Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
2,404 incidents
Syndicate LabsDeFi ProtocolBridgeBase$380K returned$380K
Using a leaked upgrade key, an attacker altered Syndicate Labs’ Commons bridge contracts and drained about 18.5 million SYND tokens and $50,000 in user assets across two networks. The project pledged to compensate affected users.
YieldCoreDeFi ProtocolEthereum$399K
A missing authorization check in YieldCore’s vault let anyone withdraw assets by naming another user as the owner and directing the funds elsewhere. The attacker drained 392,764 USDC belonging to eight depositors, emptying the vault.
JUDAOTokenBSC$228K
A double-sync bug in JUDAO’s transfer logic miscalculated pool balances, enabling flash-loan-backed price manipulation and sales at inflated prices. The attacker drained funds through BSC trading pools, including at least 205,259 USDT and 36 BNB.
QuantTokenEthereum$138K
A permissionless helper contract let anyone use the admin authority delegated by a QNT reserve pool’s administrator to make arbitrary calls. Attackers drained 1,988.5 QNT, worth about $138,000.
Singularity FinanceDeFi ProtocolBase$413K
A misconfigured price oracle undervalued tokens held by Singularity Finance’s vault, letting an attacker deposit USDC for nearly all vault shares and then redeem them for a share of the actual assets. The attack drained funds from the vault.
ZetaChain GatewayEVMChainBridgeEthereumBasePolygon+3 chains$334K
Missing access controls in ZetaChain’s GatewayEVM let an attacker make unauthorized calls and use existing token approvals to drain about $334,000 in USDC and USDT from team wallets across four chains. User funds were unaffected, and the team patched the issue.
ScallopDeFi ProtocolSui$142K
A flaw in the rewards calculation of Scallop’s deprecated V2 rewards contract let the attacker use a small SUI stake to claim far more rewards than earned, draining about 150,000 SUI. The active lending markets and user deposits were unaffected.
LitecoinChainLitecoinUndisclosed
A flaw in Litecoin’s MWEB transaction validation let attackers create malformed transactions that some outdated nodes accepted, enabling unauthorized withdrawals from the peg. The chain was reorganized by 13 blocks to fix the issue.
PurrlendDeFi ProtocolMegaETHHyperliquid L1$1.5M
Attackers compromised Purrlend’s 2-of-3 admin multisig, gave themselves bridge permissions, and minted unbacked tokens to borrow real assets from liquidity pools. The losses were about $1.52 million across HyperEVM and MegaETH.
GiddyDeFi ProtocolEthereum$1.3M
Attackers exploited GiddyVaultV3’s incomplete signature checks: key swap details were not covered by the signed authorization, allowing them to substitute malicious transaction parameters and take protocol assets worth about $1.3 million.
KipseliDeFi ProtocolBase$72.4K
Kipseli’s router used a USDC quote as the transfer amount for another token without checking that the tokens matched. An attacker exploited the decimal mismatch to receive far more cbBTC than the WETH they swapped; most of the funds were later returned.
Volo VaultsDeFi ProtocolSui$3.5M
After a high-privilege admin key was compromised, an attacker drained Volo’s WBTC, XAUm and USDC vaults on Sui. The team recovered most of the roughly $3.5 million taken and froze the vaults to prevent further losses.
Transit FinanceDeFi ProtocolEthereum$258K
An unauthenticated swap callback in Transit Finance let attackers trigger functions during swap operations without authorization. They used this to extract about $257,800 from the protocol.
Juicebox V3DeFi ProtocolEthereum$52K
A flaw in Juicebox V3 REVLoans let an attacker supply forged loan-accounting data and bypass the price oracle, which checks asset prices. The attacker borrowed against an inflated share price and drained about 21.77 ETH.
Thetanuts FinanceDeFi ProtocolEthereum$50K
The attacker deposited a tiny amount into a new Thetanuts vault, then sent ETH directly to it to distort how vault shares were valued. Later depositors received almost no shares, allowing the attacker to redeem nearly all the vault’s assets and take about $50,000.
Custom sAVAX Aave Rebalancer contract$64K
A public function in a custom Aave rebalancer let callers send arbitrary instructions while the contract held borrowing permission for a user. An attacker used it to borrow against that permission and take WAVAX, but a whitehat bot recovered all funds before they could be withdrawn.
Custom sAVAX RebalancerDeFi ProtocolAvalanche$64K
A public function in an Avalanche rebalancer allowed unchecked calls to other contracts. The attacker used its delegated borrowing power from Aave V3 to borrow WAVAX on behalf of victims and extract about $64,000.
VercelUndisclosed
A compromise of AI platform Context.ai gave an attacker access to a Vercel employee’s Google Workspace account, from which they escalated access. They also identified environment variables marked as non-sensitive; Vercel said customer variables encrypted at rest were protected.
Kelp DAODeFi ProtocolBridgeEthereumArbitrum$293M
Attackers compromised RPC nodes used to verify Kelp DAO’s rsETH bridge messages and made the single-verifier setup accept forged messages. This enabled about $290 million in losses; LayerZero said its protocol and other applications were not affected.
DNS registrar for eth.limoUndisclosed
The DNS registrar for eth.limo was attacked, prompting a warning to avoid eth.limo-related pages until the issue was confirmed resolved. The reports did not specify any stolen funds.
Rhea FinanceDeFi ProtocolNear$18.4M
An attacker created fake tokens and pools on NEAR and used a complex swap route to bypass Rhea Finance’s slippage protections, draining assets from its lending reserves. Some funds were returned or frozen, while recovery efforts continued.
GrinexCEXTronEthereum$13.7M
Attackers compromised Grinex wallets on TRON and Ethereum and stole cryptocurrency, then swapped USDT for TRX and ETH, likely to reduce the chance of the stablecoins being frozen. The exchange suspended trading and withdrawals.
LootBot AI$9.6K
LootBot AI’s xLoot staking contract counted duplicate NFT IDs repeatedly when calculating redemption rewards. An attacker exploited this with repeated IDs to drain about 6.21 ETH, keeping roughly 4.1 ETH after repaying a flash loan.
CowSwapDeFi ProtocolEthereum$1.2M
Attackers hijacked the cow.fi domain through social engineering at its registrar and sent visitors to a fake CoW Swap site. Users who signed malicious transactions lost funds; CoW Swap later regained control of the domain.
ZerionWallet$100K
An attacker used social engineering to compromise a Zerion employee’s device and obtain access to internal hot-wallet keys. About $100,000 was taken from company wallets; user funds and Zerion’s products were unaffected.
DangoDeFi ProtocolDango$410K returned$1.9M
Dango’s insurance fund accepted negative donation amounts without checking them, letting an attacker manipulate balances and take USDC. About $410,000 was bridged out; the remaining $1.49 million was recovered and returned.
MONATokenBSC$61K
A flaw in MONA’s deferred-burn mechanism let an attacker trigger a delayed token burn from the MONA/USDT pool after manipulating its reserves, then drain USDT from the pair. Flash loans and borrowing funded the attack and were repaid in the same transaction.
HyperbridgeDeFi ProtocolBridgeEthereumBaseBSC+1 chains$2.5M
A missing bounds check in Hyperbridge’s proof verification let the attacker forge a cross-chain message and mint 1 billion DOT tokens, which were sold against liquidity pools. The incident caused about $2.5 million in losses across several networks, mainly to incentive pools.
SubQuery NetworkDeFi ProtocolBase$134K
A missing owner check in SubQuery’s Base Settings contract let an attacker change key contract addresses and drain pooled SQT. About 382 million SQT was taken from staking, rewards, and treasury funds, affecting 272 stakers and delegators.
AethirDeFi ProtocolBridgeBSC$400K
An attacker exploited an access-control weakness in Aethir’s BNB Chain bridge adapter to take about 423,000 ATH. Aethir disconnected the affected contracts and worked with exchanges to block attacker wallets; the main Ethereum ATH supply remained intact.
Squid MulticallDeFi ProtocolArbitrumBNB ChainAvalanche+2 chains$517K
A user had mistakenly given Squid Multicall unlimited permission to spend their tokens. An attacker exploited its publicly callable function to transfer approved tokens from the wallet across multiple chains, taking about $517,000.
TGAI$11.9K
The attacker used a flash loan and helper contracts to manipulate reserves in a TGAI liquidity pool on PancakeSwap, then swapped tokens to take a profit. The project lost about $11,940.
DenariaDeFi ProtocolLinea$166K
An attacker used a flash loan to skew prices in Denaria’s virtual trading pool, then made oversized trades that inflated calculated profits. The incident caused losses of about $165,000.
BSC TMM/USDTDeFi ProtocolBSC$1.67M
Insufficient access controls let an attacker use flash loans to burn TMM held in the TMM/USDT pool, leaving its recorded reserve at one token. The distorted price enabled a large USDT withdrawal; the attacker repaid the loans and kept the remaining profit.
Silo V2DeFi ProtocolArbitrum$359K
An oracle priced wstUSR far above its market value, while flaws in Silo V2’s deposit accounting let an attacker inflate redemption payouts from the soUSDC vault. The incident affected the Arbitrum deployment; the reported sources do not specify the amount taken.
EIP-7702 Victim$17.2K
An attacker called an exposed swap callback in a user’s EIP-7702 delegated code on BNB Chain, which lacked access controls, and supplied crafted data to make the account transfer its tokens to the attacker. About $17,200 was taken.
HypurrFiUndisclosed
HypurrFi’s website domain was hijacked, but the protocol, user funds, and team infrastructure were reported unaffected. The team moved its website to a different domain.
AdobeUndisclosed
Adobe was reported to be investigating a suspected cyberattack that may have exposed data belonging to about 13 million users. The reported leak could include support-ticket information, but the details were not confirmed.
SAS Token$12K
A flaw in SAS Token’s custom transfer logic let an attacker build up sell-burn credit, then burn tokens directly from the liquidity pool and alter its reserves. The attacker swapped tokens to extract a profit.
Trust WalletUndisclosed
Trust Wallet’s Discord vanity link was hijacked and redirected users to a phishing server. The report did not describe any funds being stolen.
