Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
Ramses ExchangeDeFi ProtocolArbitrum$93K
A flaw in Ramses Exchange’s rewards system let attackers claim the same incentives repeatedly across multiple NFT positions, draining accumulated rewards and fees.
Citadel Finance$93K
An attacker manipulated the prices of assets used by Citadel Finance on Arbitrum and stole funds from the protocol.
Citadel.oneDeFi ProtocolArbitrum$93K
A smart-contract access-control flaw in Citadel.one let attackers withdraw users’ WETH and USDC, taking about $93,000.
Affine ProtocolDeFi ProtocolEthereum$88K
Attackers exploited Affine Protocol’s flash-loan callback, which did not check untrusted input, to trigger a contract upgrade path and steal collateral.
Squid Game (SQUID)TokenBSC$87K
An attacker used a flash loan and a flaw in the SQUID swap contract’s interaction with PancakeSwap to exploit unintended trades and drain funds from the pool.
BTC24H (BTC24H)DeFi ProtocolPolygon$85.7K
A flaw in BTC24H’s Polygon lock contract let anyone claim tokens without checking whether they were eligible. The reported loss was about $85,700.
xBlastTokenEthereum$84.5K
An attacker compromised xBlast’s main wallet, took XBL tokens worth about 22 ETH, and sold them. The project said it planned to issue a replacement token and compensate affected users.
Matez (MATEZ)DeFi ProtocolBNB Chain$80K
Matez on BNB Chain was exploited through an arithmetic error that truncated numbers, causing losses of at least about $80,000.
Linking The World (LW)$80K
A contract vulnerability on BNB Chain led to an attack on Linking The World and losses of about $80,000.
SpectraDeFi ProtocolEthereum$73K
A flaw in Spectra’s router let an attacker make the contract call other functions with chosen parameters, draining tokens approved by users from four wallets. Spectra’s core protocol contracts were unaffected.
GAGAW (GAGAW)$70K
GAGAW on BSC was suspected of being attacked, with funds lost.
MainnetSettlerDeFi ProtocolEthereum$66K
An approval flaw in MainnetSettler allowed attackers to make unauthorized contract calls and use transferFrom to take Hold tokens from users who had approved the contract. Losses were about $66,000.
Saga DAODeFi ProtocolSolana$65.8K
A compromised personal wallet let an attacker drain 750 SOL from Saga DAO and its treasury; the DAO’s multisig required only one of 12 approvals to transfer funds. The stolen funds were later returned.
CoWDeFi ProtocolEthereum$59K
An access-control flaw in CoW Protocol on Ethereum was exploited, causing losses of about $59,000; the reports did not specify how the flaw was used.
MintRisesPricesDeFi ProtocolBSC$59K
A reentrancy flaw let an attacker repeatedly call MintRisesPrices’ mint and burn functions in one transaction, manipulating prices and draining about $59,000 from the protocol.
HYDT$58K
A suspicious attack involving HYDT tokens on BSC caused losses of about $58,000.
AaveDeFi ProtocolEthereum$56K
A flaw in Aave’s ParaSwap repayment adapter left token allowances too large after failed swaps, letting an attacker exploit unvalidated transaction data and take accumulated tokens. About $56,000 was stolen from peripheral contracts, not Aave’s core protocol.
Smart Bank Token (SBT)$56K
The Smart Bank Token contract on BNB Chain was attacked, causing a loss of about $56,000. The attack method was not reported.
Juice FinanceDeFi ProtocolEthereum$54K
An attacker exploited a flaw in Juice Finance’s staking reward calculations to drain tokens, then sold them for about 54 ETH. The team later compensated stakers with their stake plus a 10% bonus.
PythiaDeFi ProtocolEthereum$53K
A reentrancy flaw in Pythia’s staking rewards function let an attacker repeatedly claim rewards before balances updated, taking 21 ETH.
Rosa Finance$44.8K
Arbitrum liquidity protocol Rosa Finance was exploited, and about $45,000 was lost. The reports did not explain how the attack worked.
ZoomerCoinTokenEthereum$41K
A flash-loan attack exploited crafted transaction data to make ZoomerCoin’s contract transfer tokens that had already been approved for it. The attacker exchanged the tokens for ETH, and the reported loss was 14.06 ETH.
DualPoolsDeFi ProtocolBSC$41K
A flaw in DualPools’ share calculations truncated values, letting attackers turn a tiny amount of dLINK into large amounts of LINK. They then drained pools holding WBNB, BTC, ETH, ADA, and BUSD.
EXcommunityDeFi ProtocolBNB$37K
EXcommunity on BNB Chain was attacked through an undisclosed smart-contract vulnerability, causing losses of about $37,000.
JokInTheBoxETHDeFi ProtocolEthereum$34K
A flaw in JokInTheBox’s staking contract let attackers unstake repeatedly from the same balance because the contract did not properly check whether the withdrawal had already occurred. They drained about $34,000.
MFT (MFT)$33.7K
MFT on BSC was suspected of being attacked, with about $33,700 lost; the reports did not specify how the attack worked.
MFTDeFi ProtocolBNB Chain$33.7K
A logic flaw in MFT’s BNB Chain contract was exploited, causing losses.
GPUTokenBNB$32.4K
A flaw in GPU’s transfer code increased a user’s balance when they transferred tokens to themselves. Attackers exploited it, using flash loans to amplify the attack, and took about $32,000.
Rugged ArtDeFi ProtocolEthereum$32.4K
A reentrancy flaw in Rugged Art’s contract let attackers exploit unsafe external calls to drain 11 ETH.
APEMAGADeFi ProtocolEthereum$32K
A flaw in APEMAGA’s contract logic let attackers drain about 9.4 ETH. The report does not describe how the flaw was used in more detail.
Akashalife (AK1111)$31.5K
Akashalife’s BSC token was suspected of being attacked, with reported losses of about $31,500; the attack method was not specified.
AK1111DeFi ProtocolBNB Chain$31.5K
An access-control flaw in the AK1111 contract let an unauthorized party withdraw funds, causing about $31,500 in losses.
dYdXDeFi ProtocolEthereum$31K
Attackers took over dYdX’s domain settings and redirected visitors to a fake site that asked wallet users to transfer tokens to the attackers. Two users lost about $31,000 before the site was restored.
Dyson$31K
Dyson on BNB Chain was attacked, causing a loss of about $31,000. The attack method was not reported.
OmnipusDeFi ProtocolEthereum$30K
A disabled validation check in Omnipus’s presale contract let attackers claim they had overpaid in ETH and receive refunds they were not owed, extracting about $30,000.
UPS$30K
UPS on BNB Chain was attacked and lost funds.
Vista FinanceDeFi ProtocolBSC$28K
Vista Finance’s staking integration did not distinguish staked tokens from freely available balances. This let its flash-mint feature miscalculate how many tokens were available for loans.
OTSeaDeFi ProtocolEthereum$26K
A flaw in OTSea’s staking contract let an attacker manipulate reward calculations and repeatedly withdraw more rewards than their stake entitled them to. About $26,000 was stolen.
Fire (FIRE)$24K
Attackers exploited a flaw in the FIRE token’s burn mechanism, which runs when tokens are transferred, and stole 9 ETH.
ZenterestDeFi ProtocolEthereum$21K
An outdated price feed showed MPH at a vastly inflated price, letting an attacker borrow more from Zenterest than the collateral warranted and profit from the loans. The protocol lost about $21,000.
