Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
OpynDeFi ProtocolEthereum$371K
A flaw in Opyn’s ETH put-option exercise function let attackers reuse one ETH payment to withdraw collateral from multiple vaults. They took 371,260 USDC from option sellers.
CWT$4.5M
Ransomware attackers hijacked CWT’s computer systems, and the travel company agreed to pay them $4.5 million worth of Bitcoin.
ETCUndisclosed
The Ethereum Classic blockchain reorganized 3,693 blocks, halting block production for nearly six hours before it returned to normal. The report does not describe any funds being taken.
2getherCEXBitcoinEthereum$1.18M
Attackers compromised 2gether’s systems and stole Bitcoin and Ether from user accounts. The exchange offered reimbursement options in its own 2GT tokens.
LedgerUndisclosed
Someone used an API key to access Ledger’s database without permission, exposing e-commerce and marketing data. Payment details and crypto assets were not affected, and the key was disabled.
TwitterUndisclosed
Hackers took over prominent Twitter accounts and posted cryptocurrency phishing messages. Scammers received 12.86 BTC before the posts were deleted.
CashaaCEXBitcoin$3.1M
Malware on a Cashaa employee’s computer initiated Bitcoin transfers to attacker-controlled wallets. The exchange reported that about 336 BTC was stolen and halted crypto transactions.
Our coverage: Cashaa Exchange Hack Results In More Than $3 Million Lost In BTCSource
Bitcoin GoldUndisclosed
Bitcoin Gold’s network was hit by 51% attacks lasting nearly 10 days, allowing the chain’s transaction history to be reorganized. The team issued an alert and released an update with block checkpoints to protect the network.
Russian blockchain voting platformUndisclosed
Personal information from people who voted through Russia’s blockchain voting platform was exposed in downloadable files on a government website. The files included identity and passport details, and the report also noted a flaw that could allow some repeat votes.
Ravencoin$40M
A vulnerability in Ravencoin allowed unknown parties to create extra RVN, amounting to 1.5% of the planned total supply. The tokens may have been sold, but the report does not give a confirmed loss amount.
VETHDeFi ProtocolEthereum$450K
An access-control flaw in VETH’s contract let an attacker take control of the remaining Vether and claim about 900,000 tokens. They sold 150,000 on Uniswap for roughly 15 ETH.
Balancer$2.41K
An attacker used a flash loan—a short-term loan repaid within one transaction—to exploit a COMP trading pool in Balancer and take unclaimed COMP rewards, making a profit of 10.8 ETH.
BalancerDeFi ProtocolEthereum$500K
An attacker exploited Balancer pools’ failure to account for tokens that burn a portion of each transfer, repeatedly trading with borrowed funds to drain assets from imbalanced pools. The affected pools lost tokens including STA and STONK, as well as ETH, WBTC, LINK, and SNX.
Web3 DeFi$100K
A fake SAI-to-DAI migration app tricked users into signing transactions that sent their SAI to an attacker’s address. More than $100,000 worth of SAI was traced to the attacker.
Atomic LoansUndisclosed
A researcher found two flaws that could have let borrowers unlock some or all of their Bitcoin collateral without repaying loans. Neither flaw was exploited, and no funds were affected; Atomic Loans paused new loans while preparing an update.
DDM$40K
Impersonators flooded DMM’s Telegram during its token sale and tricked people into sending them funds. DMM later sent affected users replacement DMG tokens.
BancorDeFi ProtocolEthereum$545K
A flaw in Bancor v0.6 let anyone use token approvals stored for users to transfer their funds. The team moved some funds to safety, but front-running bots took additional funds before the contract was patched.
DeversiFiUndisclosed
An oversized order repeatedly failed the exchange’s order limit checks, but the system kept resubmitting it. The repeated rejections disrupted the processing of other orders.
FilecoinUndisclosed
A vulnerability in Filecoin’s code allowed extra tokens to be issued; 6Block said it created 1.6 billion FIL to demonstrate the flaw, then reported it to Filecoin’s team for fixing.
LMEXUndisclosed
LMEX said its platform was hacked and 150,000 USDT was stolen. It closed deposits and withdrawals after the theft left it with a debt shortfall.
TBTCUndisclosed
The Keep team found a flaw in TBTC’s Bitcoin redemption process that could put deposits at risk of liquidation. It activated a 10-day deposit pause; the report describes no theft.
LoopringUndisclosed
A flaw in Loopring’s front end limited users’ EdDSA private keys to a small, searchable range, making them vulnerable to discovery by trial and error. The exchange shut down for half a day to upgrade; no theft was reported.
YoubiUndisclosed
Youbi Exchange faced heavy DDoS traffic—an overload of requests that disrupted access to its servers—for three consecutive days. The service was briefly inaccessible.
BitSGUndisclosed
Repeated DDoS attacks—floods of traffic intended to disrupt a service—affected BitSG’s website and app, preventing users from logging in at times.
FelixUndisclosed
An EOS gambling app was hit by an attack involving fake EOS, according to the report; it gives no further details on the method or losses.
HegicDeFi ProtocolEthereum$28.5K
A typo in Hegic’s options contract caused some users’ funds to remain locked after options expired. The funds were recovered and affected users were refunded.
Lendf.MeDeFi ProtocolEthereum$25M
An attacker exploited a reentrancy flaw in Lendf.Me, repeatedly moving tokens before the protocol updated its balances, and stole funds. Law enforcement and exchanges helped recover the funds within days.
UniswapDeFi ProtocolEthereum$220K
An attacker exploited a reentrancy flaw in Uniswap V1’s imBTC pool, using a token callback to withdraw funds before balances were updated. The pool lost about 1,278 ETH.
BisqDeFi ProtocolBitcoin$248K
Bisq’s fallback payout process failed to check that the destination was its legitimate donation address. Attackers substituted their own addresses and took traders’ deposits and security funds, totaling 34.86 BTC.
Cocos-BCXUndisclosed
Cocos-BCX said someone stole mapping wallet information and used it to take and sell 1,087,522,819.2 COCOS tokens.
Ledger ChromeUndisclosed
Fake Ledger Chrome extensions promoted through Google search ads and other methods tricked users into installing them, allowing attackers to steal cryptocurrency. At least 1.4 million XRP were taken.
MakerDaoDeFi ProtocolEthereum$8.32M
During Ethereum network congestion, MakerDAO’s price oracle failed to update, leaving outdated collateral prices. Buyers exploited the resulting auctions with zero-DAI bids, taking ETH and leaving the system with a shortfall and bad debt.
Trident Crypto FundUndisclosed
Attackers leaked a database containing data from 266,000 Trident Crypto Fund users, including email addresses, phone numbers, encrypted passwords and IP addresses.
Josh Jones$45M
Josh Jones had about $45 million in digital currency stolen after his SIM card was hacked.
OokiDeFi ProtocolEthereum$650K
An attacker manipulated sUSD prices across several protocols that bZx relied on for price data, then front-ran liquidations. The attack caused losses of about $645,000.
bZx$645K
bZx was attacked, with an estimated loss of ETH.
VBITEXUndisclosed
VBITEX was hacked, leading to unauthorized changes to platform data and theft of virtual assets; the report gives no further details.
bZx$350K
The DeFi lending protocol bZx was exploited in an oracle attack, with reported losses of up to $350,000.
OokiDeFi ProtocolEthereum$350K
Attackers used flash loans—borrowed funds repaid within one transaction—and spread them across exchanges to manipulate wrapped Bitcoin prices reported to bZx’s oracle, a price feed with too few sources. They profited from the manipulated prices.
Trinity WalletWalletIota$2M
A DNS hijacking attack on Trinity Wallet led to malicious code stealing users’ private-key seeds. More than 50 users lost 8.55 million MIOTA.
