Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
ETCUndisclosed
The attacker rented mining power to carry out a 51% attack on ETC, affecting exchanges including Gate.io, Yobit, and Bitrue. The attacker later returned all the ETC.
HotDiceUndisclosed
HotDice was targeted in a transaction congestion attack, while the developers were unable to effectively identify and isolate high-risk or blacklisted accounts. The report did not state the amount taken.
ggeosUndisclosed
The ggeos contract was hit by a transaction rollback attack, which reverses or disrupts transactions. The reports do not specify what was taken or what happened to the funds.
EOS BUFFUndisclosed
EOS BUFF was repeatedly attacked, earning the attacker hundreds of EOS; the attack method was not reported.
TronwinUndisclosed
An overflow flaw in the Tronwin DApp was exploited, and 2 million TRX were stolen.
LuckBetUndisclosed
An attacker again exploited LuckBet’s random-number generation; the report does not specify what was taken.
LuckyMeUndisclosed
An attacker repeatedly targeted the LuckyMe game contract and profited thousands of EOS.
GameBetUndisclosed
An attacker used a transaction rollback—a reversal of a transaction—to exploit the GameBet dice contract, then sent most of the EOS gained to a FreeWallet account.
Fountain(FTN)Undisclosed
The attacker exploited an overflow flaw in Fountain’s batchTransfers function, which handles multiple transfers at once. The reports do not specify what was taken or what happened to the funds.
Lucky NutsUndisclosed
The Lucky Nuts game contract was repeatedly exploited through its random-number system. Most of the stolen EOS was later sent to a Binance account.
FastWinUndisclosed
A hacker gained control of and modified FAST's token contract, creating a flaw that allowed extra tokens to be issued for free.
PickownUndisclosed
The game contract accepted false transfer notifications from players because it did not filter them, allowing the transfer-error-prompt exploit. The report does not say what was taken.
LuckBetUndisclosed
An attacker exploited LuckBet’s game contract to obtain EOS, then transferred most of it to a Huobi exchange account.
EosDiceUndisclosed
An attacker targeted EosDice’s game contract and transferred most of the EOS gained to a Binance exchange account.
Big.gameUndisclosed
Big.game suffered a suspected rollback attack. The game reported a loss of about 8,000 EOS and moved the remaining dice prize pool to a secure account.
BetDiceUndisclosed
BetDice was hit by an attack involving transaction rollbacks; the report gives no further details about what was taken.
TRUSTBETUndisclosed
An attacker exploited a flaw in TRUSTBET's lottery randomness to replay the draw and win repeatedly, taking 11,501 EOS. The EOS was transferred to a Huobi deposit account.
ToBetDeFi ProtocolEOSUndisclosed
The attacker rolled back bet transactions, while ToBet's off-chain system briefly read the bets from a node and triggered lottery draws. The reports disagree on whether this resulted in funds being extracted.
EOS MaxDeFi ProtocolEOSUndisclosed
Attackers used EOS’s blacklist feature to reverse transactions after betting outcomes, letting players recover losing bets. The EOS MAX attacker reportedly gained 55,526 EOS, and the game was suspended.
VertcoinLayer 1Vertcoin$100K
An attacker rented mining power to gain majority control of Vertcoin’s network and reorganize its transaction history, enabling double-spends. The attack caused estimated losses exceeding $100,000.
kittyfishingUndisclosed
An attacker repeatedly used a rollback attack against the Kittyfishing game, making 91 attacks in two hours. The report does not specify what was taken.
FastwinUndisclosed
An attacker carried out 124 attacks on Fastwin’s game contract. The report does not specify what was taken or what happened to the funds.
Dice3DUndisclosed
The attacker used multiple contract accounts to submit game requests at once, placing small bets with a decoy account before increasing bets from the main account when the odds looked favorable. This allowed them to win large bonuses.
Dice3DUndisclosed
The attacker sent transaction requests from multiple accounts at once, manipulating the game so the final account had the highest chance of winning. The reports do not specify what was taken or what happened to the funds.
AtidiumUndisclosed
After Atidium’s official account was compromised, tokens including ATD were transferred out, and 130 million ATD was sent to Newdex for 3,183.8564 EOS.
nutsgamblingUndisclosed
An attacker exploited nutsgambling 144 times in under an hour, taking 1,141.71 EOS. The funds were moved through several accounts to another EOS account and had not been withdrawn to an exchange, according to the report.
BitPay CopayUndisclosed
Malicious code was added to third-party JavaScript libraries used by Copay and BitPay wallet apps, potentially exposing private keys and putting users’ Bitcoin and Bitcoin Cash at risk. The affected versions were 5.0.2 through 5.1.0.
vegasgame111Undisclosed
The attacker used a fake-EOS flaw in the quiz game contract to win hundreds of EOS. They moved the proceeds through multiple newly created accounts.
EOS LelegoDeFi ProtocolEOSUndisclosed
The attacker exploited Lelego’s predictable random-number system, using information from earlier blockchain blocks to guess game outcomes. They won 6,282.5 EOS and transferred 6,500 EOS to Binance.
LuckyGoUndisclosed
LuckyGo’s game contract was taken offline; the attacker iloveloveeos, described as a malicious contract, had been exposed in September in connection with an attack on FairDice.
AurumCoinLayer 1AurumCoin$500K
An attacker gained most of AurumCoin’s mining power, sent AU to Cryptopia and sold it before reversing the transaction to spend the coins again. The attack left the blockchain inactive.
HireVibes & AirDropsDACDeFi ProtocolEOS$13.6K
An attacker used a compromised EOSIO.SG testing account to take HVT and other airdrop tokens from the AirDropsDAC contract. Some HVT was sold for EOS, which was then sent to another account.
EOS.WINDeFi ProtocolEOS$9.18K
An attacker predicted EOS.WIN's random numbers by controlling a block reference number, making 10 successful attacks and gaining 9,180 EOS.
EOSDiceDeFi ProtocolEOS$25.1K
Attackers predicted EOSDice’s random numbers by analyzing blockchain information, exploiting a flaw in how the game generated randomness. The report does not specify what was taken.
MyEosVegasUndisclosed
The attacker launched 700 attacks against the MyEosVegas game contract. The reports do not specify what was taken or what happened to the funds.
EOSDiceUndisclosed
A flaw in EOSDice’s random-number system let an attacker predict game outcomes; the project had mistakenly included a seed the attacker could control.
FFgameDeFi ProtocolEOS$7.2K
The attacker predicted FFGame’s random results using information from earlier blockchain blocks and the game’s number-generation method, then triggered a winning result. The attack was part of a coordinated assault on eight EOS gambling platforms.
CaseGoUndisclosed
CaseGo was attacked, but the report does not give details about the method or outcome.
GATE.IOCEXBitcoinEthereumUndisclosed
Attackers compromised StatCounter’s analytics code and inserted JavaScript that targeted Gate.io’s Bitcoin withdrawal page, replacing withdrawal addresses with their own. The code could submit withdrawal forms automatically when certain limits were exceeded.
EOSevenUndisclosed
A large amount of SVN was moved from the EOSeven game account to tuningfinish, then partly returned; tuningfinish sold SVN on Newdex and sent the resulting EOS to Binance.
