Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Compound LabsUndisclosed
An attacker took control of Compound Labs’ account for about four hours and posted spam messages. The team regained control and removed them.
INSC NFTUndisclosed
A vulnerability in the INSC NFT contract let multiple attackers steal NFTs and transfer them to Blur and OpenSea for sale.
UniSat WalletUndisclosed
UniSat Wallet’s official Twitter account appeared to be compromised and posted a promotion containing a suspected malicious link.
MetakeyUndisclosed
Metakey’s Discord account was compromised, and malicious links were posted in announcements. The report did not specify any theft.
0xKofiUndisclosed
The @0xKofi Twitter account was hacked and used to share a scam link. The report does not describe any stolen funds.
thirdwebUndisclosed
Thirdweb disclosed a security flaw in several pre-built smart contracts, including DropERC20, ERC721, ERC1155, and AirdropERC20. The report did not say that funds had been stolen.
AerodromeUndisclosed
Aerodrome reported that its website frontend was compromised and warned users not to interact with it while the team investigated. The report did not specify any losses.
InfStonesUndisclosed
A vulnerability at InfStones may have exposed root-level access to 25 validator servers, potentially including key material. It was unclear whether Lido-related servers or keys were affected, and the report does not confirm any funds were stolen.
LoopringUndisclosed
Loopring’s Twitter account was hacked and used to post a phishing link.
Trader JoeUndisclosed
Trader Joe said an analytics plugin used by its website may have been hacked to inject malicious JavaScript code into the site.
TellorUndisclosed
Tellor’s Twitter account was compromised and used to post a phishing link about a $TRB airdrop.
Frax FinanceUndisclosed
Frax Finance warned users not to visit its websites after its DNS—the system that directs web addresses to sites—was attacked. The report did not say that funds were taken.
EverscaleUndisclosed
A large number of EVER tokens were stolen from Everscale. The network worked with exchanges to stop further outflows and temporarily disconnected Octus Bridge.
NOWAIUndisclosed
NOWAI’s Discord server was compromised and directed users to a phishing site designed to trick them into connecting their wallets.
LastPassUndisclosed
LastPass was suspected of a data breach after a user said more than 20 ETH was taken from a hot wallet whose recovery phrase had been stored there. The report said similar losses may have affected others, but did not confirm the breach.
LoozrUndisclosed
A fake Collab.Land verification link in Loozr’s Discord led users to a phishing site with a wallet drainer. The report did not specify any losses.
Wall Street MemeUndisclosed
An attacker posted a phishing link in the announcements channel of Wall Street Meme’s Discord server.
CryptopreneursUndisclosed
An attacker compromised Cryptopreneurs’ Discord server and posted a phishing link.
OrdswapUndisclosed
Ordswap lost control of its website domain, apparently through an issue involving its hosting provider. The compromised site redirected visitors to phishing links.
StarksportUndisclosed
A Starksport community team member’s Discord account was compromised. The report did not describe any stolen funds or further impact.
OmniBTCUndisclosed
Attackers took over OmniBTC’s Discord account and posted a phishing link in its announcement channel.
MetaMundoUndisclosed
An attacker posted a phishing link in MetaMundo’s Discord announcements channel.
MCTUndisclosed
DNS hijacking redirected some MCT wallet users to a fraudulent website that could capture their private keys. MCT advised users who had entered keys on its site to move their funds.
Metropolis WorldUndisclosed
Metropolis World said its Discord server was compromised. The report did not describe any stolen funds or further impact.
VendXUndisclosed
VendX’s Discord server was compromised; the report gives no further details about what the attacker did.
GEMIEUndisclosed
Attackers compromised GEMIE’s Discord server and posted phishing links in its announcement channel.
ModeUndisclosed
Mode’s Discord server was hacked, and an attacker posted a phishing link in the announcements channel. The report did not state whether anyone lost funds.
LuckyFactoryNFTUndisclosed
A phishing link was posted in LuckyFactoryNFT’s factory-updates channel. The report warns against interacting with it but does not report any funds stolen.
SpaceChainUndisclosed
SpaceChain’s Discord server was hacked, and an attacker posted a phishing link in its announcements channel.
Venom BearsUndisclosed
Attackers compromised the Venom Bears Discord server. No stolen funds or other losses were reported.
UpbitUndisclosed
Scammers deposited fake APT tokens into Upbit user accounts, and users sold them. The report said the exchange’s wallet system appeared to process deposits based only on token type and data.
SynthtopiaUndisclosed
Synthtopia’s Discord server was compromised. The report does not say whether funds were stolen or how the compromise happened.
BEDUUndisclosed
A BEDU team member’s Discord account was compromised.
TimeSoulUndisclosed
A phishing link was posted in the announcements channel of the TimeSoul Discord server. No losses were reported.
Linear FinanceUndisclosed
Linear Finance’s LUSD stablecoin was under exploit attack, prompting the team to pause liquidations while it investigated. The report said users’ accounts were not at risk.
Coinbase WalletUndisclosed
Attackers used Coinbase Wallet’s Web3 messaging feature to send users messages containing phishing links. The reports warn users not to click unfamiliar links but do not report funds taken.
One MintUndisclosed
An attacker compromised One Mint’s Discord account, posted malicious links, and shut down channels including support. The report did not describe any stolen funds.
ThalaLabsUndisclosed
An attacker took over ThalaLabs’ Twitter account and posted a phishing website linked to a wallet drainer, a tool that tricks visitors into surrendering crypto.
WitnetUndisclosed
Witnet’s Discord server was compromised and temporarily taken offline.
LDOUndisclosed
The LDO token contract can return “false” when a transfer exceeds a user’s balance instead of reverting the transaction, creating a potential fake-deposit fraud risk. Lido said this behavior was expected and that LDO and stETH were safe; no theft was reported.
