Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
bnbs (bnbs)TokenBinance$20.3K
The BNBS token contract on BSC had a reentrancy bug: the attacker repeatedly called a function before the contract updated its records, draining about $20,300.
FireTokenTokenEthereum$20K
FireToken’s transfer function burned tokens sent to Uniswap pools and immediately changed the pool’s recorded balances. Attackers exploited this to make ETH appear overpriced and swap FireToken for it.
NCD$20K
NCD on BNB Chain was attacked through a contract vulnerability, resulting in a reported loss of about $20,000.
TCH$19K
The TCH token on BNB Chain was repeatedly exploited through a transaction malleability issue, which can let transaction details be altered. The reported loss was about $19,000.
Wall Street Memes$18K
Wall Street Memes’ presale contract was attacked, resulting in the theft of about 2.5 million WSM tokens, worth approximately $18,000.
BSCGem (BSCGem)$17.3K
BSCGem on BNB Chain was suspected of being attacked, with an estimated loss of about $17,300.
ChiSaleDeFi ProtocolEthereum$16.3K
A logic flaw in ChiSale’s Ethereum contract was exploited, causing about $16,300 in losses.
WIFCOIN_ETHTokenEthereum$16K
WIFCOIN_ETH was reportedly exploited through a business-logic flaw that allowed funds to be taken; the reports did not give further technical details.
MixedSwapRouterDeFi ProtocolArbitrum$16K
A flaw in MixedSwapRouter on Arbitrum let attackers trigger unauthorized token transfers from the protocol, taking about 293,000 WINR.
Standing on Bizness (BIZNESS)$15.7K
Standing on Bizness (BIZNESS) appears to have suffered a reentrancy attack, in which a contract is called again before an earlier operation finishes, causing an estimated loss of $15,700.
BiznessDeFi ProtocolBase$15.7K
Bizness on Base was exploited through a reentrancy bug: the attacker repeatedly called contract functions before the protocol had updated its records, draining funds.
Introspection Token$15.2K
An attacker exploited the IT token’s transfer function to increase the pool’s token reserves, manipulate its price, and repeatedly trade against the pool for profit.
GFA token$15K
Attackers exploited GFA contracts that let anyone calculate and issue rewards, then used the resulting tokens to drain assets. The stolen funds were later moved through Tornado Cash.
Erc20transferTokenEthereum$14.8K
An Ethereum token-transfer utility had no access checks in a function that moves tokens users have approved, allowing anyone to drain USDC from multiple users.
RPPDeFi ProtocolBNB Chain$14.1K
RPP on BNB Chain was exploited through a logic flaw, causing losses of about $14,100.
Sweepr Token (SWEEPR)$14K
Sweepr Token on Ethereum was suspected of being attacked, with funds lost.
OKX NFT AggregatorCEXBSC$14K
An access-control flaw in OKX’s BSC NFT aggregator let attackers use withdrawal and transfer functions to steal about $14,000 in user funds.
X319DeFi ProtocolBNB Chain$12.9K
An access-control flaw in the X319 contract let an unauthorized party extract about $12,900.
JHY TokenTokenBinance$12K
A flaw in JHY Token’s dividend tracker recorded users’ balances as the liquidity-pool token balance, letting them swap more tokens than they owned and drain funds.
LABUBU TokenTokenBinance$12K
A flaw let an address transfer tokens to itself and inflate its balance. The attacker used a flash loan—a temporary loan repaid in the same transaction—to repeat the exploit, then swapped and moved the proceeds across chains and mixed them.
LABUBU (LABUBU)$11.9K
A suspicious attack on LABUBU on BSC resulted in a loss of about $11,900.
JHY (JHY)$11.2K
A suspicious attack on JHY’s BNB Chain contract resulted in a loss of about $11,200; the available report does not explain how it happened.
RedKeysGame$10.6K
RedKeysGame on BNB Chain was attacked, causing a loss of about $10,000. The attack method was not reported.
NFTGDeFi ProtocolBNB Chain$10K
A flaw in NFTG’s BNB Chain access controls let unauthorized callers extract funds from the protocol.
ALPDeFi ProtocolBSC$10K
A function intended for internal use in ALP’s contract was left publicly accessible, allowing unauthorized calls. The amount lost was not disclosed.
SaturnTokenBNB$9K
A flaw in Saturn’s token transfer logic let an attacker use flash loans to manipulate the SATURN/WBNB pool’s reserves and drain about 14 BNB.
Decentralized Finance (DCF)$8.8K
Decentralized Finance (DCF) was attacked on BNB Chain, resulting in an estimated loss of about $8,800; the reports did not explain the attack method.
Proxy_b7e1DeFi ProtocolBNB Chain$8.5K
A logic flaw in a proxy-based contract on BNB Chain was exploited, causing losses of about $8,500.
VRugTokenEthereum$8.4K
VRug removed liquidity from its Ethereum protocol in a rug pull, leaving users with losses.
DOGGOTokenEthereum$7K
A flaw in DOGGO’s withdrawal logic let attackers take more from the contract than their share, due to an incorrect calculation or missing balance update. The report did not specify the amount taken.
HFLH (HFLH)$5.3K
HFLH on BNB was suspected of being attacked, with an estimated loss of about $5,300. The attack method was not reported.
SATOSHI (SATS)$5K
SATOSHI (SATS) was attacked on Ethereum; the available report did not specify how or what happened to the funds.
SlurpycoinTokenBinance$3K
An attacker used a flash loan and sandwich trades to manipulate Slurpycoin’s price around its buyback mechanism, profiting from the token’s burn process. Reported losses were about $3,000.
Decrypt$3K
An attacker took over Decrypt’s email newsletter account and sent subscribers a phishing email. The attacker made money from recipients who were tricked by the scam.
ETHFINDeFi ProtocolBSC$1.2K
An access-control flaw in ETHFIN’s BSC smart contract allowed unauthorized calls to privileged functions. The report did not specify whether funds were stolen.
Superchain EcoUndisclosed
Superchain Eco’s X account was compromised and used to post phishing links.
Yat SiuUndisclosed
Yat Siu’s social media account was compromised, and a hacker used it to promote a fake Solana token launch that Animoca Brands said was not official.
Vivek RamaswamyUndisclosed
Vivek Ramaswamy’s account was reported compromised amid rumors of a DOGE and USUAL collaboration.
zkPassUndisclosed
zkPass’s X account was compromised and used to publish phishing posts.
AnthropicUndisclosed
Anthropic’s official X account appeared to be compromised and posted an unknown token contract address related to AI agents.
