Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
THORChainDeFi ProtocolBridgeEthereum$350K
A logic flaw in THORChain’s cross-chain system treated ERC-20 tokens with the symbol “ETH” as genuine ETH. Attackers used the fake ETH to obtain other tokens, and the network isolated the issue and repaired it.
Merlin LabDeFi ProtocolBSC$330K
A flaw in Merlin Lab’s Alpaca-BNB strategy counted BNB sent by a user as mining revenue, inflating MERL rewards. The attacker repeatedly exploited the calculation and made about $300,000.
SafeDollarDeFi ProtocolPolygon$248K
An attacker exploited SafeDollar’s staking pool, where deflationary-token behavior left the contract’s actual balance low while its deposit records stayed inflated. The flaw enabled the attacker to create and sell SDO tokens for about $248,000 in stablecoins.
xWin FinanceDeFi ProtocolBSC$270K
An attacker used a flash loan to manipulate prices and exploit faulty slippage checks in xWin’s reward system, extracting 303,998 XWIN tokens.
SharedStakeDeFi ProtocolEthereum$500K
An insider used a known flaw in SharedStake’s time-locked contracts—contracts that restrict when tokens can be withdrawn—to take 500,000 SGT tokens in several withdrawals. The tokens were later sold or used as collateral.
StableMagnetDeFi ProtocolBSC$27M
StableMagnet’s contracts contained a hidden backdoor that let the team drain liquidity pools and take tokens from wallets that had approved the contracts.
Eleven FinanceDeFi ProtocolBSC$4.5M
A flaw in Eleven Finance’s emergency withdrawal function failed to burn users’ shares, allowing an attacker to withdraw repeatedly from the same position. The stolen funds were later reported returned.
FireblocksDeFi ProtocolEthereum$72M
A failed key-backup process left StakeHound unable to access 38,178 ETH: Fireblocks lost two key shards, and StakeHound’s backup and recovery arrangements did not restore access. The ETH became permanently inaccessible.
Impossible FinanceDeFi ProtocolBSC$500K
An attacker used a flash loan and a fake token pair to manipulate pool prices because Impossible Finance’s swap function lacked a key price check. The attacker made about $497,000; roughly $252,000 was later returned.
PolyDEXDeFi ProtocolPolygon$500K
A flaw in PolyDEX’s token-locker contract let an attacker repeatedly call its withdrawal function and take about $500,000 in assets. The attacker moved the funds to Ethereum before the team could apply a fix.
Visor FinanceDeFi ProtocolEthereum$505K
An attacker gained access to an admin account for Visor Finance’s emergency withdrawal functions and took about $505,000 in assets awaiting placement in liquidity pools. The team replaced the withdrawn funds from its treasury.
AlchemixDeFi ProtocolEthereum$6.5M
A deployment-script error gave Alchemix’s alETH vault an incorrect debt calculation, allowing users to withdraw collateral without repaying their loans. The pool developed a shortfall, though Alchemix said users’ funds were not lost.
JBS$11M
Ransomware disrupted JBS’s operations, and the company paid cybercriminals $11 million in Bitcoin to protect its plants from further damage and limit the impact on its business.
EvoDefiDeFi ProtocolBSC$1M
A flaw in EvoDefi’s reward-update logic failed to account for rewards that had already been minted, letting an attacker repeatedly claim excess GEN tokens.
88mphDeFi ProtocolEthereumUndisclosed
A bug in 88mph’s NFT contract let anyone repeatedly initialize it, take control as owner and mint NFTs without restriction. The flaw was reported and patched within two hours; no theft was reported.
Fetch.aiCEXMultiple$2.6M
Fraudsters gained access to Fetch.ai’s Binance account and sold FET tokens at sharply reduced prices to associated parties, extracting about $2.6 million in value. Fetch.ai obtained a court order requiring Binance to trace and freeze the attackers’ accounts.
SiaUndisclosed
A sustained denial-of-service attack disrupted connections for about 30% of Sia storage hosts, but did not affect the network’s overall operation. No major financial losses were reported.
BurgerSwapUndisclosed
An attacker exploited a reentrancy flaw—a contract weakness that allows an operation to be repeated before it finishes—to manipulate prices through repeated swaps and counterfeit tokens, then profit from the trades.
PancakeHunnyUndisclosed
An attack on PancakeHunny generated a large amount of HUNNY tokens, which the attacker sold on the market for ETH. The sales caused HUNNY’s price to plunge.
Hunny FinanceDeFi ProtocolBSCUndisclosed
An accounting error in Hunny Finance’s Minter contract let an attacker repeatedly run a malicious contract, locking about $1.1 million in tokens. The team disputed that tokens had been stolen.
Belt FinanceDeFi ProtocolBSC$6.3M
An attacker used flash loans—temporary loans repaid within one transaction—to manipulate Belt Finance’s pool ratios and exploit faulty calculations of users’ pool shares. The attack drained about $6.2 million, most of which was converted to another token and moved to Ethereum.
Our coverage: Belt Finance Latest BSC Flash Loan Exploit Victim, Damages Total $50 Million USDSourceRekt report
BurgerSwapDeFi ProtocolBSC$7.2M
An attacker used a flash loan and a fake token to manipulate BurgerSwap’s prices, exploiting a reentrancy flaw in its contracts to make profitable swaps. About $7 million in tokens was stolen.
JulSwapUndisclosed
JulSwap was hit by a flash loan attack, and the price of its JULB token fell by more than 95% in a short time. The report does not specify how much was taken.
MerlinLabsDeFi ProtocolBSC$680K
A flaw in Merlin Lab’s reward calculation used the contract’s token balance instead of the user’s deposit, allowing an attacker to repeatedly claim excess rewards. A second attack was reported hours later.
Merlin Labs$550K
Merlin Labs was attacked again about eight hours after an earlier attack, losing roughly 200 ETH. The description does not give details of how the attack worked.
AutoShark FinanceDeFi ProtocolBSC$823K
An attacker used a flash loan to manipulate AutoShark’s SHARK-BNB pool, then sent tokens into SharkMinter to inflate reward calculations and mint SHARK. The attacker sold the tokens, making about $750,000.
Bogged FinanceDeFi ProtocolBSC$3M
A flaw in Bogged Finance’s token-transfer fee calculation charged 1% instead of the intended 5%, letting an attacker manipulate staking rewards and mint 15 million BOG tokens. The team reported that about $3 million was taken from the liquidity pool.
PancakeBunnyDeFi ProtocolBSC$45M
An attacker used a flash loan to manipulate exchange prices and mint BUNNY tokens, then sold them and took 114,631 WBNB. The resulting sell-off caused BUNNY’s price to crash.
VenusDeFi ProtocolBSC$100M
An attacker drove up XVS’s price on exchanges, then used the inflated token as collateral to borrow large amounts of Bitcoin and Ether from Venus. The price later fell, leaving the protocol with about $77 million in losses.
bEarn FiDeFi ProtocolBSC$18M
Attackers exploited a contract that handled BUSD and ibBUSD deposit amounts inconsistently, using flash-loan cycles to inflate withdrawals. Nearly 10.86 million BUSD was drained from the affected pool.
FinNexusDeFi ProtocolEthereumBSC$7M
Malware reportedly exposed the private key controlling FinNexus’s FNX token contract, giving an attacker control to mint large amounts of FNX on Ethereum and BSC and sell them, causing the token price to collapse.
Sony LifeUndisclosed
A Sony Life employee allegedly redirected a company transfer to a bank account he controlled, then converted the funds into more than 3,879 bitcoin. The FBI later seized about 3,789 bitcoin from his wallet.
flash.sxDeFi ProtocolEOS$13M
A reentrancy flaw in flash.sx’s flash-loan contract let an attacker repeatedly withdraw about 1.2 million EOS and 462,000 USDT. EOS block producers later changed the attacker’s account permissions, and all users were made whole.
xTokenDeFi ProtocolEthereum$24M
An attacker used a flash loan—borrowed funds that are repaid within one transaction—to manipulate a price feed and mint tokens at distorted prices; a flaw also let them mint xBNTa using tokens other than BNT. The affected pools were drained, causing nearly $25 million in losses.
LNDFi$1.18M
Leaked admin keys were used to change LNDFi’s contracts and drain a pool, taking about $1.18 million.
Rari CapitalDeFi ProtocolEthereum$10M
An attacker used a flash loan and an arbitrary-call feature in Rari’s ibETH integration to make the pool believe it held more ETH than it did, then withdrew about $10–14 million in ETH.
Value DeFiDeFi ProtocolBSC$11M
A flaw in Value DeFi’s uninitialized pool contracts let an attacker take control and withdraw liquidity tokens from the pools. More than 3,000 ETH was reported lost.
Colonial Pipeline$2.7M
A ransomware attack hit Colonial Pipeline, which paid a ransom in Bitcoin. The government later recovered 63.7 Bitcoin.
HpoolUndisclosed
A denial-of-service attack disrupted the front end of Hpool’s website, making it unavailable. No stolen funds were reported.
Value DeFiDeFi ProtocolBSC$10M
An attacker reinitialized Value DeFi’s vSwap pool, gave themselves operator control, and used a recovery function to drain its liquidity tokens and associated funds. The affected pool lost BUSD and other tokens.
