Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
BAYCUndisclosed
Attackers took over Bored Ape Yacht Club’s official Instagram account and stole 91 NFTs, including BAYC, MAYC and BAKC items.
AkutarsUndisclosed
Code flaws in Akutars’ auction contract permanently locked 11,539.5 ETH, preventing withdrawals. The report said problems with bidder and auction counts, as well as the withdrawal function, left the funds stuck.
Ugly PeopleUndisclosed
Attackers compromised the Ugly People NFT project’s Discord and used it to spread fake minting links. No losses were reported.
MetaconzUndisclosed
A malicious bot installed on a Metaconz team administrator’s Discord account led 79 users to lose 11.9 ETH. The attacker used a wallet-approval function to take control of victims’ wallets; the team said it would compensate users.
FaceDAOUndisclosed
An unauthorized account transferred and sold FACE tokens held by the FaceDAO team. The amount was not reported.
Marvin InuUndisclosed
Marvin Inu’s cross-chain bridge was exploited, and tokens worth 110 ETH were stolen and sold, sharply lowering the token’s price. The project closed the bridge and fixed the vulnerability.
UGCUndisclosed
Hackers took over India’s Education Grants Council Twitter account, changed its profile to impersonate an Azuki NFT creator, and posted a fake airdrop link. The agency recovered the account after six hours.
Multiple NFT projectsUndisclosed
Discord servers for several NFT projects were attacked, and the source code for the Captcha verification bot was leaked; the Ticket tool for private messages was also attacked. The reports do not describe any stolen funds.
Jet ProtocolUndisclosed
A flaw in Jet Protocol could have allowed attackers to withdraw tokens from accounts they did not control. The team fixed it; no actual theft was reported.
InuSaitamaUndisclosed
InuSaitama reportedly suffered an arbitrage attack: an attacker swapped SAITAMA tokens through Saitamask and Uniswap, then converted them to ETH and transferred the proceeds.
Maison GhostUndisclosed
Maison Ghost’s Discord was compromised, and the attacker posted a fake minting link. About 300 NFTs were stolen and sold for 128 ETH; the proceeds were sent to Tornado.
VEVEUndisclosed
VEVE reported that its system had been exploited, allowing a large number of gems to be obtained illegally.
MekaVerseUndisclosed
Attackers compromised MekaVerse’s official Discord. Community members reported that bots’ wallets may have been stolen, but users were not reported affected.
ArthurUndisclosed
A hot wallet linked to Defiance Capital founder Arthur was suspected of being stolen. On-chain records showed 60 NFTs transferred from the wallet, worth about 310 ETH in total.
HubspotUndisclosed
An unauthorized party accessed BlockFi customer data stored by its vendor Hubspot, including names, email addresses and phone numbers. Passwords, government-issued IDs and Social Security numbers were not stored there.
ActiveCampaign（AC）Undisclosed
An attacker accessed information held by email provider ActiveCampaign, which served Unchained Capital. Customer contact and account details, and possibly IP addresses, may have been exposed; Unchained’s own systems were not affected.
MOXUndisclosed
MOX was hacked because its transferFrom function did not check whether the caller was authorized to transfer the tokens.
FutureSwapUndisclosed
Human error exposed access credentials for a FutureSwap account holding about 300,000 FST in reward reserves. The attacker used the account to transfer the available tokens to themselves.
PayBitoUndisclosed
The LockBit ransomware group said it stole PayBito customer records, email data, password hashes, and administrator data, and published some of the material. It demanded a ransom and threatened to release more data.
The Heart ProjectUndisclosed
Scammers took over The Heart Project’s Discord server, deleted channels, and posted fraudulent links. Users who clicked them reported losing assets, and the project said it would reimburse them.
MetaMaskUndisclosed
MetaMask automatically loaded NFT image URLs, allowing an attacker who sent a target an NFT with a URL they controlled to learn the target’s IP address from server logs. No funds were reported stolen.
wxBTRFLYUndisclosed
A flaw in the wxBTRFLY token’s transferFrom function incorrectly changed spending permissions, putting affected users’ assets at risk. The project responded by moving those assets to a multisignature wallet, which requires several authorized signers.
LooksRareUndisclosed
LooksRare was hit by a denial-of-service attack, which briefly took the NFT marketplace offline and prevented some users from connecting wallets or listing NFTs. The team restored the site.
Arbitrum OneUndisclosed
Arbitrum One stopped producing new blocks and processing transactions for more than two hours, and MetaMask could not connect to the network.
StoboxCompanyUndisclosed
StoboxCompany said an attacker obtained the private key for its token deployer address, enabling the theft or liquidation of reserve funds on Ethereum and BSC.
SolanaUndisclosed
Solana experienced heavy congestion and failed transactions for about four hours. A DDoS attack was debated as a possible cause, but co-founder Anatoly Yakovenko denied that one occurred; no theft was reported.
DefiChainChainBridgeDefiChainUndisclosed
A fee-calculation flaw in DeFiChain’s atomic swaps let attackers substitute BTC for DFI while keeping the same numerical fee, causing excessive fees to be paid in BTC-denominated assets. The flaw also allowed unbacked dBTC to enter circulation.
