Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
AcrossDeFi ProtocolBridgeSolana$4.5M
An attacker forged Solana deposit signals, tricking Across relayers into paying out on fake cross-chain deposits. The relayers lost about $4.5 million of their own funds; users were not affected.
FlyCowTokenBSC$65.3K
FlyCow’s FCOW token burned its balance in a liquidity pool during a swap and reset the pool’s reserves, letting an attacker manipulate its state and drain about $65,300 in USDT through another swap.
DefiTuna LendingDeFi ProtocolSolana$580K
The attacker routed borrowed USDC through a highly illiquid TUNA/USDC pool, where the tiny swap output rounded a position’s value down to zero and bypassed the lending pool’s solvency check. The exploit drained about $580,000 in USDC.
CrowdRingCircleTokenBSC$209K
The attacker burned CRC tokens directly from the PancakeSwap pair, then called sync to make its recorded reserves differ from its actual balances. This artificially raised CRC’s price and let the attacker drain USDT from the pool.
OstiumDeFi ProtocolArbitrum$23.8M
An attacker used a compromised Ostium oracle signer key to submit false Bitcoin prices and open trades at those prices, then close them at market rates. The attack drained USDC from the protocol’s liquidity vault.
CascadeDeFi ProtocolArbitrum$1.34M
The attacker manipulated prices in a low-liquidity market, triggering liquidations of Cascade short positions and enabling a withdrawal of about $1.34 million USDC. The funds were largely recovered and affected users were to be compensated.
TeleSwapDeFi ProtocolBitcoin$735K
TeleSwap’s Bitcoin hot wallet was compromised, and more than $735,000 flowed out. The wallet stopped processing transactions, and the funds were later moved toward a mixer.
Sonic ICPDeFi ProtocolICP$276K
Race conditions during Sonic DEX’s asynchronous transaction processing let the attacker withdraw funds before pool balances were reconciled. The exploit affected 26 liquidity pools, and the protocol was paused.
BarnBridgeDeFi ProtocolEthereum$776K
An attacker passed a malicious governance proposal, took control of BarnBridge’s DAO, and replaced its SMART Yield contract with a malicious version. They used existing USDC spending approvals from about 50 users to take roughly $776,000.
Drips NetworkDeFi ProtocolEthereum$24.9K
An unsafe number conversion in Drips Network’s DaiDripsHub reversed a deposit into a withdrawal, allowing an attacker to drain about 24,883 DAI from the reserve.
Lumi FinanceDeFi ProtocolArbitrum$270K
Flaws in Sodium smart-account validation let an attacker-controlled paymaster gain token allowances from Lumi Finance users’ accounts. The attacker used those approvals to drain about $270,000 in assets.
Chi ProtocolDeFi ProtocolEthereum$8.5K
The attacker flash-borrowed WETH to buy depegged USC cheaply, then exploited a redemption function that assumed USC was worth $1 without checking its market price. They redeemed the tokens for full-value collateral, nearly draining the protocol’s reserves.
PHXTokenBSC$89.5K
PHX’s transfer-fee logic made the liquidity pool’s recorded reserves differ from its actual token balances. The attacker exploited the mismatch, using a flash loan to drain WBNB from the pool.
Bonzo LendDeFi ProtocolHedera$9.05M
A flaw in the Supra price oracle let an attacker submit a wildly inflated SAUCE price to Bonzo Lend, using only 250 SAUCE as collateral to borrow millions of dollars in USDC and WHBAR. The borrowed funds were swapped and some were bridged to Ethereum.
BlueMove DEXDeFi ProtocolSui$529K
BlueMove DEX’s liquidity pools were drained of more than 700,000 SUI. The cause was reported as either an LP-token double-minting flaw introduced in an upgrade or an arithmetic overflow in older AMM code.
BFBTokenBSC$198K
The attacker used zero-value transfer calls to repeatedly trigger BFB’s burn logic, destroying tokens held in a PancakeSwap liquidity pool. They drained the pool’s WBNB.
BonkDAOTokenSolana$20M
An attacker bought enough BONK to pass a malicious governance proposal, using the DAO’s voting system to transfer 4.43 trillion BONK from its treasury to attacker-controlled wallets. The proposal passed under a low voting threshold and without a delay before execution.
Lazy Summer ProtocolDeFi ProtocolEthereum$6.04M
An attacker used overvalued tokens from an impaired Silo vault to inflate the reported value of Lazy Summer’s USDC vaults, then redeemed shares at the inflated price. They extracted about $6.04 million in USDC.
HinkalDeFi ProtocolEthereum$820K
A flaw in Hinkal’s deprecated note format allowed unauthorized deposits without proof verification and bypassed checks on withdrawals. The attack drained about $820,000 in USDC from one Ethereum pool.
Edel FinanceDeFi ProtocolEthereum$403K
The attacker used flash loans to inflate the value of wGOOGLx collateral in Edel Finance’s lending protocol, which lacked a fallback price check. This enabled excessive borrowing and left about $403,000 in bad debt.
AIDCTokenBSC$121K
A bug in AIDC’s sell and burn logic failed to deduct accumulated burn fees from the seller’s balance. The attacker exploited the resulting pool imbalance to drain WBNB.
Nomic$3.15M
A flaw in Nomic’s forwarding logic created 40.65 unbacked nBTC, leaving Osmosis’s allBTC pool short by about $3.15 million. Osmosis froze 22.65 allBTC, but roughly 18 BTC-equivalent had already reached Tornado Cash before the issue was discovered.
PolymarketDeFi ProtocolPolygon$3M
A malicious script injected through a third-party vendor’s software appeared on Polymarket’s website and tricked users into approving fraudulent token transfers. It drained about $3 million in PUSD from 11 wallets; the funds were moved from Polygon to Ethereum.
Ocean ProtocolDeFi ProtocolPolygon$128K
The attacker flash-borrowed mOCEAN and cycled it through eight SideStaking-managed BPool clones on Polygon. A flaw in the pools’ one-sided liquidity calculations let them extract a net profit.
Lixir FinanceDeFi ProtocolEthereum$12.3K
A flaw in Lixir Finance’s permit signature checks let an attacker reuse one signature to gain approval to withdraw assets from vault holders across multiple vaults. The attacker took WETH, USDC, USDT and LIX worth about $12,300.
DLMCTokenBSC$223K
An attacker used a flash loan to manipulate DLMC’s internal token price, then redeemed referral rewards at an inflated rate. The rewards could be sold immediately, enabling the attacker to extract value without holding positions.
Yield YakUndisclosed
Malicious code was injected into Yield Yak’s vote.yieldyak.com subdomain. The code could put visitors’ assets at risk of theft.
SecondFiWalletCardano$2.4M
A flaw in SecondFi’s Cardano signing code reused transaction nonces, exposing private keys from wallet signatures. Attackers drained about 16 million ADA from 374 wallets; the project secured additional funds through an emergency rescue.
Royal.ioNFTfiPolygon$263K
A flaw in Royal.io’s legacy royalty accounting let the attacker manipulate reward calculations using a flash loan and 100 zero-value token transfers. They withdrew about $263,000 in USDC.
Taiko BridgeChainBridgeTaiko$1.7M
A leaked SGX signing key let the attacker forge proofs and submit fake bridge messages, bypassing Taiko’s checks and draining assets from its Ethereum ERC20 vault. The bridge was paused.
Quicksilver ZoneDeFi ProtocolQuicksilver$3.5K
A flaw in proof checking let an attacker forge proofs and mint about 505,000 qATOM and 10 million qOSMO without backing. The chain was halted, and the reported actual loss was limited to about $3,500.
GitcoinUndisclosed
Attackers compromised Gitcoin’s files.gitcoin.co subdomain and added malicious code designed to steal cryptocurrency from visitors’ wallets. The incident affected the website front end, not an on-chain smart contract.
MEV Bot$7.5M
Attackers tricked JaredFromSubway.eth’s MEV bot into approving tokens for malicious contracts by using fake token wrappers and liquidity pools. They used those approvals to transfer out WETH, USDC and USDT, draining about $7.5 million.
JaredFromSubway MEV BotOtherEthereum$7.5M
An attacker planted fake profitable trades that led JaredFromSubway’s MEV bot to approve malicious contracts to spend its tokens. The attacker later used those approvals to sweep more than $7.5 million in WETH, USDC, and USDT and laundered the funds through Tornado Cash.
LABUBU/OLPCLiquidity PoolBSC$1.1M
A misconfigured decimals setting in the OLPC token caused large unintended token burns and desynchronized PancakeSwap pool reserves. An attacker used the resulting pricing error to drain LABUBI and swap it for about 1.115 million USDT.
Secret NetworkChainBridgeSecret$4.67M
A flaw in Secret Network’s bridge contract let the attacker forge deposit messages through a custom IBC channel, minting unbacked tokens that were redeemed for real assets from Axelar’s escrow. About $4.67 million in assets was drained, then moved through other networks.
Namada Shielded PoolsDeFi ProtocolBridgeNamada$600K
An IBC transfer flaw let the attacker drain assets from Namada’s Multi-Asset Shielded Pool and move them across chains. About $600,000 in tokens was taken; a stale indexer initially continued to display the funds as available.
mySwap CLDeFi ProtocolStarknet$305K
An attacker created a fake EVIL token to exploit accounting and share calculations in mySwap’s concentrated-liquidity pools, draining about $305,000 in ETH, USDC, USDT and STRK.
JBTokenBSC$50K
The attacker used a flash loan and manipulated JB token pool prices, exploiting contract functions that repeatedly adjusted the pool’s reserves to extract USDT. The JB gateway lost about $50,000, and the flash loan was repaid in the same transaction.
Aztec BridgeDeFi ProtocolBridgeEthereum$2M
A flaw in the proof checks for Aztec’s deprecated bridge escape hatch let an attacker withdraw assets without corresponding deposits. The attacker took 1,158 ETH, 150,000 DAI, and about 0.47 renBTC.
