Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Beluga ProtocolDeFi ProtocolArbitrum$175K
An attacker manipulated the token balances in a Beluga Protocol pool on Arbitrum, using a flash loan—borrowed funds repaid in one transaction—to withdraw extra tokens.
SharedStakeDeFi ProtocolEthereum$175K
Weak ownership checks let an attacker gain admin access to SharedStake, create a token minter with unlimited permissions, and mint sgETH without collateral. The attacker then withdrew about 105 ETH.
Nikhil Gopalani$173K
A phisher tricked RTFKT executive Nikhil Gopalani into giving up confidential information, possibly while posing as an Apple representative. He lost more than $173,000 in NFTs and other digital assets.
MIKE & SID$171K
A backdoor function in the MIKE and SID token contracts allowed unlimited token minting. The attacker profited 87.9 ETH.
ElephantStatusDeFi ProtocolBSC$165K
An attacker used a flash loan to manipulate WBNB’s price in ElephantStatus’s liquidity pool, enabling them to extract value they were not entitled to. The report does not give a loss amount.
TrustPadDeFi ProtocolBSC$155K
A TrustPad staking-contract flaw let an attacker repeatedly claim pending rewards by manipulating lock periods. The reports did not specify the amount taken.
CarsonDeFi ProtocolBSC$150K
An attacker used flash loans to manipulate Carson token prices on BSC, repeatedly trading to create a temporary price imbalance and extract value. About $145,000 was lost; the attacker exchanged the assets for BNB and sent them to Tornado Cash.
Tropykus RSKDeFi ProtocolRootstock$150K
A rounding error in Tropykus RSK’s redemption counter affected interest calculations and was exploited, causing losses of about $150,000.
land$150K
The DeFi protocol land was reportedly attacked because its contract did not restrict who could mint tokens. The incident caused losses of about $150,000.
MultichainDeFi ProtocolBridgeEthereum$130K
An attacker exploited missing signature checks in Multichain’s permit-based transfer process, front-running a user’s transaction to move WETH from the router contract. About 87 ETH was taken.
DD Coin$126K
DD Coin was attacked and lost about 126,000 USDT.
AraDeFi ProtocolBSC$125K
An attacker used a flash loan, a loan borrowed and repaid in one transaction, against Ara Finance’s swap contract, which lacked access controls and had broad token approvals. The attacker stole cryptocurrency worth about $124,000.
El Dorado ExchangeDeFi ProtocolArbitrum$120K
An attacker manipulated prices through a vulnerable El Dorado Exchange oracle, a service that supplies price data, and liquidated positions. The attacker returned more than $400,000 after the team acknowledged code vulnerabilities.
PeopleDAODAOEthereum$120K
An attacker edited a shared Google Sheets payment form to add a hidden fraudulent payment, which PeopleDAO’s multisig signers approved when distributing contributor rewards. About 76 ETH was stolen, and the funds were later traced to HitBTC and Binance.
UtopiaTokenBSC$119K
A flaw in Utopia’s swap or price-calculation logic let an attacker extract 492 BNB from the BSC token protocol.
Local TradersDeFi ProtocolBSC$118K
An attacker called a function with no access protection to take ownership of the Local Traders contract, then manipulated token prices to buy LCT cheaply and resell it. The report did not state the amount taken.
Transit FinanceDeFi ProtocolBSCEthereum$110K
Transit Finance’s router did not check user-supplied swap paths. An attacker supplied a forged pool address, causing the router to transfer more tokens than intended during swaps.
FFISTTokenBSC$110K
A flaw in FFIST’s airdrop function let attackers exploit predictable token distributions and imbalances in the liquidity pool. They swapped small amounts of FFIST for disproportionate value, sending the token’s price sharply down.
DEP/USDT, LEV/USDC$106K
The DEP/USDT and LEV/USDC pools were drained of stablecoins. The report lists 36,000 USDC and 69,960,000 USDT as stolen.
ArbiSwapDeFi ProtocolArbitrum$100K
ArbiSwap’s team used admin functions to drain 85 ETH and more than $112,000 in tokens after promoting a fake high-yield staking scheme. The report describes this as a rug pull.
Pine ProtocolDeFi ProtocolEthereum$95K
A flaw caused Pine Protocol’s old and new contract versions to share liquidity pools. The attacker used the mismatch to borrow NFT collateral while recording repayment as a flash loan, repeatedly draining vault assets.
TrustTheTrident$95K
TrustTheTrident’s $SELLC contract was attacked, causing approximately $95,000 in losses. The attack method was not reported.
Rodeo FinanceDeFi ProtocolArbitrum$90K
Rodeo Finance was exploited through a flaw in its reserve-minting logic and later through manipulation of its price oracle, a source of asset prices. The attacks caused about $1.7 million in losses, of which about $816,000 was recovered as unshETH.
MeloDeFi ProtocolBinance Smart Chain$90K
An access-control flaw in Melo’s BSC protocol let an attacker use sensitive functions without authorization and drain about $90,000 from user accounts.
WGPT Token$82.5K
WGPT Token suffered a flash-loan attack, causing losses of about $82,500.
DKPTokenBSC$80K
The attacker used a flash loan to manipulate DKP’s price by exploiting an oracle that relied on the USDT-DKP pair’s ratio, then profited through trading.
RoeFinance$80K
A price manipulation attack emptied a RoeFinance pool, resulting in a loss of about $80,000.
Roe FinanceDeFi ProtocolEthereumPolygon$80K
An attacker used a flash loan to distort a Uniswap pool’s price, which Roe Finance’s oracle failed to check for freshness, then traded against the manipulated price and took funds.
KUB-Split (Split)$78.4K
A flash-loan attack manipulated KUB-Split’s pool, allowing the attacker to take about $78,400.
Cellframe NetworkDeFi ProtocolBSC$76.1K
A flash-loan attack exploited calculation errors during Cellframe’s liquidity migration, manipulating pools and extracting value through a new CELL-BUSD pool. The attacker made about 245 BNB, and CELL’s price fell sharply.
Neverfall protocol$75K
Neverfall protocol was hacked, and attackers deposited the stolen funds into Tornado Cash.
BiswapDeFi ProtocolBNB Chain$72K
A flaw in Biswap’s liquidity migration contract let an attacker exploit users’ approvals of their liquidity-provider tokens and steal funds. Biswap said its V2 and V3 pool assets were safe.
OMNI Real Estate Token$70.7K
A suspected contract-code vulnerability was exploited in the OMNI Real Estate Token project on BSC. The attacker made more than 236 BNB, worth about $57.
OmniEstateDeFi ProtocolBSC$70.7K
A flaw in OmniEstate’s BSC staking pool let an attacker bypass checks by setting the staking duration to zero, then repeatedly withdraw and claim rewards to extract BNB.
AzukiDaoDeFi ProtocolEthereum$68K
AzukiDAO’s token-claim contract failed to check whether a signature had already been used, letting an attacker replay one valid signature to claim BEAN tokens repeatedly. About 1.79 million tokens were stolen, and the claim contract was suspended.
ParibusDeFi ProtocolArbitrum$67.8K
An attacker exploited a reentrancy flaw in Paribus’s Compound V2-based lending contracts, using flash loans to borrow against the same collateral twice. The attack drained USDT, WBTC, and ETH, with reported losses of about $100,000.
Thoreum FinanceDeFi ProtocolBSC$65.5K
A flaw in Thoreum Finance’s token transfer logic let an attacker repeatedly transfer tokens to themselves and inflate their balance. The attacker profited about 2,000–2,260 BNB.
Floor DaoDeFi ProtocolEthereum$64.2K
A logic flaw in FloorDAO’s staking contract for its rebasing sFLOOR token was discovered and exploited during rebasing operations. The report does not specify the amount taken or what happened to the funds.
OxODexPool$61K
An attacker used a flash loan—borrowed funds repaid within one transaction—to exploit OxODexPool, taking about 40 ETH. The funds remained in the attacker’s wallet.
PlatypusDeFi ProtocolAvalanche$50K
A flaw in Platypus’s liquidity conversion logic treated USDC and USDC.e as having the same value, despite price differences between them. This let traders deposit one token and withdraw more value in another, extracting about $50,000.
