Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
111 incidents Clear filters
LuBianOtherBitcoin$3.5B
An attacker exploited weak key generation in LuBian’s infrastructure to guess private keys and steal 127,426 BTC from its mining pool.
KuCoinCEXEthereum$281M
Attackers obtained the keys to KuCoin’s hot wallets and stole cryptocurrency, including Bitcoin and tokens. KuCoin recovered most of the funds through tracking, contract changes, and law enforcement cooperation, and said it would cover users’ losses.
YFValue$170M
A flaw in YFValue’s staking pool let malicious users reset the pool’s timer. The team said funds worth about $170 million were at risk of being locked, and an attacker tried to use the flaw to blackmail it; no funds were reported stolen.
Compounder.Finance$80M
Compounder.Finance project owners transferred large amounts of tokens to their own accounts, causing the project to lose tokens worth about 80 million yuan.
Saffron Finance$50M
A flaw in Saffron Finance’s redemption contracts left deposits from its first cycle locked for eight weeks. The team was working on a fix and a transition to the next cycle.
Josh Jones$45M
Josh Jones had about $45 million in digital currency stolen after his SIM card was hacked.
Ravencoin$40M
A vulnerability in Ravencoin allowed unknown parties to create extra RVN, amounting to 1.5% of the planned total supply. The tokens may have been sold, but the report does not give a confirmed loss amount.
Lendf.MeDeFi ProtocolEthereum$25M
An attacker exploited a reentrancy flaw in Lendf.Me, repeatedly moving tokens before the protocol updated its balances, and stole funds. Law enforcement and exchanges helped recover the funds within days.
Harvest FinanceDeFi ProtocolEthereum$24M
An attacker used a flash loan to manipulate prices in Curve’s stablecoin pool, repeatedly minting and redeeming Harvest Finance tokens to drain funds. The attacker later returned about $2.5 million, reducing users’ losses.
Electrum$22M
Hackers stole Bitcoin from Electrum wallet users by tricking them into installing fake software updates. Older versions of the app remained vulnerable.
Pickle FinanceDeFi ProtocolEthereum$19.7M
A flaw in Pickle Finance’s contract let an attacker use fake “jars”—contracts used to manage deposits—to drain about 20 million DAI from its pDAI pool.
Electrum$16M
A fake Electrum software update prompt led a user to connect to an attacker’s server when making a transfer. The report said 1,400 bitcoin were sent to the attacker’s wallet.
EminenceDeFi ProtocolEthereum$15M
An attacker used a flash loan to manipulate the price of EMN in Eminence’s bonding-curve system, draining funds from the newly launched project. Reports said $8 million was returned to a Yearn deployer contract.
CompoundDeFi ProtocolEthereum$12.5M
Reports describe conflicting incidents: one says a price-feed error caused about $90 million in Compound liquidations; another says Compounder Finance’s developers replaced strategy pools with malicious contracts and drained them. The reports do not establish that these accounts concern the same event.
EXMOCEXMultiple$10.5M
Attackers made coordinated withdrawals from EXMO’s compromised hot wallets, taking several cryptocurrencies, including BTC, ETH, XRP, ETC, ZEC and USDT. The exchange froze withdrawals; reports put the loss at about 5–6% of its assets.
Cover ProtocolDeFi ProtocolEthereum$9.4M
A flaw in Cover Protocol’s reward contract let an attacker mint an enormous number of COVER tokens, which were exchanged for other assets. A white-hat hacker returned funds, including 4,350 ETH, for distribution to liquidity providers.
MakerDaoDeFi ProtocolEthereum$8.32M
During Ethereum network congestion, MakerDAO’s price oracle failed to update, leaving outdated collateral prices. Buyers exploited the resulting auctions with zero-DAI bids, taking ETH and leaving the system with a shortfall and bad debt.
Nexus MutualDeFi ProtocolEthereum$8M
An attacker gained remote access to Nexus Mutual founder Hugh Karp’s computer and replaced his MetaMask extension, tricking him into signing a transfer of 370,000 NXM tokens worth more than $8 million. The attacker later demanded a ransom.
Warp FinanceDeFi ProtocolEthereum$7.8M
An attacker used flash loans to manipulate Uniswap prices and inflate the apparent value of Warp Finance LP tokens, then borrowed stablecoins against them. About $7.7 million was taken, and the team said roughly $5.5 million remained in the vault for distribution to affected users.
Origin ProtocolDeFi ProtocolEthereum$7.7M
An attacker used flash loans to exploit a reentrancy flaw in Origin Dollar’s vault minting function, inflating the token supply and then redeeming against it to drain vault funds.
Value DeFiDeFi ProtocolEthereum$7.4M
A flash loan attack manipulated stablecoin exchange rates through Curve’s price feed, allowing the attacker to drain Value DeFi’s MultiStables vault. The attacker returned part of the funds, but the vault still suffered losses.
OUSD$7M
A flash-loan attack exploited a vulnerability in Origin Dollar’s vault, causing about $7 million in losses. The report says the team was investigating the flaw and whether funds could be recovered.
OKExCEXEthereum Classic$5.6M
Attackers used a 51% attack on Ethereum Classic to reverse deposits made to OKEx after withdrawing the deposited coins, effectively spending them twice. OKEx reported losses and said it would reimburse affected users.
ETERBASECEXBitcoinEthereumXRP+3 chains$5.4M
Attackers compromised Eterbase’s internet-connected hot wallets and moved stolen Bitcoin, Ethereum, XRP, Tezos, Algorand and TRON to addresses they controlled. The losses exceeded $5.4 million.
AeternityChainAeternity$5.2M
An attacker gained control of more than half of Aeternity’s mining power and reorganized blocks to double-spend coins at exchanges. A later attempt to repeat the attack was detected and blocked.
CWT$4.5M
Ransomware attackers hijacked CWT’s computer systems, and the travel company agreed to pay them $4.5 million worth of Bitcoin.
LivecoinCEXMultiple$3.3M
Attackers used compromised credentials to take control of Livecoin’s servers and nodes, then manipulated exchange prices and drained several hot wallets. The exchange later shut down permanently.
Cheese BankDeFi ProtocolEthereum$3.3M
An attacker used a flash loan to buy Cheese tokens and inflate their price, then used the inflated value of deposited pool tokens as collateral to borrow available stablecoins. CheeseBank lost about $3.3 million.
CashaaCEXBitcoin$3.1M
Malware on a Cashaa employee’s computer initiated Bitcoin transfers to attacker-controlled wallets. The exchange reported that about 336 BTC was stolen and halted crypto transactions.
Our coverage: Cashaa Exchange Hack Results In More Than $3 Million Lost In BTCSource
EtherCrashDeFi ProtocolEthereum$2.5M
EtherCrash’s single-key wallet was compromised, and two large withdrawals totaling about $2.5 million were made and exchanged for DAI. EtherCrash said it would compensate users for their losses.
AkropolisDeFi ProtocolEthereum$2M
An attacker exploited a flaw in Akropolis’s SavingsModule that issued deposit tokens twice, allowing them to withdraw more than they had deposited. The attacker used this to take about 2.03 million DAI from the yCurve and sUSD pools.
Trinity WalletWalletIota$2M
A DNS hijacking attack on Trinity Wallet led to malicious code stealing users’ private-key seeds. More than 50 users lost 8.55 million MIOTA.
ETC$1.68M
Ethereum Classic suffered a 51% attack that reorganized more than 4,000 blocks. The attackers reportedly made at least $1.68 million.
Ethereum ClassicLayer 1Ethereum Classic$1.68M
Attackers gained control of enough Ethereum Classic mining power to reorganize 4,236 blocks and reverse transactions, enabling double-spends. The attack lasted more than 15 hours and stole at least $1.68 million in value.
2getherCEXBitcoinEthereum$1.18M
Attackers compromised 2gether’s systems and stole Bitcoin and Ether from user accounts. The exchange offered reimbursement options in its own 2GT tokens.
PercentFinance$1M
Problems in PercentFinance’s USDC, ETH and WBTC markets left some funds permanently locked. The team froze the affected markets, trapping 446,000 USDC, 28 WBTC and 313 ETH.
AltillyCEXMultiple$750K
An attacker used compromised API keys to access Altilly’s hosting provider, took control of its servers and deleted backups, leaving encrypted wallets inaccessible. One report said 30 BTC and 12,000 USDT were stolen; the exchange shut down without recovering funds.
YAM$750K
A bug in YAM’s rebase calculation permanently locked governance tokens in a contract, leaving them unusable. The project’s price also plunged.
OokiDeFi ProtocolEthereum$650K
An attacker manipulated sUSD prices across several protocols that bZx relied on for price data, then front-ran liquidations. The attack caused losses of about $645,000.
bZx$645K
bZx was attacked, with an estimated loss of ETH.
