Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
New Market TradingOtherEthereumBaseArbitrum$3.98M
A flaw in New Market Trading’s SquidRouterModule let attackers use addresses they supplied to pass permission checks, then route assets through attacker-controlled pools. They drained funds from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.
Third-party Gnosis Safe Module (SquidRouterModule)$3.2M
A faulty third-party Gnosis Safe module, which victims had trusted to spend their tokens without further signatures, accepted a publicly visible string as proof and let the attacker run arbitrary transactions. Fake swaps drained about $3 million from 86 wallets; the funds were consolidated into DAI.
WUSD.fi / GLOVELiquidity PoolEthereum$200K
Attackers used flash loans and many wallets to repeatedly claim GLOVE rewards because the reward system lacked protection against duplicate accounts. They sold the rewards into Uniswap V3 pools, draining about $200,000 in USDC and USDT.
BitmorDeFi ProtocolBase$6K
An access-control flaw in Bitmor’s DCA contract on Base let attackers drain tokens from wallets whose owners had active approvals for the contract.
Fractal ProtocolDeFi ProtocolArbitrum$13.7K
The attacker used flash-loan callbacks to repeatedly re-enter Fractal’s USDF vault, exploiting its share calculations to withdraw more USDC.e than they deposited. About 13,700 USDC.e was taken, leaving the vault’s liquid USDC buffer nearly empty.
StablRDeFi ProtocolEthereum$2.8M
After one of StablR’s three multisig keys was compromised, the attacker minted 8.35 million USDR and 4.5 million EURR without collateral and sold them for about $2.8 million in ETH. Both stablecoins depegged.
MureDeFi ProtocolEthereum$11.7K
A flaw in signature checking let an attacker use a malicious contract to bypass verification and drain 4.85 million QUEST tokens that had been approved for Mure’s distribution contract. The tokens were swapped for about 5.45 ETH.
PolymarketDeFi ProtocolPolygon$700K
An attacker used a compromised six-year-old operations wallet key to withdraw USDC and POL on Polygon in batches. Polymarket froze some funds and said user funds and platform operations were unaffected.
RetoSwapDeFi ProtocolMonero$2.7M
RetoSwap failed to verify the source of trade acknowledgment messages, allowing attackers to impersonate arbitrators and redirect multisig wallets to attacker-controlled addresses. About 7,000 XMR was stolen from traders.
Butter Bridge$180K
A flaw in the Butter Bridge’s retry-message checks let an attacker forge a cross-chain message and mint unbacked MAPO tokens. They sold about 1 billion of them for roughly $180,000 in liquidity; most of the fake tokens remained in the attacker’s wallet.
MAP ProtocolChainBridgeEthereumBSC$110K
A flaw in Butter Bridge’s retry-message checks let an attacker mint unauthorized MAPO tokens on Ethereum and BNB Chain. They extracted about 52.2 ETH in value before MAPO’s price crashed.
BankrAI AgentBase$170K
Attackers used stolen or tricked session tokens or signing keys to make direct transfers from 14 Bankr users’ Base wallets, bypassing token approvals. About $170,000 was taken; Bankr paused the affected functionality and pledged reimbursement.
HermesVaultDeFi ProtocolAlgorand$26K returned$30K
A flaw in HermesVault’s withdrawal script let an attacker bypass checks of zero-knowledge proofs, which validate transactions without revealing their details, and withdraw ALGO without authorization. The team patched the issue and began refunding affected users.
ElevateFiDeFi ProtocolPolygon$16K
The attacker used flash-loan-funded buying to inflate EFI’s price in a Uniswap pool, which ElevateFi’s staking vault read directly without a price safeguard. This let the attacker create staking positions recording $2.5 million in principal using only 713.5 EFI each time, repeated 100 times.
Echo ProtocolDeFi ProtocolBridgeMonad$821K
An attacker who obtained Echo Protocol’s admin key minted 1,000 unbacked eBTC on Monad, then used some as collateral to borrow WBTC and swap it for ETH. About 384 ETH was sent to Tornado Cash, while most of the minted eBTC remained under the attacker’s control.
Verus-Ethereum BridgeDeFi ProtocolBridgeVerus$11.5M
An attacker forged a cross-chain message to exploit the Verus-Ethereum bridge, turning small VRSC fees into millions of dollars in Ethereum-based assets. The attacker later returned about 4,052 ETH, while reports said roughly 1,350 ETH remained in their wallet.
SEA TokenTokenArbitrum$153K
SEA Token interactions on Arbitrum were exploited through price manipulation, reportedly using a flash loan to distort the token’s price. The attacker extracted about $153,000 in value; the precise mechanism was not confirmed.
MetaSeaDeFi ProtocolArbitrum$110K
MetaSea’s redemption function overpaid SEA yield when positions were opened and redeemed in the same block. Using flash loans, the attacker repeatedly deposited USDT, claimed and sold excess SEA, and extracted about $110,000 across eight attacks.
Adshares BridgeOtherBridgeEthereum$628K
Attackers used the bridge’s signer to approve three wrapping requests tied to nonexistent Adshares-chain transactions, creating fake wrapped ADS tokens. Selling them drained about $628,000 in ETH and USDC from Ethereum liquidity pools.
THORChainChainBridgeBitcoinEthereumBase+1 chains$10.7M
A flaw in THORChain’s threshold-signature system, which lets multiple participants authorize transactions together, allowed a malicious node to obtain enough vault key material to authorize withdrawals. The attacker drained protocol-owned funds across multiple chains; user funds and liquidity-provider positions were reported safe.
Transit FinanceDeFi ProtocolTron$1.88M
An attacker exploited vulnerabilities in Transit Finance’s discontinued TRON contract, draining about $1.88 million in DAI and other assets. The funds were moved to an Ethereum address; the team said current contracts were unaffected and promised to compensate users.
ShapeShift FOX ColonyDeFi ProtocolArbitrum$133K
An attacker exploited a flaw in FOX Colony’s meta-transaction authorization to replace its routing component with a malicious version, then use it to drain ERC-20 tokens. The reported losses ranged from about $132,700 to $182,700; the core exchange platform was unaffected.
Aurellion LabsRWAArbitrum$456K
An incompletely initialized proxy contract let an attacker call its setup function and take ownership, then add a malicious function to drain USDC from wallets that had approved the contract. The project paused operations and committed to reimbursing users.
SQ ProtocolDeFi ProtocolBSC$346K
A hardcoded owner backdoor in SQ Protocol’s staking contract let the attacker take control, create fake staking claims and redeem about 296,500 USDT, then sell SQi tokens for more. Total realized losses were about $346,000.
BoostHookDeFi ProtocolEthereum$187K
An attacker used a flash loan to push up the ETH/PERP pool price, opened leveraged positions at the inflated price, then reversed the move. A limit on liquidations left four positions with 8 ETH of debt each open, creating bad debt for BoostHook.
IEXCBPDeFi ProtocolBNB Chain$97K
An attacker manipulated PancakeSwap’s live token prices while using flash loans and multiple accounts to exploit IEXCBP’s reward-withdrawal calculations. The protocol’s entire reward pool was drained.
TACDeFi ProtocolBridgeTONTAC$2.85M
An attacker used a counterfeit USD₮ wallet on the TON side of the TON–TAC bridge to send a fraudulent message and mint unbacked TAC tokens. The incident drained locked assets, including USDT, BLUM, and tsTON, and the bridge was paused.
Ink FinanceDeFi ProtocolPolygon$140K
A flaw in Ink Finance’s treasury proxy whitelist let an attacker use a malicious contract posing as an approved claimer to make unauthorized transfers. About $140,000 in USDT was stolen, with a flash loan helping fund the attack.
Huma FinanceDeFi ProtocolPolygon$101K
A logic and access-control flaw in Huma Finance’s deprecated V1 credit pools let an attacker advance unapproved credit records and borrow the pools’ remaining funds. About 101,400 USDC and USDC.e was taken from protocol and pool-owner fees; user funds were not at risk.
Roaring Kitty‘s X accountUndisclosed
Attackers apparently took over Keith Gill’s verified X account and used it to promote a Solana meme coin, briefly driving its market value higher before the posts were deleted and the price crashed. More than 80 wallets reportedly lost about $2.86 million.
RenegadeDeFi ProtocolArbitrum$209K returned$209K
An unprotected initializer and an out-of-sync proxy version counter let an attacker install malicious logic in Renegade V1 and drain 27 tokens. A whitehat returned about $190,000 of the roughly $209,000 taken; the V1 Arbitrum deployment was paused.
TrustedVolumesOtherEthereum$6.7M
Missing access controls in TrustedVolumes’ RFQ swap proxy let the attacker add themselves as an authorized order signer and forge trades, draining WETH, WBTC, USDT and USDC. About $2 million in ETH was later returned, with a similar amount reportedly retained by the attacker.
Ekubo ProtocolDeFi ProtocolEthereum$1.4M
A flaw in Ekubo’s swap extension let attackers use users’ existing token approvals to transfer tokens to themselves without authorization. They stole 17 wBTC, worth about $1.4 million, and laundered the funds through Tornado Cash.
SquidRouterModuleDeFi ProtocolEthereumBase$3.2M
A verification flaw in SquidRouterModule treated a publicly known string as proof of a secure message, letting an attacker impersonate Gnosis Safe wallet owners and execute transactions. The attacker drained 86 vaults, consolidating about $3.2 million in DAI.
SmartCreditDeFi ProtocolEthereum$72K
SmartCredit’s Leveraged Lido staking feature was exploited, draining funds from the module. The team paused the feature and said its Loss Provision Fund would cover affected stakers’ losses.
Bisq v1DeFi ProtocolBitcoin$550K
A flaw in Bisq v1’s trade protocol let modified clients bypass checks on negative miner fees and take Bitcoin from multisig trade outputs. About 11 BTC was stolen from 10 users; Bisq v2 and Easy were unaffected.
Sharwa.FinanceDeFi ProtocolArbitrum$32.9K
An attacker manipulated oracle price data on Arbitrum to extract value from Sharwa.Finance. The protocol lost about $32,850.
Wasabi ProtocolDeFi ProtocolEthereumBaseBerachain+1 chains$5.5M
Attackers obtained Wasabi’s deployer key and used it to upgrade vaults and pools across Ethereum, Base, Berachain, and Blast, then withdraw funds. Reports put losses at roughly $5.5 million, including user funds and treasury assets.
Sweat FoundationDeFi ProtocolNear$3.5M
A logic flaw in the SWEAT token contract let an attacker use a custom drain contract to take tokens from foundation-controlled accounts and sell some of them. The team patched the contract and restored external users’ balances.
Aftermath FinanceDeFi ProtocolSui$1.14M
A fee-accounting flaw let an attacker set negative builder fees to inflate synthetic collateral and withdraw funds from Aftermath’s perpetuals vault. They drained about $1.14 million in USDC; other products were unaffected.
