Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
EOSCastDeFi ProtocolEOS$72.9K
The attacker used a fake EOS token to trick the EOSCast game contract, which failed to check who had issued the token. This let the attacker drain real EOS from the prize pool.
MapleChangeUndisclosed
MapleChange reported a hack and temporarily disabled customer accounts while investigating. It did not specify the amount or how the funds were taken, and said it would arrange refunds based on customer reports.
EOS PokerUndisclosed
During a server expansion, EOS Poker’s operators failed to save the game’s random seed to the database. The system stopped recording seeds after game 868590.
EosRoyaleDeFi ProtocolEOS$60K
Attackers used information from earlier blocks to predict EosRoyale’s random game results and stole 11,000 EOS from its operational wallet.
TRADE.IOUndisclosed
Someone gained access to Trade.io’s cold-storage wallets and stole more than 50 million TIO tokens. Some of the tokens reached Bancor and Kucoin.
WORLD CONQUESTUndisclosed
A player exploited the game’s tax rules to block later buyers and end the game abnormally, taking nearly all the EOS in its fund pool.
EOSBetDeFi ProtocolEOS$338K
Attackers forged transfer notifications—messages that tell a contract a token transfer occurred—to exploit EOSBet's contract and drain funds. The reported loss was about $338,000.
SpankChainDeFi ProtocolEthereum$38K
An attacker used a malicious token contract whose transfer function repeatedly called back into SpankChain’s payment-channel contract, draining about 165 ETH. The attacker later returned the funds after negotiations.
EOSBankUndisclosed
The EOSBank contract's owner permissions were changed, and 18,000 EOS was transferred to the account fuzl4ta23d1a.
ZAIFCEXBitcoin$60M
Attackers gained access to Zaif’s hot-wallet keys and stole Bitcoin, Bitcoin Cash, and MonaCoin. The Bitcoin Cash amount was not specified.
NewdexDeFi ProtocolEOS$58K
Attackers created counterfeit EOS tokens and used them to buy real EOS and other tokens on Newdex, exploiting the exchange’s lack of smart-contract checks and its use of personal accounts for settlement. Newdex later compensated users.
EOSBetUndisclosed
The EOSBet game contract failed to verify that transfer actions came from the EOS token contract or the game’s own token contract. The report does not specify what was taken.
EOS.WinUndisclosed
The attacker exploited a code flaw to exchange fake EOS tokens for real EOS and win without placing a bet.
EOSBetDeFi ProtocolEOS$200K
The attacker used a malicious contract to send fake EOS transfer notices, bypassing EOSBet’s checks and making the platform pay out real EOS without a valid bet.
EOS Happy SlotUndisclosed
An attacker replayed transactions to claim multiple winnings in a single attempt.
FairDiceUndisclosed
The attacker exploited FairDice’s time-dependent randomness: the same bet could produce different results at different times, allowing the attacker to reject losing outcomes. The reports do not specify what was taken.
DEOSBETUndisclosed
Hackers cracked the pattern used to generate random numbers in DEOSBET; the report does not say what was taken.
EOS.WinUndisclosed
An attacker cracked EOS.Win's random number generation, causing a reported loss of 2,000 EOS. The attack was not publicly disclosed at the time.
LuckyosUndisclosed
Hackers cracked the random-number pattern in Luckyos’s rock-paper-scissors game and repeatedly played rock at a chosen time to win prizes.
EOSBETUndisclosed
A malicious contract consumed EOSBET’s RAM, and the game failed to check who was calling its transfer action. This let the attacker exchange fake tokens for real ones.
Fomo 3DUndisclosed
An attacker used special techniques to take the bonus from Ethereum’s Fomo 3D game; the description does not specify how the attack worked.
Fomo 3DUndisclosed
Fomo 3D’s website was reportedly hacked, and its access and traffic fell sharply. The reports do not specify what was taken or what happened to the funds.
KICKICODeFi ProtocolEthereum$7.7M
Attackers gained access to the key controlling KICK tokens, destroyed tokens at 40 addresses and recreated them in attacker-controlled wallets, taking 70 million KICK. The team later regained control using a cold-storage key.
狼人游戏(EOS Fomo3D)Undisclosed
An overflow bug in the EOS Fomo3D game contract caused its cash pool balance to turn negative.
BancorDeFi ProtocolEthereum$23.5M
Attackers gained access to a wallet linked to Bancor's BancorConverter contract, apparently using a compromised private key, and drained about $23.5 million in tokens.
BithumbCEXEthereum$31M
Attackers gained access to Bithumb’s online wallet system and stole cryptocurrency, including about 35,000 ETH and other tokens.
CoinrailCEXEthereum$37.2M
Attackers broke into Coinrail’s systems and stole more than $40 million in altcoins, including NPXS and Aston X. Partner exchanges helped recover about two-thirds of the stolen assets.
Our coverage: Bitcoin This Week: CFTC Subpoenas Major Crypto Exchanges, Coinrail Hacked, Bitcoin Prices And MoreSource
Litecoin CashUndisclosed
Litecoin Cash suffered a 51% attack, in which an attacker controls most of the network's mining power. The team contacted exchanges and raised the required confirmations to 100 to guard against attacks.
ZenCashChainZenCash$550K
An attacker gained majority control of ZenCash’s mining power and reorganized 38 blocks, enabling double-spends of ZEN across exchanges. The attack caused losses estimated at about $550,000.
Verge$4.82M
Attackers bypassed a previous fix and carried out another 51% attack on Verge, resulting in a loss of funds.
Our coverage: Verge Allegedly Suffers Another 51% AttackSource
BAI TokenUndisclosed
A flaw in the BAI smart contract allowed tokens to be transferred from any account without its owner’s permission. The disclosure reported numerous thefts.
EDU TokenUndisclosed
A critical flaw in the EDU smart contract allowed tokens to be transferred from any account.
VergeChainVerge$1.75M
Attackers exploited Verge’s timestamp checks by mining blocks with false timestamps, causing difficulty to adjust and enabling unusually fast mining. They created and took counterfeit XVG.
TAYLORUndisclosed
Taylor reported that attackers stole its ETH funds and TAY tokens from the team and bounty pools. Tokens in the founders’ and advisers’ pools were not taken because a vesting contract kept them inaccessible.
Bitcoin GoldChainBitcoin Gold$18M
Attackers gained most of Bitcoin Gold’s mining power, sent BTG to exchanges and sold it, then reversed the transactions to spend the same coins again, taking about 388,000 BTG from exchanges.
MonacoinChainMonaCoin$90K
From May 13 to 15, an attacker secretly mined and strategically released Monacoin blocks while controlling up to 57% of the mining power. This invalidated legitimate blocks and reportedly enabled about $90,000 in MONA to be stolen through exchange manipulation.
MyEtherWallet$13M
Attackers hijacked MyEtherWallet’s DNS, which redirected visitors to a malicious site; users’ wallets were emptied after they logged in.
SmartMeshTokenEthereum$140M
An integer-overflow flaw in SmartMesh’s transferProxy function let attackers create counterfeit tokens; some were traded on exchanges before trading was halted.
GateCEX$235M
Attackers compromised Gate.io’s private keys and drained Bitcoin, Ethereum, Dogecoin, and other tokens from the exchange. The breach was not publicly revealed until 2024.
COINSECURECEXBitcoin$3.3M
Coinsecure’s private keys were exposed online for more than 12 hours while the exchange was handling Bitcoin Gold distributions, enabling attackers to steal BTC. The chief security officer was arrested as a prime suspect.
