Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Mask NetworkUndisclosed
Bots attacked the contract address for Mask Network’s second ITO round. The project blacklisted the address; the report does not state what funds, if any, were taken.
Spartan ProtocolDeFi ProtocolBSC$30.5M
A flaw in Spartan Protocol’s liquidity-share accounting let an attacker use a flash loan—a loan taken and repaid within one transaction—to inflate a pool’s balance, then withdraw more than their fair share. The attack drained about $30 million from the SPARTA/WBNB pool.
Fei ProtocolUndisclosed
Fei Protocol found a vulnerability in its ETH joint-curve contract that could have allowed flash-loan price manipulation to drain its reserves. The contract was paused and the flaw was fixed before it was exploited; no user funds were affected.
HotbitUndisclosed
Attackers paralyzed Hotbit’s services and tried to access its wallets, but the risk-control system blocked them from reaching cryptocurrency assets. They deleted the database and obtained plaintext customer information, including phone numbers and email addresses.
Uranium FinanceDeFi ProtocolBSC$57.2M
A calculation error in Uranium Finance’s swap function let attackers extract nearly all the reserves from affected pools by sending minimal value. The project shut down, and victims received no compensation.
FTXUndisclosed
FTX’s website suffered a small denial-of-service attack, which disrupted its API and website responsiveness. The report said user funds and core systems were unaffected.
EasyFiDeFi ProtocolPolygon$59M
Malware on the EasyFi CEO’s computer exposed administrator keys, which were used to transfer EASY tokens and drain stablecoins from the protocol’s liquidity pools. The stolen assets included 2.98 million EASY tokens and about $6 million in stablecoins.
CelsiusUndisclosed
A breach at a Celsius third-party service provider exposed customer information. Attackers used it to send fake emails and texts directing users to phishing sites that sought their private keys.
PancakeSwapDeFi ProtocolBSC$1.8M
Someone with administrator access manipulated PancakeSwap’s lottery by exploiting its predictable block-hash random number generator, taking 59,765 CAKE from the prize pool.
PolkatrainDeFi ProtocolPolkadot$3M
A flaw in Polkatrain’s rebate system let an attacker repeatedly trade to claim rewards without limits or checks that the rewards had run out. The contract lost 57,000 DOT.
Force DAODeFi ProtocolEthereum$367K
Attackers exploited Force DAO’s xFORCE vault, which failed to check whether a token transfer had succeeded, allowing them to claim FORCE without a valid transfer. About $367,000 in FORCE was taken.
Turtle DexDeFi ProtocolBSC$2.5M
TurtleDex’s team drained liquidity from its PancakeSwap and ApeSwap pools shortly after raising funds, then converted the proceeds to ETH and withdrew them through Binance.
AcerUndisclosed
Ransomware group REvil said it had compromised Acer computers and stolen files, including financial records. It demanded up to $50 million in Monero to unlock the computers and keep the data from being published.
SIL.FinanceUndisclosed
A vulnerability in SIL.Finance’s contract permissions let automated trading bots submit transactions to profit from the flaw. The project said it recovered $12.15 million and planned compensation for any affected users.
Iron FinanceDeFi ProtocolPolygon$170K
An error in Iron Finance’s reward-rate settings inflated farming rewards 365-fold, allowing an attacker to drain all SIL rewards from two pools. The loss was about $170,000.
TSD$7.1M
An attacker gained enough voting control in TSD’s DAO to pass a proposal adding code that minted 11.8 billion TSD tokens to their account. They sold the tokens on PancakeSwap.
TSD (True Seigniorage Dollar)DeFi ProtocolBSC$7.1M
An attacker bought enough TSD governance tokens to pass a proposal replacing the token’s contract with a malicious version. It minted 11.8 billion TSD, which the attacker immediately sold on PancakeSwap.
Deus DAODeFi ProtocolFantom$3M
A flash-loan attack manipulated the USDC/DEI price feed, triggering incorrect liquidations on Deus Finance. The attacker reportedly profited about $3 million.
Multiple DeFi protocolsUndisclosed
Attackers took control of the DNS settings for several BSC DeFi websites, including Cream Finance and PancakeSwap, and used the sites to ask visitors for private keys or recovery phrases. The projects later regained control of their domains.
PancakeSwap / Cream FinanceDeFi ProtocolBSCEthereumUndisclosed
Attackers hijacked the DNS records for Cream Finance and PancakeSwap, redirecting visitors to phishing sites that asked for wallet recovery phrases and private keys. Both teams regained control of their domains.
RollDeFi ProtocolEthereum$5.7M
An attacker obtained Roll’s hot-wallet key and stole about $5.7 million in social tokens, then sold them on Uniswap and laundered the proceeds through Tornado Cash.
TryRollUndisclosed
TryRoll, a platform for community tokens, was suspected of being attacked, and tokens including WHALE, FWB, KARMA and JULIEN were sold for a total of 2,998 ETH. The report said 700 ETH was deposited into Tornado Cash, a service that mixes cryptocurrency transactions.
DODODeFi ProtocolEthereum$3.8M
DODO’s crowdpooling contract allowed its initialization function to be called again, letting an attacker reconfigure pools with worthless tokens and drain their reserves. About $3.8 million was taken, and roughly $3.1 million was returned by trading bots.
CNA$40M
Ransomware attackers took control of CNA’s network, and the insurance company paid a $40 million ransom to regain access.
Paid NetworkDeFi ProtocolEthereum$27M
An attacker accessed PAID Network’s deployment wallet and upgraded its token contract to allow unlimited minting. They created 59.4 million unauthorized PAID tokens and sold them into the PAID/ETH pool on Uniswap.
Curve FinanceUndisclosed
A vulnerability in Curve’s Pool Factory v1 was reported, and users were urged to withdraw from those pools. The issue did not affect v2 pools, and the report said it could not be used to steal users’ funds.
Meerkat Finance - BSCDeFi ProtocolBSC$31M
An attacker exploited a flaw in Meerkat Finance’s proxy setup to gain administrator control and drain its vaults, which held $31 million. The team later launched a refund program.
SeascapeNetworkDeFi ProtocolEthereum$500K
An attacker stole an early SeascapeNetwork investor’s private key and took 18,750 CWS from the investor’s wallet. The tokens were exchanged for ETH and sent through the Tornado Cash mixing service.
GabUndisclosed
Hackers took 70 GB of data from Gab, including public posts, personal information, passwords, and private account posts and messages. The data was handed to Distributed Denial of Secrets.
TetherUndisclosed
Tether said it received a ransom demand for 500 BTC, with the sender threatening to publish forged documents unless paid. Tether refused to pay and reported the demand and documents to law enforcement.
FurucomboDeFi ProtocolEthereum$14M
An attacker used a fake Aave v2 contract and a flaw in Furucombo’s contract checks to take tokens that users had pre-approved for transfer, including stETH and USDC. About 22 users were affected, and Furucombo later said it would issue compensation tokens.
Yeld.financeUndisclosed
A flash loan attack exploited Yeld.finance’s DAI pool, affecting more than 10 users. The 160,000 DAI loss was later returned; other stablecoin pools were unaffected.
Primitive FinanceUndisclosed
A serious vulnerability was found in Primitive Finance’s smart contract. Because the contract could not be upgraded or paused, the team exploited it to secure user funds, which it said would be returned.
Cryptopia$45K
A dormant wallet controlled by Cryptopia’s liquidator was accessed, and attackers took about NZ$62,000 worth of XSN tokens.
F2PoolUndisclosed
A DDoS attack temporarily disrupted some F2Pool addresses. The affected services were restored.
ULUndisclosed
Ransomware encrypted UL’s servers and disrupted some employees’ work. UL chose not to pay the ransom and restored its systems from backups.
KMAUndisclosed
The DoppelPaymer ransomware group said it had broken into Kia Motors America’s systems and leaked sensitive data, while demanding payment in Bitcoin. KMA reported outages affecting internal, reseller, and customer-facing systems.
VergeUndisclosed
An attacker gained control of most of Verge’s mining power and reorganized the blockchain, deleting transaction history from roughly 200 days.
Alpha Finance/Cream FinanceDeFi ProtocolEthereum$37.5M
An attacker used recursive flash loans to exploit a rounding error in lending calculations, borrowing against inflated sUSD debt across Alpha Finance and Cream Finance. The combined reported losses were about $37.5 million.
BT.FinanceDeFi ProtocolEthereum$1.5M
A flash-loan attack manipulated price oracles used by BT.Finance’s ETH, USDC, and USDT strategies, draining about $1.5 million. A withdrawal-fee protection feature reduced the loss by nearly $140,000.
