Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
ChainflipDeFi ProtocolBridgeTron$736K
The attacker exploited Chainflip’s handling of TRON transaction memos to make an already processed deposit appear to be a separate failed swap, triggering duplicate refunds. Six of eight attempts succeeded, paying out 736,442 USDT; the network was paused.
TeleSwapDeFi ProtocolBitcoin$735K
TeleSwap’s Bitcoin hot wallet was compromised, and more than $735,000 flowed out. The wallet stopped processing transactions, and the funds were later moved toward a mixer.
CometDEXDeFi ProtocolStellar$717K
A CometDEX accounting bug let USDC be swapped for itself, understating the pool’s reserves; the attacker used flash loans to deposit against the false balance and redeem excess LP shares for pool assets. Blend Backstop depositors were exposed through its Comet LP shares.
PolymarketDeFi ProtocolPolygon$700K
An attacker used a compromised six-year-old operations wallet key to withdraw USDC and POL on Polygon in batches. Polymarket froze some funds and said user funds and platform operations were unaffected.
LOOPSDAOLiquidity PoolBSC$694K
The attacker used a flash loan to inflate the price of LPD in a thin PancakeSwap pool, making the protocol calculate far too much interest. LpdFi paid it by burning its own liquidity-pool position, sending about $690,000 in USDC to the attacker.
BCE-USDT liquidity pool$679K
A flaw in BCE’s token burn mechanism let attackers bypass trading restrictions and manipulate the BCE-USDT pool’s reserves, extracting funds from the PancakeSwap pool.
BCEDeFi ProtocolBSC$679K
A flaw in BCE token’s burn mechanism let malicious contracts trigger burns inside a PancakeSwap pool and distort its BCE-USDT reserves. The attacker used the imbalance to extract value from the pool.
The SandboxDeFi ProtocolBridgeBaseBSCEthereum$675K
The attacker abused an approval function in The Sandbox’s Base bridge contract to change cross-chain settings, mint unbacked SAND on Base and BNB Chain, and withdraw backed SAND from the Ethereum bridge vault. Bridging on Base and BNB Chain was halted.
RISExChainRISE$673K
A misconfigured withdrawal permission in RISEx’s RWA strategy let an unauthorized address withdraw 673,011.56 USDC. The team patched the contract within minutes and fully compensated XLP depositors using July fees.
TrovesDeFi Protocol$667K
A replaced rebalancing contract retained permission to act on Troves’ xWBTC/WBTC vault, allowing an attacker to take about 8.6 WBTC. Troves revoked the contract’s permissions and paused three vaults as a precaution.
ACryptoSDeFi ProtocolArbitrumBSCPolygon+2 chains$665K
A missing input check in ACryptoS vault deposits let attackers submit incomplete token amounts, causing vaults to issue too many shares for small deposits. They used the shares to withdraw assets from 77 vaults across five chains.
ChainConnectDeFi ProtocolBridgeEthereumBSCAvalanche+1 chains$650K
Unauthorized access to ChainConnect’s EVM integration let attackers drain tokens from bridge contracts on Ethereum, BNB Chain, Avalanche and Polygon. Bridge operations were paused.
Adshares BridgeOtherBridgeEthereum$628K
Attackers used the bridge’s signer to approve three wrapping requests tied to nonexistent Adshares-chain transactions, creating fake wrapped ADS tokens. Selling them drained about $628,000 in ETH and USDC from Ethereum liquidity pools.
Swan TreasuryDeFi ProtocolBSC$625K
An attacker used a leaked Swan Treasury signer key to create valid signatures and buy about 687,000 STY at roughly one-hundredth of the intended price, using a flash loan. They sold the tokens, causing the protocol a loss of about $625,000.
InitiaChainInitia$615K
Using compromised rollup infrastructure keys, an attacker forged IBC transfers—cross-chain asset messages—to withdraw funds from Initia escrow accounts. Some assets left through Noble, while most remaining assets stayed on the halted network; recovery was still under investigation.
Namada Shielded PoolsDeFi ProtocolBridgeNamada$600K
An IBC transfer flaw let the attacker drain assets from Namada’s Multi-Asset Shielded Pool and move them across chains. About $600,000 in tokens was taken; a stale indexer initially continued to display the funds as available.
FlamincomeDeFi ProtocolEthereum$595K
Flamincome’s vault misvalued its Curve position using a manipulable spot price and a reward-pool balance anyone could increase. The attacker used flash-borrowed USDT to inflate the vault’s share price, then redeemed shares for real Aave liquidity, profiting about $345,900.
DefiTuna LendingDeFi ProtocolSolana$580K
The attacker routed borrowed USDC through a highly illiquid TUNA/USDC pool, where the tiny swap output rounded a position’s value down to zero and bypassed the lending pool’s solvency check. The exploit drained about $580,000 in USDC.
LULATokenBSC$578K
The attacker abused the LULA contract’s recycle() function and manipulated PancakeSwap’s pool reserves, draining LULA tokens and then swapping for nearly all the pool’s USDT. The reported loss was about $578,000.
ProjektDeFi ProtocolEthereum$560K
A flash loan helped the attacker create fake purchase records through Projekt’s unvalidated reward-tracking function, inflating reward claims. They withdrew about 301.7 ETH from the reward vault.
$TENDRILDeFi ProtocolBSC$550K
A flaw in TENDRIL’s sell logic let the token pair’s reserves update before the full sale arrived, creating an imbalance that an attacker exploited to drain USDT liquidity from the PancakeSwap pool.
Bisq v1DeFi ProtocolBitcoin$550K
A flaw in Bisq v1’s trade protocol let modified clients bypass checks on negative miner fees and take Bitcoin from multisig trade outputs. About 11 BTC was stolen from 10 users; Bisq v2 and Easy were unaffected.
Lien FinanceDeFi ProtocolEthereum$542K
A validation flaw let the attacker mint bond tokens without backing and bypass the contract’s burn-before-swap check. They exchanged the unbacked tokens for about $542,000 in USDC from OTC pools.
Sovryn DexDeFi ProtocolRootstock$539K
An attacker exploited a failure to verify actual receipts during fee processing in Sovryn’s XUSD/WRBTC pool, receiving XUSD that was partly converted to BTC and ETH. Sovryn applied emergency fee controls, delisted the pool, and began assessing liquidity-provider losses.
MakerDAO ETH-A Liquidation Keeper BotDeFi ProtocolEthereum$538K
An unprotected drain function in a third-party MakerDAO liquidation keeper let anyone withdraw collateral from old auctions. The attacker claimed 200 WETH and sent it to an address they controlled; MakerDAO’s core contracts were not affected.
BlueMove DEXDeFi ProtocolSui$529K
BlueMove DEX’s liquidity pools were drained of more than 700,000 SUI. The cause was reported as either an LP-token double-minting flaw introduced in an upgrade or an arithmetic overflow in older AMM code.
Squid MulticallDeFi ProtocolArbitrumBNB ChainAvalanche+2 chains$517K
A user had mistakenly given Squid Multicall unlimited permission to spend their tokens. An attacker exploited its publicly callable function to transfer approved tokens from the wallet across multiple chains, taking about $517,000.
AviciCrypto CardSolana$501K
A flaw in an outdated Rain Solana card contract used by Avici let attackers gain unauthorized control and withdraw about $501,000 from users’ card balances. Around 1,685 users were affected; the contract was upgraded, and refunds were promised.
Flooring Protocol & BitmapPunksNFTfiEthereum$500K
A packed-storage and token-indexing flaw let an attacker create near-limitless Flooring Protocol tokens with a small WETH deposit and drain NFT pools. Yuga Labs’ white-hat team rescued 68 valuable NFTs, including BAYC and CryptoPunks.
AFI ProtocolDeFi ProtocolEthereum$480K
AFI Protocol’s afiUSD vault was drained of about $480,000, but the exploit method was not disclosed. AFI paused the vault and said its other vaults were unaffected.
BankrbotWalletBase$480K
An attacker took over Bankrbot’s X account and posted fake airdrop links while draining the project’s Bankr wallet of about 1.5 billion BNKR tokens. The wallet did not have multi-factor authentication.
NuNetTokenEthereum$463K
An attacker with NuNet’s deployer and minting key called the NTX token’s mint function to create about 408.5 million unbacked tokens. The contract had no supply cap to prevent minting by someone with that key.
Holdstation$462K
Attackers compromised the distribution system for Holdstation’s DeFAI Smart Wallet app, leading to unauthorized transactions from some users’ wallets. The team confirmed losses of about $462,000 in USDT and pledged to compensate affected users; the smart contracts were not exploited.
Aurellion LabsRWAArbitrum$456K
An incompletely initialized proxy contract let an attacker call its setup function and take ownership, then add a malicious function to drain USDC from wallets that had approved the contract. The project paused operations and committed to reimbursing users.
XRPH Wallet$452K
About 4,011 XRPH Wallet accounts had unauthorized transactions involving XRPH, XRPHAI, and other assets, with roughly $452,000 stolen. The funds were converted to DAI and remain unmoved in one address; the project said the XRP Ledger itself was not affected.
Garden FinanceDeFi ProtocolBridgeEthereumBaseArbitrum+1 chains$450K
An attacker breached an independent solver’s off-chain database and inserted fake transaction records, triggering unauthorized releases from Garden Finance’s HTLC contracts. About $450,000 in USDT was taken across four networks; the project said its protocol and smart contracts were not compromised.
Premia V3DeFi ProtocolArbitrum$437K
An attacker created empty option pools and used flash loans to buy options that locked collateral in Premia V3 vaults, then withdrew that collateral as liquidity. Six underwriter vaults on Arbitrum were affected.
Singularity FinanceDeFi ProtocolBase$413K
A misconfigured price oracle undervalued tokens held by Singularity Finance’s vault, letting an attacker deposit USDC for nearly all vault shares and then redeem them for a share of the actual assets. The attack drained funds from the vault.
AnkrDeFi ProtocolFlow$410K
A flaw in Ankr’s ankrFLOW staking contract let an attacker create unbacked tokens, use them as collateral on MORE Markets and borrow about 15.5 million WFLOW from its lending reserve. MORE Markets’ contracts worked as designed.
Edel FinanceDeFi ProtocolEthereum$403K
The attacker used flash loans to inflate the value of wGOOGLx collateral in Edel Finance’s lending protocol, which lacked a fallback price check. This enabled excessive borrowing and left about $403,000 in bad debt.
