Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
LibertiVault$450K
A reentrancy flaw in LibertiVault’s deposit function let attackers repeatedly call it before balances were updated, leading the contract to issue excess tokens. Funds worth more than $450,000 were taken across Polygon and Ethereum.
SVT$400K
Attackers used flash loans to exploit loopholes in SVT’s token trading contracts, repeatedly buying and selling to make about $400,000. About 1,070 BNB was later sent to Tornado Cash.
Poolz FinanceDeFi ProtocolBSC$390K
An integer overflow—a calculation error— in Poolz’s LockedDeal contract let an attacker exploit its pool-creation function and obtain tokens after depositing very little. The stolen assets included POOLZ and other tokens.
friend.tech$385K
A hacker used SIM-swap attacks against four friend.tech users and made a reported 234 ETH in the following 24 hours.
unshETHDeFi ProtocolEthereum$375K
A developer’s leaked deployment key let an attacker take ownership of unshETH contracts and drain about $375,000 from the staking protocol. Withdrawals were paused, and the keys were secured; ETH deposits were protected by multisignature controls and a time lock.
ThemisDeFi ProtocolArbitrum$370K
Attackers used flash loans—temporary borrowed funds—to distort the price of pool tokens used as collateral, then borrowed assets against the inflated value. The attack drained about 317 WETH from the lending protocol.
Zircon GammaDeFi ProtocolBSCMoonriver$350K
Attackers manipulated Zircon’s pools on Moonriver and BSC by donating tokens to inflate reserves, then withdrew shares using faulty calculations. The exploit drained about $350,000.
fcdep(EPMAX)DeFi ProtocolBSC$350K
The attacker used a flash loan and faulty balance accounting to manipulate token balances and extract funds from the fcdep (EPMAX) protocol.
Midas CapitalDeFi ProtocolBSC$340K
A rounding error in Midas Capital’s lending protocol let an attacker use tiny deposits and borrowed collateral to withdraw far more than they were entitled to. The HAY/BUSD pool lost more than $600,000.
Art CoinDeFi ProtocolEthereum$331K
A misconfigured Art Coin presale and Uniswap V3 liquidity pool let an attacker buy ART cheaply and sell it at a favorable rate, extracting 181 ETH from the pool.
Uwerx networkOtherEthereum$327K
The attacker used Uwerx’s 1% token-burn rule and Uniswap pool functions to distort WERX’s price, then traded back to extract ETH for profit.
Locus FinanceDeFi ProtocolEthereumArbitrum$321K
An attacker obtained a Locus Finance developer’s private key during a leadership transition and used administrative access to drain vaults. The vaults lacked multisignature security.
Channels FinanceDeFi ProtocolBSC$320K
An accounting flaw in Channels Finance’s old Compound V2-based contracts let an attacker mint tokens that were not backed by real assets, then drain funds.
Conic FinanceDeFi ProtocolEthereum$300K
A read-only reentrancy flaw let attackers manipulate the price readings used by Conic Finance’s ETH omnipool and drain funds. A separate, unrelated attack on the crvUSD omnipool also generated a profit for the attacker.
Mycelium$300K
Problems with Mycelium’s ETH-USD price feeds left the MLP pool relying on faulty price data, which arbitrage bots exploited. The team fixed the issue and resumed trading.
TheStandard.ioDeFi ProtocolArbitrum$290K
An attacker used low liquidity in a WBTC/PAXG pool and a swap without slippage protection to manipulate the price after minting EUROs against WBTC collateral. About 243,000 EUROs were later returned to the protocol.
Tales of ElleriaGamingArbitrum$280K
An attacker forged signatures for Tales of Elleria’s Arbitrum bridge, a system for moving assets between networks, and minted 5 billion ELM tokens. They took about 140 ETH from the linked liquidity pool before the project froze operations.
Venus ProtocolDeFi ProtocolBSC$274K
A malfunctioning Binance price feed reported an incorrect snBNB price, leading to unintended liquidations and a shortfall for Venus Protocol. The protocol said its core pool and XVS were unaffected.
GalxeOtherEthereum$270K
An attacker gained control of Galxe’s domain account and redirected its website to a phishing page. About 1,120 users signed malicious transactions, losing roughly $270,000; Galxe later announced a compensation plan.
WiseLendingDeFi ProtocolEthereum$260K
An attacker used a flash loan and rounding errors in WiseLending’s share calculations to inflate share prices through deposits and withdrawals. A white-hat MEV bot—an automated trader acting to protect users—front-ran the exploit and recovered funds.
VelodromeDeFi ProtocolOptimism$250K
Attackers used social engineering to take over the domain registrar accounts for Velodrome and Aerodrome, then redirected their websites to fake protocol pages. Users who approved transactions on the fake contracts lost funds.
Harbor ProtocolDeFi ProtocolComdex$250K
An attacker manipulated Harbor Protocol’s oracle prices using low-liquidity cSwap markets, making collateral appear more valuable and borrowing CMST against it. The exploit depleted funds from the stOSMO, LUNA, and WMATIC vaults.
SperaxUSDTokenArbitrum$250K
A flaw in SperaxUSD’s balance calculation let an attacker mint 9.7 billion unbacked USDs after sending tokens to a precomputed Safe address. The attacker exchanged about $250,000 before the contract was paused.
ThunderCEXEthereumSolana$240K
Attackers compromised Thunder Terminal’s MongoDB connection details and used stolen session tokens to make unauthorized withdrawals from 114 user wallets. They took 86.5 ETH and 439 SOL; users’ private keys were not compromised.
ShidoDeFi ProtocolBNB Chain$239K
A configuration error in Shido on BNB Chain led to the loss of about 976 BNB. The attacker moved the funds through Tornado Cash and bridged some to Ethereum.
BalancerDeFi ProtocolEthereum$238K
Attackers hijacked Balancer’s DNS and sent visitors to a fake website that stole funds; its smart contracts were not affected. Reports gave different loss estimates.
Peapods FinanceDeFi ProtocolEthereum$231K
A reentrancy flaw in Peapods Finance’s WeightedIndex contract, exploited using flashloans, let an attacker extract PEAS tokens. The white-hat hacker returned about 90% of the funds.
SynthetifyDeFi ProtocolSolana$230K
An attacker used token-based voting to take control of Synthetify’s inactive DAO and compromise the protocol. The platform was frozen, and the stolen assets were not recovered.
AstridDeFi ProtocolEthereum$228K
A flaw in Astrid Finance’s withdrawal function let an attacker create counterfeit tokens and exchange them for ETH. The attacker later returned about 80% of the stolen funds.
BRATokenBSC$225K
A flaw in BRA’s transfer tax logic added the tax to trading pools twice, creating excess tokens that could be claimed. An attacker sold the extra BRA for about 820 WBNB.
Hypr Network$220K
An exploit in Hypr Network’s bridge, which moves assets between blockchains, led to funds being taken.
HideYoApes$208K
HideYoApes reported a phishing incident, after which an attacker sold the holder’s Yuga Labs NFTs, including a Bored Ape and related collectibles, for 127.3 wETH.
Keep3r NetworkDeFi ProtocolEthereum$200K
An attacker compromised Keep3r Network’s governor private key, reset pool governors, then used a reentrancy attack—a way to repeatedly call a contract before an earlier action finishes—to take about 4,084 KP3R.
SNK (Snooker)DeFi ProtocolBinance Smart Chain$198K
The attacker used SNKMiner’s referral function to link multiple contracts and inflate staking rewards based on linked accounts’ SNK balances, then claimed the excess rewards.
TimeTokenEthereum$190K
A flaw in the TIME token’s multicall setup let an attacker spoof addresses and run malicious contract code. They burned tokens from a liquidity pool, raising the token price and extracting about $190,000.
SNK$190K
The attacker exploited SNK’s invitation-reward system to generate rewards and make a profit.
GDSDeFi ProtocolBSC$187K
A flash loan—a temporary loan repaid in the same transaction—was used to manipulate GDS’s liquidity-pool mining reward calculation. The attacker withdrew excessive rewards through multiple contracts and kept about $187,000 after repaying the loan.
CivFundDeFi ProtocolEthereum$180K
An attacker used a callback function in CivFund’s Ethereum contract to transfer funds that users had approved for the contract, then sent them to Uniswap to sell. The attack caused about $180,000 in losses.
CIVNFTDeFi ProtocolEthereum$180K
CIVNFT’s fund-transfer functions had no access controls, allowing an attacker to trigger callbacks that sent CIV and USDT to Uniswap, where the tokens were sold.
CoWSwapDeFi ProtocolEthereum$180K
A flaw in CoW Swap’s SwapGuard contract allowed an attacker to make unauthorized calls, approve a malicious contract, and transfer DAI from the settlement contract.
