Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
EGD FinanceDeFi ProtocolBinance Smart Chain$36K
An attacker used a flash loan to manipulate EGD’s price on PancakeSwap, exploiting the protocol’s price-based reward calculation to claim excessive rewards. Funds were unexpectedly withdrawn from the project’s pool.
Wiener DOGEDeFi ProtocolBSC$30K
A flash-loan attacker exploited Wiener DOGE’s transfer fees, which were also charged on liquidity-pool trades, to drain tokens from the pools and unbalance their prices. The attacker profited about 78 BNB.
FPRDeFi ProtocolBSC$29K
An access-control flaw in FPR allowed unauthorized users to call privileged functions, draining about $29,000 in protocol assets.
N00dleSwapDeFi ProtocolEthereum$29K
A reentrancy flaw in N00dleSwap’s ERC777 token-transfer callback let an attacker repeatedly re-enter the contract during transfers and drain about $29,000 in tokens.
Last Kilometer$26.5K
Last Kilometer was exploited in a flash-loan attack, resulting in a loss of $26,495.
SpaceGodzillaDeFi ProtocolBSC$25.4K
Using a flash loan, an attacker inflated the price of SpaceGodzilla tokens on PancakeSwap and then swapped them back for BUSD, making a profit of about 25,000 BUSD. The proceeds were converted to BNB and sent through Tornado Cash.
JaypeggersDeFi ProtocolEthereum$18.5K
A flaw in Jaypeggers’ buy function let an attacker use a malicious NFT contract to re-enter the sell function and exploit an incorrect price calculation, stealing about 15.32 ETH.
BGLDTokenBSC$18K
An attacker used a flash loan to artificially raise BGLD’s price and then make a profitable swap on PancakeSwap. The report does not state the amount taken.
SpiritSwapDeFi ProtocolFantom$18K
Attackers tricked a GoDaddy employee into giving them control of SpiritSwap’s domain, then used a fake site with altered swap settings to redirect users’ funds. About $18,000 was stolen before the site was shut down.
UEarnPoolDeFi ProtocolBSC$16K
Using a flash loan and repeatedly calling a public function that linked accounts to inviters, an attacker manipulated UEarnPool’s reward calculations and routed rewards to accounts they controlled.
ConvexFinanceDeFi ProtocolEthereum$14K
An attacker hijacked Convex Finance’s website address and redirected visitors to a phishing site with malicious contracts. Some users approved transactions and lost tokens; Convex reimbursed affected users.
Numbers ProtocolDeFi ProtocolBridgeEthereum$13.8K
A flaw in Numbers Protocol’s Multichain bridge integration let an attacker exploit a user’s token approval to transfer NUM from multiple accounts. The attacker took 557,754 NUM and converted them to about 13 ETH.
AUR ProtocolTokenBSC$13K
Missing permission checks in critical AUR token functions let attackers call privileged functions and drain token assets.
sDAOTokenBSC$13K
A flaw in sDAO’s business logic let attackers manipulate how the token protocol worked and extract funds. The reports did not specify how much was taken.
Ribbon FinanceDeFi ProtocolEthereum$12K
A DNS hijack sent Ribbon Finance users to a phishing site that prompted them to approve malicious contracts. Two users approved the contracts, and one lost 16.5 WBTC; the team said its contracts remained safe.
SEAMANTokenBSC$7K
A business-logic flaw in SEAMAN’s token mechanics allowed attackers to manipulate token flows. The report did not specify the amount taken or what happened to the funds.
PolynomialDeFi ProtocolOptimism$7K
A missing input check in one Polynomial contract variant affected a limited number of users. The protocol compensated those affected.
PI-DAO$6.45K
PI-DAO was exploited in a flash loan attack, resulting in a loss of $6,445.
APCTokenBSC$6K
An attacker combined a flash loan with price manipulation to inflate APC’s price and profit from swaps.
MBC & ZZSHTokenBSC$5.9K
Flaws in permission checks and protocol logic let attackers drain funds from the MBC and ZZSH token projects on BSC.
Medamon$3.16K
A flash-loan attack exploited Medamon and resulted in a loss of $3,159.
Xave FinanceDeFi ProtocolEthereum$635
A fake verification message allowed four malicious proposals to pass Xave Finance’s governance module, minting a huge amount of RNBW tokens. The attacker converted them to xRNBW.
Luke DashjrUndisclosed
Attackers compromised Bitcoin developer Luke Dashjr’s wallets after bypassing two-factor authentication and stole more than 216 BTC. A leaked PGP key was initially suspected as part of the breach.
Kevin O’LearyUndisclosed
A hacker took over Kevin O’Leary’s Twitter account and used it to promote a fake Bitcoin and Ethereum giveaway with a link to participate. Twitter removed the posts; no stolen funds were reported.
LastPassUndisclosed
A hacker accessed LastPass’s cloud storage using information from an earlier incident, stealing source code and technical details. The stolen information was used to target an employee and obtain credentials and keys that could access and decrypt some cloud-stored data.
Polynomial ProtocolUndisclosed
A flaw in Polynomial Protocol’s Optimism deposit contract let anyone use its swap-and-deposit function to make arbitrary external calls and steal tokens approved to the contract.
NOVATokenTokenBSCUndisclosed
NOVAToken’s administrator used privileged access to mint unlimited tokens and drain value from the protocol.
PayPalUndisclosed
Attackers used stolen or reused username-and-password combinations from other sites to try to access PayPal accounts; PayPal said the incident could have exposed customer information but that no personal information was stolen.
BBOXTokenBSCUndisclosed
An attacker used a flash loan to manipulate BBOX’s price on a decentralized exchange and make profitable trades.
RFBDeFi ProtocolBSCUndisclosed
The attacker exploited RFB’s predictable random-number system, anticipating its results and manipulating the protocol’s outcomes.
Ratio FinanceDeFi ProtocolSolanaUndisclosed
A developer private key for Ratio Finance was compromised, allowing an attacker to access protocol accounts and drain user collateral. The exact loss was not disclosed.
Overnight FinanceDeFi ProtocolAvalancheUndisclosed
An attacker used a flash loan—a loan borrowed and repaid within one transaction—to exploit Overnight Finance’s protocol logic and drain funds on Avalanche.
LoopringUndisclosed
A large-scale DDoS attack disrupted Loopring’s service for 11 hours, but users’ funds were not at risk. The wallet service was later restored.
Eden NetworkUndisclosed
An attacker took control of Eden Network’s deployer account and the EDEN token contract. The attacker said a new token contract would be deployed and offered to return control if Eden Network bought 200 ETH of NEDEN.
OpenseaUndisclosed
A flaw in OpenSea’s older Wyvern contracts could let attackers trick users into signing a transaction that handed over control of a proxy contract authorized to withdraw their listed NFTs. The issue did not affect the newer Seaport protocol.
THORChainUndisclosed
A software bug caused THORChain nodes to disagree on transaction memo strings, stopping the network from processing transactions. The network resumed producing blocks after a patch; no funds were lost, though some RUNE exchange deposits and withdrawals were suspended.
Gate.ioUndisclosed
Gate.io’s official Twitter account was reportedly compromised and used to post phishing links. The fake site asked users to sign a transaction that could allow their Ethereum assets to be stolen.
VivityUndisclosed
Attackers compromised the Vivity NFT project’s Discord server; the report does not specify any resulting theft or loss.
BlurUndisclosed
A fake Blur account posted a phishing link claiming users could check BLUR token allocations. Blur warned users not to click the link.
PetraUndisclosed
A Petra wallet bug could display an incorrect recovery phrase when creating an account in an existing wallet. Petra fixed the issue; the report did not describe any stolen funds.
