Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
DFXFinance$231K
A flaw in a Curve flash-loan function let the attacker re-enter DFX Finance’s deposit process and exploit how it checked loan repayments, allowing funds to be withdrawn. The attacker made about $231,000.
Steven Galanis$231K
A hacker compromised Cameo CEO Steven Galanis’s wallet and took ApeCoin, ETH, a Bored Ape NFT, Otherside land plots, and other NFTs. The Bored Ape and other NFTs were subsequently sold.
QuickSwap MarketDeFi ProtocolPolygon$220K
A flaw in the Curve liquidity-pool price oracle let an attacker use a flash loan to inflate collateral values in QuickSwap’s Market XYZ lending market on Polygon and drain assets, including LDO, MATIC and staked MATIC.
X2Y2NFTfiEthereum$200K
Scammers used Google Ads to direct users to fake X2Y2 websites that appeared to match the legitimate address, then tricked them into connecting their wallets to phishing contracts. About 100 ETH was stolen from users.
Layer2DAODeFi ProtocolOptimism$190K
An attacker gained multisignature access to Layer2DAO’s wallet on Optimism and stole 49.95 million L2DAO tokens, selling some of them. The project later bought back more than 31 million tokens from the attacker.
Rabby$190K
A flaw in Rabby Swap let attackers use the contract’s token-swap function to make unchecked external calls. They used it to steal funds from users who had authorized the contract.
Bill Murray$174K
Bill Murray’s personal wallet was apparently compromised through a leaked recovery phrase, and about 112 wETH raised for his charity NFT was stolen. The funds were converted to ETH and transferred through several wallets to Binance.
CryptovoxelGamingEthereum$171K
An attacker used a vulnerable Cryptovoxels Discord bot to post a phishing link, tricking users into approving malicious wallet transactions. The approvals let the attacker steal NFTs, which were then sold on OpenSea.
Trust Wallet$170K
A vulnerability in Trust Wallet’s browser extension affected private keys for some new wallets created in two versions. Two breaches using the vulnerability caused combined losses of about $170,000.
DeeKay$150K
Hackers took over NFT artist DeeKay’s Twitter account and used it to direct followers to a fake airdrop site. A victim lost four Cool Cats and three Azuki NFTs, and the stolen NFTs were worth about $150,000.
MooCakeCTXDeFi ProtocolBSC$140K
An attacker used a flash loan to deposit CAKE twice without first settling rewards, then withdrew the funds and repaid the loan, exploiting MooCakeCTX’s reward accounting.
CoFiXProtocol$140K
Attackers manipulated prices on CoFiXProtocol on BNB Chain and made about $140,000.
Quint$130K
A flaw in Quint’s restaking function left reward amounts unchanged, letting an attacker claim the same LP-token rewards repeatedly and steal about $130,000.
pandorachainDAODeFi ProtocolBSC$128K
A flash-loan attack manipulated asset prices on pandorachainDAO, letting the attacker make profitable trades and take about $128,000 in assets.
ATK$120K
An attacker used a flash loan to exploit the ATK strategy contract and obtain a large amount of ATK tokens. They exchanged the tokens for about $120,000 in BSC-USD, then began converting and transferring the funds.
KaoyaswapDeFi ProtocolBinance Smart Chain$118K
A flaw in Kaoyaswap’s swap function let an attacker manipulate token calculations using a flash loan and take 37,294 BUSD and 271.2 WBNB.
MAD$116K
A missing access check let anyone call a sensitive function in the contract holding MAD tokens and transfer those tokens out. The attacker profited by selling the tokens for 556 BNB.
fomo-dao$110K
The fomo-dao project was reportedly attacked, and the attacker made about $110,000, which was transferred to Tornado Cash.
QuickswapDeFi ProtocolPolygon$108K
Attackers took control of QuickSwap’s GoDaddy-hosted DNS and redirected users’ swaps through attacker-controlled contracts, causing users to lose about $107,600 before the domain was recovered.
DDC$105K
A flaw that allowed pool fees to be deducted arbitrarily was exploited against DDC, resulting in a loss of about $104,600.
QuixoticNFTfiOptimism$100K
A missing check on buyers’ signatures in Quixotic’s marketplace contract let an attacker use fake NFT sell orders to take tokens from users who had authorized the marketplace. The team paused activity and reimbursed affected users.
CityDAODAOEthereum$95K
An attacker hijacked a CityDAO Discord administrator account and posted a fake land airdrop linking to a phishing site. Users who connected their wallets and approved fraudulent transactions lost 29.67 ETH.
Citizen FinanceDeFi ProtocolBSCPolygon$94.3K
An attacker gained access to Citizen Finance’s private keys on BNB Chain and Polygon and transferred BNB, MATIC and USDC from the protocol.
brahTOPG$89.9K
A flaw in brahTOPG’s Zapper contract allowed arbitrary external calls, enabling an attacker to steal tokens from users who had approved the contract.
Brahma FinanceDeFi ProtocolEthereum$89.3K
A flaw in Brahma Finance’s Zapper contract let an attacker make an unvalidated external call and drain 89,343 USDC from three users’ authorized accounts.
Pirate XDeFi ProtocolBSC$78K
An attacker exploited a flaw in Pirate X’s staking and withdrawal process to sell 9.6 million PXP tokens, making about 212 BNB. The team said a vulnerable token-conversion feature had launched without a security review.
NimbusPlatformDeFi ProtocolBSC$76K
An attacker used a 278 BNB flash loan to manipulate the token ratio in NimbusPlatform’s pool, inflating their share of rewards. The flawed calculation awarded more rewards than expected.
SheepFarmDeFi ProtocolBSC$72K
SheepFarm’s registration function could be called repeatedly without updating user timestamps, letting the attacker increase gem rewards and build yield through village upgrades. They sold the yield for BNB and withdrew about 262 BNB.
FTXCEXEthereum$70K
FTX’s withdrawal-fee system allowed requests with unusually high gas limits, and the exchange unknowingly paid the extra fees for smart-contract calls that minted XEN tokens for the attacker. The attacker made thousands of such calls without paying the gas costs.
LlamascapeNFTfiEthereum$70K
Attackers phished Llamascape staff accounts on Discord and used them to post a fake mint link. Users who interacted with the malicious contracts lost about 30–40 ETH.
HackDaoDeFi ProtocolBinance Smart Chain$65K
An attacker used flash loans and HackDao’s flawed token-fee accounting to repeatedly borrow and liquidate against themselves without repaying, extracting 200 BNB before the theft was detected.
AESTokenBSC$61.6K
The attacker repeatedly sent AES tokens to the AES–USDT pool and called its skim function to take excess tokens. The cycles burned AES and let the attacker turn small token amounts into large USDT payouts.
MU&MUGTokenAvalanche$57K
An attacker used a flash loan to artificially raise MU&MUG’s token price on Avalanche, then made profitable swaps that drained about $57,000.
Equalizer FinanceDeFi ProtocolEthereumBSCPolygon+1 chains$50K
Flash loans were used to manipulate Equalizer vault balances and exploit a flawed withdrawal calculation across four chains, allowing more assets to be withdrawn than the attacker was entitled to. Equalizer said it covered all losses, while another report said some funds remained unaccounted for.
Tableland$45.8K
Attackers compromised Tableland’s Discord, impersonated moderators and directed members to a fake mint website. People who granted the site wallet permissions lost Tableland Rigs and other NFTs.
LPCDeFi ProtocolBinance Smart Chain$45K
A flash-loan attacker exploited LPC’s transfer function, which miscalculated balances when tokens were sent from an address to itself, and extracted value from the protocol.
Ragnarok Online InvasionGamingBSC$44K
Ragnarok Online Invasion’s ROI token contract left its ownership-transfer function unprotected, allowing an attacker to take control and steal about 158 BNB.
TiFiTokenBSC$43.5K
A flash loan let an attacker temporarily manipulate TIFIToken’s price on BSC, enabling profitable trades on decentralized exchanges.
LiveArtXNFTfiEthereum$39K
Attackers compromised LiveArtX’s treasury wallet, whose private key was shared among team members without multi-signature protection, and stole 197 NFTs. They sold the NFTs at low prices and moved some proceeds through other tokens.
OWNLYDeFi ProtocolBinance Smart Chain$37K
A missing claim-status check in OWNLY’s unstaking function let an attacker repeatedly claim tokens from the staking contract, then exchange them for 115 BNB.
