Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
BitBTCUndisclosed
A bug in the BitBTC–Optimism bridge could let someone create fake tokens on one side and exchange them for real tokens on the other. An attempt to extract 200 billion BitBTC was only a test, and the team fixed the bug.
DataverseUndisclosed
Dataverse reported an attack on its GEO contract on BNB Chain, possibly involving a minting flaw that allowed unlimited tokens to be created. It warned that GEO tokens bought on BNB Chain during the reported period were invalid.
PLTDUndisclosed
A flash-loan exploit reduced the PLTD balance in a Cake-LP pool to one token, letting the attacker exchange PLTD for all the pool’s BUSD, about 24,497 BUSD in total.
TokenPocketUndisclosed
Abnormal traffic disrupted access to TokenPocket’s official website, prompting emergency maintenance. The report said user assets were not affected.
BNBChainUndisclosed
Attackers forged proofs submitted to Binance Bridge by exploiting a flaw in how it checked block data, allowing them to claim BNB twice. They stole 1 million BNB in each of two transactions.
BXHUndisclosed
The attacker used a flash loan to manipulate the token price that BXH’s staking contract read from its liquidity pool, then exploited that price to take funds. The contract lost 40,085 USDT, and the attacker kept 31,794 USDT after repaying the loan and fee.
Bad Guys by RPFNFTfiEthereumUndisclosed
Bad Guys’ free-mint function failed to enforce its one-NFT-per-wallet limit, letting two accounts mint about 450 of the 1,221 free NFTs.
CUPIDUndisclosed
A flash-loan attack on BNB Chain made about $78,622 and caused CUPID’s price to fall by more than 90%; VENUS rose sharply before falling back.
OptiFiUndisclosed
An operational error during an upgrade shut down OptiFi’s Solana mainnet program, and it could not be recovered. About 661,000 USDC was locked, and the team said it would compensate users.
SuiUndisclosed
Sui’s Discord server was reportedly compromised and used to post links. Some users said they lost money after clicking the attackers’ links.
Rainbow BridgeUndisclosed
An attacker’s attempt to steal funds from Rainbow Bridge was stopped within 31 seconds. The attacker lost 5 ETH in the process.
XSTABLE ProtocolDeFi ProtocolEthereumUndisclosed
Incorrect checks in XSTABLE’s smart contract were exploited, causing the XST token price to fall sharply. The protocol’s website and social media channels were taken down.
GenomesDAOUndisclosed
A flaw let attackers repeatedly reset key settings in GenomesDAO’s LPSTAKING contract, draining the collateral held there.
VelodromeUndisclosed
A Velodrome team member stole funds from a team-operated wallet, including $350,000 and an earlier $56,000; no user funds were lost. Velodrome later confirmed it had recovered all the stolen money.
NeopetsUndisclosed
Neopets reported a customer-data breach, and a hacker offered the website’s source code and database for sale. The breach may affect 69 million users.
TablelandUndisclosed
Attackers stole Tableland Discord administrators’ permissions after members ran a malicious script hidden in a bookmark. They used an admin account to post a fake site link that could give them access to visitors’ NFTs.
BiFiUndisclosed
An attacker exposed the key for BiFi’s server that issued Bitcoin deposit addresses, then signed a fake deposit address. BiFi mistakenly credited the fake deposit, allowing the attacker to borrow 1,852 ETH.
The British ArmyUndisclosed
The British Army’s official Twitter and YouTube accounts were hacked and used to post cryptocurrency and NFT promotions. The posts and video were later removed.
Polygon & FantomUndisclosed
A DNS hijack—redirecting a website through its domain settings—affected RPC interfaces for Polygon and Fantom and was reportedly aimed at stealing users’ seed phrases. Ankr restored the service, and no funds were reported lost.
DeFiSaverUndisclosed
DeFiSaver reported an attempted DNS attack, but said its analysis found that no users were affected.
whaleswap.financeUndisclosed
A flaw in whaleswap.finance’s trading checks let an attacker use a flash loan—borrowed funds repaid in the same transaction—to exploit the contract and take at least 5,946 BUSD and 5,964 USDT.
SNOODUndisclosed
A reentrancy attack on the SNOOD ERC-777 contract drained the Uniswap V2 pair’s liquidity, taking 104 ETH.
LACOSTEUndisclosed
LACOSTE’s Discord account was hacked, and scammers posted phishing links in its announcements channel.
Babel FinanceUndisclosed
Babel Finance suspended customer withdrawals amid market turmoil. Documents later said proprietary trading losses and liquidations cost the firm about 8,000 BTC and 56,000 ETH.
KnownOriginUndisclosed
KnownOrigin reported that its Discord server had been attacked and warned users not to click links. The report did not describe any stolen funds.
FswapUndisclosed
The attacker borrowed funds through Biswap and used them to attack Fswap in a malicious loan transaction, making about 1,751 WBNB worth around $500,000.
treasure swapUndisclosed
A missing trading check in two Treasure Swap contracts let an attacker exchange a tiny amount of WETH for all the WETH in the pools. The attacker made 3,945 BNB.
OptimismUndisclosed
Optimism sent 20 million OP tokens to a multisignature address that Wintermute could not control on Optimism, allowing an attacker to take them. The attacker returned 17 million; another 1 million was sent to Vitalik and returned.
Homeless FriendsUndisclosed
Homeless Friends’ Discord was compromised, and the attacker used it to promote a phishing website.
NovoUndisclosed
Novo was suspected of an attack; 280 BNB were transferred to Tornado Cash, a service that obscures cryptocurrency transactions.
bDollarUndisclosed
An attacker manipulated bDollar’s price and exploited a flaw in its CommunityFund liquidity function, which could use the project’s own funds after the price was raised. The attacker made a profit of 2,381 WBNB.
Kronos DAOUndisclosed
Kronos DAO used users’ DAI deposited in its vaults to invest in Kairos Cash; the investment resulted in a reported loss of 6 million DAI. The project described it as a strategic investment, while investors questioned the lack of advance notice.
Alien FrensUndisclosed
Alien Frens’ Discord was attacked, and the project warned users not to click minting links. No stolen funds were reported.
Lazy LionsUndisclosed
The Lazy Lions Discord server was hacked. Reports said the incident may have involved MEE6 staff being able to assign themselves roles remotely across servers; no stolen funds or assets were specified.
Axie InfinityUndisclosed
Attackers compromised the Mee6 bot on Axie Infinity’s main Discord server and used it to give a fake Jiho account permission to post a fraudulent mint announcement. The announcement was removed; no stolen funds were reported.
天穹Undisclosed
Hackers used false balances on the Tianqiong digital collectibles platform to buy and steal users’ collections, which were then sold at sharply inflated prices.
CoinGecko&Etherscan&DeFi PulseUndisclosed
Malicious pop-ups on cryptocurrency websites prompted visitors to connect their MetaMask wallets. The CoinGecko founder suspected a malicious ad script, and the pop-up promoted a fake Bored Ape Yacht Club site; no losses were reported.
OpenSeaUndisclosed
Attackers compromised OpenSea’s Discord and posted fake links to a supposed limited NFT mint in bot accounts. No stolen funds were reported.
Rainbow BridgeUndisclosed
An attacker submitted forged blocks to Rainbow Bridge, but an automatic watchdog stopped the attempt and the attacker lost 2.5 ETH.
SolanaUndisclosed
Metaplex reportedly discontinued part of its program, and a test transaction was described as charging 0.01 SOL in labor fees, with collected penalties going to the Candy Machine instance’s configuration account. The report does not describe a theft.
