Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
417 incidents Clear filters
DMM BitcoinCEXBitcoin$305M returned$305M
Attackers compromised a DMM Bitcoin employee and intercepted legitimate transactions to drain the exchange’s hot wallet, taking about 48.2 billion yen worth of bitcoin.
PlayDappDeFi ProtocolEthereum$290M
After PlayDapp’s deployer key was compromised, an attacker added themselves as a PLA token minter and minted large quantities of tokens in two transactions. PlayDapp later paused the token contract.
WazirXCEXEthereum$235M
Attackers compromised a WazirX multisignature wallet held with Liminal, causing a loss of more than $230 million in tokens. A multisignature wallet requires approval from multiple signers to move funds.
Chris Larsen$113M
Unauthorized access to Chris Larsen’s personal XRP accounts led to the theft of 213 million XRP. Some affected addresses were frozen after exchanges were notified.
MunchablesGamingBlast$62.5M
A developer used control of Munchables’ upgradeable proxy—a contract that can be updated—to assign themselves funds and drain about $62.5 million. The developer later returned the funds, which were secured in a multisig wallet.
BitForex$56.5M
BitForex experienced suspicious fund outflows across multiple blockchains, after which the exchange restricted access and stopped processing withdrawals. The reports describe a suspected exit scam, but do not confirm who took the funds or what happened to them.
BtcTurkCEX$54M
Attackers compromised private keys to BtcTurk’s hot wallets and stole cryptocurrency, mainly targeting Avalanche holdings. Binance froze $5.3 million in recovered funds, and the exchange halted deposits and withdrawals while investigating.
Radiant CapitalDeFi ProtocolBSCArbitrum$50M
Attackers used malware to compromise devices belonging to three Radiant contributors, then deceived multisig signers into approving malicious transactions that gave the attackers control of lending markets on BNB Chain and Arbitrum, which they drained.
HedgeyDeFi ProtocolArbitrumEthereum$44.7M
Attackers exploited missing checks in Hedgey’s `createLockedCampaign` function, using flash loans to bypass access controls and create fraudulent approvals. Vault funds were stolen from the Ethereum and Arbitrum networks.
BingXCEXEthereum$43.3M
Attackers breached BingX’s hot wallets and drained about $43 million in cryptocurrency. BingX said it would reimburse affected users from its reserves.
Our coverage: BingX Promises User Compensation After $43 Million HackSourceRekt report
ZKasino$33M
ZKasino was reported to have carried out a rug pull, taking about $33 million.
PenpieDeFi ProtocolEthereum$27M
Penpie was drained after an attacker used fake yield-token markets and flash-loan-funded liquidity to exploit the protocol’s reward-claiming process. The attack resulted in losses reported as nearly $30 million.
FixedFloatDeFi ProtocolEthereumBitcoin$26.1M
Attackers compromised the private keys for FixedFloat’s hot wallets—the online wallets used to handle transactions—and stole Bitcoin and Ether. The Ethereum funds were routed through eXch, while the Bitcoin was spread across addresses.
ThalaDeFi ProtocolAptos$25.5M
A missing balance check in Thala’s v1 farming contracts let an attacker withdraw $25.5 million in liquidity-pool tokens without owning them. Thala recovered $25 million within hours through negotiations.
IndodaxCEXEthereumPolygonOptimism$25.2M
Attackers stole tokens from Indodax’s hot wallets. Investigators said the private keys did not appear to be compromised, and the breach may instead have involved the exchange’s withdrawal system.
Our coverage: Indodax Loses $22 Million In Major Crypto HackSourceRekt report
LykkeCEXEthereumBitcoin$22.4M
Lykke’s hot wallet was compromised, and about 158 BTC and 2,161 ETH, along with other assets, were stolen. The exchange halted trading and later declared bankruptcy; the cause of the compromise was not established in the reports.
Gala GamesDeFi ProtocolEthereum$22.3M
Attackers used a compromised Gala Games minting key to create 5 billion GALA tokens and sold 592 million for about $21.8 million in ETH. About 5,913 ETH was later returned to the project.
DEXXWalletSolana$21M
Attackers gained access to private keys and drained funds from users’ DEXX wallets on Solana. At least 900 users were affected, with estimates of total losses ranging from $21 million to $30 million.
U.S. Government-Controlled WalletOtherEthereum$20M
An attacker compromised the private key to a U.S. government-controlled wallet and took about $20 million in cryptocurrency. About $19.3 million was later returned; roughly $700,000 went to instant exchanges.
UwU LendDeFi ProtocolEthereum$20M
An attacker used large trades in Curve pools to distort UwU Lend’s price data, then exploited the false prices to take assets from the lending pools.
Sonne FinanceDeFi ProtocolOptimism$20M
An attacker used a donation attack, manipulating a newly created lending market before its safeguards took effect, and stole more than $20 million from Sonne Finance on Optimism.
Curio EcosystemDeFi ProtocolEthereum$16M
An attacker exploited a voting-power flaw in Curio’s Ethereum contracts to gain enough authority to call a malicious contract and mint about 1 billion CGT. The tokens were valued at approximately $16 million.
RainCEXBitcoinEthereumXRP+1 chains$14.8M
Attackers compromised Rain’s exchange wallet keys on Bitcoin, Ethereum, Solana and XRP, then moved the stolen assets through instant exchanges and converted them into Bitcoin and Ether.
M2CEXEthereumSolanaBitcoin$13.7M
Attackers compromised M2 Exchange hot wallets across several blockchains and took cryptocurrency worth about $13.7 million. The exchange froze assets within 16 minutes and restored customer funds from reserves.
RoninDeFi ProtocolBridgeEthereum$12M
An incomplete Ronin Bridge contract upgrade left voting weights unset, allowing withdrawals without the required multisignature checks. About 4,000 ETH and 2 million USDC were taken, then returned by white-hat hackers, who received a bounty.
Our coverage: Ronin Hackers Return $10M ETH To Earn A $500K RewardSourceRekt report
LI.FI$11.6M
Attackers exploited a vulnerability in LI.FI’s cross-chain protocol, causing suspicious transactions and more than $10 million in reported user losses.
Prisma FinanceDeFi ProtocolEthereum$11.6M
An attacker used a flash loan to exploit Prisma Finance’s migration process, which did not check where callback requests came from. This let them take over loan positions and withdraw their collateral.
SomesingDeFi ProtocolEthereum$11.6M
A vulnerability in Somesing led to the theft of 730 million SSX tokens, including tokens held by the foundation and tokens that had not yet been distributed.
Jihoz$10M
Axie Infinity co-founder Jihoz said two of his personal crypto addresses were compromised. The incident did not affect Ronin’s operations or Sky Mavis’s keys.
LiFi/JumperDeFi ProtocolBridgezkSync EraLineaMetis$9.73M
A flaw in LI.FI’s GasZip code let attackers use malicious transaction instructions to take tokens from 153 wallets whose owners had granted the protocol unlimited spending permission. The losses were reported at about $8–11 million across multiple chains.
WOOFiDeFi ProtocolArbitrum$8.75M
An attacker used flash loans to manipulate WOO’s price on WOOFi’s Arbitrum exchange and profit from trades, repeating the exploit three times.
Polter FinanceDeFi ProtocolFantom$8.7M
A flash loan—borrowed funds that are repaid within one transaction—was used to distort the BOO price reported by Polter Finance’s oracle, letting the attacker take out oversized loans. The reports gave differing loss estimates.
BittensorDeFi Protocol$8M
A malicious version of Bittensor’s Python package, distributed through PyPI, stole users’ wallet keys during staking, delegation, or transfer actions. Attackers took about 32,000 TAO, worth roughly $8 million.
Rho MarketsDeFi ProtocolScroll$7.6M
A misconfigured oracle— a tool that supplies price data—let an MEV bot operator exploit Rho Markets’ lending protocol and take USDT and USDC from users across multiple chains. The operator later returned the funds.
CoinspaidCEXEthereumBinance Smart Chain$7.5M
An attacker with access to CoinsPaid wallets stole assets on Ethereum and BNB Chain, including USDT, USDC, CPD, and BNB. The stolen assets were swapped for ETH and distributed to other wallets and exchanges.
GMEE$7M
Unauthorized access to GMEE’s GitLab was used to steal 600 million GMEE tokens from its Polygon token contract. The attacker exchanged them for ETH and MATIC.
GameeDeFi ProtocolPolygon$7M
An attacker obtained Gamee’s deployer key through an unsecured GitLab environment, then used it to bypass protections in the `recoverERC721s()` function and steal GMEE tokens from Polygon.
VelocoreDeFi ProtocolLineazkSync Era$6.8M
Velocore’s pools on Linea and zkSync Era were exploited after faulty fee calculations allowed rates above 100%. The attacker used a flash loan to shrink a pool and create excess liquidity-provider tokens, stealing about $6.8 million.
Casper Network$6.7M
Attackers exploited a flaw in Casper Network’s contract installer to bypass access checks and gain permission to transfer tokens. Thirteen wallets were affected, with illicit transactions estimated at about $6.7 million, and validators paused the network while a patch was prepared.
Solrise FinanceDeFi ProtocolCasper$6.7M
A privilege-escalation flaw on Casper let attackers bypass contract access checks and gain control of 13 accounts, transferring about $6.7 million in tokens. Validators halted consensus to stop further attacks.
