Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
252 incidents Clear filters
BybitCEXEthereum$1.4B returned$1.4B
Attackers tricked Bybit signers into approving a masked transaction that changed the hot wallet’s security rules, using a spoofed Safe interface. This enabled the theft of over $1.4 billion in ETH and other assets.
CetusDeFi ProtocolSui$223M
A math error in Cetus’s liquidity calculations let attackers create positions showing large amounts of fake liquidity with minimal deposits, then withdraw real pool assets. Sui validators froze some of the funds, while others escaped.
Balancer V2DeFi ProtocolEthereumArbitrumBase+3 chains$128M
A rounding flaw in Balancer V2’s stable-pool swap calculations let attackers manipulate pool values and withdraw assets for far less than they were worth. The exploit affected pools across several chains; mitigation efforts protected or recovered some funds.
BitgetCEX$100M
Bitget’s market-making bot entered a predictable trading loop on the VOXEL/USDT futures pair. Traders used high leverage to extract about $100 million before Bitget froze accounts and rolled back trades.
PhemexCEXEthereumSolanaXRP+10 chains$85M
Attackers compromised Phemex’s hot-wallet private keys and signing systems, draining wallets across multiple blockchains. Reported losses ranged from about $69 million to $85 million.
NobitexCEXTronEthereumBSC+4 chains$82M
Compromised hot-wallet keys let attackers steal roughly $82–90 million from Nobitex across multiple blockchains. The attackers sent the stolen assets to inaccessible addresses, destroying rather than keeping them.
UPCXDeFi ProtocolEthereum$70M
Using a compromised private key, an attacker upgraded UPCX’s ProxyAdmin contract and used an admin withdrawal function to move 18.4 million UPC from three management accounts. UPCX later said it still controlled the tokens while it investigated.
InfiniDeFi ProtocolEthereum$49.5M
A former Infini developer who retained vault-draining privileges used admin access to drain the contract. The stolen USDC was converted into ETH.
BtcTurkCEXEthereumAvalancheArbitrum+4 chains$48M
BtcTurk’s hot wallets were hit across seven blockchains after private keys were compromised, with reports estimating losses in the tens of millions of dollars. The exchange acknowledged unusual wallet activity and suspended deposits and withdrawals.
CoinDCXCEX$44.2M
A server breach exposed the private key for CoinDCX’s operational hot wallet, and the attacker stole about $44 million in corporate funds, moving assets from Solana to Ethereum. Customer funds in cold storage were unaffected.
GMXDeFi ProtocolArbitrum$40M returned$42M
A reentrancy flaw in GMX V1 let an attacker manipulate short positions and inflate GLP’s price, then redeem GLP for profit. The attacker returned the funds and received a $5 million bounty.
SwissBorgCEXSolana$41.5M
Compromised API credentials belonging to SwissBorg’s staking partner Kiln let an attacker alter unstaking transactions and take withdrawal control. About 192,600 SOL, worth roughly $41.5 million, was stolen from SwissBorg’s SOL Earn program.
UpbitCEXSolana$36M
Upbit’s Solana hot wallets were drained after a weakness in its signing setup could allow private keys to be inferred from transaction history. The exchange suspended transfers, tracked the stolen assets, and reported that some funds had been frozen.
BigONECEXBitcoinBSCEthereum+2 chains$27M
Attackers breached BigONE’s production systems and changed backend withdrawal logic to approve fraudulent withdrawals across five blockchains. About $27 million was stolen; no private keys were reported leaked.
SBI CryptoOtherBitcoinEthereumLitecoin+2 chains$21M
SBI Crypto’s hot wallets were drained of several cryptocurrencies, which attackers moved through five instant exchanges and into Tornado Cash, a transaction-mixing service. SBI Group did not publicly confirm the incident.
BonkDAO$19.3M
An attacker used token-weighted governance voting to pass a proposal transferring BonkDAO treasury funds. The attack exploited the voting process, not a code flaw or leaked keys.
WOO XCEXBitcoinEthereumArbitrum+1 chains$14M
A phishing attempt tricked a WOO X team member into opening a malicious development tool, compromising their device and the development environment. Attackers then made unauthorized withdrawals from nine user accounts across several blockchains.
AbracadabraDeFi ProtocolArbitrum$13M
An attacker used a flash loan to exploit a flaw in liquidation rules for Abracadabra lending pools that accepted GMX V2 liquidity-pool tokens as collateral. The attacker triggered liquidations and collected the associated incentives, taking about 6,262 ETH.
Berachain$12.8M
Funds lost to a BEX/Balancer v2 vulnerability were returned to the Berachain Foundation’s deployer address, and the blockchain resumed normal operations.
Cork ProtocolDeFi ProtocolEthereum$12M
An unprotected swap hook and weak checks let the attacker create fake market structures and token derivatives in Cork Protocol. They used them to drain wstETH from the protocol.
BitoProCEXEthereumTronSolana+1 chains$11.5M
Social engineering led to malware being installed on a BitoPro cloud operations team member’s system, compromising the exchange’s hot wallets. Attackers withdrew assets across several blockchains and later laundered them through exchanges and other services.
Garden FinanceDeFi ProtocolBridgeEthereumArbitrumBase+1 chains$11.4M
Attackers compromised a Garden Finance solver, a service that handles cross-chain transactions, and used it to drain funds across Ethereum, Arbitrum, Base, and Solana. Losses were reported at about $10.8 million.
UXLINKDeFi ProtocolEthereumArbitrum$11.3M
Attackers gained control of UXLINK’s multisig, a wallet requiring multiple signers, and changed its owners without approval. They drained assets and minted UXLINK tokens, causing losses reported at more than $11 million.
DogWifToolsOtherSolana$10M
Attackers took control of DogWifTools’ GitHub repository token and inserted malware into several software versions. The malicious updates stole users’ wallet private keys and cryptocurrency.
ResupplyDeFi ProtocolEthereum$9.6M
The attacker donated tokens to manipulate the exchange rate in Resupply’s new vault, then used a tiny amount of collateral to borrow most of the vault’s funds. The exchange rate determines how many shares deposits or withdrawals represent.
zkLendDeFi ProtocolStarknet$9.55M
An attacker exploited rounding-down errors in zkLend’s withdrawal calculations, using precise wstETH deposits to inflate their account balance and drain tokens from other pools. About $3.2 million was returned after negotiations; the remaining funds were lost to a Tornado Cash scam.
Astra NovaAI AgentEthereum$9.09M
A third-party market maker account used for Astra Nova’s token launch was compromised, letting the attacker sell tokens representing 8.6% of the supply for more than $9 million. The token price fell sharply, and the team said the funds remained in USDT on a centralized exchange.
Yearn FinanceDeFi ProtocolEthereum$9M
An accounting flaw in Yearn’s yETH pool let an attacker mint an enormous amount of yETH and swap it for legitimate assets, draining about $9 million. Some funds were later recovered, including through the burning and replacement of pxETH.
ZothDeFi ProtocolEthereum$8.85M
After gaining access to Zoth’s admin privileges, an attacker upgraded its contract to a malicious version and withdrew USD0++ stablecoins, swapping them into other tokens and ending up with 4,223 ETH.
IonicDeFi ProtocolMode$8.6M
Attackers posed as Lombard Finance representatives and persuaded Ionic to accept counterfeit LBTC as collateral. They deposited 250 fake tokens to borrow real assets, some of which were bridged to Ethereum.
Trust WalletWalletEthereumBitcoinSolana$8.5M
A malicious Trust Wallet browser extension update stole users’ private keys, allowing attackers to access affected wallets. About $8.5 million was lost.
BunniDeFi ProtocolEthereumUnichain$8.4M
A rounding error in Bunni V2’s withdrawal logic let attackers withdraw more tokens than they were entitled to, draining about $8.4 million across Ethereum and Unichain.
ALEX ProtocolDeFi ProtocolStacks$8.37M
A malicious token exploited a flaw in ALEX Protocol’s asset verification, allowing the attacker to impersonate the vault and drain multiple pools. Losses were about $8.37 million.
ZapperDeFi ProtocolEthereumArbitrumOptimism+2 chains$7.9M
Attackers used social engineering to compromise Zapper’s .fi domain registrar and redirect visitors to a malicious site that sought credentials and enabled unauthorized transactions. Zapper told users to use zapper.xyz while it worked to recover the domain.
NoOnesDeFi ProtocolBridgeEthereumBinanceSolana+1 chains$7.9M
Attackers exploited a flaw in NoOnes’ Solana bridge relay, which processes cross-chain messages, to bypass validation and authorize unauthorized withdrawals across several blockchains. They made hundreds of small transactions.
YalaTokenSolanaEthereum$7.64M
An attacker used a temporary deployment key to create an unauthorized bridge, then used it to mint unauthorized YU tokens and extract funds. Thai authorities arrested a suspect, and most of the funds were recovered.
KiloExDeFi ProtocolBSCBaseTaiko$6.75M returned$7.5M
KiloEx’s contracts accepted manipulated ETH/USD oracle prices across several chains, letting the attacker profit from trades opened at artificially low prices and closed at real prices. The stolen assets were later recovered.
ODIN.FUNDeFi ProtocolICP$7M
Attackers inflated token prices in ODIN.FUN’s internal market by depositing worthless tokens and trading them, then withdrew 58.2 BTC. The protocol had no outside price check to catch the manipulation.
Pundi AI$6.57M
A vulnerability in Pundi AI’s token swap contract let an attacker front-run its deployment and mint 1 million unauthorized tokens. The team recovered about 87% of the affected funds and said it would cover the remaining loss of nearly $2 million.
WemixDeFi ProtocolWemix$6.22M
An attacker stole authentication credentials for Wemix’s Nile NFT platform monitoring system and used them to access the Play Bridge Vault, making 13 withdrawals of 8.65 million WEMIX tokens. The tokens were sold on external exchanges.
