Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Maya ProtocolDeFi ProtocolBridgeMayachain$1.7M
A chain of accounting and outbound-tracking bugs credited an almost empty ARB.LINK pool with CACAO that had never been transferred into it. The attacker added liquidity and withdrew about 48.87 million CACAO from Asgard liquidity, converting some into BTC and other assets.
FoxMarketDeFi ProtocolBSC$120K
FoxMarket’s bond-minting function relied on a manipulable PancakeSwap spot price, which the attacker skewed using borrowed funds. This led to excess FOX tokens being issued; the attacker sold a referral allocation and kept about $120,000 in profit.
Bodega MarketDeFi ProtocolCardano$3.6K
A vulnerability in Bodega Market’s prediction-market contracts let an attacker drain rewards and market seed funds. The underlying flaw has not been confirmed.
Harmony ProtocolChainBridgeHarmony$3.2M
Flaws in Harmony’s chain allowed unauthorized minting of ONE, including through replayed cross-shard receipts that credited tokens without a matching source debit. Tokens were sent to exchanges, and the team patched the chain and paused the cross-chain bridge.
CoinsbuyWalletEthereumTron$7.9M
An access-control flaw in Coinsbuy’s wallet infrastructure let an attacker drain wallets on Ethereum and Tron. Some funds were converted to Monero, while ChangeNOW froze part of the stolen funds.
Coreum BridgeDeFi ProtocolBridgeXRPLCoreum$200K
A flaw in Coreum Bridge’s deposit checks let the attacker submit fake deposits that relayers accepted as valid. The bridge then released nearly 200,000 XRP from its reserves.
USMDeFi ProtocolEthereum$136K
A pricing-accounting flaw in USM’s redemption logic let an attacker use a flash loan to manipulate internal prices and split one redemption into 64 smaller withdrawals, extracting about 70.83 ETH.
OraichainChainBridgeOraichain$1M
A flaw in Oraichain’s cross-chain transfer path let an attacker mint ORAI without matching collateral on the originating chain. The network halted cross-chain services and was preparing to burn the unauthorized tokens and reconcile its supply.
Atomic GreenDeFi ProtocolArbitrum$30K
A replay flaw let the attacker reuse one manager signature across 21 Uniswap V3 liquidity positions; flash-loan price manipulation helped trigger unauthorized withdrawals of the full positions. The attacker took about 29,984 USDC.
RavencoinChainRavencoinUndisclosed
The Ravencoin network was affected by a missing input-validation issue. The loss amount and further details were not disclosed.
RRWalletWalletBitcoin$2M
Weak random-number generation in RRWallet produced predictable seed phrases, allowing an attacker to derive private keys and steal one user’s bitcoin.
Panther ProtocolDeFi ProtocolBase$7.58K
A malicious governance proposal exploited Panther Protocol on Base, causing a loss of about $7,578. No further details were reported.
Hyperliquid MalaysiaWalletSolanaUndisclosed
An attacker used a compromised private key to drain a wallet associated with Hyperliquid Malaysia on Solana. The amount taken was not disclosed.
KITE FoundationWalletEthereum$13.3M
Sixteen KITE Foundation wallets were compromised, allowing attackers to make authorized transfers of KITE tokens. The foundation paused transfers and bridges, then replaced the token and migrated legitimate balances 1:1, excluding attacker-controlled addresses.
UnistreetsDeFi ProtocolEthereum$17.8K
An arbitrary-call flaw in Unistreets’ LaunchpadFactoryAuto contract let the attacker approve and burn liquidity-provider NFT positions held by the factory. This drained about $17,750 in liquidity.
ZEUSUndisclosed
ZEUS’s infrastructure was attacked, but the incident was mitigated and no customer funds were lost or at risk. Services were temporarily taken offline for a security audit; there was no evidence of a Lightning node software flaw.
RISExChainRISE$673K
A misconfigured withdrawal permission in RISEx’s RWA strategy let an unauthorized address withdraw 673,011.56 USDC. The team patched the contract within minutes and fully compensated XLP depositors using July fees.
MOKELiquidity PoolBSC$907K
MOKE was exploited through a smart-contract flaw that let the attacker repeatedly claim tokens from an internal reserve without an eligibility check. The attacker converted the tokens into about 1,546 BNB, for a loss of roughly $907,000.
LOOPSDAOLiquidity PoolBSC$694K
The attacker used a flash loan to inflate the price of LPD in a thin PancakeSwap pool, making the protocol calculate far too much interest. LpdFi paid it by burning its own liquidity-pool position, sending about $690,000 in USDC to the attacker.
ColdcardWalletBitcoin$116M
A Coldcard firmware flaw bypassed the hardware random-number generator during seed creation, leaving some wallet keys weak enough to guess offline. Attackers used this to drain bitcoin from many addresses without accessing the devices.
Swan TreasuryDeFi ProtocolBSC$625K
An attacker used a leaked Swan Treasury signer key to create valid signatures and buy about 687,000 STY at roughly one-hundredth of the intended price, using a flash loan. They sold the tokens, causing the protocol a loss of about $625,000.
Set ProtocolDeFi ProtocolEthereum$9.6K
A malicious pre-issuance hook exploited unlocked accounting in Index Coop’s ExchangeIssuance contract, changing position values during issuance and causing Set Protocol to transfer excess assets.
Crypto DAODeFi ProtocolBSC$8.2M
A missing access check let anyone call vault functions in Crypto DAO’s Pro token contract. The attacker took about 167,200 Pro tokens, with reported profit of roughly $52,000; the cited $8.2 million in USDT was held by related addresses, not reported as stolen.
LULATokenBSC$578K
The attacker abused the LULA contract’s recycle() function and manipulated PancakeSwap’s pool reserves, draining LULA tokens and then swapping for nearly all the pool’s USDT. The reported loss was about $578,000.
WEMIXDeFi ProtocolWEMIX3.0$737K
After gaining administrative control of the WEMIX$ contract, the attacker minted about 5.23 million counterfeit tokens and swapped them for real WEMIX and USDC.e. The funds were then moved across Ethereum and BNB Chain.
ChainConnectDeFi ProtocolBridgeEthereumBSCAvalanche+1 chains$650K
Unauthorized access to ChainConnect’s EVM integration let attackers drain tokens from bridge contracts on Ethereum, BNB Chain, Avalanche and Polygon. Bridge operations were paused.
Garden FinanceDeFi ProtocolBridgeEthereumBaseArbitrum+1 chains$450K
An attacker breached an independent solver’s off-chain database and inserted fake transaction records, triggering unauthorized releases from Garden Finance’s HTLC contracts. About $450,000 in USDT was taken across four networks; the project said its protocol and smart contracts were not compromised.
ProjektDeFi ProtocolEthereum$560K
A flash loan helped the attacker create fake purchase records through Projekt’s unvalidated reward-tracking function, inflating reward claims. They withdrew about 301.7 ETH from the reward vault.
BankrbotWalletBase$480K
An attacker took over Bankrbot’s X account and posted fake airdrop links while draining the project’s Bankr wallet of about 1.5 billion BNKR tokens. The wallet did not have multi-factor authentication.
Triple-APaymentsEthereumTronArbitrum$9.7M
Attackers gained access to Triple-A’s hot wallets across several blockchains and drained company-owned digital assets, later consolidating them at an Ethereum address. Client funds held in separate trust accounts were unaffected.
Solido CashDeFi ProtocolSupra$900K
A misconfigured price feed treated SOLID collateral as nearly as valuable as CASH, despite SOLID’s much lower market value. The attacker minted excess CASH against the collateral and sold it for SUPRA; the losses fell mainly on liquidity providers and protocol reserves, not users.
Lien FinanceDeFi ProtocolEthereum$542K
A validation flaw let the attacker mint bond tokens without backing and bypass the contract’s burn-before-swap check. They exchanged the unbacked tokens for about $542,000 in USDC from OTC pools.
AFX BridgeDeFi ProtocolBridgeArbitrum$24.2M
The attacker used five compromised validator keys to meet the AFX bridge’s signing threshold and drain about $24.15 million in USDC. They bridged the funds to Ethereum and swapped them for ETH; the Arbitrum native bridge was unaffected.
VerusCoin$7.54M
An attacker exploited a flaw in VerusCoin’s Ethereum Bridge and drained $7.54 million. The report described it as a second attack on the bridge, following an earlier exploit.
Verus Ethereum BridgeDeFi ProtocolBridgeVerus$7.53M
An attacker used Verus-Ethereum Bridge’s import path to trigger payouts on Ethereum without matching deposits. The bridge lost about $7.54 million in assets; this was a repeat of the flaw exploited in May.
Zilliqa exchange partnerChainZilliqa$1.64M
A flaw in the Zilliqa Ledger app caused signing nonces—values used to authorize transactions—to be generated with predictable bits, letting attackers recover private keys from transaction signatures. They stole about 683.13 million ZIL from an exchange partner’s cold wallet.
Wanchain Cardano-BNB Chain BridgeChainBridgeCardano$10M
A flaw in the Cardano-BNB bridge’s signature checks let a signature intended for a small NIGHT redemption authorize much larger withdrawals. The attacker drained about 515 million NIGHT from the bridge’s Cardano-side lock address.
42DAODeFi ProtocolBSC$912K
The attacker fed 42DAO’s oracle an abnormally low BTCB price, triggering forced liquidation of BTCB vaults at far below-market prices. The attack caused Balance Coin to lose nearly all of its value.
FlashTradeDeFi ProtocolSolana$98K
A flaw in MagicBlock’s SDK failed to check an account during a withdrawal callback, letting an attacker trigger a fake withdrawal from FlashTrade’s Solana ephemeral instance. About $98,000 was taken; the team said it would cover the loss.
Allbridge CoreDeFi ProtocolBridgeSolana$1.65M
The attacker used a flash loan to rapidly swap USDC and USDT in Allbridge Core’s Solana pools, distorting their price ratio. They then withdrew liquidity at the manipulated rate, taking about $1.65 million.
