Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
Velar PerpsDeFi ProtocolMezo$401K
An attacker exploited predictable oracle update timing in Velar’s BTC/MUSD perpetual market, using repeated trades to manipulate prices and drain about $401,000.
Predict.funPrediction MarketBSC$400K
A suspected compromise of Predict.fun’s third-party API documentation site was linked to unauthorized transfers from users’ smart wallets. The project took the site offline and pledged to reimburse affected users.
AethirDeFi ProtocolBridgeBSC$400K
An attacker exploited an access-control weakness in Aethir’s BNB Chain bridge adapter to take about 423,000 ATH. Aethir disconnected the affected contracts and worked with exchanges to block attacker wallets; the main Ethereum ATH supply remained intact.
YieldCoreDeFi ProtocolEthereum$399K
A missing authorization check in YieldCore’s vault let anyone withdraw assets by naming another user as the owner and directing the funds elsewhere. The attacker drained 392,764 USDC belonging to eight depositors, emptying the vault.
FutureSwapDeFi ProtocolArbitrum$395K
A flaw in FutureSwap’s position accounting let an attacker manipulate the protocol’s collateral records and withdraw more than they had deposited. Reports disagree on the attack details and loss amount.
BitMartCEXBaseArbitrumOptimism$391K
Attackers breached BitMart and took cryptocurrency from exchange-associated wallets on Base, Arbitrum, and Optimism. The entry method was unknown, and investigators said some funds were linked to the Mercado Bitcoin exploit that day.
Ploutos MoneyDeFi ProtocolEthereum$390K
Ploutos Money mistakenly used a Bitcoin price feed to value USDC, letting an attacker deposit only 8 USDC and borrow about 187 ETH. The exploit drained roughly $390,000.
Syndicate LabsDeFi ProtocolBridgeBase$380K returned$380K
Using a leaked upgrade key, an attacker altered Syndicate Labs’ Commons bridge contracts and drained about 18.5 million SYND tokens and $50,000 in user assets across two networks. The project pledged to compensate affected users.
Little Boy PlusTokenBSC$367K
A zero-value transferFrom call bypassed checks in Little Boy Plus’s token logic, letting the attacker mint tokens directly into its PancakeSwap pool without updating its recorded reserves. They used the imbalance to withdraw USDT; the funds were later sent to Tornado Cash.
Silo V2DeFi ProtocolArbitrum$359K
An oracle priced wstUSR far above its market value, while flaws in Silo V2’s deposit accounting let an attacker inflate redemption payouts from the soUSDC vault. The incident affected the Arbitrum deployment; the reported sources do not specify the amount taken.
SQ ProtocolDeFi ProtocolBSC$346K
A hardcoded owner backdoor in SQ Protocol’s staking contract let the attacker take control, create fake staking claims and redeem about 296,500 USDT, then sell SQi tokens for more. Total realized losses were about $346,000.
SymbiosisDeFi ProtocolBridgeBSCEthereum$336K
A flaw in Symbiosis’s Bitcoin bridge allowed the attacker to mint unbacked syBTC and sell some of it for about 4.39 WBTC on Ethereum. The team paused affected BTC routes; reported total losses for liquidity providers and users were 9.97 BTC.
Fusion by IPOR$336K
A flaw in an older IPOR Fusion Vault allowed an attacker to make arbitrary external calls and extract about $336,000 in USDC. The funds were later recovered through a white-hat agreement, with the DAO covering a 10% bounty.
IPOR FusionDeFi ProtocolArbitrum$336K returned$336K
A flaw in IPOR Fusion’s withdrawal checks let malicious fuse contracts run arbitrary code through EIP-7702 delegation and drain about $336,000 in USDC from its Arbitrum vault. About $267,000 was moved to Tornado Cash.
ZetaChain GatewayEVMChainBridgeEthereumBasePolygon+3 chains$334K
Missing access controls in ZetaChain’s GatewayEVM let an attacker make unauthorized calls and use existing token approvals to drain about $334,000 in USDC and USDT from team wallets across four chains. User funds were unaffected, and the team patched the issue.
FlashLoopAdapter（Aave V3 Loop Safe Module）DeFi ProtocolEthereum$305K
FlashLoopAdapter’s authorization check could be fooled by a fake Safe, letting the attacker make real victim Safes execute unauthorized transactions. The attacker repaid one Safe’s Aave debt to unlock collateral and drained weETH from two Safes.
mySwap CLDeFi ProtocolStarknet$305K
An attacker created a fake EVIL token to exploit accounting and share calculations in mySwap’s concentrated-liquidity pools, draining about $305,000 in ETH, USDC, USDT and STRK.
Ankr Ethereum Cross-chain BridgeDeFi ProtocolBridgeEthereum$305K
An attacker submitted forged bridge receipts for a previously redeemed Optimism deposit, changing the recipients, tokens, and amounts while using valid signatures from the bridge’s trusted signer. The bridge accepted them and released staking tokens and other assets.
AROSTokenBSC$295K
An attacker drained about $295,300 in USDT from the AROS/USDT PancakeSwap pool. Reports did not confirm the precise method.
RocketDeFi ProtocolRocket$288K returned$288K
An attacker traded against their own accounts in a dormant, illiquid perpetual market, creating artificial profits while bankrupting a disposable account. They withdrew about $287,000 through Rocket’s Bridge, but Rocket later confirmed the funds were returned.
Sonic ICPDeFi ProtocolICP$276K
Race conditions during Sonic DEX’s asynchronous transaction processing let the attacker withdraw funds before pool balances were reconciled. The exploit affected 26 liquidity pools, and the protocol was paused.
Lumi FinanceDeFi ProtocolArbitrum$270K
Flaws in Sodium smart-account validation let an attacker-controlled paymaster gain token allowances from Lumi Finance users’ accounts. The attacker used those approvals to drain about $270,000 in assets.
Royal.ioNFTfiPolygon$263K
A flaw in Royal.io’s legacy royalty accounting let the attacker manipulate reward calculations using a flash loan and 100 zero-value token transfers. They withdrew about $263,000 in USDC.
Transit FinanceDeFi ProtocolEthereum$258K
An unauthenticated swap callback in Transit Finance let attackers trigger functions during swap operations without authorization. They used this to extract about $257,800 from the protocol.
dTRINITY dLENDDeFi ProtocolEthereum$257K
An attacker exploited an almost-empty dLEND lending market on Ethereum, using repeated flash-loan fees to inflate collateral values and borrow the pool’s dUSD supply. This created about $257,000 in bad debt; the team said it would cover the losses.
GoonFiDeFi ProtocolSolana$254K
A configuration and pricing-logic bug mispriced GoonFi v2’s WSOL/USDC pool on Solana, allowing searchers to drain about $254,000 in a single transaction. The project halted the program.
Balancer V1DeFi ProtocolEthereum$250K
An attacker used flash loans and temporary collateral positions to exploit a previously disclosed pricing flaw in deprecated Balancer V1 pools, extracting about $250,000.
DGLDDeFi ProtocolBridgeBase$250K
A flaw involving the DGLD cross-chain bridge let attackers mint more than 100 million unbacked tokens on Base and sell them. The project absorbed about $250,000 in losses; physical gold and existing backed tokens were unaffected.
ATMTokenBSC$243K
A flaw in ATM’s automatic swap-on-transfer mechanism let the attacker repeatedly trigger swaps beyond the intended limits. They drained about $243,500 from the protocol.
MT-WBNB liquidity pool$242K
A flaw in the MT-WBNB pool’s trading restrictions let an attacker use the router to acquire MT tokens, then burn tokens directly from the pool to inflate its price. The attacker sold the tokens for WBNB and made an estimated $242,000.
Movie TokenDeFi ProtocolBSC$242K
Movie Token’s contract burned tokens directly from the PancakeSwap liquidity pool without updating the pool’s records. Combined with a flash swap, this sharply reduced the pool’s MT reserves and enabled the attacker to sell tokens at inflated prices.
Inverse Finance$240K
An attacker manipulated DOLA’s price on Ethereum, triggering liquidations of multiple Inverse Finance users’ positions. The incident caused an estimated $240,000 loss.
Curve LlamaLendDeFi ProtocolEthereum$240K
The attacker used a flash loan and a donation to inflate the sDOLA vault’s exchange rate, which the market’s oracle treated as a spot price, triggering liquidations of 27 borrowers. The attacker gained about $240,000; borrowers lost about $822,000 in equity.
DominionDeFi ProtocolSolana$238K
An attacker compromised Dominion’s treasury multisig and drained its SILV holdings and loan positions. They sold about 46,909 SILV into thin markets, realizing roughly $238,000 as the token’s peg broke.
Balancer V1DeFi ProtocolEthereum$234K
After pushing a pool’s WBTC reserves close to zero, an attacker exploited rounding in Balancer V1 to mint BPT pool shares for just one satoshi of WBTC. They then redeemed the shares for DPI, USDC, WETH and WBTC.
Gondi V3NFTfiEthereum$230K
An access-control flaw let attackers call Gondi V3’s purchase function without the required ownership check, using lingering token approvals to take about 78 NFTs worth roughly $230,000. The vulnerable contract was disabled.
PolyculeDeFi ProtocolPolygon$230K
Attackers breached the server used by Polycule’s trading bot, where users’ private keys were stored without encryption, and drained about $230,000 from affected users. The related bots were taken offline.
JUDAOTokenBSC$228K
A double-sync bug in JUDAO’s transfer logic miscalculated pool balances, enabling flash-loan-backed price manipulation and sales at inflated prices. The attacker drained funds through BSC trading pools, including at least 205,259 USDT and 36 BNB.
DLMCTokenBSC$223K
An attacker used a flash loan to manipulate DLMC’s internal token price, then redeemed referral rewards at an inflated rate. The rewards could be sold immediately, enabling the attacker to extract value without holding positions.
FluidDeFi ProtocolEthereum$215K
Attackers used compromised operational keys for Fluid’s rewards system to submit fake reward allocations and claim FLUID, GHO, and a small amount of cbBTC. The loss was about $215,000; Fluid’s lending markets, core contracts, and user deposits were unaffected.
