Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
83 incidents Clear filters
CoincheckCEXNEM$534M
Attackers stole customers’ NEM coins from Coincheck’s internet-connected hot wallet, which used a single key rather than requiring multiple approvals. The exchange began reimbursing affected customers.
Our coverage: CoinCheck Hacking Brings Consumer Protection To The ForeSource
GateCEX$235M
Attackers compromised Gate.io’s private keys and drained Bitcoin, Ethereum, Dogecoin, and other tokens from the exchange. The breach was not publicly revealed until 2024.
BitGrailCEXNano$170M
A flaw in BitGrail’s withdrawal system let attackers withdraw the same funds repeatedly, stealing Nano from the exchange’s hot wallets.
SmartMeshTokenEthereum$140M
An integer-overflow flaw in SmartMesh’s transferProxy function let attackers create counterfeit tokens; some were traded on exchanges before trading was halted.
ZAIFCEXBitcoin$60M
Attackers gained access to Zaif’s hot-wallet keys and stole Bitcoin, Bitcoin Cash, and MonaCoin. The Bitcoin Cash amount was not specified.
Blockchain.info$50M
A hacking group used Google search ads for cryptocurrency-related terms to direct users to fake Blockchain.info websites, stealing more than $50 million in cryptocurrency.
CoinrailCEXEthereum$37.2M
Attackers broke into Coinrail’s systems and stole more than $40 million in altcoins, including NPXS and Aston X. Partner exchanges helped recover about two-thirds of the stolen assets.
Our coverage: Bitcoin This Week: CFTC Subpoenas Major Crypto Exchanges, Coinrail Hacked, Bitcoin Prices And MoreSource
BithumbCEXEthereum$31M
Attackers gained access to Bithumb’s online wallet system and stole cryptocurrency, including about 35,000 ETH and other tokens.
BancorDeFi ProtocolEthereum$23.5M
Attackers gained access to a wallet linked to Bancor's BancorConverter contract, apparently using a compromised private key, and drained about $23.5 million in tokens.
Bitcoin GoldChainBitcoin Gold$18M
Attackers gained most of Bitcoin Gold’s mining power, sent BTG to exchanges and sold it, then reversed the transactions to spend the same coins again, taking about 388,000 BTG from exchanges.
MyEtherWallet$13M
Attackers hijacked MyEtherWallet’s DNS, which redirected visitors to a malicious site; users’ wallets were emptied after they logged in.
KICKICODeFi ProtocolEthereum$7.7M
Attackers gained access to the key controlling KICK tokens, destroyed tokens at 40 addresses and recreated them in attacker-controlled wallets, taking 70 million KICK. The team later regained control using a cold-storage key.
Verge$4.82M
Attackers bypassed a previous fix and carried out another 51% attack on Verge, resulting in a loss of funds.
Our coverage: Verge Allegedly Suffers Another 51% AttackSource
COINSECURECEXBitcoin$3.3M
Coinsecure’s private keys were exposed online for more than 12 hours while the exchange was handling Bitcoin Gold distributions, enabling attackers to steal BTC. The chief security officer was arrested as a prime suspect.
VergeChainVerge$1.75M
Attackers exploited Verge’s timestamp checks by mining blocks with false timestamps, causing difficulty to adjust and enabling unusually fast mining. They created and took counterfeit XVG.
ZenCashChainZenCash$550K
An attacker gained majority control of ZenCash’s mining power and reorganized 38 blocks, enabling double-spends of ZEN across exchanges. The attack caused losses estimated at about $550,000.
AurumCoinLayer 1AurumCoin$500K
An attacker gained most of AurumCoin’s mining power, sent AU to Cryptopia and sold it before reversing the transaction to spend the coins again. The attack left the blockchain inactive.
BlackWallet$400K
An attacker accessed BlackWallet’s hosting account and changed its DNS settings, redirecting users to a version of the wallet hosted by the attacker. Cryptocurrency was collected in the attacker’s wallet.
EOSBetDeFi ProtocolEOS$338K
Attackers forged transfer notifications—messages that tell a contract a token transfer occurred—to exploit EOSBet's contract and drain funds. The reported loss was about $338,000.
EOSBetDeFi ProtocolEOS$200K
The attacker used a malicious contract to send fake EOS transfer notices, bypassing EOSBet’s checks and making the platform pay out real EOS without a valid bet.
VertcoinLayer 1Vertcoin$100K
An attacker rented mining power to gain majority control of Vertcoin’s network and reorganize its transaction history, enabling double-spends. The attack caused estimated losses exceeding $100,000.
MonacoinChainMonaCoin$90K
From May 13 to 15, an attacker secretly mined and strategically released Monacoin blocks while controlling up to 57% of the mining power. This invalidated legitimate blocks and reportedly enabled about $90,000 in MONA to be stolen through exchange manipulation.
EOSCastDeFi ProtocolEOS$72.9K
The attacker used a fake EOS token to trick the EOSCast game contract, which failed to check who had issued the token. This let the attacker drain real EOS from the prize pool.
EosRoyaleDeFi ProtocolEOS$60K
Attackers used information from earlier blocks to predict EosRoyale’s random game results and stole 11,000 EOS from its operational wallet.
NewdexDeFi ProtocolEOS$58K
Attackers created counterfeit EOS tokens and used them to buy real EOS and other tokens on Newdex, exploiting the exchange’s lack of smart-contract checks and its use of personal accounts for settlement. Newdex later compensated users.
SpankChainDeFi ProtocolEthereum$38K
An attacker used a malicious token contract whose transfer function repeatedly called back into SpankChain’s payment-channel contract, draining about 165 ETH. The attacker later returned the funds after negotiations.
EOSDiceDeFi ProtocolEOS$25.1K
Attackers predicted EOSDice’s random numbers by analyzing blockchain information, exploiting a flaw in how the game generated randomness. The report does not specify what was taken.
HireVibes & AirDropsDACDeFi ProtocolEOS$13.6K
An attacker used a compromised EOSIO.SG testing account to take HVT and other airdrop tokens from the AirDropsDAC contract. Some HVT was sold for EOS, which was then sent to another account.
EOS.WINDeFi ProtocolEOS$9.18K
An attacker predicted EOS.WIN's random numbers by controlling a block reference number, making 10 successful attacks and gaining 9,180 EOS.
FFgameDeFi ProtocolEOS$7.2K
The attacker predicted FFGame’s random results using information from earlier blockchain blocks and the game’s number-generation method, then triggered a winning result. The attack was part of a coordinated assault on eight EOS gambling platforms.
TronwinUndisclosed
An overflow flaw in the Tronwin DApp was exploited, and 2 million TRX were stolen.
LuckBetUndisclosed
An attacker again exploited LuckBet’s random-number generation; the report does not specify what was taken.
LuckyMeUndisclosed
An attacker repeatedly targeted the LuckyMe game contract and profited thousands of EOS.
GameBetUndisclosed
An attacker used a transaction rollback—a reversal of a transaction—to exploit the GameBet dice contract, then sent most of the EOS gained to a FreeWallet account.
Fountain(FTN)Undisclosed
The attacker exploited an overflow flaw in Fountain’s batchTransfers function, which handles multiple transfers at once. The reports do not specify what was taken or what happened to the funds.
Lucky NutsUndisclosed
The Lucky Nuts game contract was repeatedly exploited through its random-number system. Most of the stolen EOS was later sent to a Binance account.
FastWinUndisclosed
A hacker gained control of and modified FAST's token contract, creating a flaw that allowed extra tokens to be issued for free.
PickownUndisclosed
The game contract accepted false transfer notifications from players because it did not filter them, allowing the transfer-error-prompt exploit. The report does not say what was taken.
LuckBetUndisclosed
An attacker exploited LuckBet’s game contract to obtain EOS, then transferred most of it to a Huobi exchange account.
EosDiceUndisclosed
An attacker targeted EosDice’s game contract and transferred most of the EOS gained to a Binance exchange account.
