Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Little Boy PlusTokenBSC$367K
A zero-value transferFrom call bypassed checks in Little Boy Plus’s token logic, letting the attacker mint tokens directly into its PancakeSwap pool without updating its recorded reserves. They used the imbalance to withdraw USDT; the funds were later sent to Tornado Cash.
DIPTokenBSC$111K
A missing return statement in the DIP token’s transfer function caused PancakeSwap trades to execute twice. The attacker manipulated the pool’s reserves and drained about $111,000 in USDC.
RetoSwapDeFi ProtocolMonero$2.7M
RetoSwap’s dispute process allowed funds to be released without both sides completing the trade. An attacker won XMR from buy offers after Bitcoin confirmations without sending the corresponding BTC.
Thetanuts FinanceDeFi ProtocolEthereum$105K
A rounding flaw in a deprecated vault let the attacker repeatedly mint shares while the required deposits rounded to zero, then redeem the vault’s assets. A whitehat later used the same flaw to recover most of the funds, leaving a reported net loss of about $105,000.
Aztec ConnectDeFi ProtocolBridgeEthereum$2.1M
A flaw in Aztec Connect’s proof checks let an attacker submit transactions whose proofs did not match the Ethereum state updates, creating unbacked balances and withdrawing real assets. The current Aztec Network and AZTEC token were unaffected.
Axelar Secret IBC BridgeDeFi ProtocolBridgeEthereumSecret$4.67M
An attacker forged cross-chain deposit messages through a fake IBC channel to mint unbacked saTokens, then redeemed them through a legitimate channel to drain Axelar’s escrow of about $4.67 million.
RaydiumDeFi ProtocolSolana$1.34M
A flaw in Raydium’s deprecated AMM V3 program let the attacker use a fake liquidity-pool token address to bypass withdrawal checks and drain five inactive pools. The pools held about $1.34 million in assets, including USDC, SOL and RAY.
Token of PowerTokenEthereum$1.58M
An attacker gained majority voting power in the Token of Power DAO and passed a proposal to mint a huge amount of TOP tokens. They used the newly minted tokens to drain about 944 WETH from a Balancer pool; Balancer itself was not exploited.
Haedal Vault$915K
A cross-version logic flaw let the attacker use an old deposit route to mint inflated LP shares, then redeem them through newer routes for excess underlying assets. The Haedal Vault losses were about $915,000.
NovaBoxChainEthereum$107K
NovaBox’s reward system calculated dividends before updating deposit balances, letting the attacker claim rewards based on inflated holdings. Using a flash loan, the attacker drained nearly all of the reward pool through these fake dividends.
Asterix LabsNFTfiEthereum$40K
A flaw in shared DN404 token code affected Asterix Labs’ ASTX contract, allowing attackers to drain about $40,000. The same vulnerability had been used against Flooring Protocol the previous day.
Humanity ProtocolDeFi ProtocolEthereumBSC$32M
A Humanity Foundation member’s private keys were compromised, allowing attackers to drain linked wallets and mint 447 million H tokens without authorization. The stolen funds were swapped for ETH, and reported losses exceeded $30 million.
Flooring Protocol & BitmapPunksNFTfiEthereum$500K
A packed-storage and token-indexing flaw let an attacker create near-limitless Flooring Protocol tokens with a small WETH deposit and drain NFT pools. Yuga Labs’ white-hat team rescued 68 valuable NFTs, including BAYC and CryptoPunks.
OpenMonero P2P$62.9K
An attacker gained root access to OpenMonero’s P2P trading platform server and stole about 200 XMR. The project owner said all funds were lost.
Syscoin BridgeDeFi ProtocolBridgeSyscoin$10M
A parsing flaw let Syscoin Bridge accept a malformed burn proof as valid, enabling the unauthorized creation of about 5 billion SYS. The funds were moved and split, then returned through a whitehat recovery.
Ambient FinanceDeFi ProtocolEthereum$111K
An accounting flaw in Ambient Finance’s deposit and withdrawal logic let an attacker cycle funds through the protocol’s contract and withdraw about 83.72 ETH.
DTXT/USDT liquidity pair on BSC$35K
The attacker tricked DTXT’s contract into treating large token sales as liquidity additions, bypassing sell fees and draining about 35,041 USDT from the DTXT/USDT pool.
BYToken$87.4K
An attacker used BYToken’s public auto-burn function to burn tokens directly from its trading pair and reset the pool’s reserves. This skewed the BY/WBNB price, allowing the attacker to sell BY and drain nearly all the pool’s WBNB.
ATMTokenBSC$243K
A flaw in ATM’s automatic swap-on-transfer mechanism let the attacker repeatedly trigger swaps beyond the intended limits. They drained about $243,500 from the protocol.
GPU.NETDeFi ProtocolEthereum$10.6K
An unverified report claimed a roughly $10,600 incident involving GPU.NET on Ethereum. No supporting news coverage, security report, or on-chain confirmation was reported.
ApeBond$3.42K
A flaw in ApeBond’s ApeYieldVault let an attacker use duplicate pool IDs to inflate a token lock, unlock and claim the inflated amount, then sell ABOND. After repaying a flash loan, the attacker kept about 5.72 WBNB.
TSRTokenBSC$2.5M
Inadequate access controls on TesseraDAO’s mint function let the attacker create about 99 million TSR tokens, which they sold for USDT before bridging and laundering the funds.
TESSERADeFi ProtocolBNB$2.4M
An attacker took control of TesseraDAO’s core contract, changed its permissions, and minted 99 million TSR tokens without backing. Selling them brought in about $2.4 million in USDT, which was later moved through Tornado Cash.
Gnosis PayOtherGnosis Chain$1.5M
A flawed signature check in Gnosis Pay’s Zodiac Delay Module failed to verify whether a contract call succeeded, allowing unauthorized transactions from affected wallets. The issue affected 5,281 wallets, and Gnosis said users would be fully reimbursed.
ATOHook$25K
A storage-slot collision made ATOHook treat a reentrancy-protection value as a reward balance. The attacker repeatedly claimed the resulting fixed reward, taking about 14.41 ETH.
The X account of crypto KOL Jadoodoo$5K
An attacker took over crypto commentator Jadoodoo’s X account and sent followers phishing links disguised as collaboration offers. Multiple crypto influencers were affected, with reported losses of about $5,000.
AROSTokenBSC$295K
An attacker drained about $295,300 in USDT from the AROS/USDT PancakeSwap pool. Reports did not confirm the precise method.
FluidDeFi ProtocolEthereum$215K
Attackers used compromised operational keys for Fluid’s rewards system to submit fake reward allocations and claim FLUID, GHO, and a small amount of cbBTC. The loss was about $215,000; Fluid’s lending markets, core contracts, and user deposits were unaffected.
Phala CloudUndisclosed
A flaw in Phala Cloud’s API let an attacker modify some off-chain key-management virtual machines and install a script that may have accessed decrypted environment variables after startup. The issue was patched and contained.
Gravity BridgeDeFi ProtocolBridgeEthereum$5.4M
Gravity Bridge was exploited and lost about $5.4 million, mainly in USDC, ETH, and USDT. Reports differ on how the attacker gained the ability to take the assets; funds were subsequently moved through exchanges and mixers.
Alephium BridgeDeFi ProtocolBridgeEthereum$815K
A backend flaw in Alephium TokenBridge’s message checks let attackers forge transfer approvals and drain about $815,000 in assets across Ethereum and BNB Chain. They also minted unbacked wrapped ALPH tokens.
AFI ProtocolDeFi ProtocolEthereum$480K
AFI Protocol’s afiUSD vault was drained of about $480,000, but the exploit method was not disclosed. AFI paused the vault and said its other vaults were unaffected.
MoneyMon$85.5K
A signature-checking flaw in MoneyMon’s NFT contract let an attacker bypass reward-claim checks by setting the admin address to zero and using an invalid signature. The attacker drained the contract’s tokens and swapped them for USDT.
YSDAO$19.5K
The attacker manipulated PancakeSwap V2 pool reserves through contract calls and extracted funds from YSDAO. The loss was about $19,500.
DxSaleDeFi ProtocolBSC$7.3M
An attacker used owner privileges in DxSale’s old liquidity locker contracts to lower fees, change unlock times, and withdraw funds from more than 1,400 pools. The stolen liquidity was worth about $7.3 million.
ONTRTokenEthereum$98.2K
A flawed ownership check let anyone reclaim control of ONTR after its creator renounced ownership. The attacker used hidden balance-grant logic to create a large apparent ONTR balance, sold it into the token pool, and took out WETH.
Joe Agent$45K
Joe Agent sent BNB before updating a user’s liquidity record, allowing the attacker to re-enter the contract repeatedly and steal 62.5 BNB and about 1.196 million JOE.
SuperfortuneTokenEthereum$15.2M
During a multisig token transfer, the recipient address was changed to a suspected attacker-controlled address because the transaction checks did not catch the substitution. About 14.98 million GUA was sent there and later sold for roughly 2,784 ETH.
Stake DAODeFi ProtocolBridgeArbitrum$91K
A compromised deployer key let an attacker change Stake DAO’s LayerZero bridge settings and mint trillions of unbacked vsdCRV tokens. They drained about 43.8 ETH from a Curve pool before bridging it; the protocol’s core contracts were not affected.
SKPDeFi ProtocolBNB$212K
A flaw in SKP’s transfer logic let an attacker alter the SKP/USDT pool’s recorded reserves during a swap, pushing its SKP reserve close to zero and draining USDT and BNB. Flash loans—borrowed funds repaid in the same transaction—helped amplify the attack.
