Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
LW TokenDeFi ProtocolBinance Smart Chain$50K
An attacker used a flash loan to distort the LW token’s price in a PancakeSwap trading pair, then extracted about 48,415 USDT. The token’s price fell sharply after the exploit.
FLOKI$50K
FLOKI suffered a flash-loan attack that caused losses of more than $50,000.
CyberKongz$50K
Hackers took over CyberKongz’s official Twitter account, replaced its links with phishing links and posted false mint information. The account was renamed and placed under protection.
LW$48.4K
The LW token on BSC was attacked, causing a loss of 48,415 USDT and a sharp drop in its price. The attackers later sent about 150 BNB to Tornado Cash.
BEVOTokenBSC$45K
An attacker used a flash loan and BEVO’s deliver function to manipulate its deflationary balance calculations, then used the pair’s skim function to take the extra tokens. The attack brought about $45,000 in profit.
Stargate SnapshotDeFi ProtocolEthereum$43K
A malicious Stargate Snapshot proposal linked to a fake eligibility-check site that stole users’ credentials and private keys. More than 1,000 users were affected, with about $43,000 in losses reported.
Connext$39K
A denial-of-service attack disrupted Tokensoft’s API and crashed Connext’s airdrop claim database and website. Before claims returned to normal, tokens from unrelated wallets were claimed and sold; Connext said its own systems were not compromised.
BFCToken$38K
An attacker exploited BFCToken’s transfer function to burn tokens from a liquidity pool without paying for them, causing losses of about $38,000.
HyperliquidDeFi ProtocolArbitrum$37K
The attacker manipulated SNX prices on centralized exchanges and exploited Hyperliquid’s vault system, which relied on those spot prices, by trading against the inflated price.
Neutra FinanceDeFi ProtocolArbitrum$36.5K
An attacker exploited Neutra Finance’s convert function, which valued liquidity-pool tokens using spot prices. Tokens with the same name from different pools could be swapped, letting the attacker profit from their price difference.
Thales$35K
A core contributor’s computer and MetaMask wallet were compromised, along with Thales hot wallets and admin bots on BNB Chain; the reported compromised wallets held about $35,000. Thales said funds on Optimism, Arbitrum, Polygon, and Base were safe.
LunaFiDeFi ProtocolPolygon$35K
A flaw in LunaFi’s reward-claiming logic let an attacker deposit, claim rewards and withdraw in one transaction, repeatedly draining the reward pool. The attack used a malicious contract.
Revert FinanceDeFi ProtocolEthereum$29K
An access-control flaw in Revert Finance’s V3Utils contract let attackers make unauthorized contract calls and transfer users’ approved tokens. The team deployed a refund bot to recover the affected users’ funds.
SushiSwap$26K
A delayed Chainlink price update in SushiSwap’s Kashi lending system created a mismatch between the collateral and loan prices. The attacker used the gap to liquidate positions and take USDT.
GSSTokenBSC$25K
An arithmetic flaw in GSS’s transfer logic let an attacker manipulate the BSC liquidity pool using token transfers and its skim function, withdrawing 707,162 GSS twice. The attacker had first borrowed BUSDT through a flash loan to acquire GSS.
KucoinCEX$22.6K
Scammers took over KuCoin’s Twitter account and used it to promote a fake giveaway, leading users to send BTC and ETH to a fraudulent address. KuCoin said it would reimburse verified losses.
TheNFTV2DeFi ProtocolEthereum$19K
A flaw in TheNFTV2’s withdrawal calculations let an attacker withdraw more assets than their share of the protocol.
MChainCapital$18.9K
MChainCapital suffered a flash loan attack, a temporary loan used within one transaction to exploit a contract, losing about $18,871.
DAppSocialDeFi ProtocolEthereum$16K
A flaw in DAppSocial’s deposit function let an attacker create deposit records without transferring tokens, then withdraw against those false records. The attacker used a helper contract and a zero-day lock period to exploit the broken balance check.
CFCDeFi ProtocolBSC$16K
An attacker repeatedly sent tokens to CFC’s trading pool and triggered a function that burned tokens, manipulating the pool’s token supply and balances. They used the imbalance to extract value; the amount was not reported.
MicDaoDeFi ProtocolBSC$13K
An attacker manipulated MicDao’s token supply and price, then sold tokens for profit and moved the proceeds to BSC. The reported gain was about $12,263.
XSDWETHpool$12.1K
An attacker used a flash loan and a malicious contract to exploit XSDWETHpool on BSC, gaining 56.96 WBNB, worth about $12,100.
Mirage Finance$12K
Mirage Finance was exploited for about $12,000. The reports did not explain how the attack worked.
Ivan Bianco$10K
YouTuber Ivan Bianco accidentally exposed his wallet’s recovery phrase during a livestream, letting an unknown person take its crypto and NFTs. Afterward, a wallet that had taken most of the funds returned about $50,000 in crypto.
Indexed FinanceDeFi ProtocolEthereum$9.93K
An error in the ORCL5 token’s calculation of output amounts let an attacker use a flash loan to drain approximately $9,925 from Indexed Finance.
Ethereum Foundation$9.1K
An MEV bot sandwich-attacked the Ethereum Foundation’s sale of 1,700 ETH on Uniswap V3, placing trades around the sale to profit from its price impact. The Foundation lost $9,101, while the bot made $4,060.
RobinhoodCEXBSC$8.2K
Attackers took over Robinhood’s social media accounts and used them to promote a fake BNB Chain token, leading users to buy it. The accounts were reportedly compromised through a third-party vendor.
BABYDOLL$7.9K
The Baby Doll project was hit by a flash-loan attack, and the attacker took 25 BNB.
APEDAO$7K
An attacker repeatedly transferred APEDAO tokens into the pair contract, then used its skim function to withdraw excess tokens and its godead function to destroy tokens held there. The attack raised the token price and caused about $7,000 in losses.
EACTokenBSC$6.38K
An attacker used a flash loan to inflate the price of EAC on BSC, then sold tokens at the artificially high price for a profit.
SpookySwapDeFi ProtocolFantom$5K
Malicious code injected into SpookySwap’s frontend replaced its router with a fraudulent contract, diverting users’ swap funds to the attacker. The attack caused about $5,000 in losses.
Sashimi Swap$3.5K
A bot used a flash loan to attack Sashimi Swap’s investment and slETH contracts, taking the small amounts left in them—about $3,500 in total.
SheepTokenBSC$3K
An attacker repeatedly used the SHEEP token’s burn function and synchronized its trading pair, manipulating its reflection accounting and extracting about $3,000.
Ethscriptions.comNFTfiEthereum$2.83K
A flaw in the Ethscriptions.com marketplace contract let users withdraw inscriptions they did not own; about 202 inscriptions were taken from roughly 123 addresses. The Ethscriptions protocol itself was not affected.
pSeudoEth$2.3K
The pSeudoEth token was exploited in a flash-loan attack, causing a loss of about $2,300.
uniclyNFTDeFi ProtocolEthereum$2K
An attacker exploited a reentrancy flaw in uniclyNFT’s PointFarm contract, repeatedly calling its deposit function before the contract updated its records. This minted excess rewards and drained uJENNY tokens.
GYM NetworkDeFi ProtocolBSC$1.19K
A flaw in GYM Network’s deposit function let an attacker record deposits without transferring tokens. The attacker repeatedly created false deposits of 8 million GYMNET and withdrew the credited balance.
DePay$827
An attacker exploited a security flaw in DePay’s router using a flash loan, a short-term crypto loan, to steal 827 USDC.
LibertifyDeFi ProtocolEthereumPolygon$230
A reentrancy flaw in LibertiVault’s deposit function let attackers call the function again before the contract updated its share totals, creating excess shares and allowing them to claim inflated rewards. They used flash loans to fund the attack.
OKXUndisclosed
A vulnerability in OKX Wallet’s BRC20 marketplace caused fake sats to appear in its order book, putting buyers at risk of acquiring false assets. OKX restored trading and said it would compensate users who mistakenly bought affected tokens.
