Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
252 incidents Clear filters
Usual ProtocolDeFi ProtocolEthereum$43K
An arbitrage attack exploited a flaw in Usual’s USD0++ vault, which allowed tokens to be exchanged at a fixed rate without properly checking the transaction. The attacker profited by selling USD0 elsewhere; the reported loss was about $43,000, with no user funds affected.
BankX$43K
BankX was reported to have been attacked on BNB Chain, Ethereum, and Optimism; the available report did not specify the method or outcome.
SorraDeFi ProtocolEthereum$41K
A flaw in Sorra’s staking rewards function failed to account for rewards already claimed. The attacker repeatedly withdrew to claim the same rewards before the contract updated its records.
DIMODeFi ProtocolBridgeEthereum$40K
An attacker used a compromised developer key with authority to upgrade DIMO’s Wormhole bridge contract to withdraw 30 million DIMO tokens, then sold them. The proxy was reverted and ownership moved to a multisig.
Alien Base$38K
Multiple attacks on Alien Base’s BunniHub contract caused losses of about $38,000; the reports did not specify how the contract was exploited.
MoscaDeFi ProtocolBSC$37.6K
A flaw in Mosca2’s join() function let anyone inflate member balances instead of merely topping them up, enabling the attacker to drain the treasury.
MoscaDeFi ProtocolBinance$37.6K
A flaw in Mosca’s withdrawal function cleared one user balance field but left two others unchanged, allowing an attacker to withdraw the same funds repeatedly. The reported loss was about $19,500.
AIRWADeFi ProtocolBSC$33.6K
An access-control flaw in AIRWA on BNB Chain let an unauthorized attacker extract funds from the protocol; the amount taken was not reported.
Nexo$31.5K
A lack of access controls in a Nexo contract enabled a sandwich attack, in which transactions are placed around a user’s trade to profit from its price impact. About $31,000 was lost.
TokenHolderTokenBSC$26K
Missing permission checks in TokenHolder’s contract let an unauthorized caller use restricted functions to drain about $26,000.
ACBDeFi ProtocolBSC$22.8K
An attacker manipulated ACB’s spot-price feed on BNB Chain to inflate staking reward calculations, causing losses of about $22,000.
CoinMarketCap$21.6K
CoinMarketCap’s website front end was compromised, affecting 76 accounts and causing $21,624 in losses. The platform said it would reimburse those users.
FortuneWheel$21.6K
FortuneWheel was suspected of a price-manipulation attack on BNB Chain, with a reported loss of about $21,600.
Min Token (MIN)$21.4K
Min Token was suspected of being attacked on BNB Chain, with an estimated loss of about $21,400. The attack details were not reported.
Raga FinanceDeFi ProtocolHyperliquid L1$18.5K
No credible source in the incident reports documents a specific Raga Finance hack on this date.
402BridgeDeFi ProtocolBridgeBase$17.7K
A leaked private key compromised 402Bridge’s wallets, while excessive token approvals let the attacker take users’ USDC. The stolen funds were swapped for ETH and bridged to Arbitrum.
Next Earth$17K
The NFT project Next Earth suffered a reentrancy attack on Polygon; the report provides no details about the amount taken or what happened to the funds.
VDS$13K
SlowMist detected what appeared to be an attack on VDS on BSC. The report did not describe how it happened or what happened to the funds.
BBXTokenTokenBSC$12K
BBXToken’s transfer function burned liquidity pool tokens before updating the pool’s reserves. An attacker exploited this to distort the PancakeSwap pool and extract value.
Tenderize V2DeFi ProtocolEthereum$10.9K
A flaw in Tenderize V2’s proxy upgrade validation was exploited, causing a small loss on Ethereum.
GMGN$10.3K
A phishing site posing as a third-party token website tricked GMGN users into triggering unauthorized transactions, affecting about 107 users. GMGN said affected accounts were secured and losses would be fully compensated.
HORS$10.3K
HORS was suspected of being attacked on BSC, with an estimated loss of about $10,300.
ABCCApp$10.1K
An attacker reportedly exploited ABCCApp on BSC through an unprotected contract function that changed a value used to calculate claimable USDT. The reported loss was about $10,100.
BNB Chain$8K
After BNB Chain’s English X account was compromised, attackers used phishing links to trick users into transactions, causing about $8,000 in losses. The links were removed, and user compensation was completed.
BUIDL$8K
BUIDL was suspected of being attacked on BNB Chain, with a reported loss of about $8,000; the available report gave no details on how it happened.
AventaDeFi ProtocolEthereum$7K
A flash loan—a temporary loan that must be repaid within one transaction—was used to exploit a vulnerability in Aventa and drain about 3.9 ETH from the protocol.
Unverified_35bcDeFi ProtocolBSC$6.7K
An attacker exploited an unverified BSC contract by repeatedly triggering a function that transferred funds before updating its records. The amount taken was not specified.
FixedTokenBSwapDeFi ProtocolEthereum$2.2K
An attacker used crafted swap paths and a fake token that bypassed a transfer check to evade FixedTokenBSwap’s on-chain price check and extract fixed amounts of RTV in repeated transactions.
ICRYPEX GlobalUndisclosed
A security alert identified a potentially critical vulnerability at ICRYPEX Global, but the report did not say whether it was exploited or whether funds were lost.
AzbitmUndisclosed
SlowMist warned Azbitm that it had detected a potential vulnerability. The report did not say whether funds were taken.
AlmanakUndisclosed
Operational errors and a DDoS attack disrupted Almanak’s airdrop claims and wallet deployment. About 1,100 users saw a pending status, but the team restored service, cleared the backlog, and said users’ tokens were safe.
PEPEUndisclosed
Attackers altered PEPE’s official website code to redirect visitors to a malicious page. The report did not identify any stolen funds.
ReactUndisclosed
Attackers exploited a React vulnerability that allowed code to run remotely without authorization, injecting code into websites to steal funds from cryptocurrency wallets. The React team released a patch and urged affected users to upgrade.
WLFIUndisclosed
Some WLFI users’ wallets were compromised through phishing or leaked recovery phrases, rather than a flaw in WLFI’s platform or contracts. WLFI burned 166.67 million tokens from a suspected compromised wallet and reallocated the same amount to a secure address.
Nofx AIUndisclosed
A security issue in the NOFX AI automated trading system exposed some users’ wallet private keys and exchange and trading-platform API keys. Theft incidents were reported, but the report gave no total loss.
AftermathUndisclosed
Attackers took control of Aftermath’s X account. Users were warned not to interact with it until the team regained access.
GMGNUndisclosed
An MEV sandwich attack affected 729 GMGN transactions, causing losses to users. GMGN later said it had calculated the losses and paid compensation to affected users.
NobleUndisclosed
An attacker compromised Noble’s official X account and used it to post phishing tweets.
Watt ProtocolUndisclosed
An attacker took over Watt Protocol’s official X account and used it to post phishing messages.
Panoptic V1.1DeFi ProtocolBaseUnichainEthereumUndisclosed
Researchers found a flaw in Panoptic V1.1’s position checks: its hash method could produce the same identifier for different positions. This could have let attackers bypass collateral checks and drain pools, but the flaw was reported before it was exploited.
