Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
236 incidents Clear filters
Poly NetworkDeFi ProtocolBridgeEthereumBSCPolygon$611M
Attackers exploited access-control and cryptography flaws in Poly Network’s cross-chain bridge contracts, taking over $610 million across Ethereum, BSC and Polygon. The attacker later returned nearly all the funds, keeping only transaction fees.
BitMartCEXEthereumBSC$196M
Attackers compromised BitMart’s Ethereum and BNB Chain hot wallets and stole cryptocurrency from them. Other wallets were reported unaffected.
Our coverage: BSC Wallets Compromised As Well – Damages In The Bitmart Hack Grow To 196 Million USDSourceRekt report
CompoundDeFi ProtocolEthereum$147M
An off-by-one error in Compound V2’s COMP distribution logic caused users to claim far more tokens than intended after a governance proposal took effect. Deposits and borrowed funds were reported not to be at risk.
Vulcan ForgedDeFi ProtocolEthereumPolygon$140M
An attacker compromised Venly’s semi-custodial servers and obtained credentials to access Vulcan Forged users’ wallets, stealing more than 4.5 million PYR. The project later returned most or all of the stolen tokens to affected wallets.
BXHDeFi ProtocolBSC$139M
An attacker obtained BXH’s administrative private key and used it to authorize a transaction transferring tokens from the protocol’s Binance Smart Chain assets to the attacker’s account. The reported amount was $139 million.
Cream FinanceDeFi ProtocolEthereum$130M
Attackers used flash loans to manipulate the price of yUSD and exploit accounting across Cream Finance’s connected lending and trading protocols. They created unbacked tokens and took about $130 million in assets.
BadgerDAODeFi ProtocolEthereum$120M
An attacker used a compromised Cloudflare API key to add malicious code to BadgerDAO’s website, tricking users into approving token transfers. Assets were taken from about 200 accounts, including bitcoin and ether.
VenusDeFi ProtocolBSC$100M
An attacker drove up XVS’s price on exchanges, then used the inflated token as collateral to borrow large amounts of Bitcoin and Ether from Venus. The price later fell, leaving the protocol with about $77 million in losses.
LiquidCEXEthereum$91.4M
Attackers compromised Liquid Global’s warm wallets, using information from a previous breach to break into its MPC wallet system. They stole various cryptocurrencies, and the exchange suspended deposits and withdrawals while investigating.
Mirror ProtocolDeFi ProtocolTerra$90M
Attackers exploited a flaw in Mirror Protocol’s collateral-unlock logic, using duplicate IDs to unlock more collateral than they were entitled to. They drained about $89.7 million before the exploit was detected.
AscendEXCEXEthereumBSCPolygon$77M
Attackers used compromised private keys to make unauthorized transfers from AscendEX hot wallets across Ethereum, BSC, and Polygon, stealing about $77.7 million in tokens. The exchange’s cold wallets were not affected.
FireblocksDeFi ProtocolEthereum$72M
A failed key-backup process left StakeHound unable to access 38,178 ETH: Fireblocks lost two key shards, and StakeHound’s backup and recovery arrangements did not restore access. The ETH became permanently inaccessible.
Compound$68.8M
Compound’s liquidity-mining token distribution contract had a known flaw, and a call to its drip() function triggered another distribution of COMP tokens while the team was trying to fix the issue.
AnubisDAODeFi ProtocolEthereum$60M
After raising 13,556 ETH from investors, AnubisDAO redirected the funds to attacker-controlled wallets within 20 hours. The ETH was later laundered through Tornado Cash.
Our coverage: Rug Pull Or Phishing Attack? AnubisDAO Investors Lose 58 Million USD
EasyFiDeFi ProtocolPolygon$59M
Malware on the EasyFi CEO’s computer exposed administrator keys, which were used to transfer EASY tokens and drain stablecoins from the protocol’s liquidity pools. The stolen assets included 2.98 million EASY tokens and about $6 million in stablecoins.
Uranium FinanceDeFi ProtocolBSC$57.2M
A calculation error in Uranium Finance’s swap function let attackers extract nearly all the reserves from affected pools by sending minimal value. The project shut down, and victims received no compensation.
bZxDeFi ProtocolPolygonBSC$55M
A bZx developer opened a phishing document containing malware, which exposed the private keys for the project’s Polygon and BSC deployments. The attacker used the keys to take about $55 million; the Ethereum deployment was unaffected.
PancakeBunnyDeFi ProtocolBSC$45M
An attacker used a flash loan to manipulate exchange prices and mint BUNNY tokens, then sold them and took 114,631 WBNB. The resulting sell-off caused BUNNY’s price to crash.
Sentinel$40M
About $40 million in DVPN tokens was stolen after a mnemonic phrase associated with HitBTC was reportedly exposed. Sentinel and HitBTC disputed whether the leak resulted from an exchange issue or a vulnerability in Sentinel’s software.
CNA$40M
Ransomware attackers took control of CNA’s network, and the insurance company paid a $40 million ransom to regain access.
Alpha Finance/Cream FinanceDeFi ProtocolEthereum$37.5M
An attacker used recursive flash loans to exploit a rounding error in lending calculations, borrowing against inflated sUSD debt across Alpha Finance and Cream Finance. The combined reported losses were about $37.5 million.
Vee.FinanceDeFi ProtocolAvalanche$34M
An attacker manipulated prices on the Pangolin exchange, which Vee Finance relied on as its only price source, then used the distorted prices to steal BTC and ETH. The platform suspended its contracts and deposits and withdrawals; its stablecoin funds were reported unaffected.
MonoXDeFi ProtocolEthereumPolygon$31.4M
An attacker exploited MonoX’s swap function to manipulate the price of its MONO token, then drained about $31 million in assets, including WETH and MATIC, across Ethereum and Polygon.
Meerkat Finance - BSCDeFi ProtocolBSC$31M
An attacker exploited a flaw in Meerkat Finance’s proxy setup to gain administrator control and drain its vaults, which held $31 million. The team later launched a refund program.
Spartan ProtocolDeFi ProtocolBSC$30.5M
A flaw in Spartan Protocol’s liquidity-share accounting let an attacker use a flash loan—a loan taken and repaid within one transaction—to inflate a pool’s balance, then withdraw more than their fair share. The attack drained about $30 million from the SPARTA/WBNB pool.
GrimFinanceDeFi ProtocolFantom$30M
A missing reentrancy guard in Grim Finance’s vault let attackers make nested calls during deposits and repeatedly count false collateral. The attack drained more than $30 million from the protocol.
Curve Finance$30M
Mochi’s USDM project used governance voting to increase rewards and liquidity in its Curve pool, then exchanged 46 million USDM for DAI. This left users providing USDM liquidity on Curve facing potential losses estimated at $30–40 million.
StableMagnetDeFi ProtocolBSC$27M
StableMagnet’s contracts contained a hidden backdoor that let the team drain liquidity pools and take tokens from wallets that had approved the contracts.
Paid NetworkDeFi ProtocolEthereum$27M
An attacker accessed PAID Network’s deployment wallet and upgraded its token contract to allow unlimited minting. They created 59.4 million unauthorized PAID tokens and sold them into the PAID/ETH pool on Uniswap.
xTokenDeFi ProtocolEthereum$24M
An attacker used a flash loan—borrowed funds that are repaid within one transaction—to manipulate a price feed and mint tokens at distorted prices; a flaw also let them mint xBNTa using tokens other than BNT. The affected pools were drained, causing nearly $25 million in losses.
BilaxyCEXEthereum$21.7M
Bilaxy’s hot wallet was compromised, and an attacker stole about $21.7 million in tokens, including USDT, USDC and UNI. The attacker later sent 200 ETH to Tornado Cash, a service that mixes cryptocurrency transactions.
Popsicle FinanceDeFi ProtocolEthereum$20.7M
A flaw in Popsicle Finance’s Uniswap V3 optimizer pool let the same fee rewards be claimed repeatedly after users transferred their pool shares. The exploit drained about $20.7 million.
Cream FinanceDeFi ProtocolEthereum$18.8M
A reentrancy flaw in the AMP token callback handler let an attacker repeatedly borrow against collateral and withdraw more than they had deposited. AMP tokens and ETH were stolen; some ETH was later recovered.
Our coverage: Cream Finance Hacked For 27 Million USDSourceRekt report
SnowdogDeFi ProtocolAvalanche$18.1M
SnowdogDAO moved its liquidity into a private pool that required a secret key to use, leaving most holders unable to sell. Three addresses took large amounts of liquidity, while $18.1 million was blocked from holders.
bEarn FiDeFi ProtocolBSC$18M
Attackers exploited a contract that handled BUSD and ibBUSD deposit amounts inconsistently, using flash-loan cycles to inflate withdrawals. Nearly 10.86 million BUSD was drained from the affected pool.
Indexed FinanceDeFi ProtocolEthereum$16M
An attacker used flash loans to distort the balances of Indexed Finance’s DEFI5 and CC10 pools, buy their component tokens at discounted prices, and drain the pools in one transaction. The loss was about $16 million.
Farmers World$15.7M
Farmers World players reported being unable to obtain RAM after pledging WAXP. Project discussions said a game plug-in may have changed the pledge address to one not controlled by the game; no smart-contract or wallet flaw was identified.
FurucomboDeFi ProtocolEthereum$14M
An attacker used a fake Aave v2 contract and a flaw in Furucombo’s contract checks to take tokens that users had pre-approved for transfer, including stETH and USDC. About 22 users were affected, and Furucombo later said it would issue compensation tokens.
pNetworkDeFi ProtocolBridgeBSCBitcoin$13M
An attacker forged withdrawal event records for pNetwork’s cross-chain bridge, and its software processed them without checking that they came from authorized contracts. The attacker took 277 BTC, worth about $13 million, in wrapped form on BSC.
flash.sxDeFi ProtocolEOS$13M
A reentrancy flaw in flash.sx’s flash-loan contract let an attacker repeatedly withdraw about 1.2 million EOS and 462,000 USDT. EOS block producers later changed the attacker’s account permissions, and all users were made whole.
