Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
xPET$254K
A vulnerability in xPET’s newly launched PvP feature was exploited, and hackers stole 91.5 ETH.
SpectralDeFi ProtocolEthereum$250K
A flaw in Spectral’s Syntax V2 bonding-curve contracts let an attacker use a flash loan and an unintended token approval to manipulate the pool’s pricing and remove liquidity.
LeadBlock's Morpho Blue MarketDeFi ProtocolEthereum$250K
A misconfigured price oracle valued gold far too highly in a Morpho Blue PAXG/USDC market. An attacker used the pricing error and a mismatch in token decimal places to withdraw funds after depositing a small amount of PAXG.
TectonicDeFi ProtocolCronos$250K
An attacker used a flash loan to manipulate deposit logic in a newly added Tectonic lending market that lacked protection, taking about $250,000.
HarryPotterObamaSonic10InuTokenEthereum$243K
An attacker manipulated the liquidity pool’s reserves to distort the HarryPotterObamaSonic10Inu 2.0 token’s price, taking 84.7 ETH. The funds were later sent to Tornado, a service that obscures transaction trails.
OpenLeverageDeFi ProtocolBSC$236K
An attacker used a flash loan to exploit a business-logic flaw and manipulate OpenLeverage’s accounting, extracting about $260,000. The protocol mobilized insurance and buyback funds to compensate users and planned to shut down.
Bankroll NetworkDeFi ProtocolBSC$235K
A missing check on an address field in Bankroll Network’s token-sale contract let attackers manipulate dividend calculations and claim dividends without sending WBNB, causing about $230,000 in losses.
ZongZiFaDeFi ProtocolBSC$229K
An attacker used a flash loan to manipulate ZongZi’s token price and collect invitation rewards, taking about 391 WBNB.
Convergence FinanceDeFi ProtocolEthereum$210K
A missing input check in Convergence Finance’s staking-claim function let an attacker use a malicious contract address to mint 58 million CVG tokens, which were sold for about $210,000. The attacker also took about $2,000 in unclaimed Convex rewards.
zkFinanceDeFi ProtocolzkSync Era$200K
The reported zkFinance hack could not be verified; no credible sources documented an incident on that date or nearby dates.
DefiPlazaDeFi ProtocolEthereum$200K
A flaw in DeFiPlaza V2’s swap logic let a carefully crafted transaction drain pool tokens. An MEV bot—software that races to capture profitable transactions—got the funds first and returned them to the team.
Ember Sword NFT$195K
A vulnerability in Ember Sword’s unverified NFT auction contract let an attacker take 60 WETH from 159 people who had approved the contract.
FENGSHOU (NGFS)TokenBSC$191K
An attacker exploited the FENGSHOU token’s publicly callable `delegateCallReserves` function to set a malicious contract as its Uniswap proxy and run code in the vulnerable contract, extracting funds.
iVest DAOTokenBSC$190K
A flaw in iVest’s token-transfer code let attackers manipulate the token’s price and take value through its donation mechanism. The attack caused about $172,000 in losses.
MetaDragonNFTfiBNB$181K
A flaw in MetaDragon’s NFT contract let attackers claim and convert more than 4,000 NFTs belonging to other users into META tokens, which they sold for 321.5 BNB.
Yield ProtocolDeFi ProtocolArbitrum$181K
An accounting flaw in Yield Protocol’s Arbitrum pools let an attacker use flash-loaned assets to create a mismatch between token balances and recorded supply, then withdraw excess tokens. About $181,000 was stolen.
Nebula RevelationDeFi ProtocolOptimism$180K
A reentrancy flaw in Nebula Revelation’s Optimism staking contract let an attacker withdraw tokens without authorization. The project later announced a compensation plan for affected users.
DeezNutz 404TokenEthereum$170K
A flaw in DeezNutz 404’s token contract let attackers exploit self-transfers to mint unlimited tokens. They sold the newly minted tokens for about $170,000.
MAATDeFi ProtocolBinance$168K
A flaw in MAAT’s BSC Stargate withdrawal logic left a tiny share balance that let outsiders redeem funds without using up their shares. The breach led to unauthorized withdrawals of USDT.
TGBS (TGBS)$151K
TGBS was exploited through a flash-loan attack, resulting in a loss of about $151,000.
YIEDLDeFi ProtocolBSC$150K
YIEDL’s redeem function did not properly validate a user-supplied parameter controlling asset exchanges. An attacker manipulated it to bypass share requirements and repeatedly exchange tokens, taking an estimated $150,000 to $300,000.
Chronos$148K
Chronos’s concentrated-liquidity pools managed by Dyson Money were exploited in a way likened to the Gamma exploit. Chronos said other V2 pools were unaffected and the remaining funds were secure.
ParticleTradeDeFi ProtocolEthereum$140K
A flaw in ParticleTrade’s handling of user input let attackers manipulate the contract’s state and steal funds.
Z123TokenBSC$136K
An attacker used a flash loan and repeatedly called a vulnerable token function to burn tokens and inflate Z123’s trading price, extracting funds before repaying the loan.
Perpy FinanceDeFi ProtocolArbitrum$132K
An uninitialized staking contract proxy let an attacker take control of Perpy Finance’s contract, upgrade it, and withdraw about 58.49 million PRY tokens. The tokens were exchanged for 41.895 ETH.
BUBAITokenEthereum$131K
BUBAI’s liquidity was removed from Ethereum, leaving users with reported losses of about $131,000.
Barley FinanceDeFi ProtocolEthereum$130K
An attacker exploited a flaw in Barley Finance’s newly deployed wBARL pod contract to mint a large share of the BARL supply. The project said most of the affected tokens came from team allocations, with little impact on users.
Magpie ProtocolDeFi ProtocolEthereumPolygonBSC+7 chains$129K
A flaw in Magpie Protocol’s router let attackers bypass access controls by placing selectors—function identifiers—in unexpected positions in call data. They used it to transfer tokens from 221 wallets, stealing $129,000.
YONTokenBNB$118K
A missing permission check in YON’s transferFrom function let an attacker’s contract take tokens directly from the liquidity pool. The attack resulted in the theft of 190 BNB.
AutoChain GlobalDeFi ProtocolBSC$113K
AutoChain Global’s smart contract on BNB Chain was exploited, causing about $113,000 in losses. Public reports did not provide details of the vulnerability.
WXETADeFi ProtocolEthereumBSC$110K
An attacker used WXETA’s unguarded contract setup function to grant themselves permission to mint tokens, then drained liquidity pools holding USDT and WXETA.
OSN$110K
An attacker exploited OSN’s LP Dividend Tracker contract, which sells its own tokens as rewards for adding liquidity, and made multiple transactions that caused about $110,000 in losses.
TonUPDeFi ProtocolTON$108K
A staking contract parameter was configured incorrectly, letting users claim staked UP tokens they were not entitled to; 307,264 tokens were taken. TonUP suspended redemptions and bought back the stolen tokens.
OMPx$107K
OMPx was attacked, causing a loss of about $107,000. The attacker’s initial funds came through Railgun, and the stolen funds were later deposited there.
SteamSwap (STM)DeFi ProtocolBSC$105K
SteamSwap on BNB Chain was attacked through price manipulation that let the attacker exploit how the exchange calculated its reserves and drain about $105,000.
RunWay (BYC)$100K
RunWay (BYC) appears to have been attacked on BNB Chain, causing an estimated loss of about $100,000; the report did not specify how.
BYC TokenTokenBinance$100K
On BSC, an attacker manipulated BYC’s auto-burn settings through large swaps, then used the function to reduce the token reserve in the liquidity pool and drain its USDT.
OpSecDeFi ProtocolEthereum$100K
An attacker compromised a key controlling OpSec’s staking contract, changed its ownership, and withdrew and sold OPSEC tokens. The attacker converted about 59 ETH; illiquid trading pools limited how much could be cashed out.
LayerSwapDeFi ProtocolEthereum$100K
Attackers compromised LayerSwap’s GoDaddy account and redirected its domain to a phishing site, tricking about 50 users into losing roughly $100,000. LayerSwap began refunding affected users with additional compensation.
Mars$98K
The Mars token issuance protocol was attacked, losing about 1 million MARS and 137 WBNB.
