Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
LedgerWalletMultiple$271K
Scammers used fake Ledger emails and websites to trick users into revealing wallet recovery details or installing malware. One reported scam stole more than 1.15 million XRP, while other victims reportedly lost their wallet balances.
PercentFinance$1M
Problems in PercentFinance’s USDC, ETH and WBTC markets left some funds permanently locked. The team froze the affected markets, trapping 446,000 USDC, 28 WBTC and 313 ETH.
Axion NetworkDeFi ProtocolEthereum$500K
Malicious code in Axion’s software allowed unlimited AXN minting through its unstake function. The attacker created 79 billion tokens and sold them, driving the price down and taking about 1,300 ETH.
EtherCrashDeFi ProtocolEthereum$2.5M
EtherCrash’s single-key wallet was compromised, and two large withdrawals totaling about $2.5 million were made and exchanged for DAI. EtherCrash said it would compensate users for their losses.
Harvest FinanceDeFi ProtocolEthereum$24M
An attacker used a flash loan to manipulate prices in Curve’s stablecoin pool, repeatedly minting and redeeming Harvest Finance tokens to drain funds. The attacker later returned about $2.5 million, reducing users’ losses.
Electrum$22M
Hackers stole Bitcoin from Electrum wallet users by tricking them into installing fake software updates. Older versions of the app remained vulnerable.
WLEODeFi ProtocolEthereum$42K
An attacker used WLEO’s token contract to mint unlimited tokens, then traded them for ETH from a Uniswap liquidity pool. About $42,000 worth of ETH was taken.
Curve FinanceUndisclosed
Scammers bought Google search ads impersonating Curve’s website and tricked a visitor into a phishing attack. The user lost 20 bitcoins.
DeFi SaverUndisclosed
Users reported that 310,000 DAI had gone missing in connection with DeFi Saver Exchange. DeFi Saver said the funds were safe and linked the issue to exchange benefits reported earlier.
KuCoinCEXEthereum$281M
Attackers obtained the keys to KuCoin’s hot wallets and stole cryptocurrency, including Bitcoin and tokens. KuCoin recovered most of the funds through tracking, contract changes, and law enforcement cooperation, and said it would cover users’ losses.
EminenceDeFi ProtocolEthereum$15M
An attacker used a flash loan to manipulate the price of EMN in Eminence’s bonding-curve system, draining funds from the newly launched project. Reports said $8 million was returned to a Yearn deployer contract.
SodaDeFi ProtocolEthereum$160K
A variable naming error in Soda’s WETHCalculator contract let attackers withdraw more than 400 ETH from its liquidity mining pool. The report also says the flaw was fixed.
bZxUndisclosed
A replay bug in bZx’s iToken contracts enabled repeated lending actions and affected about $8 million in assets. bZx patched the bug, and the attacker later returned all the funds.
CoralDeFi ProtocolEOS$420K
A reentrancy bug in Coral’s wRAM contract let repeated, overlapping calls mint more tokens than intended. The attack caused a loss of more than 120,000 EOS.
SYFIDeFi ProtocolEthereum$250K
A bug in SYFI’s token rebase calculations let a trader stake a small amount and extract nearly $250,000 in gains, while the token price collapsed. The project’s contract had not been audited.
Soft Finance$250K
A user reported exploiting a vulnerability in Soft Finance and making a profit of $250,000. The report did not specify how the flaw worked or what funds were affected.
ETERBASECEXBitcoinEthereumXRP+3 chains$5.4M
Attackers compromised Eterbase’s internet-connected hot wallets and moved stolen Bitcoin, Ethereum, XRP, Tezos, Algorand and TRON to addresses they controlled. The losses exceeded $5.4 million.
Banco EstadoUndisclosed
REvil ransomware was behind a cyberattack that forced Chilean bank Banco Estado to shut down its nationwide operations.
TSEMUndisclosed
Ransomware attackers targeted Tower Semiconductor and demanded a Bitcoin ransom. The company shut down some servers and paused production at some factories.
Argentine National Immigration ServiceUndisclosed
NetWalker ransomware attackers accessed Argentina’s National Immigration Service database and stole information. The government refused to pay the ransom, which rose to 355 bitcoin.
CherryFiUndisclosed
A transfer compatibility flaw in CherryFi’s USDT handling caused funds to become locked, preventing users from transferring USDT into or out of the project.
ChainlinkUndisclosed
Attackers spammed nine Chainlink node operators and obtained about 700 ETH from their hot wallets.
Electrum$16M
A fake Electrum software update prompt led a user to connect to an attacker’s server when making a transfer. The report said 1,400 bitcoin were sent to the attacker’s wallet.
LedgerUndisclosed
An attacker used a misconfigured API key to access part of Ledger’s e-commerce and marketing database, exposing customers’ contact and order information. Ledger disabled the key and fixed the issue.
ETCUndisclosed
An attacker reorganized more than 7,000 Ethereum Classic blocks in another 51% attack, rewriting roughly two days of mining history. The incident caused missing blocks and prompted checks for missing transactions.
Degen.MoneyUndisclosed
A double-approval flaw in Degen.Money’s authorization process could let an attacker transfer users’ funds after they approved the project’s staking contract. Users reportedly lost money through the exploit.
NZXUndisclosed
A distributed denial-of-service attack took the New Zealand Stock Exchange offline for two days. The exchange said the attack came from abroad.
BTC ERAUndisclosed
Criminals impersonated the BTC ERA trading platform in emails that encouraged recipients to invest and pay, using the campaign to spread malware.
FilecoinUndisclosed
An attacker sent large numbers of messages to a Filecoin node, consuming its computing resources and preventing it from completing work, which caused it to lose computing power.
YFValue$170M
A flaw in YFValue’s staking pool let malicious users reset the pool’s timer. The team said funds worth about $170 million were at risk of being locked, and an attacker tried to use the flaw to blackmail it; no funds were reported stolen.
CryptoTrader.TaxUndisclosed
A hacker stole data belonging to more than 1,000 CryptoTrader.Tax users and reportedly tried to sell it on dark web forums.
KuCoinUndisclosed
KuCoin warned that fake websites were impersonating the exchange and offering false rewards to persuade users to deposit cryptocurrency. The report did not specify losses.
OKExCEXEthereum Classic$5.6M
Attackers used a 51% attack on Ethereum Classic to reverse deposits made to OKEx after withdrawing the deposited coins, effectively spending them twice. OKEx reported losses and said it would reimburse affected users.
LedgerUndisclosed
A trader reported that someone accessed their Ledger crypto wallet and stole more than 100,000 ERC-20 tokens; the report does not explain how the wallet was compromised.
BASEDUndisclosed
An attacker tried to permanently freeze BASED’s Pool1, but the attempt failed. The project said the pool’s funds and BASED tokens remained safe.
YAM$750K
A bug in YAM’s rebase calculation permanently locked governance tokens in a contract, leaving them unusable. The project’s price also plunged.
Domestic cloud serverUndisclosed
Attackers broke into cloud servers through SSH, a remote login service, and installed malware that used the servers to spread, mine Monero and launch denial-of-service attacks. No stolen funds were reported.
ETC$1.68M
Ethereum Classic suffered a 51% attack that reorganized more than 4,000 blocks. The attackers reportedly made at least $1.68 million.
Ethereum ClassicLayer 1Ethereum Classic$1.68M
Attackers gained control of enough Ethereum Classic mining power to reorganize 4,236 blocks and reverse transactions, enabling double-spends. The attack lasted more than 15 hours and stole at least $1.68 million in value.
Jon Prosser$4K
A hacker took over YouTuber Jon Prosser’s channel, renamed it “NASA [news]” and broadcast false Bitcoin-related claims. The stream reportedly generated about $4,000 in illegal proceeds.
