Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
26 incidents matching “Initia” Clear filters
InitiaChainInitia$615K
Using compromised rollup infrastructure keys, an attacker forged IBC transfers—cross-chain asset messages—to withdraw funds from Initia escrow accounts. Some assets left through Noble, while most remaining assets stayed on the halted network; recovery was still under investigation.
InitiaChainInitia$2.6M
A bug in Initia’s MoveVM, the software that runs its smart contracts, let an attacker mint unbacked tokens and bridge about $2.7 million in assets off the network. Initia halted its L1 blockchain and rollups; native INIT tokens were unaffected.
StartaleDeFi ProtocolEthereum$2.88K
A flaw in Startale smart-account initialization let an attacker reinitialize pre-funded accounts during deployment with malicious code and transfer out their assets. About 330 accounts were affected; the Soneium network was not.
Namada Shielded PoolsDeFi ProtocolBridgeNamada$600K
An IBC transfer flaw let the attacker drain assets from Namada’s Multi-Asset Shielded Pool and move them across chains. About $600,000 in tokens was taken; a stale indexer initially continued to display the funds as available.
Aurellion LabsRWAArbitrum$456K
An incompletely initialized proxy contract let an attacker call its setup function and take ownership, then add a malicious function to drain USDC from wallets that had approved the contract. The project paused operations and committed to reimbursing users.
RenegadeDeFi ProtocolArbitrum$209K returned$209K
An unprotected initializer and an out-of-sync proxy version counter let an attacker install malicious logic in Renegade V1 and drain 27 tokens. A whitehat returned about $190,000 of the roughly $209,000 taken; the V1 Arbitrum deployment was paused.
MoonwellUndisclosed
An attacker bought enough MFAM tokens to pass an initial Moonwell governance vote that could transfer control of lending markets and other components to a malicious contract. No funds were reported taken, and voting was ongoing, with opposition votes then leading.
Rari CapitalDeFi ProtocolEthereum$2M
An unprotected proxy upgrade let an attacker take control of Rari Capital’s implementation contract and gain admin privileges. They used that access to borrow without collateral from its lending pools.
KintoDeFi ProtocolBridgeArbitrum$1.55M
A flaw in Kinto’s token contract let the attacker mint counterfeit K tokens without limit. They used the tokens to drain assets from lending pools and a trading pool.
WXETADeFi ProtocolEthereumBSC$110K
An attacker used WXETA’s unguarded contract setup function to grant themselves permission to mint tokens, then drained liquidity pools holding USDT and WXETA.
RoninDeFi ProtocolBridgeEthereum$12M
An incomplete Ronin Bridge contract upgrade left voting weights unset, allowing withdrawals without the required multisignature checks. About 4,000 ETH and 2 million USDC were taken, then returned by white-hat hackers, who received a bounty.
Our coverage: Ronin Hackers Return $10M ETH To Earn A $500K RewardSourceRekt report
OMPx$107K
OMPx was attacked, causing a loss of about $107,000. The attacker’s initial funds came through Railgun, and the stolen funds were later deposited there.
Perpy FinanceDeFi ProtocolArbitrum$132K
An uninitialized staking contract proxy let an attacker take control of Perpy Finance’s contract, upgrade it, and withdraw about 58.49 million PRY tokens. The tokens were exchanged for 41.895 ETH.
TelcoinPaymentsPolygon$1.25M
An attacker exploited uninitialized wallet proxy contracts on Polygon, setting up malicious versions that could drain funds from wallets that had never made a transaction. Telcoin temporarily froze app use while investigating.
Luke DashjrUndisclosed
Attackers compromised Bitcoin developer Luke Dashjr’s wallets after bypassing two-factor authentication and stole more than 216 BTC. A leaked PGP key was initially suspected as part of the breach.
Earning.FarmDeFi ProtocolEthereum$1.2M
Attackers exploited EFLeverVault’s flash-loan callback because it did not check who had initiated the loan, enabling unauthorized ETH withdrawals from the collateral pool. One attack was intercepted, while another netted the attacker 268 ETH.
Bitbns$7.5M
Bitbns later acknowledged that it had been hacked on February 1, but its CEO did not confirm how much was stolen. Reports disagreed on the amount and on whether the exchange initially concealed the incident.
DAO MakerDeFi ProtocolEthereum$4M
An unprotected initialization function let an attacker reset DAO Maker’s vesting contracts and take ownership, then use an emergency withdrawal function to steal tokens intended for distribution. The tokens were exchanged for about $4 million in DAI.
Punk ProtocolDeFi ProtocolEthereum$8.95M
An attacker reused an unguarded contract initialization function to change the address controlling withdrawals, draining stablecoins from Punk Protocol. A white-hat hacker recovered about $5 million; the remaining funds were reported sent to Tornado Cash.
88mphDeFi ProtocolEthereumUndisclosed
A bug in 88mph’s NFT contract let anyone repeatedly initialize it, take control as owner and mint NFTs without restriction. The flaw was reported and patched within two hours; no theft was reported.
Value DeFiDeFi ProtocolBSC$11M
A flaw in Value DeFi’s uninitialized pool contracts let an attacker take control and withdraw liquidity tokens from the pools. More than 3,000 ETH was reported lost.
Value DeFiDeFi ProtocolBSC$10M
An attacker reinitialized Value DeFi’s vSwap pool, gave themselves operator control, and used a recovery function to drain its liquidity tokens and associated funds. The affected pool lost BUSD and other tokens.
DODODeFi ProtocolEthereum$3.8M
DODO’s crowdpooling contract allowed its initialization function to be called again, letting an attacker reconfigure pools with worthless tokens and drain their reserves. About $3.8 million was taken, and roughly $3.1 million was returned by trading bots.
CashaaCEXBitcoin$3.1M
Malware on a Cashaa employee’s computer initiated Bitcoin transfers to attacker-controlled wallets. The exchange reported that about 336 BTC was stolen and halted crypto transactions.
Our coverage: Cashaa Exchange Hack Results In More Than $3 Million Lost In BTCSource
Parity MultisigDeFi ProtocolEthereum$150M
A user reinitialized Parity’s shared wallet library and then destroyed it, permanently disabling more than 500 multisig wallets containing about 500,000 ETH.
ParityWalletEthereum$30M
A flaw in Parity’s multisignature-wallet library let an attacker take ownership of wallets and drain them. A white-hat group used the same flaw to rescue funds from other vulnerable wallets.
