Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
WaltonchainUndisclosed
Waltonchain’s mainnet suffered a coordinated attack. The team said it resolved the problem by upgrading the mainnet.
SPOKparkUndisclosed
Attackers used multiple contracts to carry out a rollback attack against SPOKpark, a Tron game, and made 50,845 TRX. The website later became inaccessible.
BitrueCEXRippleCardano$4.7M
Attackers exploited a flaw in Bitrue’s withdrawal review process to bypass security checks and access user funds. They then stole XRP and ADA from the exchange’s hot wallet.
SynthetixDeFi ProtocolEthereumUndisclosed
A faulty oracle price feed reported the Korean won at 1,000 times its actual rate, and a trading bot exploited the error to generate over 37 million sETH in profits. The funds were recovered through a negotiated return and bug bounty.
yizeslotsbetUndisclosed
An error in the yizeslotsbet EOS contract’s transfer prompt was exploited, and the attacker obtained 10,000 FB tokens.
SKR EOSUndisclosed
Hackers repeatedly attacked SKR EOS using a weakness in its random-number process and earned thousands of EOS.
RouletteUndisclosed
An attacker used a self-created contract to exploit a transaction rollback flaw in the DAppRoulette contract and gained 27,000 TRX.
BETXUndisclosed
A stolen project private key gave an attacker owner privileges over BETX’s token contract, allowing them to transfer all 600 million BETX held by managers and sell the tokens on Newdex.
GateHubCEXRipple$9.5M
Attackers gained access to GateHub API permissions and stole 23.2 million XRP from about 100 user accounts; users’ private keys were reported secure. About 13.1 million XRP was laundered through exchanges before recovery efforts.
KrakenCEXBitcoin$10.5M
A hacker took control of a large Kraken account, then sold 1,200 BTC into a thinly traded BTC/CAD market, driving down the price and triggering liquidations of other users’ positions. The hacker reportedly gained about $10.45 million from those liquidations.
RemitanoUndisclosed
Remitano suspended XRP deposits and withdrawals after false XRP deposits caused losses for buyers, following complaints from users.
Poker EOSDeFi ProtocolEOSUndisclosed
Poker EOS’s private key was exposed, allowing attackers to drain more than 26,992 EOS from the game and transfer some of it to exchanges.
Coinbase$100K
An attacker used a SIM swap—redirecting a victim’s phone number to a device they controlled—to access a Coinbase account and steal more than $100,000 in Bitcoin.
DiceGameUndisclosed
Attackers used a transaction rollback against DiceGame and gained 5,150 TRX.
BinanceCEXBitcoin$40M
Attackers obtained Binance user credentials and other information through methods including phishing and malware, then withdrew 7,000 BTC. Binance reimbursed affected customers from its insurance fund.
Our coverage: Binance Hack: What Went Wrong And Where They Stand?Source
TronBankDeFi ProtocolTron$4.27M
A flaw in TronBank’s deployed contract let someone withdraw 26.73 million TRX, emptying the contract. The person who took the funds said they would return them to investors, but the report does not confirm that they did.
BitoProUndisclosed
An attack on BitoPro’s XRP market caused the price to crash, and the exchange was thought to have lost about 7 million XRP. The attack method was described as a false top-up, but further details were not reported.
Wheel Of FortuneUndisclosed
An attacker used transaction rollbacks against the TRON Wheel Of Fortune DApp and took 7,856 TRX; the attack was still ongoing.
eosblue.oneUndisclosed
A malicious memo caused eosblue.one’s server to fail when parsing it, letting the attacker repeatedly win prizes or receive unusually large refunds.
TronWowDeFi ProtocolTronUndisclosed
Attackers exploited TronWow’s predictable random-number generation to predict game outcomes, making 2,167,377 TRX in profits across 1,203 attacks.
TronBankDeFi ProtocolTronUndisclosed
TronBank failed to check that tokens used in its investment function were genuine BTT. Attackers used counterfeit tokens to inflate their balances, creating roughly 170–200 million fake BTT.
IseriCoinUndisclosed
An attacker exploited a vulnerability in IseriCoin’s contract to send a large amount of tokens to their own account.
EOSlotsUndisclosed
An attacker repeatedly exploited EOSlots’ random-number system to win from the game, which then suspended operations.
DEOS GamesUndisclosed
Attackers created hundreds of accounts and made small bets through DEOS Games’ lucky-draw feature, exploiting unusually high returns to gain thousands of EOS.
EosNowUndisclosed
The attacker used multiple accounts to congest EOS transactions and disrupt the eosnowbetext quiz game, making a profit. Transaction congestion means flooding or crowding the network so other transactions are delayed.
BithumbCEXEthereumRipple$19M
Bithumb’s internet-connected wallet was accessed using private keys, and EOS and XRP were stolen; reports differed on the amount of EOS taken. The exchange suspected insider involvement, and said customer funds were in cold storage.
Our coverage: Bithumb Experienced Major Hack Costing Over $19M Worth In CryptosSource
TronCrushDeFi ProtocolTronUndisclosed
TronCrush’s transfer function allowed an address to send tokens to itself, letting an attacker create TCC tokens without backing. The same flaw affected more than 20 other contracts and DApps.
ZIONUndisclosed
An attacker exploited ZION.games, gaining more than 2,849 EOS and transferring the proceeds to Binance. The report said the method resembled an earlier attack on TGON.
TGONUndisclosed
An attacker controlled multiple accounts to repeatedly exploit TGON, earning thousands of EOS and transferring the proceeds to Binance.
BiKiUndisclosed
SMS verification codes were hijacked, allowing attackers to change passwords on 37 BiKi accounts and transfer assets from 18 of them. BiKi said it would cover the losses.
CoinBeneCEXEthereum$40M
Coinbene’s hot wallet was compromised, and ERC-20 tokens were drained to unknown addresses. Reports described large amounts of Coinbene and Maximine tokens being stolen and sold.
DragonExCEXBitcoinEthereumEOS+3 chains$7M
Attackers used phishing and fake Worldbit-bot trading software to breach DragonEx’s systems and obtain private keys and API access. They drained 20 cryptocurrency wallets, including wallets holding Bitcoin and Ether.
EtboxCEXBitcoinEthereum$132K
Attackers targeted Etbox’s infrastructure to obtain exchange wallet private keys and API credentials, then stole cryptocurrency from the platform’s wallet.
dBet GamesUndisclosed
An attacker repeatedly targeted dBet Games and made a profit; the report does not specify the amount or attack method.
EOSVegasUndisclosed
Attackers repeatedly congested EOSVegas with transactions, interfering with the game and making a profit. The attacker’s account was also reported as active in an attack on EOS Cube.
EOS CubeUndisclosed
An attacker congested EOS transactions to disrupt the cubecontract game and made a profit. Transaction congestion means crowding the network to delay or interfere with other transactions.
YUM.gamesUndisclosed
An attacker appeared to call YUM.games’ game-start function and claim a prize without placing a bet, earning a profit.
MercatoxUndisclosed
An attacker used a hard_fail attack against the Mercatox exchange and earned thousands of EOS.
LuckyGoUndisclosed
An attacker repeatedly targeted LuckyGo and made a profit of hundreds of EOS.
dBet GamesUndisclosed
Attackers repeatedly targeted dBet Games and made hundreds of EUSD, an EOS-based stablecoin, which they sold through the Newdex exchange.
