs $8M In LossesSourceRekt report
DAFI Protocol$200K
An attack on the ChainSwap cross-chain bridge led to about $200,000 worth of DAFI being sold. DAFI Protocol said its token contract and Super Staking were safe.
Dora Factory$42.4K
A vulnerability in the ChainSwap bridge contract allowed attackers to withdraw DORA tokens that had been locked there, which they then sold through Uniswap.
Umbrella NetworkUndisclosed
A flaw in the ChainSwap cross-chain bridge contract led to the theft of more than 3 million UMB tokens from Umbrella Network.
DAO venturesUndisclosed
A flaw in the ChainSwap cross-chain bridge contract led to the theft of 300,000 DVG tokens from DAOventures. The team took a snapshot of token holders and liquidity providers for a planned compensation process.
OptionRoomUndisclosed
An attack on the cross-chain asset bridge ChainSwap gave hackers ROOM tokens on Ethereum and BSC. OptionRoom removed liquidity before the tokens were sold and recovered $342,117 by selling tokens held by the project’s deployer.
Anyswap$7.9M
Anyswap was reported as affected in a wave of bridge incidents alongside ChainSwap, and the report said the issue had been fixed. It gives no details on the attack method or funds taken.
MultichainCEXBridgeEthereumBSCFantom$7.9M
A repeated value in signatures from two Multichain V3 router transactions let an attacker recover the router’s private key and withdraw funds from the bridge. The loss was reported at more than $7.8 million; Multichain said it would replenish the stolen liquidity and compensate providers.
Bitcoin.orgUndisclosed
Bitcoin.org was hit by a large distributed denial-of-service attack, which floods a website with traffic, alongside a Bitcoin ransom demand. The website remained accessible.
RAI Finance$414K
A vulnerability in ChainSwap’s contract exposed RAI Finance’s connected access and payment permissions, allowing attackers to steal 2.9 million RAI. The attackers later returned 2.2 million, leaving a loss of 670,000 RAI.
Saudi AramcoUndisclosed
A blackmailer claimed to have stolen a large cache of Saudi Aramco corporate data using a previously unknown vulnerability. The claimed data included employee and customer information and internal company documents; the blackmailer demanded payment or threatened to sell it.
Haven ProtocolDeFi ProtocolHaven$8.19M
Attackers exploited several flaws in Haven Protocol’s minting and conversion checks to create XHV and other tokens. The project later rolled the network back to its pre-attack state through a hard fork.
DEXToolsUndisclosed
DEXTools reported that it had been hacked, affecting some DEXT holders. It did not disclose how the hack occurred or the amount taken.
ChainswapDeFi ProtocolBridgeEthereumBinance Smart Chain$800K
Attackers exploited a flaw in ChainSwap’s bridge authorization checks to mint tokens across multiple projects and steal assets. Some tokens were recovered, and the remaining reported loss was about $800,000.
XDX SwapDeFi ProtocolBridgeHuobi Eco Chain$176K
A suspected backdoor in XDX Swap’s cross-chain exchange code let an attacker take about 85 ETH. Most of the funds were later recovered with help from security groups.
