Timeline

On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed

CoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the resulting losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations

Duelbits suffered unauthorized transfers from hot wallets across Ethereum, BSC, Bitcoin, and Tron. Stolen assets were rapidly moved, bridged and largely consolidated into ETH and DAI on Ethereum. Duelbits took its platform offline while investigating and stated that user funds were safe. Security researchers suspect compromise of hot-wallet private keys, but Duelbits has not yet published a technical root cause

The attacker manipulated the spot price of the relatively illiquid MAMO token, increasing the collateral value recognized by Moonwell. The attacker used the inflated MAMO collateral to borrow liquid assets including cbBTC, ETH/WETH, USDC, and wstETH, leaving the lending markets with undercollateralized positions

An attacker acquired majority voting power in the thinly held governance tokens controlling Term Vaults and used that voting power to pass malicious governance proposals. The proposals gave the attacker control over the affected vaults, enabling the underlying assets to be withdrawn. The attack therefore did not require stealing an administrative key or bypassing an authorization check—the attacker obtained the required authority through the governance mechanism itself. Recent reporting indicates the affected products were Term’s strategy vaults built on Yearn V3 infrastructure rather than Term Finance’s core fixed-rate repo lending architecture

An attacker exploited chained balance-accounting defects in the shared Cosmos EVM module used by KiiChain. By deploying a contract at a precomputed vesting-account address and delegating one wei more KII than its spendable balance, the attacker triggered an arithmetic underflow in the staking precompile’s EVM balance write-back. Combined with a missing overflow guard in the EVM value-transfer path, this allowed real KII to be redirected from victim accounts to attacker-controlled addresses without increasing total supply. The sequence was repeated against 18 targets

Sixteen wallets associated with KITE Foundation were drained simultaneously in a coordinated private-key compromise. The transfers were ordinary ERC-20 transfer() calls authorized by the affected wallets rather than an exploit of the KITE token contract. KITE Foundation subsequently paused Ethereum KITE transfers and cross-chain bridges, then deployed a replacement ERC-20 and migrated legitimate balances 1:1 from a pre-incident snapshot while excluding attacker-controlled addresses

On July 28, 2026, an unprotected exec() function in Crypto DAO's vault on BNB Chain allowed any caller to execute transfers, draining $8.2M USDT.

On July 23, 2026 (second of two exploits in 66 days), Verus-Ethereum Bridge was drained of $7.54M via the import path; a small 0.01 VRSC transaction triggered unbacked ETH/tBTC payouts due to missing deposit verification. The vulnerability repeated from May and was never patched.

On July 21, 2026, Wanchain's Cardano-BNB Chain bridge was drained of ~515M NIGHT tokens. The TreasuryCheck validator concatenated 14 variable-length fields without separators, allowing a signature authorizing ~3,110 NIGHT to be reused for vastly larger redemptions.

On July 11, 2026 at 00:51 UTC, an attacker deposited 250 SAUCE tokens (~$5 worth) as collateral on Bonzo Lend on Hedera. Attacker pushed a fabricated SAUCE price into Supra's oracle inflated by ~12 orders of magnitude, then borrowed 6.63M USDC and 34.5M WHBAR. Bonzo's TVL fell 77%; Hedera's network TVL dropped 40% within 24 hours.

FleetCommander NAV Inflation via Depegged xUSD

On June 20, 2026, Ethereum's prominent MEV bot JaredFromSubway.eth was drained of $7.5M+ in WETH, USDC, and USDT when an attacker deployed 66 fake token contracts as profitable MEV opportunities. The bot automatically granted large spending approvals to malicious contracts over weeks, which were then swept in a coordinated transaction and laundered through Tornado Cash.

Syscoin bridge exploited via parsing inconsistency between Syscoin Core and NEVM relay. A malformed UTXO burn proof with duplicate asset commitments was accepted as valid by the relay, enabling unauthorized minting of ~5B SYS tokens.

Attacker exploited unprotected owner key in DxSale's legacy 2021 locker contract on May 26-27, 2026, draining over 1,400 liquidity pools on BNB Chain for $7.3M using EIP-7702 batch delegation. Key had no timelocks or multisig controls.

On May 17-18, 2026, the Verus-Ethereum bridge was exploited when an attacker forged a cross-chain payload that passed all cryptographic checks but lacked amount reconciliation between chains, converting ~$10 in VRSC fees into $11.58 million in Ethereum assets (103.6 tBTC, 1,625 ETH, 147,000 USDC).

An attacker exploited missing access control in TrustedVolumes' RFQ swap proxy to add themselves to the order signer allowlist, forge trade orders, and drain funds across 85 transactions in WETH, WBTC, USDT, and USDC.

Grinex custodial wallets on Tron and Ethereum were compromised in April 2026, resulting in ~$13.74M drained. Attackers immediately swapped USDT into TRX and ETH to defeat stablecoin freezes before the exchange suspended operations.

On March 22, 2026, Cyrus Finance on BSC was exploited through price manipulation. Attacker abused reliance on live PancakeSwap V3 spot price in withdrawal logic, with no TWAP or oracle resistance, to extract liquidity and tokens.

On February 22, 2026, an attacker pumped Stellar's thin USTRY market from ~$1.06 to ~$106.74, inflating collateral values. Two transactions drained $10.97M (1M USDC + 61M XLM) from YieldBlox DAO's Blend V2 lending pool, exploiting the lack of liquidity checks and anomaly detection in the oracle.

Matcha Meta users lost $13.43M on January 25, 2026 when the SwapNet aggregator was exploited for arbitrary-call ability. The vulnerability allowed unauthorized access to user-approved tokens across Base and Ethereum. The frontend UI inadequately warned about approval risks.

Truebit Protocol suffered $26.44M exploit on January 8, 2026 from integer overflow in token purchase logic (Solidity 0.6.10 unpatched). Attacker minted TRU at negligible cost and sold to bonding-curve for ~$26M; TRU crashed 99.9%.

The Shai-Hulud npm worm compromised developer accounts and harvested Trust Wallet's Chrome Web Store API key. On December 24, 2025, the attacker published a malicious Trust Wallet Browser Extension v2.68 to the Chrome Web Store, exfiltrating private keys from users until December 26 at 11:00 UTC.

Upbit hot wallet was drained on November 27, 2025 in 54 minutes for $36M in Solana tokens (USDC, BONK, JTO, SONIC, RAY, RENDER, ORCA, PYTH). Attacker exploited weak digital signature infrastructure that allowed private key derivation from on-chain transaction history.

On October 30, 2025, one of Garden Finance's solvers was compromised, enabling an attacker to control cross-chain interactions and drain over $10M in a coordinated exploit across Ethereum, Arbitrum, Base, and Solana.

On September 24, 2025 roughly $21M in BTC, ETH, LTC, DOGE and BCH flowed out of hot wallets belonging to SBI Crypto (Japanese SBI Group's mining pool) through five instant exchangers and into Tornado Cash. ZachXBT and Cyvers linked the laundering pattern to DPRK-affiliated actors; SBI Group never publicly confirmed the incident.

During Yala's deployment of its Solana Layer Zero OFT bridge, attackers compromised temporary deployment keys. They used this access to create unauthorized bridge contracts and establish a backdoor for later exploitation. Over a month later, the attacker deployed this infrastructure to mint 120M unauthorized $YU tokens and extract $7.64M in real value. Thai authorities arrested the attacker approximately 45 days after the exploit, and most funds were clawed back.

On September 2, 2025, a rounding error in Bunni V2's withdrawal logic allowed attackers to systematically withdraw more tokens than entitled, draining $8.4M across Ethereum ($2.4M) and UniChain ($5.9M).

In August 2025, Turkish CEX BtcTurk suffered a second major hack, with $48M drained from hot wallets across 7 blockchains (Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, Polygon) after private keys were compromised.

WOO X exchange suffered a phishing attack via a fake open-source collaboration request that lured a developer to open a malicious development tool. Attackers gained access to the development environment and executed unauthorized withdrawals across nine user accounts, draining $14M across Bitcoin, Ethereum, Arbitrum, and BSC.

On July 16, 2025, BigONE crypto exchange suffered a supply chain attack where an attacker gained access to production infrastructure and modified critical backend logic to automatically approve fraudulent withdrawal requests. The attack drained approximately $27 million across five blockchains before being detected.

On July 9, 2025, ZKSwap's Ethereum Layer 1 bridge was exploited through its emergency withdrawal mechanism (Exodus Mode). The attacker exploited a critical flaw where the verifyExitProof() function failed to perform actual cryptographic verification of zero-knowledge proofs. By forging withdrawal proofs, the attacker artificially inflated their balance and withdrew approximately $5 million in assets.

Nobitex hot wallet private keys compromised on June 18, 2025, leading to $82-90M theft across blockchains. Attackers deliberately destroyed the stolen funds by sending to inaccessible addresses as a political statement.

On May 28, 2025, Cork Protocol suffered a $12 million exploit when an attacker created fraudulent market structures with an unprotected beforeSwap hook lacking authorization checks. Missing input validation on market configuration and token validation logic allowed the attacker to create fake token derivatives, draining 3,761 wstETH.

BitoPro exchange hot wallets compromised through malware deployment on a cloud operations team member via social engineering. Unauthorized withdrawals executed across multiple blockchains during a system update. Attackers attributed to North Korean Lazarus group based on attack patterns and methodology.

On April 14, 2025, at 18:53 UTC, KiloEx was exploited for $7.5M via ETH/USD price oracle manipulation across Base, BSC, and opBNB. The attacker opened positions at artificially low prices and closed at real high prices without the oracle system validating feed freshness or enforcing rate limits.

Abracadabra.Money suffered a $13M exploit on March 25, 2025 via a flash loan attack on cauldrons accepting GMX V2 LP tokens as collateral. The attacker manipulated liquidation logic to self-liquidate and extract liquidation incentives.

On March 5, 2025, 1inch disclosed a $5M exploit in Fusion v1 resolver contracts when a buffer overflow in _settleOrder() allowed an attacker to trigger integer underflow and hijack control flow to impersonate resolvers and execute unauthorized swaps. Most funds were recovered after negotiation.

Infini suffered a $49.5M exploit on February 24, 2025 when a rogue former developer who had retained vault-draining privileges drained the contract. The attacker immediately converted USDC to ETH (17,696 ETH) through Uniswap, Sky Protocol, and 0x.

zkLend lost $9.57M on February 11, 2025 on Starknet via an integer division rounding vulnerability. Attacker exploited truncated rounding in withdrawal calculations with precise wstETH deposits to inflate their raw_balance to 1724, draining all tokens from other pools. Attacker returned ~$3.2M after negotiation but lost remaining to a Tornado Cash scam.

DogWifTools, a Solana rug-pull generator tool, was compromised via supply chain attack. Attackers gained control of the GitHub repository token and inserted malware into versions 1.6.3-1.6.6. Updates delivered malicious updater.exe files that acted as Remote Access Trojans, stealing cryptocurrency wallet private keys and extracting $10M from users.

NoOnes' Solana cross-chain bridge was exploited via a vulnerability in the relay contract's message processing logic. The attacker crafted malicious bridge messages that bypassed validation, tricking the relayer into authorizing unauthorized withdrawals across multiple blockchains through hundreds of small transactions each under $7,000.

Polter Finance on Fantom exploited November 16, 2024 via flashloan oracle manipulation. Attacker borrowed ~1.4M BOO from SpookySwap, collapsing the pool and inflating BOO price. With 1 BOO valued at $1.37T by the oracle, attacker extracted massive loans.

On November 15, 2024, an attacker exploited missing balance validation in Thala's v1 farming contracts to unstake $25.5M in LP tokens without owning them. Thala recovered $25M within 6 hours through white-hat negotiation.

A dormant US government wallet holding $20M from 2016 Bitfinex seizures had its private key compromised on October 24, 2024. Attacker drained $20M in ETH, USDC, aUSDC and USDT, but $19.3M was recovered within 24 hours; ~$700K went to instant exchanges.

Attackers gained access to email communications about investor token custody, then impersonated the legitimate party to direct EigenLayer team to send 1.67M EIGEN tokens to an attacker-controlled address. The tokens were swapped and moved to CEXs.

On September 20, 2024 (4:00 AM Singapore time), BingX hot wallets were compromised via access control bypass, draining ~$43M in two separate transactions: $26M + $16.5M. Assets stolen included 13.25M ETH, 2.3M BNB, 4.4M USDT, and 360+ altcoin types. BingX promised reimbursement from reserves.

On September 10, 2024, Indodax Indonesian crypto exchange suffered a $25.47 million hack affecting its hot wallet. Attackers obtained approximately 5,204 ETH ($12.37M) along with Polygon, Tron, Bitcoin and various ERC-20 tokens without compromising private keys, suggesting the breach involved the withdrawal protocol itself.

On August 12, 2024, an undisclosed vulnerability in Poly Network's Cross-Chain Management Contract drained $4-5M in wrapped assets on Neo N3, de-pegging Flamingo's f- and p-assets. Poly Network suspended the bridge and Flamingo paused cross-chain features; Neo Global Development relaunched and took over in September. This was the third Poly Network compromise.

A June 2024 upgrade to Terra Phoenix reintroduced an unpatched ibc-go 7.3.x fork, reintroducing a reentrancy bug in ibc-hooks timeout callback. An attacker exploited this to mint tokens and swap them through Astroport before the chain halted.

Rho Markets on Scroll lost $7.6M on July 19, 2024 when a private key compromise allowed attacker to transfer oracle contract ownership and manipulate price feeds, draining all USDT and USDC.

On July 16, 2024 LI.FI protocol was exploited via insufficient input validation in GasZipFacet.sol, where the depositToGasZipERC20 function allowed user-controlled _swapData parameters to reach low-level calls with malicious transferFrom() calldata, draining $8-11M from 153 wallets with infinite approvals across Ethereum and Arbitrum.

BtcTurk lost $54-55M on June 22, 2024 when attackers compromised private keys to 10 hot wallets targeting Avalanche holdings. Binance froze $5.3M of recovered funds.

On June 9, 2024, Loopring's Official Guardian 2FA service (off-chain infra) was compromised, allowing attackers to masquerade as wallet owners, reset ownership, and steal $5M from Smart Wallets. Users with single guardian reliance were especially vulnerable.

Velocore V2 was exploited for ~$6.8M when a fee rate calculation allowed values exceeding 100%. The attacker used a flash loan to shrink the pool and trigger LP token underflow, creating excess LP tokens.

Gala Games minter private key was compromised on May 20, 2024, allowing minting of 5B GALA tokens (~$200M). The unused and unrotated key was likely stolen; attacker sold ~$200M before returning $22M (~11% recovery).

Rain lost ~$14.8M on April 29, 2024 when exchange wallet private keys were compromised across four chains (BTC, ETH, SOL, XRP). Stolen assets were consolidated into 137.9 BTC and 1,881 ETH via instant exchanges; the breach wasn't disclosed until ZachXBT surfaced it two weeks later.

Prisma Finance was exploited on March 28, 2024 via a flash loan attack on MigrateTroveZap. The onFlashLoan callback lacked origin validation, allowing the attacker to spoof migration logic and hijack troves, extracting 3,257.69 ETH (~$11.6M) in collateral.

Curio exploited March 23-25, 2024 via access control flaw in voting power. Attacker with small CGT stake escalated voting power to execute delegatecall to malicious contract, minting ~1B CGT worth $16M.

WOOFi Swap on Arbitrum was exploited on March 5, 2024 via a flash loan attack on its synthetic proactive market making algorithm. An attacker borrowed 7.7M WOO tokens, exploiting the missing Chainlink price fallback to crash the price and profit ~$8.75M across three swaps in 13 minutes.

On February 16-18, 2024, FixedFloat (non-KYC exchange) was compromised and ~$26.1M in Bitcoin and Ether were stolen: 409.304 BTC and 1,728.48 ETH. Private keys controlling hot wallets on both networks were compromised. Initially suspected as insider attack or rug pull, the team claimed external attackers exploited infrastructure vulnerabilities. Ethereum funds moved through eXch exchange; Bitcoin funds dispersed across addresses.

Abracadabra's MIM stablecoin exploited for $6.5M via precision loss in collateral calculations. An attacker used rounding errors to bypass collateral validation, inflating borrow amounts. Funded with 1 ETH from Tornado Cash, the attack caused MIM to depeg to $0.76.

Gamee's deployer private key was compromised via an unsecured GitLab environment, enabling an attacker to gain control of the project's deployer address on Polygon. The attacker exploited recoverERC721s() function bypass protections and stole approximately 600 million GMEE tokens worth ~$7M at the time.

Orbit Bridge was drained for ~$81.5M across its Ethereum vault when 7 of 10 multisig signer private keys were compromised, enabling fraudulent withdrawal signatures.

On November 22, 2023, the HECO Chain bridge to Ethereum was drained of $86.6M when the operator's account was compromised, enabling unauthorized asset withdrawals.

On November 22, 2023, KyberSwap Elastic was exploited via a double rounding error in computeSwapStep() that allowed the final swap price to exceed the target threshold without updating liquidity state. The attacker used strategic swaps to corrupt baseL and drain $48M across multiple networks.

Kronos Research's API keys were compromised, allowing attackers to drain 26M USD from trading wallets via unauthorized transactions.

On September 25, 2023, HTX's hot wallet was drained of 5,000 ETH (~$8 million). The attacker gained unauthorized access to internal wallet infrastructure via private key compromise; the attacker returned all funds on October 7, 2023, claiming a 250 ETH white-hat bounty.

CoinEx exchange suffered multi-chain attack on September 12, 2023 when attackers accessed hot wallet private keys, draining $31-54M across Ethereum, Tron, Polygon, and other chains.

Stake.com's hot wallets were compromised on September 4, 2023, leading to $41.3M theft of USDT, ETH, and other assets across Ethereum, BSC, and Polygon.

On August 25, 2023, Magnate Finance team rug-pulled Base depositors by deleting communication channels (Telegram/website), manipulating the price oracle, and draining all assets. The deployer had previously executed Solfire rug ($4.8M) in 2022.

On 31 July 2023 the anonymous deployer of the BALD memecoin on Base removed the two-sided liquidity provided two days after launch, crashing the token roughly 90%.

AlphaPo's hot wallets were drained of ~$60M across Ethereum, Tron, and Bitcoin on July 23, 2023 after private key exposure.

Floating Point Group, an institutional crypto prime brokerage, suffered a cybersecurity breach resulting in a loss of $15-20M from custody accounts. The attackers gained unauthorized access to the company's systems, leading FPG to freeze third-party accounts and migrate funds to secure wallets while working with law enforcement.

On May 28, 2023, Jimbos Protocol on Arbitrum (launched <20 days prior) was exploited for 4,090 ETH via flashloan-enabled oracle manipulation. Attacker took $5.9M flashloan and manipulated JIMBO price to exploit shift/conversion logic lacking slippage protection.

On April 15, 2023, Hundred Finance was drained of $7.4M on Optimism via a flashloan-funded donation to an empty WBTC pool, exploiting rounding errors in exchange rate calculation.

On April 13, 2023, Yearn Finance's yUSDT vault was exploited through a misconfigured oracle reference pointing to Fulcrum's USDC contract instead of USDT. Attacker exploited the incorrect contract pointer to manipulate share prices, minting 1.2 quadrillion yUSDT by depositing only 10,000 USDT, then selling for $11.54 million.

A malicious Ethereum validator exploited a flaw in the mev-boost-relay implementation by crafting an invalid block header with zero parent and state roots, bypassing validation and gaining visibility of block contents. The attacker front-ran and replaced MEV bot transactions to drain approximately $20M over 24 transactions.

On March 17, 2023 ParaSpace (NFT lending protocol on Ethereum) suffered a price manipulation exploit in the AutoCompoundApe contract allowing attackers to borrow assets with less NFT collateral than required. Security firm BlockSec intercepted the attack and recovered approximately 2,900 ETH ($5M) of BAYC NFTs before the full attack executed.

Platypus Finance was exploited for $8.5M via flashloan. The attacker manipulated the solvency check's cash/liability ratio calculation by depositing to increase liability and performing swaps to reduce cash, artificially inflating slippage.

On December 24, 2022, Defrost Finance on Avalanche suffered two coordinated attacks: V2 flashloan drained $173K via LSWUSDC price manipulation; V1 admin key compromise allowed minting 100M H20 and draining ~$12M USDT via fake oracle. All funds were later returned.

On December 10, 2022 Lodestar Finance V0 on Arbitrum suffered a flashloan and oracle manipulation attack when an attacker manipulated the price of PlutusDAO's plvGLP token to 1.83 GLP per plvGLP, then used flashloans to borrow all available platform liquidity with the inflated collateral, resulting in $6.9M loss.

On November 1-2, 2022, Deribit's BTC, ETH, and USDC hot wallets were compromised, draining ~$28M in crypto assets. Client assets in cold storage and Fireblocks vaults were unaffected. Deribit covered the loss with company reserves; the specific compromise method remains undisclosed.

On October 18, 2022, attacker exploited Moola Market on Celo by manipulating MOO token's low-liquidity price oracle to inflate collateral value, allowing unauthorized borrows and draining $8.4M in multiple tokens.

On July 23-25, 2022, Audius governance contracts were compromised when an attacker exploited a missing initialization guard allowing repeated invoke() calls. The attacker drained 18 million AUDIO tokens (~$6M) from the treasury and attempted to delegate 10 trillion tokens to controlled wallets.

On July 11, 2022, a phishing campaign targeted Uniswap users by airdropping a malicious ERC20 token to 73,399 UNI holders, promising a $2K airdrop. When users interacted with the token to claim it, they signed malicious approvals granting the attacker access to their Uniswap V3 LP tokens. The attacker siphoned 7,574 ETH (~$8M) and moved 7,500 ETH through Tornado Cash.

On June 16, 2022, Inverse Finance Frontier was exploited for $1.3M direct loss ($5.8M protocol loss) via oracle manipulation. Attacker flash-borrowed 27K wBTC, swapped into Curve tricrypto to inflate yvcrv3crypto LP price, then borrowed DOLA against inflated collateral.

On June 5, 2022, Wintermute lost 20 million Optimism governance tokens when an Ethereum L1 multisig address was provided for L2 deposit but had not been pre-deployed on Optimism. An attacker deployed the Gnosis Safe contract and took control of the address before Wintermute could recover the tokens.

Blizz Finance on Avalanche was drained of ~$8.3M in May 2022 when Chainlink froze LUNA pricing at $0.10 far above market value during Terra's collapse, allowing overcollateralized borrowing.

On May 11, 2022, Drift Protocol on Solana experienced three interconnected bugs: users could withdraw positive PnL without realizing losses, leverage increased with long-short imbalance, and insurance funds weren't isolated per market. LUNA collapse exposed these issues, causing $8.72M net withdrawal and $14.5M shortfall.

On April 30, 2022, Saddle Finance metapool was exploited via flash loan-assisted swaps manipulating LP token pricing. The attacker exploited inconsistencies in price calculations in the sUSD/saddleUSD-V2 metapool, which used the incorrect MetaSwapUtils library, enabling extraction of ~$11M.

On April 2, 2022, an attacker injected ~$3M in ETH into SushiSwap INV/ETH to artificially inflate the Keep3r price feed, then borrowed $15.6M (DOLA, ETH, WBTC, YFI) from Inverse Finance's Anchor market using inflated INV collateral.

On Gnosis Chain, attackers exploited xDAI's non-standard _callAfterTransfer() callback reentrancy; using flashloans to stack borrows before balance updates, they withdrew amounts far exceeding collateral value.

On February 10, 2022, Dego Finance was hacked when the contract deployer's private key was compromised. Attackers drained approximately $10-14.4M from liquidity pools on Uniswap and PancakeSwap across Ethereum, BSC, and Cronos.

On February 5-6, 2022, Meter's bridge was exploited via missing validation on an alternative deposit function variant. Attacker called the function directly with arbitrary amounts, draining $4.4M from Meter and causing $3.3M cascading loss in Hundred Finance collateral pools.

BitBNS exchange in India was hacked on February 1, 2022, via AWS cloud storage misconfiguration exposing private key backups. Attacker drained hot wallets for $7.5-8M; incident was concealed until March 2023.

Crypto.com's 2FA system vulnerability allowed attackers to bypass authentication and withdraw $33.7M (4,836 ETH + 444 BTC + $66.2K USD) from 483 user accounts without entering 2FA codes.

On January 8, 2022 at 10:23 PM GMT, attackers compromised LCX's Ethereum hot wallets and transferred $7.94 million in assets including ENJ, LINK, SAND, and stablecoins. Funds were converted within 45 minutes; LCX recovered ~60% through law enforcement.

Visor Finance's staking contract was exploited via reentrancy in the delegateTransferERC20 interface. Attackers recursively called the withdrawal function before state updates were completed, stealing 8,812,958 VISR tokens (~$8.2M).

Pizza DeFi was exploited via an integer overflow in eCurve that allowed unbounded minting of Tripool tokens. The attacker used these tokens as collateral to drain $5M in assets.

SnowdogDAO ($SDOG) on Avalanche launched November 14, 2021, raising $45M in 8 days. On November 25, the team moved liquidity to a private Snowbank-controlled AMM pool requiring a secret challenge key. Only 7% of holders could liquidate, while three addresses drained $10M, $7.7M, and $3.3M, blocking $18.1M in total liquidity.

On October 14, 2021, Indexed Finance's DEFI5 and CC10 pools were drained of $16M via a sophisticated flashloan attack. The attacker used massive flashloans to knock pool balances out of equilibrium, purchased component assets at heavily discounted rates, and executed the entire attack within a single transaction.

On September 19, 2021, pNetwork's cross-chain bridge was exploited when an attacker crafted fraudulent peg-out event logs. The Rust event-log processor failed to validate that requests originated from authorized pNetwork contracts, processing the fake withdrawal requests. The attacker stole 277 BTC (wrapped to BSC) worth approximately $13M.

Vee Finance on Avalanche was exploited on September 21, 2021 for ~$34-35M ($9M BTC + $26.2M ETH). The attacker manipulated Pangolin DEX prices by creating fake trading pairs and executing manipulative trades to distort prices that Vee Finance used as its single oracle source.

On August 28-29, 2021, cryptocurrency exchange Bilaxy's hot wallet was compromised, resulting in the theft of approximately $21.7 million in various ERC20 tokens including USDT, USDC, and UNI. The attacker transferred 200 ETH to Tornado Cash to mix the stolen funds.

SurgeBNB suffered a reentrancy attack funded by a 10,000 BNB flash loan. The sell function updated balances after external calls, letting attacker repeatedly withdraw value.

DAO Maker's vesting system was exploited when the init() function lacked access control, allowing an attacker to reset parameters on 4 token contracts (DERC, CPD, CAPS, SHO) and drain tokens via emergencyExit. Stolen tokens were swapped on DEXes, causing significant price impact.

On August 10, 2021, Punk Protocol was exploited for $8.95M when attacker used delegatecall to rerun unguarded Initialize function, changing forge address to gain withdrawal control. White-hat frontran and recovered ~$5M, keeping $1M as finder's fee.

On July 23, 2021, THORChain's ETH Router was exploited when an attacker deployed a custom contract to trick Bifrost Protocol into accepting fake asset deposits, triggering refunds of real assets. The attacker limited impact and requested a 10% bug bounty, suggesting a white-hat teaching lesson.

Bondly's CEO was phished for admin credentials, allowing the attacker to mint 373M BONDLY tokens and crash the price 82% by dumping on liquidity pools.

Beginning June 22, 2021, Haven Protocol was exploited through multiple vulnerabilities including miner reward validation bypass, xJPY to xBTC conversion exploitation, and hidden burn/mint amount bugs. An unknown quantity of XHV tokens were minted before the network rolled back to pre-attack state on July 20 via hard fork.

StakeHound's 38,178 ETH became inaccessible when a 3-of-4 threshold signature key backup procedure failed. Fireblocks lost custody of 2 key shards during a machine failure in March 2021, and StakeHound failed to execute disaster recovery or verify the backup through third-party services. The keys became permanently unrecoverable.

Belt Finance on BSC lost $6.3M on May 29, 2021 to a flash loan exploit. Attacker used flash loans to deposit into undersubscribed strategies and manipulate pool ratios, exploiting faulty vault-share valuation that assumed strategies remained balanced.

On May 19, 2021, PancakeBunny was exploited via flashloan-enabled oracle manipulation. Attacker manipulated USDT/BNB and BUNNY/BNB exchange rates to mint 7M BUNNY and steal 114,631 WBNB (~$45M), crashing BUNNY price.

The private key to the FinNexus contract deployer account was compromised, allowing the attacker to assume contract ownership. The attacker minted 323M FNX on Ethereum (~$6M) and 60M FNX on BSC (~$1.6M), then immediately dumped tokens on markets. FNX price collapsed from $0.356 to $0.0272 (92% decline).

A reentrancy vulnerability in vaults.sx's flashloan contract allowed an attacker to recursively extract 1.18M EOS and 462K USDT. The attacker distributed funds across 246 accounts attempting to evade recovery. EOS BPs froze accounts by supermajority consensus and the attacker was social-engineered into nulling their keys; all users were made whole.

On May 8, 2021, attacker exploited Rari's ibETH integration; using dYdX flashloan and ibETH.work's arbitrary call capability, attacker artificially inflated ibETH.totalETH() to withdraw more ETH than deposited, draining ~$11M from Rari's Ethereum Pool.

ValueDefi's vSwap pool on BSC was exploited via reinitialization vulnerability in access control. Attacker re-initialized pool, set themselves as operator, called governanceRecoverUnsupported() to drain 10,839.16 vBWAP/BUSD LP tokens and associated collateral.

Uranium Finance on BSC suffered a calculation error in its v2 pair swap function. The sanity check validation used an incorrect constant (1,000,000) that was 100x too large compared to actual balance adjustments (10,000), allowing attackers to send minimal value and extract maximum reserves through the swap function.

An attacker accumulated 33%+ of TSD governance tokens by purchasing at low market prices, then proposed replacement of the token implementation contract with a malicious version via DAO governance vote. The attacker's voting weight passed the proposal, enabling the malicious contract to mint 11.8B TSD and immediately dump on PancakeSwap.

PAID Network's token contract was compromised on March 5, 2021 when an attacker gained access to the deployment wallet's private key. The attacker upgraded the contract to enable unlimited token minting, creating 59.4M unauthorized PAID tokens.

Furucombo exploited February 27, 2021 for ~$14M via delegatecall hijack. Attacker deployed a fraudulent contract impersonating Aave v2 implementation. Furucombo failed to authenticate the target, allowing the attacker to drain pre-approved tokens (3,900+ stETH and USDC) from ~22 users.

On February 4, 2021, attacker used flashloans to acquire 215,000 ETH, then deposited borrowed USDC/DAI into Yearn's yDAI vault at manipulated exchange rates without sufficient slippage protection. The vault lost $11M; attacker profited ~$2.7M after $3.5M in fees.

Cover Protocol's Blacksmith contract was exploited on December 28-29, 2020, due to incorrect memory/storage reference in reward calculation logic, allowing unbounded minting of approximately 40 quintillion COVER tokens. Funds were returned by a white hat hacker.

EXMO detected suspicious withdrawal activity on December 21, with attackers stealing approximately 5% of the exchange's total assets from compromised hot wallets. Multiple cryptocurrencies including BTC, ETH, XRP, ETC, ZEC, and USDT were transferred out during a coordinated withdrawal.

Attacker gained remote access to founder Hugh Karp's computer and replaced his MetaMask extension with a malicious version. The compromised wallet was then used to sign and transfer 370,000 NXM tokens (~$8M) to attacker-controlled addresses. The attacker later demanded 4,500 ETH ransom.

Twenty-two days after launch, Compounder Finance's development team replaced audited strategy pools with malicious 'Evil Strategy' contracts, removing restrictions on the withdraw function and draining every asset pool. Despite advertising 24-hour timelocks, the team retained ability to swap strategy contracts as a premeditated exit.

On 2020-11-17 at 00:47:19 UTC an attacker exploited a flash-loan-funded reentrancy in OUSD VaultCore's mint function to inflate totalSupply. The contract failed to validate the transferred-in asset and lacked reentrancy protection, allowing the attacker to redeem against the inflated supply and drain the vault.

Harvest Finance exploited October 26, 2020 for $24-34M via Curve oracle manipulation. Attacker deployed $50M flashloan to skew the Curve y-pool USDT/USDC balance, then repeatedly minted fTokens at depressed valuation and redeemed at normal price (~30 times in 7 minutes).

Eminence, an incomplete unaudited DeFi project by Andre Cronje, was exploited less than 3 hours after launch. The attacker borrowed 15M DAI from Uniswap, bought EMN, burned half for eAAVE to artificially inflate the price, then withdrew from the bonding curve at the manipulated price, draining the protocol.

Attackers conducted a 51% attack on Ethereum Classic to execute a double-spend against OKEx. They deposited ETC, withdrew it, then reorganized the blockchain to erase the deposit transaction while keeping their funds, resulting in a net $5.6M theft via unconfirmed transaction reversal.

ERC777 Reentrancy

VeChain's buyback wallet was compromised on December 13, 2019, at 12:27 AM GMT, resulting in theft of 1.1B VET tokens (~$6.5M). Internal misconduct was suspected, with a trojan-infected machine containing keylogging software enabling attacker access to private keys. The VeChain Foundation issued an emergency patch causing Authority Masternodes to vote and freeze the stolen funds. On December 30, the community voted to permanently destroy 727M of the frozen VET.

Fusion's swap wallet (0x8e6bDa71f3f0F49dDD29969De79aFCFac4457379) was compromised on September 28, 2019, with attackers stealing 10M native FSN and 3.5M ERC20 FSN tokens (~$6.4M total). Investigation determined the private key was stolen and suggested potential inside involvement. Some stolen tokens were wash-traded across exchanges before being frozen, causing FSN price to crash 50% within hours.

BitPoint, a Tokyo-based exchange, discovered hot wallet breaches on July 11-12, 2019, losing approximately 3.02B yen (~$27.6M) across multiple assets: 1,225 BTC, 1,985 BCH, 11,169 ETH, and 5,108 LTC. Of the loss, $23M belonged to customers and $9.2M to BitPoint itself. The exchange later recovered ~$2.3M in stolen cryptocurrency from overseas exchanges and reimbursed customers before resuming operations.

A hacker compromised a whale account holding 1,200 BTC, placed orders to purchase BTC at artificially low prices, then dumped the stolen BTC to trigger execution and pocket $10.45M from liquidations of other users' positions.

Bithumb hot wallet was compromised by insiders with access to private keys, resulting in theft of 12.5M EOS and 6.2M XRP. All stolen funds were company assets as user funds were stored in cold storage.

Lazarus Group compromised DragonEx infrastructure through phishing attacks using a fake Worldbit-bot trading software, obtaining private keys and API access to drain 20 cryptocurrency wallets including 135 BTC, 2,738 ETH, and other assets.

On January 14, 2019, Cryptopia's hot wallet private keys were compromised, enabling theft of approximately 10 percent of platform holdings in ERC-20 tokens across 17,000 customer accounts.

Zaif cryptocurrency exchange suffered a hot wallet breach on September 14, 2018 when attackers gained access to private keys storing customer funds. Approximately 5,966 Bitcoin, unspecified Bitcoin Cash, and MonaCoin totaling 6.7 billion yen (~$60 million) were stolen from the exchange's operational wallets. Discovery occurred three days after the theft.

Bancor decentralized exchange platform suffered a security breach on July 9, 2018 where attackers gained unauthorized access to the platform's wallet containing BNT tokens, ETH, and other ERC-20 tokens. The attacker drained approximately $23.5 million in assets. Bancor identified the breach, secured affected accounts, and announced recovery and user compensation measures.

On June 10, 2018, South Korean exchange Coinrail suffered an intrusion that resulted in the theft of over $40M in altcoins. The attack compromised approximately 30% of assets held on the platform, including ~$20M in NPXS tokens, $14M in Aston X, and $6M in other tokens. Two-thirds of stolen assets were recovered through partner exchanges.

On December 6-7, 2017, NiceHash's payment wallet was compromised after attackers obtained employee credentials via phishing. The attacker accessed the wallet and stole 4,700+ BTC (~$64M). NiceHash eventually repaid all affected users by December 16, 2020.

CoinDash's ICO website was compromised on July 17-18, 2017 within 13 minutes of launch. Attacker replaced the deposit address with their own; 2,000+ investors sent 37K ETH (~$7M) to the attacker before the ICO was pulled. Hacker retained ~13.4K ETH (~$11.7M).

Bitfinex suffered a security breach when an attacker compromised hot wallet private keys, stealing 119,756 bitcoins (~$72 million). The exchange halted trading and withdrawals while investigating.

Six Bitstamp employees were targeted in a sophisticated weeks-long phishing campaign starting in November 2014. The attacker sent social engineering emails to the CTO and system administrator, culminating in malware installation that gave the attacker access to the exchange's hot wallet infrastructure.

Cryptsy announced on July 29, 2014 that an attacker under the nickname Lucky7Coin had inserted Trojan code into the exchange's systems, stealing 13,000 BTC and 300,000 LTC. Though later evidence suggested CEO Paul Vernon may have conducted internal theft and misattributed it, the reported mechanism involved compromised private keys.

Mt. Gox's auditor's computer was compromised, giving attackers access to the exchange's admin credentials. Attackers manipulated the exchange price to $0.01 BTC and used the access to drain customer accounts, transferring approximately 2,000 BTC while 650 more were purchased at the artificially low price.