Crypto Hacks
Top 10 crypto hacks of 2021
In 2021, attackers took $3.13B in 236 crypto hacks and thefts. The biggest was Poly Network on Aug 10, 2021, at $611M. The 10 largest account for 56% of the year's losses.
Last updated · Data last changed · Checked daily
The 10 biggest crypto hacks of 2021, ranked
1
Poly Network
Aug 10, 2021DeFi ProtocolBridgeEthereumBSCPolygon$611MAttackers exploited access-control and cryptography flaws in Poly Network’s cross-chain bridge contracts, taking over $610 million across Ethereum, BSC and Polygon. The attacker later returned nearly all the funds, keeping only transaction fees.
2
BitMart
Dec 4, 2021CEXEthereumBSC$196MAttackers compromised BitMart’s Ethereum and BNB Chain hot wallets and stole cryptocurrency from them. Other wallets were reported unaffected.
Our coverage: BSC Wallets Compromised As Well – Damages In The Bitmart Hack Grow To 196 Million USDSourceRekt report
3
Compound
Sep 29, 2021DeFi ProtocolEthereum$147MAn off-by-one error in Compound V2’s COMP distribution logic caused users to claim far more tokens than intended after a governance proposal took effect. Deposits and borrowed funds were reported not to be at risk.
4
Vulcan Forged
Dec 13, 2021DeFi ProtocolEthereumPolygon$140MAn attacker compromised Venly’s semi-custodial servers and obtained credentials to access Vulcan Forged users’ wallets, stealing more than 4.5 million PYR. The project later returned most or all of the stolen tokens to affected wallets.
5
BXH
Oct 30, 2021DeFi ProtocolBSC$139MAn attacker obtained BXH’s administrative private key and used it to authorize a transaction transferring tokens from the protocol’s Binance Smart Chain assets to the attacker’s account. The reported amount was $139 million.
6
Cream Finance
Oct 27, 2021DeFi ProtocolEthereum$130MAttackers used flash loans to manipulate the price of yUSD and exploit accounting across Cream Finance’s connected lending and trading protocols. They created unbacked tokens and took about $130 million in assets.
7
BadgerDAO
Dec 2, 2021DeFi ProtocolEthereum$120MAn attacker used a compromised Cloudflare API key to add malicious code to BadgerDAO’s website, tricking users into approving token transfers. Assets were taken from about 200 accounts, including bitcoin and ether.
8
Venus
May 18, 2021DeFi ProtocolBSC$100MAn attacker drove up XVS’s price on exchanges, then used the inflated token as collateral to borrow large amounts of Bitcoin and Ether from Venus. The price later fell, leaving the protocol with about $77 million in losses.
9
Liquid
Aug 19, 2021CEXEthereum$91.4MAttackers compromised Liquid Global’s warm wallets, using information from a previous breach to break into its MPC wallet system. They stole various cryptocurrencies, and the exchange suspended deposits and withdrawals while investigating.
10
Mirror Protocol
Oct 8, 2021DeFi ProtocolTerra$90MAttackers exploited a flaw in Mirror Protocol’s collateral-unlock logic, using duplicate IDs to unlock more collateral than they were entitled to. They drained about $89.7 million before the exploit was detected.
