Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
IOTAUndisclosed
A vulnerability in the official IOTA wallet app was exploited to steal user funds, prompting IOTA to shut down its network. About 850,000 MIOTA were reported stolen.
AltsbitCEXBitcoinEthereum$70K
Attackers breached Altsbit’s hot wallets, which held almost all the exchange’s funds, and stole several cryptocurrencies, including Bitcoin and Ether. The exchange suspended operations and later closed after offering partial refunds.
LuckLambo104DeFi ProtocolTron$1.5K
Attackers used contracts that triggered transaction rollbacks to exploit LuckLambo104’s smart contract and redirect funds. They gained 6,588 TRX, and the contract’s balance later fell to zero.
Bitcoin GoldLayer 1Bitcoin Gold$70K
Attackers gained majority computing power on Bitcoin Gold and reorganized blocks to reverse exchange deposits while keeping the withdrawn coins, effectively spending them twice. The attacks involved about 7,167 BTG in total.
ElectrumUndisclosed
A fake-update phishing campaign targeted Electrum users with older software versions. The report gives no amount stolen.
NULSLayer 1NULS$480K
Attackers exploited a flaw in NULS’s transaction-signature checks to transfer tokens from a team account. Some tokens reached markets; the project froze others and scheduled a hard fork to destroy them.
VeChainLayer 1VeChain$6.5M
VeChain’s buyback wallet was compromised after its private key was exposed, and 1.1 billion VET was stolen. The network froze the funds; the community later voted to permanently destroy 727 million of the frozen tokens.
Tron LoungeUndisclosed
An attacker used a self-made contract to roll back transactions against the Tron Lounge app contract, earning 54,653 TRX.
VertcoinLayer 1Vertcoin$29
An attacker reorganized Vertcoin’s blockchain in a 51% attack, replacing blocks and redirecting outputs in an attempted double-spend. Bittrex suspended withdrawals during the attack.
UpbitCEXEthereum$49.3M
Attackers compromised Upbit’s Ethereum hot wallet and stole 342,000 ETH. The exchange froze deposits and withdrawals, moved its remaining hot-wallet funds to cold storage, and said it would cover the loss.
Our coverage: Hackers Steal Almost 50 Million Dollars From UpBitSource
DiceUndisclosed
Using contracts they created, attackers exploited a transaction rollback flaw in TRON’s Dice contracts and gained 18,808 TRX.
GateHubUndisclosed
A GateHub data breach exposed passwords belonging to 1.4 million users.
VinDAXCEXEthereumMultiple$500K
Attackers stole assets from VinDAX’s hot wallets across 23 small cryptocurrencies. The exchange coordinated with the affected projects to freeze or recover the assets and later said it had recovered the stolen value.
BetHashUndisclosed
A BetHash attacker hijacked the smart contract’s bet-result notification and inserted extra operations into the process, exploiting the game’s betting rules to profit.
BitMEXUndisclosed
BitMEX exposed user data through an email error.
BitDiceUndisclosed
Attackers used a fake-EOS exploit against the BitDice game and gained more than 4,000 EOS, which they transferred to cryptocurrency exchanges.
SafuwalletUndisclosed
The SAFU Wallet browser extension injected hidden code into loaded webpages, including MEW, Index and Binance, and sent information to endpoints controlled through its domain. The code exposed users’ wallet information, which could let the operators access their wallets; the extension was later removed from the Chrome store.
FusionDeFi ProtocolEthereum$6.4M
Attackers stole Fusion’s transaction wallet private key and used it to take 10 million native FSN and 3.5 million ERC20 FSN tokens. Some tokens were traded before being frozen, and Fusion moved its remaining funds to cold storage.
CoinhouseUndisclosed
A phishing attack exposed Coinhouse users’ names and email addresses.
skreosladderUndisclosed
A hacker repeatedly exploited the EOS game to win thousands of EOS, using alternate accounts to get around the project’s blacklist.
CoinTigerCEXEthereum$9.2M
Attackers breached CoinTiger’s cold wallet, which lacked multi-signature protection, and stole PTT tokens. Some entered markets and drove the price down, while the Proton Chain project froze others.
BitstampUndisclosed
A vulnerability in Bitstamp exposed sensitive user information, including user IDs and bank card details. The report did not specify any funds taken.
SKR EOSUndisclosed
Attackers used transaction congestion—crowding the network with transactions—to exploit SKR EOS games and earn about 4,000 EOS.
SKReosUndisclosed
Attackers congested the game’s transactions by placing bets from many accounts at once, using multiple accounts to push blocks. They gained thousands of EOS.
RoyaleUndisclosed
Hackers attacked EOS Royale and took about 18,000 EOS. The attack method was not reported.
UnicornBetUndisclosed
Several hackers attacked the EOS game UnicornBet and gained thousands of EOS.
LuckyCloverUndisclosed
Multiple hackers repeatedly attacked the EOS game LuckyClover and won thousands of EOS.
MULTI.TODAYUndisclosed
An attacker exploited MULTI.TODAY’s betting-round mechanics by deploying a contract at the start of each round and using rollback betting to maximize returns, making 102,652 TRX.
7TronUndisclosed
Attackers used a rollback attack, which reverses or disrupts contract transactions, to take 67,695 TRX from 7Tron contracts.
7TronUndisclosed
Attackers used transaction rollbacks against the contracts, gaining 113,913 TRX.
YouHodlerUndisclosed
A data leak exposed YouHodler users’ personal and financial information, including bank account, passport and card details. The reports did not say that funds were stolen.
QuickBitUndisclosed
A data breach exposed some QuickBit users’ names, email and physical addresses, and card information. The exchange said about 2% of user data was accessible, but claimed it had not been copied or altered.
TronChipUndisclosed
Hackers repeatedly attacked TronChip, taking 61,867 TRX in total.
BitPointCEXBitcoinEthereumLitecoin+1 chains$27.6M
Attackers breached BitPoint’s hot wallets and stole several cryptocurrencies, including BTC, BCH, ETH and LTC. The exchange later recovered some funds from overseas platforms and reimbursed customers.
My Dash WalletUndisclosed
A malicious script embedded in My Dash Wallet sent users’ DASH balances and wallet secrets—including private keys and recovery seeds—to an external website.
TrezorUndisclosed
A person with a stolen Trezor or compatible device could use inexpensive equipment to extract its recovery seed—the words used to restore a wallet—in under five minutes. The vulnerability could not be patched.
BitmarketUndisclosed
Bitmarket abruptly shut down, citing a loss of liquidity, leaving users unable to access funds. Polish prosecutors said users lost a total of 2,300 BTC.
TKjoHFNUndisclosed
Attackers used a transaction rollback—a reversal of a transaction—to attack TKjoHFN and had made a profit, though the amount was not reported.
HiGold GameUndisclosed
An attacker repeatedly exploited HiGold Game and made a profit; the report gives no further details on the method or amount.
TLGUt5Undisclosed
An attacker repeatedly rolled back transactions involving the TLGUt5 DApp contract, taking 45,200 TRX and leaving the contract with almost no funds.
