Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
402 incidents Clear filters
Mixin NetworkOtherMixin$200M
Attackers breached a cloud provider’s database containing Mixin Network hot-wallet credentials and drained wallets holding ETH, BTC, and USDT, with about $200 million involved.
Our coverage: Mixin Network Suspends Withdrawals Following $200 Million Loss In HackSourceRekt report
Euler FinanceDeFi ProtocolEthereum$240M returned$197M
An attacker used flash loans and a flaw in Euler’s reserve-donation and liquidation logic to drain DAI, USDC, stETH, and WBTC. The attacker later returned all the stolen funds.
PoloniexCEXTronEthereumBitcoin$126M
Attackers compromised Poloniex hot-wallet private keys, draining funds across Ethereum, Tron, and Bitcoin. The cause was reported as possibly malware or social engineering, and Justin Sun committed to full reimbursement.
MultichainDeFi ProtocolBridgeMoonriverBSCFantom$126M
About $126 million in assets were withdrawn from Multichain bridge reserves on Fantom, Moonriver and Dogechain. The team said it did not know what had happened and urged users to stop using the service.
AtomicWalletEthereumTronBSC+3 chains$100M
Atomic Wallet users lost funds after the wallet application was compromised. Reports described about 5,500 affected wallets, but the cause had not been officially confirmed.
HTX & HecoDeFi ProtocolBridgeEthereum$86.6M
The HECO Chain bridge to Ethereum and HTX were hacked after an operator account was compromised, allowing unauthorized withdrawals. Reports differed on the combined losses, and the funds’ destination is not specified.
Orbit ChainDeFi ProtocolBridgeEthereum$81.7M
Attackers compromised seven of Orbit Bridge’s ten multisig signers’ private keys, allowing them to forge withdrawal approvals and drain the Ethereum vault. Orbit Chain asked exchanges to freeze the stolen assets.
Curve FinanceDeFi ProtocolEthereum$61.7M
A bug in Vyper’s reentrancy locks, which are meant to block repeated contract calls, let attackers drain several Curve pools. Some of the stolen funds were later returned.
AlphapoCEXEthereumTron$60M
Alphapo’s hot-wallet keys were compromised, and attackers drained funds across Ethereum, Tron and Bitcoin. The stolen cryptocurrency was moved between networks, and the total reported loss reached about $60 million.
CoinExCEXEthereumBSCBitcoin+9 chains$55M
Attackers accessed CoinEx’s hot-wallet private keys and drained funds across multiple blockchains. Loss estimates ranged from $31 million to $70 million; CoinEx suspended deposits and withdrawals while it investigated.
Our coverage: CoinEx Exchange Suspected Of Being HackedSourceRekt report
Kyber NetworkDeFi ProtocolEthereumBasePolygon+2 chains$48M
A double-rounding flaw in KyberSwap Elastic’s swap calculations let trades pass a price boundary without updating liquidity, enabling attackers to drain funds across multiple networks. About $5.17 million was later returned by operators of frontrunning bots.
Stake.comOtherEthereumBSCPolygon$41.3M
Stake.com’s hot wallets were drained of about $41 million in cryptocurrency across Ethereum, BSC, and Polygon. The company said the breach targeted services used to authorize blockchain transactions.
CoinsPaidOther$37.3M
Attackers posing as recruiters tricked a CoinsPaid employee into installing malware, gaining access to company systems and wallets and stealing $37.3 million in cryptocurrency. CoinsPaid said customer funds were safe.
Alchemix$35.3M
A Vyper bug let an attacker drain about 5,000 ETH from Curve’s alETH/ETH pool while Alchemix was withdrawing its liquidity. Alchemix said its own contracts were not compromised.
Kronos ResearchOtherEthereum$26M
Attackers used compromised Kronos Research API keys—credentials that let software access services—to make unauthorized transactions and drain trading wallets.
MEV Bots$25M
A flaw in a block relay let an attacker view transaction contents before a block was finalized, then construct an invalid block to target MEV bots—automated traders that seek profit from transaction ordering. The bots lost about $25 million.
BALD on BaseDeFi ProtocolBase$23M
The anonymous BALD token deployer removed the liquidity they had supplied on Base, causing the token’s price to crash by about 90%.
BitrueCEX$23M
Attackers compromised a Bitrue hot wallet and withdrew about $23 million in ETH, QNT, GALA, SHIB, HOT and MATIC. The exchange said it stopped further withdrawals from the wallet and would compensate affected users.
FPG$20M
Floating Point Group suffered a cyberattack that resulted in a reported loss of $15 million to $20 million in cryptocurrency. The company froze third-party accounts and took protective measures for its wallets.
MEV-Boost RelayOtherEthereum$20M
A flaw in MEV-Boost Relay let a malicious validator submit an invalid block header and view block contents, then replace MEV bot transactions with its own. The attacker took about $20 million across 24 transactions.
Angle Protocol$17.6M
Angle Protocol was affected because it had deposited 17.6 million USDC into Euler. It suspended the protocol, set its debt ceiling to zero, and closed its Euler AMO; the report does not state how much of the deposit was lost.
PEPETokenEthereum$15.1M
PEPE’s multisig signature requirement was reduced from five of eight to two of eight, and 16 trillion PEPE tokens were transferred to exchanges and sold. The sources disagree about who was responsible and the circumstances.
Our coverage: Pepecoin Controversy Allegations Of Insider Trading Emerge After Token Theft IncidentSource
Floating Point GroupCEX$15M
Attackers gained unauthorized access to Floating Point Group’s systems and took cryptocurrency from custody accounts. The company froze third-party accounts and moved funds to secure wallets.
GDACCEX$13.9M
Attackers accessed GDAC’s hot wallet and transferred about $13 million in BTC, ETH, WEMIX and USDT to an unidentified wallet. The stolen ETH was later laundered through Tornado Cash.
HTXCEXEthereum$13.6M
An attacker accessed private keys for three HTX hot wallets stored on exchange servers and transferred assets out after converting them to Ether. The breach also had additional losses tied to the HECO Chain bridge.
FortressCEXEthereumBitcoin$12M
A phishing attack on third-party vendor Retool exposed Fortress operator credentials, enabling unauthorized transfers from customer accounts. Fortress later reported losses of $12–15 million, said four customers were affected, and said it made up the loss.
Balancer$11.9M
During the Euler Finance attack, about $11.9 million from Balancer’s bbeUSD liquidity pool was sent to Euler, representing roughly 65% of that pool’s value. Four other pools containing bbeUSD were also affected.
Yearn FinanceDeFi ProtocolEthereum$11.5M
A misconfigured oracle reference in Yearn’s yUSDT vault pointed to a USDC contract, letting an attacker distort share prices and mint far more yUSDT than their deposit warranted. They sold the tokens for about $11.5 million.
JPEG'd$11.4M
A reentrancy flaw in JPEG’d’s PETH-ETH liquidity pool let the attacker add liquidity during a withdrawal and exploit incorrect price calculations; the NFT vault and treasury were reported safe. The DAO later received 5,494.4 WETH, with 610.6 WETH paid as a white-hat bounty.
Idle Finance$11M
Euler Finance’s attack exposed Idle Finance’s Yield Tranches and Best Yield vaults to losses; the reported exposure across both was about $11 million.
MyAlgoWalletAlgorand$9.2M
MyAlgo users with large balances lost funds from accounts whose keys were stored in browser-based mnemonic wallets. The cause was unclear, with a website compromise or phishing cited as possibilities; ChangeNow froze some funds.
dYdXDeFi ProtocolEthereum$9M
A coordinated attack manipulated prices in dYdX V3’s less-liquid SUSHI and YFI markets, triggering liquidations that drained $9 million from its insurance fund. The attacker built leveraged positions and drove up spot-market prices.
SafemoonDeFi ProtocolBSC$8.9M
A publicly accessible token-burning function let the attacker destroy SFM tokens, inflate their price and withdraw excess BNB from SafeMoon’s liquidity pool. The attacker later returned 80% of the funds and kept the remainder as a claimed bug bounty.
PlatypusDeFi ProtocolAvalanche$223K returned$8.5M
An attacker used a flash loan to exploit Platypus Finance’s solvency check, which compares assets with liabilities, and withdraw funds they were not entitled to. The reported loss was about $8.5 million, and at least $2.4 million was later recovered.
HTXCEXEthereum$8M
An attacker gained access to an HTX hot wallet by compromising its private key and took 5,000 ETH. The attacker later returned nearly all the funds, about 4,999 ETH.
HTX (Huobi)$7.9M
HTX (formerly Huobi) announced a hack resulting in a reported loss of $7.9 million. The report does not describe how the attack happened or what happened to the funds afterward.
Exactly ProtocolDeFi ProtocolOptimism$7.6M
An unchecked market address in Exactly Protocol’s DebtManager let attackers bypass permission checks and reenter a function to steal users’ deposited collateral. Two attackers took more than 7,160 ETH; the protocol said users of the DebtManager were affected.
Our coverage: DeFi Lender Exactly Protocol Suffers $12 Million ExploitationSourceRekt report
Jimbos ProtocolDeFi ProtocolArbitrum$7.5M
An attacker used a flash loan to distort JIMBO’s price and exploit liquidity operations that lacked protection against unfavorable trades. The attack took about 4,090 ETH from the protocol.
Hundred FinanceDeFi ProtocolOptimism$7.4M
The attacker used a flash loan to donate WBTC to an empty Hundred Finance pool, distorting its exchange rate through rounding errors. This let a tiny amount of hWBTC drain funds from the lending pools.
Magnate FinanceDeFi ProtocolBase$6.5M
Magnate Finance’s team manipulated the price oracle and drained assets from Base depositors, then deleted the project’s website and Telegram channel.
