Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
DharmaUndisclosed
Dharma Wallet experienced a service outage, then reported that service had returned to normal and all funds were safe.
DefinerUndisclosed
Definer’s oracle on OEC used the balance of a single liquidity pool at one moment to set token prices, making those prices vulnerable to manipulation. The report does not specify what funds, if any, were taken.
ONUSUndisclosed
Attackers exploited a Log4j vulnerability in ONUS’s payment system to steal a database containing nearly two million users’ personal and identity-verification data, along with hashed passwords. They later sold customer data after ONUS did not pay the full ransom.
OlympusDAOUndisclosed
A flaw in OlympusDAO’s bond contract let a user claim 1,697 OHM for bonds that should have paid 59 OHM. The project closed the contract after discovering the issue.
Optics BridgeUndisclosed
Optics Bridge’s recovery mode was activated through its Ethereum GovernanceRouter, allowing a recovery account to take control of the protocol and replace its multisignature permissions. The report said current bridge funds were not at risk.
MediaMarktUndisclosed
Ransomware affected MediaMarkt stores across Europe, especially in the Netherlands. The attackers demanded payment in Bitcoin, but the reports do not say that funds were taken or that a ransom was paid.
RobinhoodUndisclosed
An intruder accessed Robinhood’s systems and stole personal information from millions of users, including more detailed account data for some. Robinhood said the breach caused no customer financial losses.
Synapse ProtocolUndisclosed
An attacker manipulated the virtual price of Synapse’s nUSD pool and attempted to move funds through the bridge. Validators rejected the transfer, so about $8.2 million in nUSD was not issued to the attacker and was to be returned to affected Avalanche liquidity providers.
Youtube channelsUndisclosed
Hackers took over YouTube channels, replaced their content, and used them to impersonate technology companies and crypto exchanges in fraud attempts. Some channels were also offered for sale.
CoinMarketCapUndisclosed
A breach exposed 3,117,548 CoinMarketCap users’ email addresses. Passwords were not included.
Avaterra FinanceUndisclosed
Anyone could call Avaterra Finance’s token-minting function, allowing an attacker to create and sell thousands of tokens. The project’s contract was described as a modified fork of Goose Finance.
Pancake HunnyUndisclosed
Pancake Hunny was hit by a flash-loan attack, and the HUNNY token’s price fell sharply. The incident involved hundreds of transfers, many related to Alpaca tokens; the report does not give a confirmed amount stolen.
OpenSeaUndisclosed
A security researcher found a vulnerability in OpenSea that could have let hackers steal users’ entire crypto wallets. OpenSea said it fixed the issue within an hour; the report does not describe any funds taken.
StarkWareUndisclosed
StarkWare confirmed an urgent security issue affecting a specific user, but said it was not a vulnerability in dYdX. The issue’s details and any loss of funds were not disclosed.
Lido FinanceUndisclosed
Lido found a contract flaw that could have allowed whitelisted node operators to steal a small portion of user funds. The team applied short-term fixes; no theft was reported.
Liquid NetworkUndisclosed
A block-signature problem after a Liquid Network upgrade stopped new blocks from being produced for more than seven hours. The network said user funds were safe and unaffected.
AutoShark FinanceUndisclosed
An attacker used flash loans to exploit AutoShark Finance’s exchange-mining function, collecting FINS rewards while occupying most of the mining pool. They exchanged the 3.18 million FINS gained for 1,388 BNB.
POAPUndisclosed
Hackers compromised POAP’s badge-minting system and fraudulently issued NFTs associated with artists XCOPY and Polygonal Mind. At the artist’s request, POAP burned the affected NFTs.
CoinbaseCEXUndisclosed
Attackers exploited a flaw in Coinbase’s SMS account recovery to bypass two-factor authentication and drain customer accounts. Coinbase fixed the process and reimbursed affected users.
BitfinexUndisclosed
A transaction from a Bitfinex wallet was mistakenly charged 7,676.62 ETH in gas fees because of a software and display issue. Miners returned 7,626 ETH, keeping 50 ETH as a refund fee.
pNetworkUndisclosed
An attacker exploited the pBTC-on-BSC bridge and stole 277 BTC from its collateral. Other pToken bridges were also targeted but were reported unaffected.
DefiboxUndisclosed
An incompatibility between Defibox’s swap contract and the EMOON token caused the EOS–EMOON pool to lose about 4,863 EOS. Defibox suspended the swap contract, fixed the issue, and said its foundation would pay the loss to the EMOON community.
MISOUndisclosed
Malicious code on the MISO launchpad’s website changed the DONA auction’s payment address to the attacker’s wallet, diverting 865 ETH. The attacker later returned the funds to SushiSwap in three transactions.
Secret NetworkUndisclosed
A vulnerability in a SecretSwap smart contract let an attacker take funds from the SEFI staking contract. Secret Network upgraded its mainnet to prevent further losses; its SCRT token and cross-chain bridge contract were not affected.
Klondike FinanceUndisclosed
Klondike Finance was attacked, losing about 35,281.71 KXUSD, reported as equivalent to 6.5629 WETH.
SolanaUndisclosed
A surge of automated transactions during a token sale overwhelmed Solana’s network, causing validator computers to crash and the blockchain to stop confirming new blocks. The network was restarted and restored; no financial loss was reported.
Arbitrum OneUndisclosed
A bug caused Arbitrum One’s transaction sequencer to stall when it received many transactions at once, interrupting service for 45 minutes. Funds were not at risk, and the team deployed a fix.
dYdXUndisclosed
An error during deployment of dYdX’s staking contract changed the conversion rate so users received no stkDYDX when staking DYDX. Funds remained locked in the contract, and the project proposed restoring access and compensating affected users for missed rewards.
ETCUndisclosed
A vulnerability in the Geth Ethereum software caused a fork in the Ethereum Classic network, creating competing versions of the chain. The report does not describe funds being stolen.
OpenZeppelinUndisclosed
A security researcher found a serious re-entry flaw in OpenZeppelin’s TimelockController contract, which could let an operation be called again before the first one finished. The affected project patched the flaw, and no stolen funds were reported.
Tomb FinanceUndisclosed
A third party used Tomb Finance’s Gatekeeper fee mechanism, prompting panic selling and a sharp drop in TOMB’s price. The project said it was not attacked and no funds were stolen.
BSVUndisclosed
BSV suffered a 51% attack, meaning one party controlled most of the network’s computing power, and three competing versions of the chain were mined at once. The report does not specify stolen funds.
Sanshu InuUndisclosed
An attacker used the deflationary KEANU token to exploit a reward flaw in Sanshu Inu’s Memestake contract and profit in ETH.
Array FinanceUndisclosed
An attacker used a flash loan to exploit Array Finance’s pricing mechanism, which relied on aBPT’s total supply. The attacker made about 272.94 ETH.
pSPACEUndisclosed
A flash-loan attack exploited a profit-inflation bug in Polygon Space Token (pSPACE). The report does not specify how much was taken.
Axie InfinityUndisclosed
A denial-of-service attack flooded Axie Infinity’s marketplace server with spam in an attempt to make it unusable. The project said funds were safe.
Umbrella NetworkUndisclosed
A flaw in the ChainSwap cross-chain bridge contract led to the theft of more than 3 million UMB tokens from Umbrella Network.
DAO venturesUndisclosed
A flaw in the ChainSwap cross-chain bridge contract led to the theft of 300,000 DVG tokens from DAOventures. The team took a snapshot of token holders and liquidity providers for a planned compensation process.
OptionRoomUndisclosed
An attack on the cross-chain asset bridge ChainSwap gave hackers ROOM tokens on Ethereum and BSC. OptionRoom removed liquidity before the tokens were sold and recovered $342,117 by selling tokens held by the project’s deployer.
Bitcoin.orgUndisclosed
Bitcoin.org was hit by a large distributed denial-of-service attack, which floods a website with traffic, alongside a Bitcoin ransom demand. The website remained accessible.
