Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
OpenMonero P2P$62.9K
An attacker gained root access to OpenMonero’s P2P trading platform server and stole about 200 XMR. The project owner said all funds were lost.
MONATokenBSC$61K
A flaw in MONA’s deferred-burn mechanism let an attacker trigger a delayed token burn from the MONA/USDT pool after manipulating its reserves, then drain USDT from the pair. Flash loans and borrowing funded the attack and were repaid in the same transaction.
Argent-style Smart Wallet System$59.8K
Flaws in an Argent-style smart wallet let an attacker take ownership through a rapid recovery process and reuse signed instructions. Repeating the instructions to trade against a low-liquidity MARK/WETH pool caused about $59,800 in losses.
Likwid$55.7K
A bug in Likwid’s margin-borrow contract let repeated borrowing reuse stale pool reserves after the attacker manipulated a thinly traded pool. The attacker drained 74.31 BNB from the vault and later sent the funds to Tornado Cash.
Juicebox V3DeFi ProtocolEthereum$52K
A flaw in Juicebox V3 REVLoans let an attacker supply forged loan-accounting data and bypass the price oracle, which checks asset prices. The attacker borrowed against an inflated share price and drained about 21.77 ETH.
NimiqDeFi ProtocolPolygon$50.4K
An OpenGSN signature-checking flaw let an attacker forge requests to Nimiq’s Polygon swap contracts, which used a liquidity wallet’s existing token approvals to open payment contracts for the attacker. The attacker then redeemed the funds.
JBTokenBSC$50K
The attacker used a flash loan and manipulated JB token pool prices, exploiting contract functions that repeatedly adjusted the pool’s reserves to extract USDT. The JB gateway lost about $50,000, and the flash loan was repaid in the same transaction.
Thetanuts FinanceDeFi ProtocolEthereum$50K
The attacker deposited a tiny amount into a new Thetanuts vault, then sent ETH directly to it to distort how vault shares were valued. Later depositors received almost no shares, allowing the attacker to redeem nearly all the vault’s assets and take about $50,000.
Revert LendDeFi ProtocolBase$50K
A missing safety check in Revert Lend’s Base vault let an attacker withdraw liquidity that still backed an active loan, leaving the vault with a worthless collateral NFT. Two attackers caused $50,101 in losses, mostly from Revert’s own funds.
BonfiretokenDeFi ProtocolBSC$47.4K
BonfireSwap let callers transfer BONFIRE from wallets that had already approved its router, without checking that the caller was authorized. The attacker drained about 41 approved holders, sold the tokens for BNB, and caused losses of about $50,000.
Weft V2DeFi ProtocolRadix$47.2K
Weft V2 valued HUG at roughly 10 million times its market price because of an incorrect price feed. The attacker used a still-enabled collateral route to deposit HUG and borrow 47.28 million LSULP and 13.1005 million XRD.
Unnamed BSC DEX Router$46.1K
An unnamed BNB Chain DEX router failed to verify that swap callbacks came from genuine Uniswap V3 pools. Using a fake pool, the attacker used existing token approvals to drain about 62.28 WBNB from 29 wallets.
Joe Agent$45K
Joe Agent sent BNB before updating a user’s liquidity record, allowing the attacker to re-enter the contract repeatedly and steal 62.5 BNB and about 1.196 million JOE.
ether.fi LiquidDeFi ProtocolEthereum$43.3K
Veda’s AtomicQueue let callers name an unapproved solver, then used existing token approvals to pull liquidETH from that address. The attacker supplied 11 holders as solvers in a crafted request, draining about 15.45 ETH in one transaction.
Slice$41K
Slice’s FundsModule trusted caller-provided reports of released funds without checking that ETH or USDC had arrived. The attacker used contracts that reported transfers but sent no assets, then withdrew about $41,000 from pooled reserves.
Asterix LabsNFTfiEthereum$40K
A flaw in shared DN404 token code affected Asterix Labs’ ASTX contract, allowing attackers to drain about $40,000. The same vulnerability had been used against Flooring Protocol the previous day.
MUSystem$36.9K
A deposit-and-withdrawal flaw let users count a first-deposit bonus twice and redeem more ETH than they had deposited. The attacker repeated the cycle across 16 addresses, draining ETH from the contract.
DoinGudNFTfiPolygon$35.5K
A bug in DoinGud’s Polygon NFT offer contract left accepted bids active, letting an attacker replay the same offer and collect its USDC repeatedly. The attacker used a flash loan to fund a self-made offer and drained about $35,486.
DTXT/USDT liquidity pair on BSC$35K
The attacker tricked DTXT’s contract into treating large token sales as liquidity additions, bypassing sell fees and draining about 35,041 USDT from the DTXT/USDT pool.
Sharwa.FinanceDeFi ProtocolArbitrum$32.9K
An attacker manipulated oracle price data on Arbitrum to extract value from Sharwa.Finance. The protocol lost about $32,850.
ORBToken$32.6K
An attacker abused ORBToken’s automatic allowance and a tax-exempt selling path that lacked protection against repeated calls. By combining repeated sells with liquidity-pool reserve manipulation, they extracted about $32,611.
HermesVaultDeFi ProtocolAlgorand$26K returned$30K
A flaw in HermesVault’s withdrawal script let an attacker bypass checks of zero-knowledge proofs, which validate transactions without revealing their details, and withdraw ALGO without authorization. The team patched the issue and began refunding affected users.
BONKfunICOSolana$30K
Attackers socially engineered the domain registrar to take control of BONKfun’s website and replace it with a fake page that prompted users to sign malicious transactions. The attack caused about $30,000 in customer losses.
Atomic GreenDeFi ProtocolArbitrum$30K
A replay flaw let the attacker reuse one manager signature across 21 Uniswap V3 liquidity positions; flash-loan price manipulation helped trigger unauthorized withdrawals of the full positions. The attacker took about 29,984 USDC.
Float ProtocolDeFi ProtocolEthereum$28K
Flash-loan-funded trades manipulated a Uniswap pool’s spot price, causing Float’s contracts to misvalue liquidity-pool shares. The attacker repeatedly deposited and withdrew at distorted values, taking 10.71 ETH.
Spiral$26.8K
Spiral’s borrowing hook used a Uniswap V4 pool’s live spot price to value collateral, without safeguards against price manipulation. The attacker bypassed a same-block trading guard using multiple accounts and borrowed against inflated collateral, causing a loss of about 10.7 ETH.
WealthManagementV2DeFi ProtocolBSC$26.4K
An attacker gained WealthManagementV2 owner privileges and set extreme investment-plan parameters without delay or limits, generating artificial interest and withdrawing it. The contract lost about 26,414 USDT.
ATOHook$25K
A storage-slot collision made ATOHook treat a reentrancy-protection value as a reward balance. The attacker repeatedly claimed the resulting fixed reward, taking about 14.41 ETH.
Drips NetworkDeFi ProtocolEthereum$24.9K
An unsafe number conversion in Drips Network’s DaiDripsHub reversed a deposit into a withdrawal, allowing an attacker to drain about 24,883 DAI from the reserve.
GaslessReservoirEnabler$23K
An authorization flaw in Polygon’s GaslessReservoirEnabler contract let an attacker use victims’ existing token allowances to transfer their WETH and ZED. About 997 addresses lost roughly $23,000, which was consolidated and deposited into a bridge.
ReddioDeFi ProtocolEthereum$22.8K
RedSonic’s vault counted the same stETH in both its ETH and stETH vaults. The attacker inflated the ETH-vault share price, withdrew excess ETH, then redeemed stETH shares against the same collateral, taking about 9.25 ETH.
YapeswapDeFi ProtocolEthereum$21.9K
Yapeswap’s governance contract allowed a proposal to pass without a minimum number of votes, letting an attacker take control of a factory setting and install a malicious registry. It redirected deposits to fake vaults, causing about $21,900 in losses.
Set ProtocolDeFi ProtocolEthereum$21.9K
An upward-rounding bug in Set Protocol’s fee accounting inflated share value even when no fee was due. Attackers issued and redeemed shares to extract about 8.11 WETH from existing collateral.
Fearless Wallet$20K
Malicious code in the Fearless Wallet browser extension sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users reported unauthorized transactions totaling 17,286 DOT.
FH TokenTokenBSC$20K
A flaw in FH Token’s sell logic caused incorrect token burns during trades. The attacker repeatedly bought and sold FH to drain value from the FH/USDT pool.
YSDAO$19.5K
The attacker manipulated PancakeSwap V2 pool reserves through contract calls and extracted funds from YSDAO. The loss was about $19,500.
EtherVistaDeFi ProtocolEthereum$18.6K
An integer overflow in EtherVista’s pool swap check let a malicious router pass swaps that reduced the pool’s real reserves. The attacker used two crafted swaps to take WETH and VISTA worth about $18,600.
Locus FinanceDeFi ProtocolArbitrum$18K
UnistreetsDeFi ProtocolEthereum$17.8K
An arbitrary-call flaw in Unistreets’ LaunchpadFactoryAuto contract let the attacker approve and burn liquidity-provider NFT positions held by the factory. This drained about $17,750 in liquidity.
EIP-7702 Victim$17.2K
An attacker called an exposed swap callback in a user’s EIP-7702 delegated code on BNB Chain, which lacked access controls, and supplied crafted data to make the account transfer its tokens to the attacker. About $17,200 was taken.
