Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
307 incidents Clear filters
Ronin NetworkDeFi ProtocolBridgeEthereum$624M
Attackers obtained enough Ronin validator keys to approve fake bridge withdrawals, taking 173,600 ETH and 25.5 million USDC. The breach was discovered six days later.
Our coverage: Largest-Ever DeFi Hack: $624M Stolen From Ronin NetworkSourceRekt report
BNB BridgeDeFi ProtocolBridgeBSC$570M
An incomplete check of Merkle proofs in BNB Chain’s Token Hub bridge let an attacker forge proofs and mint 2 million BNB. The chain was paused; about $137 million was moved out before the attack was contained, while $433 million remained frozen.
Vires Finance$530M
Vires Finance suffered reported losses exceeding $530 million, but the description does not establish how the funds left. Its founder denied allegations that his wallet was linked to the outflow.
Our coverage: “Infamous” Vires Finance Governance Vote FailedSource
FTXCEXEthereumSolana$450M
FTX’s crypto wallets were compromised during the company’s bankruptcy, and more than $600 million in assets was reported stolen. Reports differed on the amount and how the wallets were accessed.
WormholeDeFi ProtocolBridgeSolana$326M returned$326M
Attackers exploited outdated signature verification on Wormhole to mint 120,000 wrapped ETH on Solana without locking equivalent ETH on Ethereum, then exchanged it for real ETH.
NomadDeFi ProtocolBridgeEthereum$190M
A setup error made Nomad’s bridge accept messages without verifying them, allowing attackers to forge instructions and drain about $190 million. More than $36 million was later returned.
BeanstalkDeFi ProtocolEthereum$181M
An attacker borrowed funds to gain enough temporary voting power to pass malicious Beanstalk proposals, then drained protocol assets. They also sent funds to a Ukraine charity; reports differ on the total stolen and how much the attacker kept.
Our coverage: Can Beanstalk Recover From The Most Recent DeFi Hack?SourceRekt report
WintermuteOtherEthereum$160M
Attackers derived Wintermute’s DeFi wallet key by exploiting a weak seed used by the Profanity vanity-address generator, which creates custom wallet addresses. The compromised wallet held funds for DeFi operations; other operations were not affected.
MangoDeFi ProtocolSolana$115M
The attacker used large MNGO purchases to inflate the token’s price reported by price feeds, making their collateral appear far more valuable. They then borrowed and withdrew about $100 million in assets from Mango’s lending pools.
ElrondDeFi ProtocolElrond$113M
A newly added blockchain function let an attacker create and take nearly 1.65 million EGLD, converting some into unbacked WEGLD. The team recovered and burned the illegal tokens, and said nearly all stolen funds were recovered.
HarmonyDeFi ProtocolBridgeEthereumBSC$100M
Attackers obtained and decrypted Harmony Horizon Bridge validator keys, then used unauthorized signatures to steal tokens across Ethereum and BSC. The bridge’s two-of-five signature requirement allowed the theft.
Fei Protocol & Rari CapitalDeFi ProtocolEthereumArbitrum$80M
An attacker exploited a reentrancy flaw—a bug that lets a contract call itself before finishing an earlier transaction—in Rari Capital’s Fuse lending pools. Using a flash loan, they borrowed and withdrew funds before the records updated, taking about 28,380 ETH and other assets.
QubitDeFi ProtocolBridgeBSC$80M
Qubit’s QBridge was exploited because its deposit function accepted a zero-address token without verifying the transfer. The attacker minted fake qXETH collateral and borrowed assets from the lending pools, draining about $80 million.
CashioDeFi ProtocolSolana$52.8M
Missing account checks let an attacker use fake collateral to mint about 2 billion CASH tokens, which were exchanged for stablecoins. The exploit caused losses of more than $50 million and sent CASH’s price sharply down.
AcalaDeFi ProtocolAcala$52M
A misconfigured incentive mechanism in Acala’s iBTC/aUSD pool allowed aUSD to be minted instead of LP tokens, creating more than 1.2 billion aUSD. The network was paused, and the funds were recovered.
LastPass Users$37M
A wallet-draining campaign linked in the report to the prior LastPass hacks has stolen more than $37 million since December 2022. The report does not explain how the wallets were accessed.
GeminiCEXEthereum$36M
Attackers obtained IRA Financial’s master API key from unencrypted emails with Gemini and used it to move funds from customer subaccounts. They withdrew about $36 million in Bitcoin and Ether before Gemini froze the accounts.
Scream$35M
Scream continued valuing FUSD and DEI at $1 after their market prices fell, allowing users to deposit them cheaply and withdraw other stablecoins from the lending platform. This left about $35 million in bad debt and blocked withdrawals for users with deposits in the drained stablecoins.
Crypto.comCEXEthereumBitcoin$33.7M
Attackers made unauthorized withdrawals from 483 Crypto.com accounts, taking ETH, BTC and other currencies. Crypto.com said it blocked most withdrawals and reimbursed users for the rest.
Transit SwapDeFi ProtocolEthereumBSC$28.9M
A missing check in Transit Swap’s claimTokens function let an attacker pull tokens from wallets that had approved the contract. About $29 million was taken, and some funds were later returned.
DeribitCEX$28M
Attackers compromised Deribit’s Bitcoin, Ethereum and USDC hot wallets and stole about $28 million. The exchange covered the loss with company reserves; customer funds in cold storage and Fireblocks vaults were unaffected.
Elephant MoneyDeFi ProtocolBSC$22.2M
An attacker used flash loans and a manipulable price feed to raise ELEPHANT’s price, then exploited weak safeguards in Elephant Money’s TRUNK redemption process. The attack resulted in a loss of about $22.2 million.
Pando RingsDeFi ProtocolMixin$22M
An attacker manipulated the oracle—a service reporting asset prices—to inflate the value of Pando Rings’ sBTC-WBTC liquidity-pool tokens, then borrowed against them and stole about $20–22 million.
3CommasCEXMulti-Chain$20M
Attackers breached and leaked 3Commas’ API-key database, then used stolen keys to access users’ connected exchange accounts and make unauthorized trades that drained cryptocurrency.
UXD Protocol$20M
UXD Protocol’s funds were exposed to losses from the Mango Markets exploit. UXD said its insurance fund could cover the exposure, paused minting, and said users could redeem UXD once Mango recovered.
Helio$19M
After Ankr’s aBNBc token vulnerability, traders used the flaw to obtain BUSD and drain Helio’s Hay liquidity pool. Helio said users’ staked BNB was safe.
LympoNFTfiEthereum$18.7M
Attackers compromised Lympo’s hot wallets and stole 165.2 million LMT tokens, then swapped them for ETH. The token price fell sharply; cold-wallet reserves remained secure.
WintermuteDeFi ProtocolOptimism$17.6M
Wintermute’s Optimism token deposit was sent to an address whose multisignature wallet contract had not yet been deployed on Optimism. An attacker deployed the contract first and took control of the address, stealing 20 million OP tokens.
Team FinanceDeFi ProtocolEthereum$15.8M
Team Finance’s migration function failed to check that token and trading-pair details matched a user’s locked liquidity. An attacker exploited this to redirect liquidity from four projects into a pool they controlled; some of the stolen funds were later returned.
Inverse FinanceDeFi ProtocolEthereum$15.6M
An attacker manipulated INV’s price feed by adding ETH to a SushiSwap trading pool, making INV appear more valuable. They used the inflated token as collateral to borrow DOLA, ETH, WBTC and YFI from Inverse Finance.
Drift TradeDeFi ProtocolSolana$14.5M returned$14.5M
Bugs in Drift Protocol’s withdrawal, leverage and insurance-fund rules were exposed during the LUNA collapse. Users withdrew more than the protocol could cover, leaving a shortfall.
Deus FinanceDeFi ProtocolFantom$13.4M
An attacker used a flash loan to manipulate the DEI price reported by an oracle reading a Solidly trading pool, then used the inflated price to borrow and drain funds from Deus Finance.
Defrost FinanceDeFi ProtocolAvalanche$6M returned$12M
Defrost Finance suffered two attacks: a flash-loan price manipulation drained funds from V2, while a compromised V1 admin key enabled fake collateral and oracle prices to drain funds. The stolen funds were later returned.
Venus ProtocolDeFi ProtocolBinance Smart Chain$11.2M
When Chainlink stopped updating LUNA prices during extreme volatility, Venus’s lending market kept valuing LUNA far above its market price. Attackers used LUNA as collateral to borrow other assets, leaving the protocol with about $11.2 million in losses.
Saddle FinanceDeFi ProtocolEthereum$11M
A flaw in Saddle Finance’s stablecoin pool pricing let an attacker use flash loans—temporary loans repaid in one transaction—to manipulate swaps and drain funds.
Dego FinanceDeFi ProtocolEthereumBSCCronos$10M
Attackers compromised Dego Finance’s deployer private key and used it to drain DEGO liquidity pools on Uniswap and PancakeSwap across Ethereum, BSC and Cronos.
Arbix FinanceDeFi ProtocolBSC$10M
Arbix Finance’s administrators used their token-minting privileges to drain about $10 million in user funds, then moved the money through AnySwap. The team’s website and social accounts disappeared.
BitKeep$9M
BitKeep users reported stolen funds after allegedly hijacked APK wallet downloads were installed. The team said multiple chains were affected, with more than $3 million lost on BNB Chain alone.
Impermax FinanceDeFi ProtocolEthereumPolygon$9M
Stolen private keys gave an attacker access to Impermax team wallets, from which about 9 million IMX tokens and most protocol-owned liquidity were taken. The team sold tokens and carried out a swap recovery plan; the lending protocol itself was not vulnerable.
Crema FinanceDeFi ProtocolSolana$8.8M
An attacker bypassed Crema Finance’s checks by creating a fake account used for pool fee calculations, then used flash loans and manipulated price data to drain about $8.78 million. Most funds were later returned after negotiations, with the attacker keeping a bounty.
