Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
SKPDeFi ProtocolBNB$212K
A flaw in SKP’s transfer logic let an attacker alter the SKP/USDT pool’s recorded reserves during a swap, pushing its SKP reserve close to zero and draining USDT and BNB. Flash loans—borrowed funds repaid in the same transaction—helped amplify the attack.
CrowdRingCircleTokenBSC$209K
The attacker burned CRC tokens directly from the PancakeSwap pair, then called sync to make its recorded reserves differ from its actual balances. This artificially raised CRC’s price and let the attacker drain USDT from the pool.
RenegadeDeFi ProtocolArbitrum$209K returned$209K
An unprotected initializer and an out-of-sync proxy version counter let an attacker install malicious logic in Renegade V1 and drain 27 tokens. A whitehat returned about $190,000 of the roughly $209,000 taken; the V1 Arbitrum deployment was paused.
Rujira AMM StrategiesDeFi ProtocolTHORChain$200K
An attacker exploited faulty skew calculations in Rujira’s concentrated-liquidity strategy to manipulate BTC/USDC trading and unbalance liquidity positions. The losses affected Liquidy Finance and other users; Rujira halted the application and planned reimbursements.
Coreum BridgeDeFi ProtocolBridgeXRPLCoreum$200K
A flaw in Coreum Bridge’s deposit checks let the attacker submit fake deposits that relayers accepted as valid. The bridge then released nearly 200,000 XRP from its reserves.
WUSD.fi / GLOVELiquidity PoolEthereum$200K
Attackers used flash loans and many wallets to repeatedly claim GLOVE rewards because the reward system lacked protection against duplicate accounts. They sold the rewards into Uniswap V3 pools, draining about $200,000 in USDC and USDT.
BFBTokenBSC$198K
The attacker used zero-value transfer calls to repeatedly trigger BFB’s burn logic, destroying tokens held in a PancakeSwap liquidity pool. They drained the pool’s WBNB.
Demex PerpDeFi ProtocolBridgeDemexEthereumBSC$192K
Demex’s bridge failed to properly verify reports of token deployments, allowing the attacker to register a low-value token as WETH and WBNB. The attacker then withdrew about $191,929 in real bridge assets while accounting for only about $10 worth of tokens.
AllbridgeDeFi ProtocolBridgeBase$191K
Allbridge accepted a Circle-attested message claiming a USDC transfer that had never happened, then credited the attacker despite no matching deposit. Using a flash loan—a temporary loan repaid within the transaction—the attacker withdrew nearly $999,000; a copycat later took the remaining funds.
LAXODeFi ProtocolBSC$190K
A flawed LAXO burn mechanism let an attacker use flash loans to burn tokens held by the PancakeSwap pool without updating its recorded reserves. The attacker manipulated swaps and extracted 487,000 USDT.
BoostHookDeFi ProtocolEthereum$187K
An attacker used a flash loan to push up the ETH/PERP pool price, opened leveraged positions at the inflated price, then reversed the move. A limit on liquidations left four positions with 8 ETH of debt each open, creating bad debt for BoostHook.
SKYDAODeFi ProtocolBSC$183K
SKYDAO’s taxed sell process caused the PancakeSwap pool to record an almost-zero SKYDAO reserve before the seller’s remaining tokens arrived. The attacker exploited the mismatch between the pool’s recorded reserves and actual balances to take USDT.
Butter Bridge$180K
A flaw in the Butter Bridge’s retry-message checks let an attacker forge a cross-chain message and mint unbacked MAPO tokens. They sold about 1 billion of them for roughly $180,000 in liquidity; most of the fake tokens remained in the attacker’s wallet.
Stake DAODeFi ProtocolArbitrumBase$176K
A flaw in Stake DAO’s oracle updater let an attacker inject false cross-chain block data and forge vote proofs, draining about $176,000 in campaign rewards. The incident was later treated as a white-hat event, and most funds were recovered.
BankrAI AgentBase$170K
Attackers used stolen or tricked session tokens or signing keys to make direct transfers from 14 Bankr users’ Base wallets, bypassing token approvals. About $170,000 was taken; Bankr paused the affected functionality and pledged reimbursement.
DenariaDeFi ProtocolLinea$166K
An attacker used a flash loan to skew prices in Denaria’s virtual trading pool, then made oversized trades that inflated calculated profits. The incident caused losses of about $165,000.
Cozy FinanceDeFi ProtocolOptimism$163K
Cozy Finance’s Optimism protection markets paid claims after the attacker submitted undisputed positive answers to UMA’s oracle, without verifying that the covered events had occurred. The attacker burned protection tokens and claimed USDC, causing about $160,000 in losses.
EnjinNFTfiEthereum$162K
A flaw in Enjin’s legacy Crypto Items system let an attacker take control of a proxy contract and register a malicious adapter. The attacker moved NFTs from about 52 wallets and redeemed their backing, draining approximately 5.24 million ENJ.
SEA TokenTokenArbitrum$153K
SEA Token interactions on Arbitrum were exploited through price manipulation, reportedly using a flash loan to distort the token’s price. The attacker extracted about $153,000 in value; the precise mechanism was not confirmed.
AlpsCon AI Trade HubDeFi ProtocolBSC$153K
AlpsCon’s contracts treated newly deposited funds as if they qualified for rewards earned before deposit. Using a publicly known test-account key and a flash loan, the attacker exploited the accounting flaw and took about $152,000 in USDC.
DBXenDeFi ProtocolEthereum$150K
A sender-identity mismatch in DBXen’s meta-transaction system let attackers claim fees accumulated across earlier burn cycles. They used new addresses to claim the fees, causing losses of about $150,000.
SynapLogicDeFi ProtocolBase$144K
Flaws in SynapLogic’s referral and swap logic let attackers make invalid referrals and withdraw more native tokens than they paid in, while also minting SYP. The exploit involved repeated transactions and caused losses of about $186,000.
ScallopDeFi ProtocolSui$142K
A flaw in the rewards calculation of Scallop’s deprecated V2 rewards contract let the attacker use a small SUI stake to claim far more rewards than earned, draining about 150,000 SUI. The active lending markets and user deposits were unaffected.
Zentra FinanceDeFi ProtocolCitrea$140K
Zentra’s repayment accounting could clear a borrower’s debt while reducing the corresponding token burn to zero. The attacker exploited this rounding flaw with flash liquidity to withdraw borrowed assets, draining 140,000 ctUSD and 30 USDC.e.
Ink FinanceDeFi ProtocolPolygon$140K
A flaw in Ink Finance’s treasury proxy whitelist let an attacker use a malicious contract posing as an approved claimer to make unauthorized transfers. About $140,000 in USDT was stolen, with a flash loan helping fund the attack.
12 DeFi frontends (including Flap, Kintsu, etc.)$138K
Attackers hijacked the domain settings of at least 12 DeFi websites and redirected visitors to malicious versions that used a wallet-draining tool. Users who connected wallets and signed transactions lost assets; the underlying smart contracts were not compromised.
QuantTokenEthereum$138K
A permissionless helper contract let anyone use the admin authority delegated by a QNT reserve pool’s administrator to make arbitrary calls. Attackers drained 1,988.5 QNT, worth about $138,000.
Stake Nova$137K
An unchecked validation issue in Stake Nova’s RedeemNovaSol function enabled a flash-loan exploit that drained the liquidity pool, taking about $137,000—roughly 95% of user deposits.
USMDeFi ProtocolEthereum$136K
A pricing-accounting flaw in USM’s redemption logic let an attacker use a flash loan to manipulate internal prices and split one redemption into 64 smaller withdrawals, extracting about 70.83 ETH.
SubQuery NetworkDeFi ProtocolBase$134K
A missing owner check in SubQuery’s Base Settings contract let an attacker change key contract addresses and drain pooled SQT. About 382 million SQT was taken from staking, rewards, and treasury funds, affecting 272 stakers and delegators.
Unknown Stake Contract$133K
An attacker manipulated the TUR-NOBEL pool price, then staked TUR to trigger rewards calculated using the inflated price. They claimed the rewards through a referral account and swapped the TUR for USDT, taking about $133,000.
TUR StakingDeFi ProtocolBSC$133K
An attacker manipulated the TUR-NOBEL pool price to inflate TUR’s spot price, which the staking contract used to calculate oversized rewards. The attacker claimed the rewards and swapped the TUR for about $133,000 in USDT.
ShapeShift FOX ColonyDeFi ProtocolArbitrum$133K
An attacker exploited a flaw in FOX Colony’s meta-transaction authorization to replace its routing component with a malicious version, then use it to drain ERC-20 tokens. The reported losses ranged from about $132,700 to $182,700; the core exchange platform was unaffected.
AMDeFi ProtocolBSC$132K
AM’s deferred-burn mechanism could accumulate an unbounded token burn that was applied on a later sale. Attackers used flash loans to inflate the pool’s USDT reserves before triggering the burn and selling at an artificially favorable price.
AM/USDT pool$131K
A flaw in the AM token’s burn mechanism let an attacker reduce the AM/USDT pool’s reserves without updating its recorded balances, artificially inflating AM’s price. The attacker sold AM back to the pool for about $131,000.
Ocean ProtocolDeFi ProtocolPolygon$128K
The attacker flash-borrowed mOCEAN and cycled it through eight SideStaking-managed BPool clones on Polygon. A flaw in the pools’ one-sided liquidity calculations let them extract a net profit.
Molt EVMOtherBase$127K
A missing access check let an attacker replace Molt EVM’s authorized token spawner with their own contract, then mint mEVM tokens for free and sell them for WETH.
AIDCTokenBSC$121K
A bug in AIDC’s sell and burn logic failed to deduct accumulated burn fees from the seller’s balance. The attacker exploited the resulting pool imbalance to drain WBNB.
FoxMarketDeFi ProtocolBSC$120K
FoxMarket’s bond-minting function relied on a manipulable PancakeSwap spot price, which the attacker skewed using borrowed funds. This led to excess FOX tokens being issued; the attacker sold a referral allocation and kept about $120,000 in profit.
Long Bridge$118K
A third-party RPC supplied fabricated withdrawal events to Long Bridge’s keeper, which released 46.7928 WETH from its vault. The team stopped the keeper and refilled the vault the same day; users did not lose funds.
