Crypto Hacks
Recent crypto hacks and thefts
The latest crypto hacks, exploits and exchange thefts, newest first: who was hit, how much was taken, how it happened and what came back. Every known incident since 2011, searchable by name, chain or attack type.
Last updated · Checked daily
440 incidents Clear filters
BinanceCEXEthereumBitcoinTRON+4 chains$6.36B
Attackers gained access to Binance’s internal systems and signing privileges, then made unauthorized withdrawals across multiple blockchains. Some stolen assets were frozen or intercepted, and Binance said it would cover the losses.
Our coverage: Binance’s Fake Job Interview Used One Trust-building TrickSourceRekt report
BitgetCEXEthereumXRPTron+1 chains$387M
Attackers used access obtained through a third-party security product to issue fraudulent withdrawal commands from Bitget hot and warm wallets. About $387.5 million was transferred to attacker-controlled addresses; Bitget said private keys and cold wallets were not compromised and the incident was contained.
Liquid NetworkChainBridgeLiquid$320M
A vulnerability in Liquid’s underlying Elements software let an attacker create unbacked L-BTC and use SideSwap’s normal withdrawal service to make the federation release about 3,996 BTC. The attacker later returned 3,400 BTC and retained about 598.5 BTC; no keys were compromised.
Drift ProtocolDeFi ProtocolSolana$295M
Attackers tricked Drift Protocol security council members into pre-signing transactions that gave them administrative control. They listed a worthless fake token as collateral, deposited it, and withdrew about $285 million in real assets.
Kelp DAODeFi ProtocolBridgeEthereumArbitrum$293M
Attackers compromised RPC nodes used to verify Kelp DAO’s rsETH bridge messages and made the single-verifier setup accept forged messages. This enabled about $290 million in losses; LayerZero said its protocol and other applications were not affected.
Crédit Mutuel Arkéa$133M
An attacker accessed a third-party service provider’s platform and used Crédit Mutuel Arkéa’s accounts to transfer funds to other financial institutions; some may later have been converted to cryptocurrency. The bank said customer assets were unaffected, while the final loss remained under assessment.
TectonicDeFi ProtocolCronos$124M
The attacker repeatedly borrowed and redeposited TONIC, then sent TONIC directly to its receipt-token contract to inflate the collateral value; an unreliable price feed compounded the effect. Tectonic’s lending markets lost about $120 million, but a Cronos rollback recovered most of it; about $9.19 million remains unrecovered.
ColdcardWalletBitcoin$116M
A Coldcard firmware flaw bypassed the hardware random-number generator during seed creation, leaving some wallet keys weak enough to guess offline. Attackers used this to drain bitcoin from many addresses without accessing the devices.
Ledger (Supply Chain)Wallet$93M
Genuine Ledger hardware wallets were secretly modified to capture recovery phrases during setup and send them over cellular connections. Attackers used the phrases to access and drain customers’ crypto; Ledger said its core systems were not compromised.
NesaChainNesa$50M
Nesa confirmed an exploit involving a Cosmos EVM vulnerability, and reports said an attacker bridged 257.7 million NES to Ethereum. Nesa did not publish transaction-level details of the exploit; the reported mechanism resembles a balance-accounting bug affecting other Cosmos EVM chains.
Mercado BitcoinCEXBitcoinEthereumSolana+7 chains$40M
Attackers compromised a Mercado Bitcoin system and moved cryptocurrency from exchange-associated wallets across multiple blockchains. Tether froze some USDT linked to the theft; the exchange said customers would not bear losses and no customer data was exposed.
Step FinanceDeFi ProtocolSolana$40M
Attackers compromised an executive’s device and gained access to Step Finance treasury and fee-wallet signing credentials, stealing about $40 million. The team later recovered about $4.7 million in assets.
Our coverage: Step Finance Hack: $30M SOL Stolen, STEP Token Crashes 90%SourceRekt report
Humanity ProtocolDeFi ProtocolEthereumBSC$32M
A Humanity Foundation member’s private keys were compromised, allowing attackers to drain linked wallets and mint 447 million H tokens without authorization. The stolen funds were swapped for ETH, and reported losses exceeded $30 million.
TruebitDeFi ProtocolEthereum$26.4M
An integer overflow in Truebit’s token-purchase code let an attacker mint TRU at negligible cost and sell it through the bonding curve. The attack drained about $26 million in value and caused TRU’s price to collapse.
ResolvDeFi ProtocolEthereum$24.5M
A compromised private key used by Resolv’s service allowed the attacker to mint about 80 million USR stablecoins without adequate backing, then swap them for ETH. The attacker extracted roughly $25 million before the protocol paused its contracts.
AFX BridgeDeFi ProtocolBridgeArbitrum$24.2M
The attacker used five compromised validator keys to meet the AFX bridge’s signing threshold and drain about $24.15 million in USDC. They bridged the funds to Ethereum and swapped them for ETH; the Arbitrum native bridge was unaffected.
OstiumDeFi ProtocolArbitrum$23.8M
An attacker used a compromised Ostium oracle signer key to submit false Bitcoin prices and open trades at those prices, then close them at market rates. The attack drained USDC from the protocol’s liquidity vault.
BonkDAOTokenSolana$20M
An attacker bought enough BONK to pass a malicious governance proposal, using the DAO’s voting system to transfer 4.43 trillion BONK from its treasury to attacker-controlled wallets. The proposal passed under a low voting threshold and without a delay before execution.
Rhea FinanceDeFi ProtocolNear$18.4M
An attacker created fake tokens and pools on NEAR and used a complex swap route to bypass Rhea Finance’s slippage protections, draining assets from its lending reserves. Some funds were returned or frozen, while recovery efforts continued.
CoinDCXCEXTRON$16M
CoinDCX reported about $16 million in suspicious outflows from TRON addresses linked to its exchange. It attributed the losses to old addresses compromised in a previous breach that continued receiving deposits, and said it absorbed the losses and credited affected users.
SuperfortuneTokenEthereum$15.2M
During a multisig token transfer, the recipient address was changed to a suspected attacker-controlled address because the transaction checks did not catch the substitution. About 14.98 million GUA was sent there and later sold for roughly 2,784 ETH.
GrinexCEXTronEthereum$13.7M
Attackers compromised Grinex wallets on TRON and Ethereum and stole cryptocurrency, then swapped USDT for TRX and ETH, likely to reduce the chance of the stablecoins being frozen. The exchange suspended trading and withdrawals.
SwapNet$13.4M
An arbitrary-call flaw in SwapNet’s aggregator contracts let attackers use existing token approvals to make unauthorized transfers from users across four networks. About $13.43 million was drained; Matcha Meta and 0x core contracts were unaffected.
MatchaDeFi ProtocolBaseEthereum$13.4M
An exploit in the SwapNet aggregator used by Matcha Meta allowed attackers to make arbitrary calls against tokens users had approved, taking about $13.43 million from users on Base and Ethereum.
KITE FoundationWalletEthereum$13.3M
Sixteen KITE Foundation wallets were compromised, allowing attackers to make authorized transfers of KITE tokens. The foundation paused transfers and bridges, then replaced the token and migrated legitimate balances 1:1, excluding attacker-controlled addresses.
79th Vault$12.5M
Using a compromised operator key, the attacker moved 79AU tokens out of a PancakeSwap pool and sold them to drain its USDT. The project later recovered about 15,000 BNB through negotiations.
Verus-Ethereum BridgeDeFi ProtocolBridgeVerus$11.5M
An attacker forged a cross-chain message to exploit the Verus-Ethereum bridge, turning small VRSC fees into millions of dollars in Ethereum-based assets. The attacker later returned about 4,052 ETH, while reports said roughly 1,350 ETH remained in their wallet.
Yieldblox$11M
An attacker manipulated the price reported to Script3’s YieldBlox pool by pushing the illiquid USTRY token’s price up about 100 times on the Stellar DEX. The oracle treated the inflated price as real, enabling a $10.97 million drain.
Blend Pools V2DeFi ProtocolStellar$11M
An attacker sharply inflated the price of the thinly traded USTRY token, making it appear more valuable as collateral in YieldBlox DAO’s Blend V2 lending pool. The attacker borrowed about $10.2 million–$10.97 million in USDC and XLM; validators and Blockaid froze a large portion, while some USDC was bridged out.
Pirate ChainChainPirate Chain$10.7M
Two transaction-validation flaws let an attacker bypass Pirate Chain’s issuance checks and create about 39.8 million unauthorized ARRR. The tokens were moved into the shielded pool, which obscures transactions; exchanges and pools were asked to pause while a recovery plan was developed.
THORChainChainBridgeBitcoinEthereumBase+1 chains$10.7M
A flaw in THORChain’s threshold-signature system, which lets multiple participants authorize transactions together, allowed a malicious node to obtain enough vault key material to authorize withdrawals. The attacker drained protocol-owned funds across multiple chains; user funds and liquidity-provider positions were reported safe.
Wanchain Cardano-BNB Chain BridgeChainBridgeCardano$10M
A flaw in the Cardano-BNB bridge’s signature checks let a signature intended for a small NIGHT redemption authorize much larger withdrawals. The attacker drained about 515 million NIGHT from the bridge’s Cardano-side lock address.
Syscoin BridgeDeFi ProtocolBridgeSyscoin$10M
A parsing flaw let Syscoin Bridge accept a malformed burn proof as valid, enabling the unauthorized creation of about 5 billion SYS. The funds were moved and split, then returned through a whitehat recovery.
KiiChainChainKiiChain$9.7M
An arithmetic flaw in KiiChain’s Cosmos EVM module let an attacker redirect KII from victim wallets by abusing vesting-account and staking balance handling. The attack was repeated against 18 targets; the network was halted to stop further theft.
Triple-APaymentsEthereumTronArbitrum$9.7M
Attackers gained access to Triple-A’s hot wallets across several blockchains and drained company-owned digital assets, later consolidating them at an Ethereum address. Client funds held in separate trust accounts were unaffected.
Bonzo LendDeFi ProtocolHedera$9.05M
A flaw in the Supra price oracle let an attacker submit a wildly inflated SAUCE price to Bonzo Lend, using only 250 SAUCE as collateral to borrow millions of dollars in USDC and WHBAR. The borrowed funds were swapped and some were bridged to Ethereum.
MoonwellDeFi ProtocolBase$8.7M
The attacker inflated the spot price of illiquid MAMO and used the inflated value as collateral to borrow assets including cbBTC, ETH, USDC and wstETH. This left Moonwell’s lending markets with undercollateralized loans.
TermFinance VaultsDeFi ProtocolEthereum$8.5M
An attacker gained majority voting power over Term’s strategy vaults and passed malicious proposals that enabled withdrawals from the vaults. The governance attack drained about $8.5 million in assets.
Crypto DAODeFi ProtocolBSC$8.2M
A missing access check let anyone call vault functions in Crypto DAO’s Pro token contract. The attacker took about 167,200 Pro tokens, with reported profit of roughly $52,000; the cited $8.2 million in USDT was held by related addresses, not reported as stolen.
CoinsbuyWalletEthereumTron$7.9M
An access-control flaw in Coinsbuy’s wallet infrastructure let an attacker drain wallets on Ethereum and Tron. Some funds were converted to Monero, while ChangeNOW froze part of the stolen funds.
