Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Growth DeFiDeFi ProtocolEthereum$1.4M
An attacker created a fake token and liquidity pool, then exploited Growth DeFi’s farming contract, which failed to check that the deposited pool shares were the correct ones. This let the attacker drain the pool.
KeepChangeUndisclosed
KeepChange stopped a withdrawal request to an attacker-controlled address before any bitcoin was lost. The attackers did steal customer information, including names, email addresses, transaction details and passwords.
YFI$11M
A flash-loan attack drained Yearn’s yDAI vault. The attacker received about $2.8 million, while the vault reportedly lost $11 million.
YearnDeFi ProtocolEthereum$11M
An attacker used flash loans and distorted exchange rates to deposit USDC and DAI into Yearn’s yDAI vault without adequate protection against price changes. The vault lost $11 million, while the attacker reportedly profited about $2.7 million.
ArmorFiUndisclosed
A security researcher found a critical flaw in ArmorFi’s protocol that could have emptied its underwriting funds. ArmorFi paid the researcher a $1.5 million bug bounty; the description does not report funds being stolen.
CryptopiaCEXMultiple$45K
During Cryptopia’s liquidation, attackers compromised a dormant wallet holding XSN tokens and took about NZ$62,000 worth. The wallet was under the liquidators’ control.
SushiSwapDeFi ProtocolEthereum$104K
An attacker created a fake, thinly traded DIGG/WETH pool and manipulated its price to exploit SushiSwap’s fee-conversion process. The attacker took 81 ETH in fees meant for xSUSHI holders.
Badger DAODeFi ProtocolEthereum$104K
An attacker exploited a missing fee-conversion setup for the DIGG/WBTC pool on SushiSwap, routing protocol fees through a pool with little liquidity and taking 81 ETH in excess slippage fees intended for xSUSHI holders.
BuyUCoinUndisclosed
BuyUCoin user data was exposed after the ShinyHunters hacker group posted a database containing personal and financial details of more than 325,000 users, including contact, tax, and bank account information.
Saddle Finance$276K
No attack or loss of funds is described; the report criticizes Saddle Finance for raising money to build a copy of Curve with no innovation.
FiroUndisclosed
Firo reported that its network was under a 51% attack, in which an attacker gains control of most of the network’s mining power. The project advised users not to trade until the network returned to normal.
TorUndisclosed
The Tor network was attacked, leaving v3 onion addresses inaccessible as consensus-authorizing nodes were reportedly overloaded. The cause of the outage was unknown.
Gretchen WhitmerUndisclosed
An anonymous person sent death threats to Michigan Governor Gretchen Whitmer and state employees, demanding more than $2 million in bitcoin. State police said the threat was not credible.
ZKSUndisclosed
Scripts manipulated ZKSwap trades and pushed up the price when liquidity was first added. The project sold some ZKS to bring the price back down and put the resulting USDT into the liquidity pool, where it was to remain for three months.
Cover ProtocolDeFi ProtocolEthereum$9.4M
A flaw in Cover Protocol’s reward contract let an attacker mint an enormous number of COVER tokens, which were exchanged for other assets. A white-hat hacker returned funds, including 4,350 ETH, for distribution to liquidity providers.
LuBianOtherBitcoin$3.5B
An attacker exploited weak key generation in LuBian’s infrastructure to guess private keys and steal 127,426 BTC from its mining pool.
AltillyCEXMultiple$750K
An attacker used compromised API keys to access Altilly’s hosting provider, took control of its servers and deleted backups, leaving encrypted wallets inaccessible. One report said 30 BTC and 12,000 USDT were stolen; the exchange shut down without recovering funds.
LivecoinCEXMultiple$3.3M
Attackers used compromised credentials to take control of Livecoin’s servers and nodes, then manipulated exchange prices and drained several hot wallets. The exchange later shut down permanently.
EXMOCEXMultiple$10.5M
Attackers made coordinated withdrawals from EXMO’s compromised hot wallets, taking several cryptocurrencies, including BTC, ETH, XRP, ETC, ZEC and USDT. The exchange froze withdrawals; reports put the loss at about 5–6% of its assets.
Warp FinanceDeFi ProtocolEthereum$7.8M
An attacker used flash loans to manipulate Uniswap prices and inflate the apparent value of Warp Finance LP tokens, then borrowed stablecoins against them. About $7.7 million was taken, and the team said roughly $5.5 million remained in the vault for distribution to affected users.
Nexus MutualDeFi ProtocolEthereum$8M
An attacker gained remote access to Nexus Mutual founder Hugh Karp’s computer and replaced his MetaMask extension, tricking him into signing a transfer of 370,000 NXM tokens worth more than $8 million. The attacker later demanded a ransom.
AeternityChainAeternity$5.2M
An attacker gained control of more than half of Aeternity’s mining power and reorganized blocks to double-spend coins at exchanges. A later attempt to repeat the attack was detected and blocked.
FoxconnUndisclosed
DoppelPaymer ransomware infected about 1,200 Foxconn servers in Mexico, disrupting factory operations and stealing data while deleting backup data. Foxconn refused the ransom, and some stolen files were later published online.
PoloniexUndisclosed
A distributed denial-of-service attack overwhelmed Poloniex’s services, interrupting trading. Service resumed, and user funds were unaffected.
CompoundDeFi ProtocolEthereum$12.5M
Reports describe conflicting incidents: one says a price-feed error caused about $90 million in Compound liquidations; another says Compounder Finance’s developers replaced strategy pools with malicious contracts and drained them. The reports do not establish that these accounts concern the same event.
Compounder.Finance$80M
Compounder.Finance project owners transferred large amounts of tokens to their own accounts, causing the project to lose tokens worth about 80 million yuan.
BTC MarketsUndisclosed
BTC Markets accidentally sent marketing emails that exposed each recipient’s full name and email address alongside those of other customers. The exchange apologized and said it was adding security measures.
Saffron Finance$50M
A flaw in Saffron Finance’s redemption contracts left deposits from its first cycle locked for eight weeks. The team was working on a fix and a transition to the next cycle.
SushiSwapDeFi ProtocolEthereum$15K
An attacker exploited a flaw in SushiSwap’s fee-distribution system by creating a malicious pool and redirecting trading fees to it. They took about $10,000–$15,000 in fees, and the project said it would compensate users from its token reserves.
Rari CapitalUndisclosed
Rari Capital fixed a vulnerability in its RGT Distributor contract and suspended related token and deposit-and-withdrawal operations while reviewing the code. The report said no funds were lost.
Pickle FinanceDeFi ProtocolEthereum$19.7M
A flaw in Pickle Finance’s contract let an attacker use fake “jars”—contracts used to manage deposits—to drain about 20 million DAI from its pDAI pool.
88mphUndisclosed
An attacker exploited a vulnerability in 88mph’s MPH token contract and obtained $100,000 in MPH tokens. A separate flaw that could have exposed ETH in a Uniswap pool was secured by moving the funds to a governance wallet.
Origin ProtocolDeFi ProtocolEthereum$7.7M
An attacker used flash loans to exploit a reentrancy flaw in Origin Dollar’s vault minting function, inflating the token supply and then redeeming against it to drain vault funds.
OUSD$7M
A flash-loan attack exploited a vulnerability in Origin Dollar’s vault, causing about $7 million in losses. The report says the team was investigating the flaw and whether funds could be recovered.
Cheese BankDeFi ProtocolEthereum$3.3M
An attacker used a flash loan to buy Cheese tokens and inflate their price, then used the inflated value of deposited pool tokens as collateral to borrow available stablecoins. CheeseBank lost about $3.3 million.
Value DeFiDeFi ProtocolEthereum$7.4M
A flash loan attack manipulated stablecoin exchange rates through Curve’s price feed, allowing the attacker to drain Value DeFi’s MultiStables vault. The attacker returned part of the funds, but the vault still suffered losses.
LiquidUndisclosed
A domain-hosting provider mistakenly transferred control of Liquid’s domain account to an intruder, who changed its DNS settings and accessed internal email accounts and documents. User data was exposed, but Liquid said customer funds and its cold wallets were safe.
AkropolisDeFi ProtocolEthereum$2M
An attacker exploited a flaw in Akropolis’s SavingsModule that issued deposit tokens twice, allowing them to withdraw more than they had deposited. The attacker used this to take about 2.03 million DAI from the yCurve and sUSD pools.
ElectrumSVUndisclosed
A bug in ElectrumSV’s multisignature locking script allowed an attacker to steal 600 BSV from a user.
GrinChainGrinUndisclosed
An unknown miner gained control of more than half of Grin’s computing power and reorganized at least one block, allowing the network’s transaction history to be altered. The team advised users to wait for extra transaction confirmations.
