Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
Saudi AramcoUndisclosed
A blackmailer claimed to have stolen a large cache of Saudi Aramco corporate data using a previously unknown vulnerability. The claimed data included employee and customer information and internal company documents; the blackmailer demanded payment or threatened to sell it.
DEXToolsUndisclosed
DEXTools reported that it had been hacked, affecting some DEXT holders. It did not disclose how the hack occurred or the amount taken.
88mphDeFi ProtocolEthereumUndisclosed
A bug in 88mph’s NFT contract let anyone repeatedly initialize it, take control as owner and mint NFTs without restriction. The flaw was reported and patched within two hours; no theft was reported.
SiaUndisclosed
A sustained denial-of-service attack disrupted connections for about 30% of Sia storage hosts, but did not affect the network’s overall operation. No major financial losses were reported.
BurgerSwapUndisclosed
An attacker exploited a reentrancy flaw—a contract weakness that allows an operation to be repeated before it finishes—to manipulate prices through repeated swaps and counterfeit tokens, then profit from the trades.
PancakeHunnyUndisclosed
An attack on PancakeHunny generated a large amount of HUNNY tokens, which the attacker sold on the market for ETH. The sales caused HUNNY’s price to plunge.
Hunny FinanceDeFi ProtocolBSCUndisclosed
An accounting error in Hunny Finance’s Minter contract let an attacker repeatedly run a malicious contract, locking about $1.1 million in tokens. The team disputed that tokens had been stolen.
JulSwapUndisclosed
JulSwap was hit by a flash loan attack, and the price of its JULB token fell by more than 95% in a short time. The report does not specify how much was taken.
Sony LifeUndisclosed
A Sony Life employee allegedly redirected a company transfer to a bank account he controlled, then converted the funds into more than 3,879 bitcoin. The FBI later seized about 3,789 bitcoin from his wallet.
HpoolUndisclosed
A denial-of-service attack disrupted the front end of Hpool’s website, making it unavailable. No stolen funds were reported.
Mask NetworkUndisclosed
Bots attacked the contract address for Mask Network’s second ITO round. The project blacklisted the address; the report does not state what funds, if any, were taken.
Fei ProtocolUndisclosed
Fei Protocol found a vulnerability in its ETH joint-curve contract that could have allowed flash-loan price manipulation to drain its reserves. The contract was paused and the flaw was fixed before it was exploited; no user funds were affected.
HotbitUndisclosed
Attackers paralyzed Hotbit’s services and tried to access its wallets, but the risk-control system blocked them from reaching cryptocurrency assets. They deleted the database and obtained plaintext customer information, including phone numbers and email addresses.
FTXUndisclosed
FTX’s website suffered a small denial-of-service attack, which disrupted its API and website responsiveness. The report said user funds and core systems were unaffected.
CelsiusUndisclosed
A breach at a Celsius third-party service provider exposed customer information. Attackers used it to send fake emails and texts directing users to phishing sites that sought their private keys.
AcerUndisclosed
Ransomware group REvil said it had compromised Acer computers and stolen files, including financial records. It demanded up to $50 million in Monero to unlock the computers and keep the data from being published.
SIL.FinanceUndisclosed
A vulnerability in SIL.Finance’s contract permissions let automated trading bots submit transactions to profit from the flaw. The project said it recovered $12.15 million and planned compensation for any affected users.
Multiple DeFi protocolsUndisclosed
Attackers took control of the DNS settings for several BSC DeFi websites, including Cream Finance and PancakeSwap, and used the sites to ask visitors for private keys or recovery phrases. The projects later regained control of their domains.
PancakeSwap / Cream FinanceDeFi ProtocolBSCEthereumUndisclosed
Attackers hijacked the DNS records for Cream Finance and PancakeSwap, redirecting visitors to phishing sites that asked for wallet recovery phrases and private keys. Both teams regained control of their domains.
TryRollUndisclosed
TryRoll, a platform for community tokens, was suspected of being attacked, and tokens including WHALE, FWB, KARMA and JULIEN were sold for a total of 2,998 ETH. The report said 700 ETH was deposited into Tornado Cash, a service that mixes cryptocurrency transactions.
Curve FinanceUndisclosed
A vulnerability in Curve’s Pool Factory v1 was reported, and users were urged to withdraw from those pools. The issue did not affect v2 pools, and the report said it could not be used to steal users’ funds.
GabUndisclosed
Hackers took 70 GB of data from Gab, including public posts, personal information, passwords, and private account posts and messages. The data was handed to Distributed Denial of Secrets.
TetherUndisclosed
Tether said it received a ransom demand for 500 BTC, with the sender threatening to publish forged documents unless paid. Tether refused to pay and reported the demand and documents to law enforcement.
Yeld.financeUndisclosed
A flash loan attack exploited Yeld.finance’s DAI pool, affecting more than 10 users. The 160,000 DAI loss was later returned; other stablecoin pools were unaffected.
Primitive FinanceUndisclosed
A serious vulnerability was found in Primitive Finance’s smart contract. Because the contract could not be upgraded or paused, the team exploited it to secure user funds, which it said would be returned.
F2PoolUndisclosed
A DDoS attack temporarily disrupted some F2Pool addresses. The affected services were restored.
ULUndisclosed
Ransomware encrypted UL’s servers and disrupted some employees’ work. UL chose not to pay the ransom and restored its systems from backups.
KMAUndisclosed
The DoppelPaymer ransomware group said it had broken into Kia Motors America’s systems and leaked sensitive data, while demanding payment in Bitcoin. KMA reported outages affecting internal, reseller, and customer-facing systems.
VergeUndisclosed
An attacker gained control of most of Verge’s mining power and reorganized the blockchain, deleting transaction history from roughly 200 days.
KeepChangeUndisclosed
KeepChange stopped a withdrawal request to an attacker-controlled address before any bitcoin was lost. The attackers did steal customer information, including names, email addresses, transaction details and passwords.
ArmorFiUndisclosed
A security researcher found a critical flaw in ArmorFi’s protocol that could have emptied its underwriting funds. ArmorFi paid the researcher a $1.5 million bug bounty; the description does not report funds being stolen.
BuyUCoinUndisclosed
BuyUCoin user data was exposed after the ShinyHunters hacker group posted a database containing personal and financial details of more than 325,000 users, including contact, tax, and bank account information.
FiroUndisclosed
Firo reported that its network was under a 51% attack, in which an attacker gains control of most of the network’s mining power. The project advised users not to trade until the network returned to normal.
TorUndisclosed
The Tor network was attacked, leaving v3 onion addresses inaccessible as consensus-authorizing nodes were reportedly overloaded. The cause of the outage was unknown.
Gretchen WhitmerUndisclosed
An anonymous person sent death threats to Michigan Governor Gretchen Whitmer and state employees, demanding more than $2 million in bitcoin. State police said the threat was not credible.
ZKSUndisclosed
Scripts manipulated ZKSwap trades and pushed up the price when liquidity was first added. The project sold some ZKS to bring the price back down and put the resulting USDT into the liquidity pool, where it was to remain for three months.
