{"meta":{"fetchedAt":"2026-10-31T10:58:20Z","rows":3372,"sources":[{"name":"DefiLlama","url":"https://defillama.com/hacks","rows":1330},{"name":"SlowMist Hacked","url":"https://hacked.slowmist.io/","rows":2332},{"name":"Web3 Is Going Great","url":"https://www.web3isgoinggreat.com/","rows":905},{"name":"rekt.news","url":"https://rekt.news/leaderboard/","rows":329},{"name":"DeFiHackLabs (exploit reproductions)","url":"https://github.com/SunWeb3Sec/DeFiHackLabs","rows":907},{"name":"FBI and IC3 statements","url":"hacks-overlay.json","rows":5}],"checks":{"Source records read":5803,"Merged into incidents":3372,"Confirmed by two or more sources":1356,"Sources agree on date and loss":1161,"Attack transactions checked on chain":823,"Confirmed on chain":811,"Contradicted on chain (in review)":6,"Incidents in the review queue":240,"Repeat run agreement":"100.00%"},"units":"usd: loss in US dollars at the time, from the sources (median when three or more give one); lo/hi: the range the sources give. ret: returned or recovered as a source states it. conf A: two or more sources agree on date (3 days) and loss (25%), B: two or more sources disagree, C: one source."},"rows":[{"id":"htc68d839941","date":"2026-10-29","name":"Binance CEX","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Bitcoin","Tron","Avalanche","Optimism","Arbitrum","Base"],"usd":6300000000.0,"lo":6300000000.0,"hi":6360000000.0,"ret":3000000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/binance/status/2115993361517891592"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/binance-hack"}],"desc":"On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves","theft":true,"tracker":"/","note":"Traced wallet by wallet on this site, with live balances of the wallets that still hold the coins."},{"id":"ht1fa9f01d3c","date":"2026-10-29","name":"Polymarket International","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Prediction Market","chains":["Polygon"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PolymarketTrade/status/2115874609014726842"}],"desc":"Attackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committed to reimbursing impacted users","theft":true},{"id":"ht9efb76173c","date":"2026-10-28","name":"Hifi Finance","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/spreekaway/status/2115570707463868782?s=46"}],"desc":"An attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokens to the attacker. At the time of reporting, the proposal was queued but had not been executed","theft":true},{"id":"ht8d8d58130d","date":"2026-10-28","name":"zkLink Nova","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Ethereum"],"usd":783100.0,"lo":783000.0,"hi":783100.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2115635114638250409"}],"desc":"An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge","theft":true,"onchain":true},{"id":"ht8c76cd8632","date":"2026-10-27","name":"Fence Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Avalanche"],"usd":1012999.9999999999,"lo":1010000.0,"hi":1013000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2115281126516490514?a=nMv1W8-mPKDp1ZlylyA&s=20"}],"desc":"An attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vault","theft":true,"onchain":true},{"id":"htf2bb1e2ad0","date":"2026-10-27","name":"Predict Fun","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"Prediction Market","chains":["BNB Chain"],"usd":400000.0,"lo":397708.0,"hi":400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/predictdotfun/status/2115089547528950108?s=46"}],"desc":"Several Predict.fun users experienced unauthorized wallet transfers totaling approximately 400,000 USDT. Preliminary findings suggest a possible compromise of the project’s API documentation website, which was hosted by a third-party provider. Predict.fun took the documentation site offline as a precaution and committed to reimbursing affected users","theft":true},{"id":"ht2e236a34f9","date":"2026-10-27","name":"Zilliqa X-Bridge","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Zilliqa"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Zilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continue","theft":true},{"id":"ht8bedab7fd7","date":"2026-10-27","name":"Diamante","kind":"hack","fam":"other","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/diamante_io/status/2115183662954356858"}],"desc":"The Diamante ecosystem experienced a security breach involving unauthorized activity by a malicious actor. The team activated emergency protocols, coordinated with exchanges and liquidity providers to suspend affected withdrawals and transfers, identified the suspected attacker, is working with law enforcement across multiple countries for recovery, and pledged to make all affected participants whole.","theft":true},{"id":"htd42cada95e","date":"2026-10-26","name":"SafeApprovalSquat","kind":"hack","fam":"keys","tech":"Misconfiguration","chains":["Avalanche"],"usd":7450000.0,"lo":7450000.0,"hi":7450000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2115005055619260758"}],"desc":"A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.","theft":true,"onchain":true,"review":["attack tx contradicts the date"]},{"id":"ht05c73d0422","date":"2026-10-26","name":"Bloom Trading Bot","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","chains":["Solana"],"usd":953000.0,"lo":947000.0,"hi":953000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/BloomTrading/status/2114646392010359238"}],"desc":"An attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds. Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquery confirmed that the transactions were signed using the affected wallets’ keys","theft":true},{"id":"htff7d719ab2","date":"2026-10-26","name":"Myriad Markets","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited a previously exposed private key belonging to Myriad’s automated market management wallet. The key had reportedly been leaked through a vulnerability in a third-party library used by a backend service. The attacker used the wallet’s privileges to manipulate positions and force incorrect resolutions across 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions, secured the remaining funds, and announced that all affected markets would be voided and users refunded","theft":true},{"id":"ht6e7caada6a","date":"2026-10-25","name":"Yapeswap","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":21900.0,"lo":21900.0,"hi":21900.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2114290073546219799"}],"desc":"YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses","theft":true},{"id":"htcac16d22ef","date":"2026-10-24","name":"X100","kind":"hack","fam":"market","tech":"Flashloan Governance Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":4750000.0,"lo":4750000.0,"hi":4850000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2114006384735916278"}],"desc":"X100’s governance system allowed an attacker to obtain two of three Senate seats using flash-loan-funded X tokens. The attacker immediately used this majority to approve and execute a malicious treasury proposal within the same transaction. The proposal forced the Freezer to swap 400,000 X tokens into an attacker-controlled liquidity pool with zero minimum output, allowing the attacker to extract treasury value through a manipulated trade","theft":true},{"id":"htf5234ea25e","date":"2026-10-23","name":"Initia","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Chain","chains":["Initia"],"usd":2600000.0,"lo":2600000.0,"hi":2700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/initia-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/initia/status/2113661738625155217"}],"desc":"Initia suffered a security incident involving the unauthorized minting of multiple assets on its L1. The attacker reportedly transferred and converted some of the minted assets into Ethereum-based holdings. Initia halted its L1 and rollups while investigating the vulnerability and coordinating with validators, exchanges, and security teams","theft":true},{"id":"ht8ce65aabb4","date":"2026-10-23","name":"Kimchi Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":385000.0,"lo":385000.0,"hi":385000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/lookonchain/status/2113527634999279887"}],"desc":"The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.","theft":true},{"id":"ht0bc207a000","date":"2026-10-22","name":"NEM（NemTokenV2）","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":821920.0,"lo":821920.0,"hi":821920.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2113206749524316486"}],"desc":"The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.","theft":true},{"id":"ht14bd7bdcce","date":"2026-10-22","name":"WAX Multi-Chain Bridge","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Solana","Ethereum","WAX"],"usd":90500.0,"lo":90500.0,"hi":90500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2113290086808990182"}],"desc":"WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum","theft":true},{"id":"htb04ca7a58f","date":"2026-10-21","name":"CoinDCX","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Tron"],"usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"CoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the resulting losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations","theft":true},{"id":"htb837555bf0","date":"2026-10-21","name":"Fearless Wallet","kind":"hack","fam":"keys","tech":"Private Key Leakage","target":"Wallet","usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Polkadot/status/2112910039207800970"}],"desc":"Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.","theft":true},{"id":"ht2690d39711","date":"2026-10-21","name":"Swell","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Base","Hyperliquid"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker gained control of approximately 30 Swell operational keys across multiple networks, including the swETH/rswETH oracle bot. The attacker drained wallet balances, artificially increased swETH and rswETH exchange rates by submitting unbacked reserve values, and redirected EigenLayer reward claims. They also deployed malicious upgrade contracts capable of draining approximately 2,513 ETH, although these upgrades had not been approved or executed when the investigation was published","theft":true},{"id":"htfdd79667eb","date":"2026-10-20","name":"Slice","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Base"],"usd":41000.0,"lo":41000.0,"hi":41000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2112746806585274454"}],"desc":"Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.","theft":true,"onchain":true},{"id":"ht57f3116438","date":"2026-10-19","name":"Argent-style Smart Wallet System","kind":"hack","fam":"bridge","tech":"Smart Contract Vulnerability","target":"Wallet","chains":["Ethereum"],"usd":59800.0,"lo":59800.0,"hi":59800.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2112157232624476254"}],"desc":"An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.","theft":true,"onchain":true},{"id":"htd83eeef467","date":"2026-10-18","name":"AlpsCon AI Trade Hub","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":152809.0,"lo":152800.0,"hi":152809.36,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.rektradar.xyz/web3-daily-exploits-19-oct-2026-alpscon-152k-hardhat-eip7702/"}],"desc":"AlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC. The attack was facilitated by an authorization whitelist containing a publicly known Hardhat test account, which the attacker used through EIP-7702 delegation","theft":true,"onchain":true},{"id":"htb157375841","date":"2026-10-18","name":"Coffer","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Solana"],"usd":0.7,"lo":0.7,"hi":0.7,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Coffer’s BTC pool incorrectly rounded tiny deposits to zero while still minting LP tokens, allowing an attacker to repeatedly obtain shares without providing equivalent assets. The attacker submitted thousands of minimal deposits, diluting existing liquidity providers and minting approximately $18 in illegitimate LP tokens. Coffer paused its pools on October 18, preventing further withdrawals, and deployed a fix on October 19","theft":true},{"id":"hta8a6c53ad2","date":"2026-10-17","name":"Qubic","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Wallet","chains":["Qubic"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/_Qubic_/status/2111796725677715474"}],"desc":"An attacker exploited predictable wallet seeds generated with insufficient randomness in Qubic’s wallet software, compromising 1,404 user wallets and stealing approximately 2.94 trillion QU. The vulnerability affected certain wallets created on Apple devices and Safari browsers. Qubic halted its network at tick 85,371,949, while MEXC froze the account receiving the remaining stolen funds. Seed generation was corrected in wallet version 4.26.4","theft":true},{"id":"hteb16412f20","date":"2026-10-17","name":"BiFi","kind":"hack","fam":"other","tech":"the idle BiFi USDT market freezes its per-block exchange rate and stores the entire 264,059-block inactive gap on the first action, then the interest model charges that full ~36 day gap of deposit interest on every later action in the same block at a utilization rate the attacker sets through permis","chains":["Ethereum"],"usd":165574.0,"lo":165574.0,"hi":165574.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht79e237d448","date":"2026-10-17","name":"TIPMine","kind":"hack","fam":"other","tech":"TIPMine.mine() is permissionless (its only guards are a supply flag and a once-per-day timer that is already open at lastMineTime 0), and it burns and pushes 2% of the TIP supply straight out of the live TIP/SOL Pancake pair through the TIP token's burnFromPool and distributeFromPool, each of which ","conf":"C","n":1,"theft":true},{"id":"ht5452ff2851","date":"2026-10-16","name":"Pirate Chain","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"Chain","chains":["Pirate Chain"],"usd":10746000.0,"lo":10746000.0,"hi":10746000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PirateChain/status/2110774266123767871"}],"desc":"Pirate Chain suffered an exploit in the transparent supply-accounting layer introduced with its Ironwood upgrade. Two transaction-validation failures reportedly allowed an attacker to bypass issuance restrictions and exploit incorrect output-script interpretation, creating approximately 39.8 million unauthorized ARRR. The tokens were transferred into the Sapling shielded pool, obscuring subsequent transfers. The team initially proposed a blockchain rollback but later confirmed that it could not execute one unilaterally","theft":true},{"id":"hted59985fee","date":"2026-10-16","name":"Affluent","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"DeFi Protocol","chains":["TON"],"usd":1053000.0,"lo":1053000.0,"hi":1053000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://defillama.com/protocol/affluent"}],"desc":"Affluent’s lending vaults reportedly suffered unauthorized share minting that allowed attackers to redeem vault assets without providing corresponding deposits. The supplied analysis identifies suspicious transactions on September 30, October 12, and October 16, 2026, involving multiple wallets. Extracted assets were reportedly transferred through exchanges, swaps, and cross-chain services","theft":true},{"id":"ht9cdaf4fad9","date":"2026-10-15","name":"KolanHook","kind":"hack","fam":"other","tech":"KolanHook settles its escrowed ETH buy-windows at the same Uniswap v4 pool's instantaneous spot price with no TWAP or bound and accept() is ungated once a window has expired, so the attacker flash-borrows 6.7 WETH from Balancer, swaps it to move the KLN spot, then calls accept() on two expired windo","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4b4886f0ba","date":"2026-10-14","name":"UNCX Network V2","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Ethereum","Base","BNB Chain","Robinhood Chain"],"usd":89000.0,"lo":86000.0,"hi":1490000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2110616419939566029"}],"desc":"An attacker exploited UNCX Vesting V2’s shared token accounting by creating vesting positions, releasing a large position, donating tokens into the pool, and cancelling a topped-up vest. This sequence allowed a small remaining vesting position to withdraw tokens belonging to other users. UNCX confirmed additional affected assets across four chains and introduced emergency fees and restrictions to contain the exploit","theft":true,"review":["sources disagree on the loss"]},{"id":"ht3b19c8200f","date":"2026-10-13","name":"Gamdom","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"Gambling Platform","chains":["Ethereum","BNB Chain","Polygon","Arbitrum","Optimism","Solana","Tron","Bitcoin"],"usd":4208000.0,"lo":4208000.0,"hi":4208000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://phemex.com/news/article/gamdom-hacked-for-42-million-across-multiple-chains-following-server-breach-99931"}],"desc":"Gamdom suffered a multichain hot-wallet compromise following unauthorized access to an automation server. Investigators traced approximately $4.21M in stolen assets across eight networks. The attacker subsequently bridged, swapped, and distributed funds through multiple wallets and services, including Mayan, Hyperliquid, and THORChain. The precise mechanism used to obtain control of the wallets remains unconfirmed","theft":true},{"id":"ht360f5cb34a","date":"2026-10-10","name":"Papertrade","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Hyperliquid"],"usd":1280000.0,"lo":1280000.0,"hi":1280000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/papertrade_xyz/status/2109308773231911359"}],"desc":"Papertrade, a perpetual trading protocol on HyperEVM, reportedly suffered an oracle manipulation attack shortly after launch. The attacker manipulated Hyperliquid’s ETH order-book midpoint through external trades while opening and closing highly leveraged synthetic positions on Papertrade. Because the protocol used the instantaneous BBO midpoint without TWAP, deviation limits, or independent price validation, manipulated prices were accepted for execution and PnL settlement, transferring approximately $1.28M from the Martingaler LP","theft":true},{"id":"htc7d63463d8","date":"2026-10-09","name":"Ledger (Supply Chain)","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","usd":93000000.0,"lo":86000000.0,"hi":93000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cryptobilis-hardware-wallet-tampering"}],"desc":"Attackers purchased genuine Ledger hardware wallets, installed concealed components capable of capturing recovery phrases, and redistributed the modified devices through resellers. The implants monitored the wallets’ displays during initialization and transmitted captured recovery phrases through cellular connections. Attackers subsequently derived users’ private keys and drained their cryptocurrency holdings. Ledger confirmed that its Secure Element, operating system, and internal infrastructure were not compromised","theft":true},{"id":"ht6d2d93a5c0","date":"2026-10-09","name":"BitBay","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Polygon"],"usd":14838.466608989136,"lo":14000.0,"hi":14838.47,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2108399198035202138"}],"desc":"BitBay’s vault contained a vulnerability in _withdraw() that transferred the contract’s entire token balance whenever liquidity == 0, without restricting withdrawals to the user’s proportional entitlement. The attacker triggered this condition through reposition() and subsequently redeemed one minimal share unit, receiving approximately 14,838.47 DAI belonging to the vault","theft":true},{"id":"ht030483d0aa","date":"2026-10-08","name":"Ethervista","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":18600.0,"lo":18600.0,"hi":18600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2108427455572918626"}],"desc":"EtherVista’s EtherVistaPair.swap() contained an integer overflow vulnerability in its constant-product invariant check. Because the contract multiplied two uint112 reserves without sufficient overflow protection, the calculation could wrap around and incorrectly validate swaps that reduced the pool’s actual reserve product. An attacker registered a malicious contract as an authorized router and executed two crafted swaps to withdraw WETH and VISTA from the pool","theft":true},{"id":"htdc8d838bc4","date":"2026-10-08","name":"X7 Finance","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Ethereum"],"usd":16514.0,"lo":16514.0,"hi":16514.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2108142452888776907"}],"desc":"An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.","theft":true},{"id":"ht15761e9805","date":"2026-10-08","name":"X7Finance","kind":"hack","fam":"code","tech":"X7Pioneer's claimRewards() adds the unaccounted ETH balance delta into totalRewards on every call but only refreshes lastETHBalance when claimable is non-zero, so calling it with an empty tokenIds array re-counts the same donated delta each time and inflates the per-token reward until a single owned","conf":"C","n":1,"theft":true},{"id":"htd00df309c2","date":"2026-10-07","name":"79th Vault","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Arbitrum"],"usd":12500000.0,"lo":12500000.0,"hi":12500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/79thVault/status/2108244949963833685"}],"desc":"An operator hot-wallet private key of 79th Vault was compromised. Using an OPERATOR_ROLE function, the attacker moved 2.01 million 79AU out of the PancakeSwap 79AU/USDT pair in seven transfers, sold them back in about 95 swaps, cut the pool’s USDT reserves from about $15,200,000 to about $3,900,000, and cashed out 16,249 BNB (about $12,500,000). Forty-one seconds later the same operator key sent 3.79 BNB to the attacker address.","theft":true},{"id":"htb30c6cef0b","date":"2026-10-07","name":"Locus Finance","kind":"hack","fam":"other","target":"DeFi Protocol","chains":["Arbitrum"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"theft":true},{"id":"htd40203a5ea","date":"2026-10-06","name":"MakerDAO ETH-A Liquidation Keeper Bot","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":538000.0,"lo":538000.0,"hi":538000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2107391959853600812"}],"desc":"A dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() to send it to an attacker-controlled recipient and unwrap it to ETH. MakerDAO’s core contracts behaved as designed; the vulnerability was in the third-party keeper","theft":true},{"id":"hta77d513164","date":"2026-10-06","name":"Set Protocol","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":21872.67,"lo":13700.0,"hi":21872.67,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2107382337654951943"}],"desc":"ETHMACOAPY’s actualizeFee() rounded redemption backing upward even when no fee was payable. Attackers donated collateral to trigger recalculation, temporarily acquired Set tokens, then redeemed them for more collateral than they contributed, with the difference coming from existing holders’ backing. Two separate EOAs repeated the process across two transactions, draining approximately 8.11 WETH","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht34859c04ae","date":"2026-10-06","name":"MakerDAOFlipKeeper","kind":"hack","fam":"code","tech":"the dormant ETH-A flip-keeper proxy's drain selector has no ds-auth check, so anyone can call it to make the keeper vat.hope() a caller-supplied worker and then deal its four undealt 2020 ETH-A auctions and flux/exit the freed 200 WETH of collateral out","conf":"C","n":1,"theft":true},{"id":"ht61561fd0ad","date":"2026-10-06","name":"SetProtocol","kind":"hack","fam":"code","tech":"actualizeFee() is permissionless and recomputes unitShares with a divCeil even when it mints zero fee, rounding the backing collateral per share up by one with no fee actually taken, so issuing the rebalancing set before the bump and redeeming the same quantity after returns more collateral than was","conf":"C","n":1,"theft":true},{"id":"ht7c4d6982ed","date":"2026-10-05","name":"Based Visa Card Internal Dashboard","kind":"hack","fam":"keys","tech":"Unauthorized Access to Internal Systems","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/BasedOneX/status/2108121017461924090"}],"desc":"Web3 financial platform Based discovered that an unauthorized third party had accessed an internal dashboard used to manage the Based Visa Card program and contained the incident shortly after detection. KYC data collected by the card issuer for some cardholders (including name, ID/passport number, date of birth, and address) may have been obtained. Card numbers, CVV, PIN, ID photos, liveness records, the Based Wallet, and card funds were not affected, and cards continue to work normally. Affected users were notified by email, authorities were informed, and users were warned about phishing and social-engineering risks.","theft":true},{"id":"htaabbaba9df","date":"2026-10-03","name":"MALT","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Polygon"],"usd":72000.0,"lo":72000.0,"hi":72000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2106418632041668784"}],"desc":"An attacker exploited a logic flaw in MALT’s swap function. With negligible input they triggered an external rebalanceHook that pulled DAI from the protocol’s Capital Source into the same pool. The swap then checked its invariant against the post-hook balances and treated the treasury-funded DAI as caller-supplied funds, allowing a disproportionate MALT withdrawal and a loss of about $ 72,000.","theft":true},{"id":"htcc3002b357","date":"2026-10-02","name":"GoldPesa","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Base"],"usd":114900.0,"lo":114900.0,"hi":114999.999186,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2106415554492059872"}],"desc":"GoldPesa’s GPXHooks rebalanced protocol-owned GPX/USDC liquidity through Uniswap v4’s shared PositionManager without ensuring its currency deltas were isolated and settled. An attacker created an unpaid WETH/USDC position within the same PoolManager unlock and then triggered GoldPesa’s hourly rebalance. Because TAKE_PAIR operated on the PositionManager’s net credit, GoldPesa’s legitimate USDC credit offset the attacker’s outstanding debt, allowing the attacker to burn their position and withdraw the resulting USDC. Uniswap v4 itself behaved as designed","theft":true},{"id":"ht73be6d5c0a","date":"2026-10-02","name":"Microsoft’s official X account","kind":"hack","fam":"other","tech":"The X account was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/crypto-news/microsoft-x-account-hijacked-promote-clippy-meme-coin/"}],"desc":"Microsoft’s official X account was accessed without authorization for about 30 minutes. Attackers changed the profile picture to Clippy, followed and reposted an impersonator account, and promoted an unauthorized Clippy meme coin to roughly 13 million followers; a later “apology” post was also unauthorized and deleted. Microsoft told The Verge and others that the account was secured, the posts removed, and that it never authorized any token tied to Clippy or $MSFT.","theft":true},{"id":"htf3ac34e1d1","date":"2026-10-01","name":"NEAR Intents","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":3800000.0,"lo":3800000.0,"hi":3800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/near-intents-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/near_intents/status/2105642219357241796"}],"desc":"NEAR Intents was exploited through a bug in the interaction between its Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract, allowing unauthorized withdrawals. The team stopped services, patched the contract-side vulnerability, and temporarily suspended deposits and withdrawals across multiple networks while completing fixes to the Omni infrastructure. The stolen funds were traced toward KuCoin and then BTC, and NEAR Intents said the losses would be compensated in full","theft":true},{"id":"ht02fa7e5be6","date":"2026-10-01","name":"FlashLoopAdapter","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":305000.0,"lo":305000.0,"hi":305000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2105855276536725599"}],"desc":"FlashLoopAdapter’s open()/close() authorization trusted any caller whose isModuleEnabled() response returned true, allowing an attacker-controlled fake Safe to pass the check. The attacker then supplied each real victim Safe as swapRouter and encoded execTransactionFromModule(...) as arbitrary swapCalldata. Because FlashLoopAdapter was already an enabled module on those Safes, they accepted the calls and transferred or withdrew collateral to the attacker","theft":true},{"id":"htd254212045","date":"2026-09-30","name":"SKYDAO","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":183482.88,"lo":59914.12,"hi":183482.88,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"SKYDAO’s taxed sell flow called its pool controller before the seller’s net tokens were credited to the PancakeSwap V2 pair. The controller sold the 35% tax, moved the gross sell amount from the pair to the dead address through controlburn(), and called pair.sync(), causing the pair to record an almost-zero SKYDAO reserve. When the original transfer subsequently credited the net SKYDAO to the pair without updating that recorded reserve, the attacker exploited the balance/reserve mismatch through pair.swap() to extract USDT liquidity","theft":true,"review":["sources disagree on the loss"]},{"id":"ht1c66393631","date":"2026-09-30","name":"MCN Labs","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":92600.0,"lo":92600.0,"hi":92600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2105145534126358819"}],"desc":"The MCN Labs–related LPBonus contract used inconsistent MSN reserve values in reward accounting. Accrual updated the reward index with the reserve at that moment, while withdrawal applied a user weight based on the reserve at claim time. The attacker first lowered the reserve to ~89.33 MSN during accrual, then raised it to ~491.11 MSN before calling UserRemoveLp, allowing a newly registered LP to claim ~1,442,165.71 FIST against only ~940,041.61 FIST of intervening reward funding—about $92,600 in losses.","theft":true},{"id":"ht982e6c79f1","date":"2026-09-30","name":"MUSystem","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Ethereum"],"usd":36900.0,"lo":36900.0,"hi":36900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2105167166639407447"}],"desc":"MUSystem’s deposit() counted the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation, while withdraw() allowed same-transaction redemption without capping returned ETH to the amount deposited. Sixteen fresh addresses repeated this cycle and drained ETH from the contract, causing about $36,900 in losses.","theft":true},{"id":"htb7d06a5b71","date":"2026-09-30","name":"MUS","kind":"hack","fam":"other","tech":"deposit refunds a first-deposit bonus and also credits it as withdrawable allocation, so a single deposit-withdraw from a fresh address returns more ETH than deposited","usd":36900.0,"lo":36900.0,"hi":36900.0,"conf":"C","n":1,"theft":true},{"id":"ht15476ad0eb","date":"2026-09-30","name":"PositionManager","kind":"hack","fam":"code","tech":"deposit values the vault's existing USDT at the manipulable PancakeSwap V3 spot price, so crashing the spot before depositing mints inflated shares that withdraw redeems in the same transaction","usd":32080.604282,"lo":32080.604282,"hi":32080.604282,"conf":"C","n":1,"theft":true},{"id":"ht317d9cd1ea","date":"2026-09-29","name":"LPBonus","kind":"hack","fam":"code","tech":"reserve inconsistency between reward accrual and LP withdrawal lets a manipulated MSN reserve inflate an LP reward claim","usd":92600.0,"lo":92600.0,"hi":92600.0,"conf":"C","n":1,"theft":true},{"id":"ht4b4af556f5","date":"2026-09-27","name":"Fake GIWA Bridge","kind":"scam","fam":"social","tech":"Impersonation Scam","target":"DeFi Protocol","chains":["Ethereum"],"usd":2080000.0,"lo":2000000.0,"hi":2080000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/singularitynet-rekt"},{"s":"SlowMist Hacked","u":"https://bitquery.io/investigations/fake-giwa-chain-bridge-drain"}],"desc":"Scammers deployed a counterfeit OP Stack-style network impersonating GIWA, including an RPC endpoint, Ethereum bridge and batch-posting infrastructure. The fake network reported GIWA’s expected mainnet Chain ID 9134, causing DYORSWAP and users to mistake it for the legitimate GIWA mainnet. Users voluntarily deposited ETH into the fraudulent bridge. After accumulating deposits, the scammers drained 766.25 ETH to an attacker-controlled address. GIWA’s actual mainnet had not launched, and neither GIWA nor DYORSWAP’s smart contracts were exploited","theft":true,"review":["sources disagree on the date"]},{"id":"ht32eed1492d","date":"2026-09-26","name":"DAOstack","kind":"hack","fam":"code","tech":"permissionless newOrganization lets an attacker hijack an existing Reputation contract and drain the Avatar","conf":"C","n":1,"theft":true},{"id":"ht9768442cb1","date":"2026-09-25","name":"Magic Eden users lose NFTs and  $1.8 million in wETH to legacy approvals exploit","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1775000.0,"lo":1775000.0,"hi":1775000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/magic-eden-nft-exploited-for-1-8-million"}],"theft":true,"headline":true},{"id":"ht53ae1f8521","date":"2026-09-25","name":"Demex Perp","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Demex","Ethereum","BNB Chain"],"usd":191929.0,"lo":191929.0,"hi":191929.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Demex’s bridge was exploited through insufficient verification between its bridge module and external-chain contract system. The attacker used a helper contract to falsify token-deployment reports, registering the low-value nLEND token against canonical WETH and WBNB contracts. Subsequent withdrawals released approximately $191,929 in bridge reserves despite deducting only $10.47 worth of nLEND. The withdrawal limiter also failed because it valued the deducted tokens rather than the assets released","theft":true},{"id":"htdf703c1642","date":"2026-09-24","name":"Bitget","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","XRP","Tron","Zcash"],"usd":387000000.0,"lo":351600000.0,"hi":387500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bitget-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/TheBlockCo/status/2104585324362084504"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitget-hack"}],"desc":"Bitget detected unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24. Subsequent tracing identified approximately $387.5M transferred to attacker-controlled addresses across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron. Bitget states that the incident has been contained and no further unauthorized transfers are possible","theft":true},{"id":"ht1cb146cbe4","date":"2026-09-24","name":"Duelbits","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Gambling Platform","chains":["Ethereum","BNB Chain","Bitcoin","Tron"],"usd":7000000.0,"lo":7000000.0,"hi":7000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/duelbits-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/DuelbitsJoe/status/2103252719217627325"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/duelbits-hack"}],"desc":"Duelbits suffered unauthorized transfers from hot wallets across Ethereum, BSC, Bitcoin, and Tron. Stolen assets were rapidly moved, bridged and largely consolidated into ETH and DAI on Ethereum. Duelbits took its platform offline while investigating and stated that user funds were safe. Security researchers suspect compromise of hot-wallet private keys, but Duelbits has not yet published a technical root cause","theft":true},{"id":"htf5ea43f634","date":"2026-09-24","name":"Payy Network","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":1828589.378132,"lo":1800000.0,"hi":1832149.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/payy_link/status/2103123293687419136"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/payy-network-bridge-exploit"}],"desc":"Payy’s RollupV1 bridge processed a malicious verifyRollup batch containing an unauthorized 1,828,589.378132 USDC withdrawal to the attacker alongside ordinary withdrawals. The batch was submitted using Payy’s prover and validator infrastructure. ExVul reports that the malicious withdrawal had an all-zero burn hash that users cannot normally generate through Payy’s public circuits, indicating that the forged withdrawal entered during proving or aggregation rather than through an ordinary user withdrawal. Payy has confirmed the bridge exploit but has not yet established whether the cause was compromised prover/validator credentials or a proof-aggregation verification flaw","theft":true},{"id":"ht4861ce82f2","date":"2026-09-24","name":"Limit Break Payment Processor","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"NFTfi","chains":["Ethereum","ApeChain","Polygon","Base"],"usd":1800000.0,"lo":1800000.0,"hi":2800000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xQuit/status/2103410682368512505"}],"desc":"A vulnerability in Limit Break’s Payment Processor allowed an attacker to abuse users’ existing token and NFT approvals to transfer assets without a legitimate marketplace purchase. Payment Processor V2 on Ethereum was exploited first, and V3 contained the same vulnerability. Limit Break paused V3 where possible, while whitehats transferred vulnerable NFTs to safe custody because V2 could not be paused and ApeChain V3 could not immediately be paused. The same underlying approval flaw could be used in reverse against WETH approvals, resulting in 660 WETH being stolen along with other tokens before whitehats could secure it ","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5991b1f504","date":"2026-09-23","name":"Meter","kind":"hack","fam":"code","tech":"Unknown","target":"Chain","chains":["Meter","BNB Chain","Ethereum"],"usd":2300000.0,"lo":2300000.0,"hi":2300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2103121249706877178"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/meter-unauthorized-mint"}],"desc":"On September 23 at 21:14 UTC, an attacker exploited a block-validation flaw on Meter mainnet that allowed unbacked MTR and MTRG to be created. The attacker dumped the counterfeit assets through DEXs and bridged proceeds out of Meter. Meter paused both mainnet and its bridge and warned that transactions after block 100731417 may not be honored. The team preserved chain state and is determining a recovery method","theft":true},{"id":"hta5861471ed","date":"2026-09-23","name":"PancakeV3SwapHelper","kind":"hack","fam":"code","tech":"Signed Swap Delta Accounting Error","chains":["BNB Chain"],"usd":1300.0,"lo":1300.0,"hi":1300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbe4131c530","date":"2026-09-23","name":"The personal X account of Nano Labs founder Jack Kong","kind":"hack","fam":"code","tech":"The X account was hacked","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/NanoLabsLtd/status/2102935346057273829"}],"desc":"The personal X account of Nano Labs founder Jack Kong was compromised. Attackers used it to promote a fake AI trading token called Binance World Assets ($BWA), claiming it would use trading fees on BNB Chain to trade bStocks and share profits with holders. Nano Labs’ official account later stated that the posts were unauthorized, that the company had not issued or endorsed any such token, and warned users not to click links or send funds to any contracts.","theft":true},{"id":"ht99f336db49","date":"2026-09-22","name":"Projects on the defunct Neutron chain lose $1.8 million to governance attack, Cosmos Hub halts chain","kind":"hack","fam":"other","chains":["Cosmos"],"usd":9500000.0,"lo":9500000.0,"hi":9500000.0,"ret":7700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/neutron-governance-attack"}],"theft":true,"headline":true},{"id":"ht1d007752fd","date":"2026-09-22","name":"Astroport","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Neutron"],"usd":4900000.0,"lo":4900000.0,"hi":4900000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/astroport_fi/status/2102348511400403381"}],"desc":"Neutron governance proposal 9 contained MsgUpdateAdmin messages that reassigned administration of Astroport contracts despite those contracts previously being administered by Astroport’s own governance contract. After the proposal passed, the attacker migrated Astroport Staking and six Astroport pair contracts to attacker-uploaded code containing a withdraw_all entry point and swept their balances. The attack did not exploit Astroport’s swap or pool logic","theft":true},{"id":"htdaf8e652f0","date":"2026-09-22","name":"Drop","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Neutron"],"usd":4400000.0,"lo":4400000.0,"hi":4400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://publicaml.org/news/2026-09-22-drop/"}],"desc":"Neutron governance proposal 9 reassigned administration of Drop’s dATOM converter and withdrawal-manager contracts to the attacker. After the proposal passed, the attacker migrated both contracts to previously uploaded malicious code exposing a withdraw_all function and swept their entire balances. Drop’s liquid-staking or redemption logic itself was not exploited; the contracts were taken over through Neutron chain governance","theft":true},{"id":"htf3509ecce7","date":"2026-09-21","name":"RWC Token","kind":"hack","fam":"market","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":109460.85,"lo":109460.85,"hi":109460.85,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2101925758214316524"}],"desc":"The RWC token on BNB Smart Chain was exploited with a flash loan. An unprotected burn function let the attacker destroy RWC sitting in the PancakeSwap RWC/USDT pair and call sync() to rewrite reserves, inflating the price before selling back. The pool lost about 109,460.85 USDT in one transaction. The attacker kept about 39,964.07 USDT; the remaining about 69,496.78 USDT was routed to the project’s company and platform wallets by the token’s fee logic.","theft":true},{"id":"ht8031a94fd7","date":"2026-09-21","name":"TheRedVillage","kind":"hack","fam":"bridge","tech":"ungated PolygonTRVRouter forwardRequest relays an attacker-supplied upgradeTo through the router's _authorizeUpgrade role on the SeasonService UUPS proxy, installing a malicious implementation that uses the proxy's TRVZooKeeper roles to pull every player's approved WETH and sweep the vault","usd":80700.0,"lo":80700.0,"hi":80700.0,"conf":"C","n":1,"theft":true},{"id":"htd8fd87b022","date":"2026-09-21","name":"DoinGud","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"NFTfi","chains":["Polygon"],"usd":35486.0,"lo":35380.154566,"hi":35486.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/teddyctf/status/2102235278970933264"}],"desc":"DoinGud’s acceptOffer settlement logic transferred an offer’s USDC price to the caller without deleting or zeroing the consumed offer record. Unlike cancelOffer, the acceptance path omitted the swap-and-pop cleanup. Missing checks also permitted the offerer to accept their own offer and permitted a zero NFT amount. By using amount=0, the attacker avoided listing cleanup and replayed identical acceptOffer calldata, causing the contract to pay the same offer repeatedly. A flash loan supplied the temporary USDC needed to construct the self-funded offer. Independent reporting likewise describes the exploit as failure to clear a bid after acceptance","theft":true},{"id":"ht65455148cf","date":"2026-09-21","name":"GaslessReservoirEnabler","kind":"hack","fam":"bridge","tech":"Smart Contract Vulnerability","chains":["Polygon"],"usd":23000.0,"lo":23000.0,"hi":23800.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2102227043979313539"}],"desc":"The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner. An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.","theft":true},{"id":"ht5c7b3a50fc","date":"2026-09-21","name":"The Internet Token","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"Token","chains":["Base"],"usd":16380.0,"lo":16380.0,"hi":265000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2101969009461567690"}],"desc":"The Internet Token’s privileged LiquidityUnifier contract had INT minting authority and exposed a permissionless swapV3(token, pool) function accepting a caller-supplied pool. Its validation only required the supplied address to contain code, not be excluded, and report INT and the requested token through token0()/token1(). The attacker supplied a malicious fake pool satisfying these checks. swapV3() stored that address as currentPoolV3 and called its swap(), allowing the fake pool to invoke uniswapV3SwapCallback() with an attacker-selected amount. Because the callback trusted currentPoolV3, it caused the privileged contract to mint INT to the fake pool. The attacker bypassed the surrounding supply-increase check by converting the newly minted INT through the project’s Convertor during the call, reducing supply before the check, and converting it back afterward. Approximately 161.3M counterfeit INT was then sold into the genuine INT/WETH pool for 5.85 WETH","theft":true,"review":["sources disagree on the loss"]},{"id":"htd29df02e7b","date":"2026-09-20","name":"Single attacker steals $2.25 million from three crypto projects in the \"Artificial Superintelligence Alliance\"","kind":"hack","fam":"other","chains":["Ethereum"],"usd":2250000.0,"lo":2250000.0,"hi":2250000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fetchai-nunet-and-singularitynet-theft"}],"theft":true,"headline":true},{"id":"ht2f288d87fe","date":"2026-09-20","name":"BV-7X","kind":"hack","fam":"social","tech":"Phishing","target":"Wallet","chains":["Robinhood Chain"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Two BV7X team wallets were compromised through phishing approvals on September 20, allowing an attacker to transfer approximately 6.18 million BV7X using Permit2 and an unlimited token allowance. One approval remained active for 27 days, enabling the attacker to steal another 149.06 million BV7X after liquidity was withdrawn into the affected wallet on October 17. The team subsequently deployed a replacement token contract and initiated a migration intended to exclude the stolen holdings","theft":true},{"id":"ht2034eb5b9b","date":"2026-09-19","name":"Fetch.ai","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":1530000.0,"lo":1530000.0,"hi":1530000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2101457227379044822"}],"desc":"Fetch.ai’s TokenConversionManagerV3 conversionIn() relied on an ECDSA signature from a single authorizer as its principal authorization mechanism. After obtaining that authorizer’s private key, the attacker signed a fresh conversion message for an attacker-controlled recipient and called conversionIn(). Unlike conversionOut(), the function lacked the checkLimits(amount) restriction and did not independently require proof that corresponding assets had been burned or locked on the other side of the conversion. The valid signature was therefore sufficient to release the converter’s entire remaining FET inventory in one transaction","theft":true},{"id":"ht3b7f4d98f3","date":"2026-09-19","name":"NuNet","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Token","chains":["Ethereum"],"usd":462730.0,"lo":462730.0,"hi":462730.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2101457227379044822"}],"desc":"An attacker possessing NuNet’s deployer/mint authority directly called mint() on the NTX token and created 408,532,878.13 unbacked NTX in a single mint. Unlike the related Fetch.ai incident, NuNet’s converter was not the exploited component. Bitquery’s on-chain reconstruction finds that the attacker held the NTX token’s own mint role, allowing the unauthorized supply to be created directly. The same attack cluster compromised multiple project authorization/deployer keys and also drained Fetch.ai’s converter","theft":true},{"id":"hta2bb924111","date":"2026-09-19","name":"MultiversX","kind":"hack","fam":"code","tech":"Unknown","target":"Chain","chains":["MultiversX"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/multiversx/status/2101341591277391953?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"An attacker exploited a VM-level atomicity issue in MultiversX that allowed invalid state changes to occur because of an order-of-operations error in edge cases. Validators paused network progression to contain the incident. MultiversX prepared a protocol correction and coordinated hard-fork recovery from a known-good checkpoint. A September 23 restart attempt failed because insufficient Shard 1 validators synchronized and transitioned into the new epoch within the activation window, so the mainnet remained paused while recovery software was updated for another restart attempt","theft":true},{"id":"hta8461f945d","date":"2026-09-19","name":"Blink Wallet","kind":"hack","fam":"code","tech":"Software Flaw","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/blinkbtc/status/2101290680584695956"}],"desc":"A software flaw at Blink Wallet allowed an attacker to access and empty a few dozen custodial accounts. Services were paused. Non-custodial wallets and the large majority of funds were unaffected. The vulnerability was patched the same day. On September 24, Blink said every affected account had been restored to its exact pre-incident balance. The attacker also accessed account information of about 3,400 other users, but no funds, names, IDs or addresses were taken from those accounts.","theft":true},{"id":"htd06aa96c6d","date":"2026-09-18","name":"Likwid","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":55721.0,"lo":55721.0,"hi":55721.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2100785330849009937"}],"desc":"The BNB Chain DeFi protocol Likwid was exploited due to a margin-borrow contract bug. In the leverage=0 path of LikwidMarginPosition, pair reserves were not updated, so each borrow reused the same quote. The attacker first pumped a thin meme pool, then repeated the collateral/borrow cycle and drained 74.31 BNB (~$ 55,721) from the vault. The funds were later sent to Tornado Cash.","theft":true},{"id":"htece3eff044","date":"2026-09-17","name":"Nostra Money Market","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Starknet","Ethereum"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/nostra-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/nostrafinance/status/2100577538053493076?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"An attacker manipulated the price of NSTR in an illiquid onchain market, causing the manipulated price to enter NSTR’s Pragma oracle response. The attacker then used NSTR at the inflated valuation as collateral in Nostra’s money market to borrow approximately $3.5M of other assets. Pragma says NSTR had limited liquidity and source coverage, the affected oracle response had only two contributing sources, and the manipulated input reflected an onchain pool price rather than a decimals or median-calculation error. Nostra paused its money market following the incident","theft":true},{"id":"htcf34e0fc00","date":"2026-09-16","name":"Flamincome","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":345900.0,"lo":345900.0,"hi":595000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2100256590716907706"}],"desc":"Flamincome’s VaultYUSDT strategy valued its Convex-staked Curve USDP LP position using the strategy’s BaseRewardPool.balanceOf() multiplied by Curve’s spot get_virtual_price(). The attacker used approximately $18M USDT of Morpho flash liquidity to acquire USDP and imbalance-mint USDP metapool LP, then permissionlessly staked LP for the strategy through Convex. This temporarily increased the strategy’s reported holdings/NAV. VaultYUSDT immediately incorporated the manipulated valuation into its share price, allowing the attacker to redeem shares at an inflated value and force the strategy to withdraw real aUSDT liquidity from Aave","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht0ba127c251","date":"2026-09-16","name":"Flamincome","kind":"hack","fam":"market","tech":"Flash Loan Price Manipulation","chains":["Ethereum"],"usd":345900.0,"lo":345900.0,"hi":345900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2100226158046461984"}],"desc":"Flamincome’s legacy USDT strategy (VaultYUSDT) was exploited. The attacker took an ~$18 million USDT flash loan via Morpho, staked manipulated Curve USDP LP into the Strategy to inflate the vault share price, then redeemed aUSDT for about $345,900 in profit.4.","theft":true},{"id":"ht9ec00a1c2e","date":"2026-09-16","name":"Nimiq","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Polygon"],"usd":50463.0,"lo":50400.0,"hi":50463.79,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2100868892742602793"}],"desc":"Nimiq’s Polygon swap contracts served as OpenGSN forwarders while relying on their own preRelayedCall path to authenticate requests rather than independently verifying the user’s signature inside execute(). An attacker registered an EIP-7702 EOA as an OpenGSN relay manager, relay worker and permissive paymaster, then selected Nimiq’s HTLC handlers as the forwarders. This allowed forged open() requests purportedly originating from a partner liquidity wallet to reach the handlers without the expected signature validation. Because that wallet had existing token approvals to the handlers, HTLCs were opened using its USDC, USDT0 and USDC.e, with the attacker-controlled contract as recipient, and subsequently redeemed by the attacker","theft":true},{"id":"htf6f3f8d49b","date":"2026-09-16","name":"PrimeFinance","kind":"hack","fam":"market","tech":"permissionless stale signed oracle report overwrite drains lending pool","usd":33400.0,"lo":33400.0,"hi":33400.0,"conf":"C","n":1,"theft":true},{"id":"ht60e76c9ffa","date":"2026-09-16","name":"Startale","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":2876.0,"lo":2876.0,"hi":2876.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/exvulsec/status/2100111910524072258"}],"desc":"Attacker exploited Startale ERC-7579 smart-account initialization logic to take control of pre-funded counterfactual accounts as they were deployed. The initializeAccount(bytes) permitted an attacker-controlled bootstrap to execute via delegatecall, while an initialization authorization flag stored with transient storage remained set for the entire transaction. The attacker could therefore deploy a victim’s pre-funded account and reinitialize it again in the same transaction with a malicious bootstrap, allowing its assets to be swept","theft":true},{"id":"ht3513ab02a4","date":"2026-09-15","name":"RsETHSafeModule","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","target":"Wallet","usd":7730000.0,"lo":7730000.0,"hi":7800000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2099779127662493875"}],"desc":"An unidentified user’s Gnosis Safe wallet on Ethereum was drained of about $7,730,000. The attacker exploited an authorization bypass in a Router multicall function, used the victim Safe module to DelegateCall attacker-crafted data, injected aEthrsETH into a malicious Uniswap V4 hooked pool, then swapped and redeemed it as rsETH. Kelp later placed a 24-hour pause on an address that received the stolen rsETH.","theft":true},{"id":"htfdf395d658","date":"2026-09-15","name":"DCENT Wallet","kind":"hack","fam":"keys","tech":"Unknown","target":"Wallet","usd":6570000.0,"lo":6570000.0,"hi":6570000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/DCENTWALLETS/status/2100076991798206573"}],"desc":"On September 16, 2026, DCENT (formerly D'CENT) issued an urgent security alert stating that abnormal asset transfers had been detected in its mobile App Wallet (software wallet) and that an emergency investigation was underway. Initial findings indicate the issue is limited to the App Wallet, with no confirmed impact on hardware wallets themselves. Users holding assets in the App Wallet, or using the same mnemonic for both the App Wallet and a hardware wallet, are strongly advised to immediately transfer funds to a secure hardware wallet or other trusted address, and to remain vigilant against scams.","theft":true},{"id":"hte545ddf11f","date":"2026-09-15","name":"Bonfire","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":47400.0,"lo":47.0,"hi":50000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2100064586980528458"}],"desc":"BonfireSwap’s public transfer path accepted a caller-supplied token owner address and passed it as the from address to BONFIRE’s transferFrom without verifying that the caller was that owner or otherwise authorized by the owner. Because BONFIRE saw BonfireSwap itself as msg.sender, existing victim-to-BonfireSwap allowances authorized the transfers. The attacker repeatedly selected wallets with standing approvals, transferred their BONFIRE into the BONFIRE/WBNB PancakeSwap pair, and used the router’s public skim path to collect the resulting excess before selling the harvested BONFIRE for BNB. No private key, admin privilege, flash loan, or PancakeSwap invariant failure was required","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5a13cfaa65","date":"2026-09-14","name":"Long Bridge","kind":"hack","fam":"bridge","tech":"Supply Chain Attack","target":"Bridge","usd":118000.0,"lo":118000.0,"hi":118000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Longdotsupply/status/2099743494994899052"}],"desc":"Long’s custodial bridge released 46.7928 WETH (about $118,000) from its Robinhood Chain vault after a third-party RPC fed the keeper fabricated Arc withdrawal events. No on-chain contract or key was breached. The team halted the keeper, rebuilt verification, and refilled the vault the same day from platform revenue. Users did not lose funds.","theft":true},{"id":"htff352a299d","date":"2026-09-12","name":"Chainflip AMM","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Tron"],"usd":736442.17,"lo":736442.17,"hi":736442.17,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Chainflip/status/2099080597281145040"}],"desc":"An attacker exploited Chainflip’s TRON-specific swap instruction and refund handling. Unlike Chainflip’s other integrations, TRON swap instructions were derived from transaction memos. The attacker could attach a different memo to a transaction already signed by Chainflip validators, causing Chainflip to interpret the transaction as another swap. When that duplicate instruction failed, the protocol refunded it even though the underlying deposit had already produced a payout, effectively allowing the same deposit to be paid twice. The attacker attempted the sequence eight times over approximately 90 minutes, with six unauthorized payouts succeeding","theft":true},{"id":"ht6714901a1c","date":"2026-09-12","name":"YamFinance","kind":"hack","fam":"market","tech":"dormant-DAO quorum governance takeover drains legacy UMA farming contracts","usd":121000.0,"lo":121000.0,"hi":121000.0,"conf":"C","n":1,"theft":true},{"id":"ht62c2ad8f75","date":"2026-09-12","name":"Spiral","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":26800.0,"lo":26800.0,"hi":26800.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2099410818244968850"}],"desc":"The attacker manipulated the Uniswap V4 pool spot price. SpiralHookV2.borrow() valued collateral using poolManager.getSlot0() without TWAP or price-change limits. The noSameBlockSwap guard (keyed by tx.origin) was bypassed via 6 different EOAs, allowing borrowing against inflated collateral in the same block as the pump, resulting in a loss of ~10.7 ETH.","theft":true},{"id":"htf2f34182df","date":"2026-09-11","name":"ether.fi Liquid","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":43260.0,"lo":38130.0,"hi":43260.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2098344499923784048"}],"desc":"Veda’s AtomicQueue allowed the caller of solve() to supply an arbitrary solver address without authenticating that the address had consented to participate as the solver. The settlement logic then executed want.safeTransferFrom(solver, user, amount). The attacker created a worthless token, submitted a self-request offering that token in exchange for liquidETH, and supplied existing liquidETH holders as the solver. Because those holders had previously approved AtomicQueue, the contract used their allowances to pull liquidETH directly from their wallets and transfer it to the attacker’s request. Eleven users were drained in a single transaction","theft":true},{"id":"htdea38308d8","date":"2026-09-11","name":"ORBToken","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":32610.72,"lo":32610.72,"hi":32610.72,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2098662550019694645"}],"desc":"Attackers exploited ORBToken’s receive() function (which auto-granted max allowance) and ORBCore’s whitelist tax exemption. The addPoolAndSell function lacked a reentrancy guard, enabling repeated tax-free sells. Combined with burnLP destroying large amounts of ORB in the LP and a subsequent sync() to manipulate reserves, the attacker extracted about $32,610.72.","theft":true},{"id":"ht7e04aac997","date":"2026-09-11","name":"GDC","kind":"hack","fam":"code","tech":"chained EOA bypass, liquidity misclassification, burn mismatch, and reentrant tax-free exit","conf":"C","n":1,"theft":true},{"id":"hte8e18e731c","date":"2026-09-10","name":"Symbiosis","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":336000.0,"lo":336000.0,"hi":775000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/symbiosis_fi/status/2098384161673285716"}],"desc":"A BridgeV2 receive transaction on BSC minted approximately 2^62 raw units of syBTC to a fresh attacker-controlled EOA, creating an enormous quantity of unbacked syBTC. The same beneficiary subsequently used the unbacked syBTC against syBTC/WBTC liquidity on Ethereum Uniswap V4, extracting and selling approximately 4.39 WBTC. The exact flaw that caused BridgeV2 to accept or authorize the malicious receive has not yet been publicly established","theft":true,"review":["sources disagree on the loss"]},{"id":"ht1de8634b01","date":"2026-09-10","name":"Dominion","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Solana"],"usd":238000.0,"lo":238000.0,"hi":238000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Dominion_Market/status/2098327452497924553"}],"desc":"An attacker exploited Dominion’s treasury wallet associated with SILV, Dominion’s tokenized silver product on Solana. Sunrise confirmed the incident originated with Dominion and was not a compromise of Sunrise infrastructure. Sunrise subsequently removed the SILV market from its UI and warned users not to interact with the SILV token while Dominion and its security partners investigate. The exact mechanism through which the treasury wallet was compromised has not yet been disclosed","theft":true},{"id":"htb423b61fcd","date":"2026-09-09","name":"Nomic","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"DeFi Protocol","chains":["Nomic"],"usd":3150000.0,"lo":3150000.0,"hi":3150000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/nomic-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/osmosis/status/2097623097696251926"}],"desc":"A vulnerability in Nomic’s custom forwarding mechanism allowed an attacker to double-spend nBTC and generate false cross-chain vouchers that were sent to Osmosis. These vouchers resulted in unbacked nBTC entering Osmosis and becoming part of Alloyed BTC’s backing. Osmosis and IBC were not compromised. After detecting the issue, Osmosis froze Nomic and Alloyed BTC inflows and outflows and coordinated an emergency upgrade with validators that froze 22.65 BTC in the attacker’s address","theft":true,"review":["sources disagree on the date"]},{"id":"htcf4db2caaf","date":"2026-09-09","name":"Balancer V1","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited a previously disclosed pricing vulnerability in deprecated Balancer V1 pools, extracting approximately $250,000. The attack was financed through flash loans and temporary collateral positions across three Aave V3 lending markets","theft":true},{"id":"hte62641a13a","date":"2026-09-09","name":"Zentra Finance","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Citrea"],"usd":140030.0,"lo":140030.0,"hi":143000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ZentraFinance/status/2098415552293195831"}],"desc":"Zentra’s Aave V3-based lending implementation contained a boundary-condition accounting flaw in repayWithATokens. The attacker borrowed assets and requested repayment of the outstanding debt plus exactly one base unit. The debt-token path’s ceil-rounding cleared the debt in full, while the aToken burn path’s rounding safeguard reduced the required burn to the caller’s available aToken balance. Because the attacker held no corresponding aTokens, the burn was reduced to zero. The Pool therefore recorded the debt as repaid without receiving equivalent value, allowing the attacker to withdraw the original flash-funded collateral while retaining the borrowed reserve assets. The sequence was repeated against ctUSD and USDC.e","theft":true},{"id":"ht4ef1f321fb","date":"2026-09-09","name":"Amnext","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":116100.0,"lo":116100.0,"hi":116100.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/tenarmoralert/status/2097506987554808212?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"The old BNB Chain DeFi protocol Amnext (AMC), a no-loss lottery/prize-pool product, was exploited. The attacker mass-minted Ticket AMC and drained about 154.02 WBNB from the protocol via PancakeSwap, causing a loss of approximately $ 116,100.","theft":true},{"id":"ht43ca4e846a","date":"2026-09-09","name":"BeatXswap","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":77512.0,"lo":63700.0,"hi":77512.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2098314846765015062"}],"desc":"BeatXswap’s LiquidityVestingConvert contract used the live V3 pool slot0() price as its sole BTX pricing source, without a TWAP, deviation limit, or manipulation check. The attacker flash-borrowed BTX, dumped it into the BTX/USDT V3 pool to sharply reduce sqrtPriceX96, then deposited 10,000 USDT and 2,000 USDT into the vulnerable contracts. The manipulated quote caused the contracts to contribute an excessive amount of their own BTX when minting LP positions, allowing the attacker to extract the BTX before reversing the swaps and repaying the flash loans","theft":true},{"id":"hta82ab67316","date":"2026-09-09","name":"OMNI404","kind":"hack","fam":"market","tech":"Smart Contract Vulnerability","usd":5923.0,"lo":5923.0,"hi":5923.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2098300936720695573"}],"desc":"Ethereum ERC-404 token OMNI404 (O404) derived NFT mint/burn counts from integer balanceOf/units diffs in _transfer(). Its transfer() treated values ≤50 as ERC-721 IDs but still moved a fixed 1e18 units. Using flash loans and Uniswap V3 exact-output swaps (transfer(recipient, 1/2/.../21)), the attacker received full-unit tokens while the pool booked wei-level amounts, draining about 2.4 WETH.","theft":true},{"id":"hteb2ddb1239","date":"2026-09-09","name":"EnsoFinance","kind":"hack","fam":"market","tech":"short-window Uniswap V3 TWAP oracle enables ~9x overvalued strategy deposit","conf":"C","n":1,"theft":true},{"id":"ht1aa14fc003","date":"2026-09-09","name":"EtherFiAtomicQueue","kind":"hack","fam":"code","tech":"missing solver access control drains victim allowances","conf":"C","n":1,"theft":true},{"id":"ht693d419100","date":"2026-09-09","name":"UnifiProtocol","kind":"hack","fam":"code","tech":"unregistered caller-supplied pool trusted for reward eligibility and math","conf":"C","n":1,"theft":true},{"id":"ht95db5f11c4","date":"2026-09-08","name":"WealthManagementV2","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain"],"usd":26414.0,"lo":26414.0,"hi":26414.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2097222515009724817"}],"desc":"The attacker obtained control of WealthManagementV2’s owner privileges, suspected to have resulted from a leaked owner private key. After taking ownership, the attacker used updatePlanConfig() to set period=0 and interestMultiplier/unlockMultiplier=528,300,000. Because the privileged configuration function had no timelock or parameter bounds, the attacker could invest and immediately redeem to generate artificially inflated interest, then use a second investment to unlock and withdraw the resulting balance","theft":true},{"id":"htebedcec91d","date":"2026-09-08","name":"OrderFactory","kind":"hack","fam":"code","tech":"missing access control on createOrderForBuyer drains buyer accounts","conf":"C","n":1,"theft":true},{"id":"htbadc2ad6d4","date":"2026-09-07","name":"Cozy V2","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Optimism"],"usd":160000.0,"lo":160000.0,"hi":163326.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2096881310237426062"}],"desc":"Cozy Finance confirmed an exploit affecting its v2 protection markets on Optimism, draining funds from the Main Set and Rabbithole Set. The affected markets relied on UMA’s Optimistic Oracle to resolve covered events. Cozy subsequently paused the affected Sets and stated there were no longer any open proposals against its UMA-based markets while it coordinated with UMA regarding dispute resolution. The precise mechanism that allowed the attacker to obtain payouts has not yet been confirmed","theft":true},{"id":"ht13e3c849d8","date":"2026-09-07","name":"Unnamed BSC DEX Router","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":46070.0,"lo":46070.0,"hi":46070.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2097153762746159228"}],"desc":"An unnamed DEX router on BNB Chain was exploited because uniswapV3SwapCallback did not authenticate a real V3 pool. The attacker used a fake pool, set victims as payer, and drained existing token allowances via transferFrom, stealing about 62.28 WBNB from 29 wallets in one transaction.","theft":true},{"id":"ht379095202e","date":"2026-09-06","name":"Liquid Network","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"Chain","chains":["Liquid","Bitcoin"],"usd":320000000.0,"lo":320000000.0,"hi":320000000.0,"ret":272000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/liquid-network-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Liquid_BTC/status/2097404704028545175"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/liquid-network-exploit"}],"desc":"An actor exploited a software vulnerability in Elements, the software underlying Liquid, to create approximately 4,000 L-BTC without corresponding BTC backing. The unbacked L-BTC was transferred to SideSwap’s peg-out service, where it was indistinguishable from legitimately backed L-BTC. SideSwap processed a valid peg-out and burned the L-BTC, causing the Liquid Federation to release approximately 3,996 BTC from its Bitcoin reserves. Liquid and SideSwap state that SideSwap’s Peg-out Authorization Key and the federation’s other keys were not compromised","theft":true},{"id":"ht5fea853d7e","date":"2026-09-05","name":"Rocket Perp","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["Rocket","Arbitrum"],"usd":287666.0,"lo":287000.0,"hi":287666.0,"ret":287665.98,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/rcktfoundation/status/2096594778863669498"}],"desc":"An attacker exploited a dormant perpetual market on Rocket by placing artificially inflated orders and trading between accounts under their control. The trades generated artificial profits in one account while bankrupting a disposable counterparty. The profitable account withdrew approximately $287,666 through Rocket’s Bridge, leaving a deficit to be socialized across platform users. Rocket subsequently confirmed the full return of the withdrawn funds","theft":true},{"id":"ht0b5a94e2d8","date":"2026-09-05","name":"Secured Finance Lending","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":104000.0,"lo":72000.0,"hi":180000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Secured_Fi/status/2097182727992963457"}],"desc":"Attackers manipulated the market-unit price used to value lending positions by self-trading both sides of Secured Finance’s order book. getMarketUnitPrice() derived its price from blockTotalAmount / blockTotalFutureValue for orders filled in the current block, allowing attacker-controlled trades to push the reported price near par. The resulting inflated lend position was accepted as collateral, enabling assets to be withdrawn from the lending pool. A block-reliability check did not prevent manipulation performed atomically with flash-loaned liquidity","theft":true,"review":["sources disagree on the loss"]},{"id":"ht1530be4a10","date":"2026-09-05","name":"Dream Health Chain","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":71800.0,"lo":71800.0,"hi":71851.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2096152539767120259"}],"desc":"A flaw in Dream Health Chain’s award state machine allowed the same fixed award to be claimed repeatedly. createAward() recorded a reward without reserving collateral for that award, while participateAward() allowed an already claimed award (status=2) to be reset to claimable (status=1). The attacker repeatedly reset and reclaimed awards for as little as a 0–1 wei transfer, draining funds from the contract’s shared proxy balance","theft":true},{"id":"ht8945e87c9d","date":"2026-09-05","name":"DHC","kind":"hack","fam":"other","tech":"repeatable claim due to missing claimed-flag","usd":71800.0,"lo":71800.0,"hi":71800.0,"conf":"C","n":1,"theft":true},{"id":"ht5433d87b1d","date":"2026-09-05","name":"Reddio RedSonic","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Ethereum"],"usd":22800.0,"lo":22800.0,"hi":22800.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2096439593403089077"}],"desc":"RedSonic’s permissionless registerErc20() allowed stETH to be registered as a separate vault asset even though the ETH vault’s rsvETH share price already counted the vault’s raw stETH balance through its Lido position. As a result, the same stETH balance simultaneously backed rsvETH and newly minted rsvstETH shares. The attacker deposited stETH to inflate the rsvETH share price, redeemed rsvETH against that inflated valuation, then redeemed rsvstETH to recover the same stETH collateral, effectively using one asset balance to support two share classes","theft":true},{"id":"htecd9ab372e","date":"2026-09-03","name":"Notional V2","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":1730000.0,"lo":1727782.0,"hi":1730000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/NotionalFinance/status/2095905726094856391"}],"desc":"An attacker exploited an unchecked uint128 cast in Notional V1’s collateral valuation logic. By minting two fCash positions against the same payer with notionals of 1 and 2^128-1, the attacker engineered a debt balance of exactly 2^128. When the free-collateral check converted the debt to ETH, uint128(balance.abs()) truncated 2^128 to zero, making the insolvent payer appear to have no debt. The attacker then settled the fabricated fCash claims and withdrew approximately $1.73M in USDC and DAI from the Escrow","theft":true},{"id":"ht585ebe7896","date":"2026-09-03","name":"XRPH Wallet","kind":"hack","fam":"bridge","tech":"Seed Phrase Leakage","target":"Wallet","usd":452000.0,"lo":452000.0,"hi":452000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/xrphealthcare/status/2095869911700533721?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On the evening of September 3, 2026, approximately 4,011 XRPH Wallet user accounts suffered unauthorized transactions involving XRPH, XRPHAI and other assets, with roughly $452,000 stolen. Funds were collected, bridged via NEAR Intents to Ethereum, and converted to about 445,198 DAI, which remains unmoved in one address. The project confirmed no issue with the XRP Ledger itself, took the app offline, and is investigating.","theft":true},{"id":"ht824e948742","date":"2026-09-01","name":"GebProxyActions","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Ethereum"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2094986310683705835"}],"desc":"The GebProxyActions contract was exploited due to missing caller access control in the quitSystem function. Victims had previously called it directly instead of via DSProxy delegatecall, setting ownsSAFE[safe] to the GebProxyActions contract. The attacker called GebProxyActions.quitSystem(manager, safe, dst) directly, bypassing GebSafeManager’s safeAllowed check and transferring collateral to themselves.","theft":true,"onchain":true},{"id":"htd0b91006ac","date":"2026-08-31","name":"More Markets exploited for $9.3 million","kind":"hack","fam":"other","chains":["Flow"],"usd":9300000.0,"lo":9300000.0,"hi":9300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/more-markets-exploit"}],"theft":true,"headline":true},{"id":"ht4eefd15699","date":"2026-08-31","name":"Aquifer","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Solana"],"usd":2469729.0,"lo":2469729.0,"hi":2500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2094467984030826622"}],"desc":"Aquifer allowed the caller to supply the input-side token program used during swaps instead of pinning it to the canonical SPL Token Program. The attacker supplied a malicious program that accepted Aquifer’s CPI transfer instruction and returned success without transferring the required input tokens. Aquifer failed to verify the actual input-token balance increase and consequently released real output tokens from its vaults without receiving payment","theft":true},{"id":"ht67b7cf02aa","date":"2026-08-31","name":"Radix","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Chain","chains":["Radix"],"usd":1249946.0,"lo":1249946.0,"hi":1249946.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A Radix Engine execution-layer flaw allowed transactions to obtain direct references to arbitrary internal fungible and non-fungible vaults without verifying that the caller owned or was authorized to access them. The attacker supplied internal vault addresses to custom code and directly invoked withdrawal functionality, bypassing the authorization rules of the accounts and components holding those vaults. Across 26 transactions, the attacker drained nearly the entire Radix supply of six Hyperlane-wrapped assets and then used their normal Hyperlane Warp Routes to bridge the stolen assets out of Radix","theft":true},{"id":"ht81036fd0c0","date":"2026-08-31","name":"Ankr","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"DeFi Protocol","chains":["Flow"],"usd":410000.0,"lo":410000.0,"hi":410000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/flow_blockchain/status/2094506622429307061"}],"desc":"A vulnerability in Ankr’s ankrFLOW liquid-staking contract allowed an attacker to create approximately 8.6M unbacked ankrFLOW. The attacker supplied the unbacked tokens as collateral on MORE Markets and borrowed approximately 15.5M WFLOW from its lending reserve. MORE Markets’ contracts operated as designed; Flow identified the originating vulnerability as Ankr’s ankrFLOW contract","theft":true},{"id":"ht750db5be6b","date":"2026-08-31","name":"Balancer V1","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":234000.0,"lo":110839.0,"hi":234000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2094272540193722744"}],"desc":"An attacker first used swaps to reduce the Balancer V1 BPool’s WBTC reserve to near-dust levels, then exploited rounding in joinswapPoolAmountOut. When the function reverse-calculated the WBTC required to mint a caller-specified amount of BPT, 18-decimal fixed-point arithmetic rounded the required input down to 1 satoshi while still minting the full BPT amount. The attacker minted 4,408.8 BPT through these underpriced joins and exited the pool proportionally to drain DPI, USDC, WETH, and WBTC","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htba7da2b7d2","date":"2026-08-31","name":"Float Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":28000.0,"lo":28000.0,"hi":28000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2094373942291026287"}],"desc":"The attacker used flash-loan-funded swaps to manipulate the Uniswap V3 pool’s slot0 spot price consumed by Float’s Hypervisor contracts. This distorted currentTick() / getTotalAmounts() and consequently the valuation of LP shares, allowing the attacker to repeatedly deposit and withdraw at manipulated share values and extract 10.71 ETH","theft":true},{"id":"hte945c045a3","date":"2026-08-30","name":"Tectonic","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Cronos","Cosmos"],"usd":120400000.0,"lo":120390000.0,"hi":124470000.0,"ret":111200000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tectonic-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/TectonicFi/status/2097128151495373291"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tectonic-theft"}],"desc":"The attacker built a leveraged TONIC/tTONIC collateral position through 98 recursive operations, then transferred TONIC directly into the tTONIC contract twice without minting corresponding tTONIC, increasing the tTONIC exchange rate outside the normal deposit path. The attacker also increased TONIC’s market price, while Tectonic’s price feed relied on VVS Finance and Crypto.com Exchange pricing without smoothing or a circuit breaker. These effects compounded the collateral valuation, allowing the attacker to borrow and remove more than $120M of assets from Tectonic’s lending markets within roughly 11 minutes","theft":true},{"id":"hta3035305a6","date":"2026-08-30","name":"Weft V2","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Radix"],"usd":47200.0,"lo":47200.0,"hi":47200.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Weft V2 accepted HUG as collateral using a severely incorrect live oracle valuation. HUG traded around 0.000131 XRD, but Weft’s Default PriceFeed valued it at 1,330.41 XRD at the time of the borrow, roughly 10 million times its actual value. The attacker bought 539,703.17 HUG for 70.6 XRD and introduced it through the flash_remove_collateral / flash_add_collateral path, which remained enabled despite normal HUG collateral additions having been disabled. Weft valued the HUG at approximately 718M XRD and allowed the attacker to borrow 47.28M LSULP and 13.1005M XRD","theft":true},{"id":"ht53dc70f7c2","date":"2026-08-29","name":"Full Sail","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Sui"],"usd":91000.0,"lo":91000.0,"hi":91000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/FullSailFi/status/2094895938846261466"}],"desc":"Full Sail’s automated vaults suffered losses following abnormal or compromised Switchboard oracle data on Sui. Full Sail uses Switchboard as an external oracle and has safeguards intended to cross-check oracle prices against on-chain pool prices, but it has not yet disclosed how the compromised feed bypassed or interacted with those protections","theft":true},{"id":"ht3ae897e2ff","date":"2026-08-29","name":"Permapod","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["ZIGChain"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Permapod confirmed that an exploit affected its smart contracts and subsequently secured the affected contracts and halted the protocol. The team has not yet disclosed the vulnerability, exploitation mechanism, affected markets, or amount lost","theft":true},{"id":"hta35c3d7fb0","date":"2026-08-28","name":"Fogo Foundation","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Foundation","chains":["Fogo","Solana"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/fogo/status/2094947465040732366"}],"desc":"An unknown actor compromised the Fogo Foundation and transferred 400M FOGO tokens to an attacker-controlled destination. Fogo has not disclosed the specific attack vector, affected Foundation wallet, or how authorization over the tokens was obtained. The Fogo blockchain itself was not initially compromised; the network was subsequently halted as a precaution to prevent movement of the affected tokens and upgrade the network to restrict associated addresses","theft":true},{"id":"ht7cc3c622be","date":"2026-08-28","name":"Exploit on Rain crypto payments infrastructure provider causes losses for \"self-custodial\" neobanks","kind":"hack","fam":"other","chains":["Solana"],"usd":1100000.0,"lo":1100000.0,"hi":1100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/avici-exploit"}],"theft":true,"headline":true},{"id":"htf3988bdbda","date":"2026-08-28","name":"Virtue","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["IOTA"],"usd":894500.0,"lo":894500.0,"hi":894500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited Switchboard’s IOTA guardian-attestation design to replace the signing keys of all 14 production oracles and submit arbitrary IOTA prices. The attacker first inflated IOTA to $10M, allowing 4.94M unbacked VUSD to be minted against 1.027 IOTA, then crashed the reported price to trigger liquidations of healthy positions. By pre-positioning the freshly minted VUSD in Virtue’s Stability Pool, the attacker captured 16.72M IOTA-equivalent of collateral from the manipulated liquidations","theft":true},{"id":"htd6d71a0e85","date":"2026-08-28","name":"Ajna V2","kind":"hack","fam":"code","tech":"Liquidation Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":775400.0,"lo":124800.0,"hi":775400.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Attackers exploited Ajna’s internal liquidation accounting across multiple lending pools. Current on-chain analysis shows liquidation operations could be sequenced to extract collateral while returning insufficient quote assets to the pool, including bucketTake, collateral removal, take, and settlement operations","theft":true,"review":["sources disagree on the loss"]},{"id":"ht2065eee6e7","date":"2026-08-28","name":"Avici","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"Crypto Card","chains":["Solana"],"usd":500859.0,"lo":500859.0,"hi":500859.22,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/avici/status/2093439613201482068?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"A vulnerability in a version of Rain’s Solana card contract used by Avici allowed unauthorized withdrawals from the contract holding users’ card balances. Avici reported that 1,685 users were affected for $500,859.22. The vulnerable contract was subsequently upgraded across all affected programs","theft":true},{"id":"ht7baf27bba3","date":"2026-08-27","name":"Moonwell Lending","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":8700000.0,"lo":8700000.0,"hi":8700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2092914508666753081"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moonwell-price-manipulation-attack"}],"desc":"The attacker manipulated the spot price of the relatively illiquid MAMO token, increasing the collateral value recognized by Moonwell. The attacker used the inflated MAMO collateral to borrow liquid assets including cbBTC, ETH/WETH, USDC, and wstETH, leaving the lending markets with undercollateralized positions","theft":true},{"id":"htabfcc0e283","date":"2026-08-27","name":"CashCowCoin","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":117400.0,"lo":117400.0,"hi":117400.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2093219144896557483"}],"desc":"CashCowCoin’s unverified trading router implementation contract had a flawed sell() flow. After the PancakeSwap Router completed the CCC→WBNB swap, the proxy called a privileged token function to transfer post-tax CCC from the Pair to the dead address and invoked Pair.sync(). This burned the sell-side CCC while permanently retaining the reduced WBNB reserve, enabling repeated draining of the pool’s WBNB through about 80 iterative sell cycles.","theft":true},{"id":"ht3b048dc564","date":"2026-08-27","name":"CCC","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":117000.0,"lo":117000.0,"hi":117000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The CCC sell() flow allowed CCC held by the PancakeSwap liquidity pair to be burned and then synchronized the pair’s reserves. This artificially reduced the pair’s CCC reserve and distorted its AMM price, enabling the attacker to repeatedly sell CCC against the manipulated pool and extract BNB liquidity","theft":true},{"id":"ht6684ab6954","date":"2026-08-26","name":"Enjin","kind":"hack","fam":"code","tech":"Ownership Takeover","target":"NFTfi","chains":["Ethereum"],"usd":162000.0,"lo":142000.0,"hi":162000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2092455321654694355"}],"desc":"Enjin’s legacy CryptoItems infrastructure was exploited through a storage-slot collision between a registered adapter and its Managed Delegate Proxy. Because adapter functions execute in the proxy’s storage context via DELEGATECALL, the attacker called the adapter’s public initialize(uint256), which wrote the attacker’s address into the proxy’s pendingManager storage slot. The attacker then called acceptManager(), gained managerial control, registered a malicious adapter, stole ENJ-backed assets from users, and liquidated them through melt().","theft":true},{"id":"ht0842b79c98","date":"2026-08-25","name":"CometDEX","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Stellar"],"usd":717000.0,"lo":717000.0,"hi":717518.92,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blend_capital/status/2092288347766984713"}],"desc":"CometDEX’s Soroban AMM allowed same-asset swaps such as USDC→USDC. When token_in and token_out were identical, the contract loaded two independent copies of the same reserve record, added the input amount to one copy and subtracted the output from the other, then wrote both back to the same map key. The second write overwrote the first, causing the pool’s recorded reserve to fall below its actual token balance. The attacker then deposited against the understated reserve, received excess LP shares, and redeemed those shares for real pool assets. The cycle was repeated 36 times using flash liquidity. Blend contracts themselves were not exploited, but Blend Backstop depositors were exposed because the backstop held BLND/USDC Comet LP shares","theft":true},{"id":"htd472e02639","date":"2026-08-25","name":"FH Token","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2092427353456812207"}],"desc":"FHToken was exploited through faulty sell-handling logic in its token contract. Reporting on the incident identifies a flaw in _transfer involving the isSell path, which incorrectly altered token balances during sell transactions. The attacker repeatedly bought and sold FH to exploit this behavior and extract value from the FH/USDT PancakeSwap V2 pool","theft":true},{"id":"ht055a6fcbe3","date":"2026-08-24","name":"Nesa","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Chain","chains":["Nesa"],"usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/nesa-rekt"}],"desc":"Nesa was exploited through a Cosmos EVM vulnerability involving inconsistent balance accounting between Cosmos EVM and the Cosmos SDK. In the shared exploit mechanism documented by Cosmos Labs, delegation of locked tokens from a vesting account through the staking precompile could cause an unchecked EVM balance underflow to approximately 2^256. The resulting artificial balance could then be used to overflow a high-balance victim account, reducing the victim balance to zero while transferring its legitimate tokens to the attacker, with no net increase in token supply. Nesa has confirmed exploitation of a Cosmos EVM vulnerability but has not publicly disclosed its Nesa-side exploit transaction or victim account, so application of the exact shared mechanism to Nesa remains strongly supported but not independently demonstrated at transaction level","theft":true},{"id":"ht6a3fb61bb0","date":"2026-08-24","name":"PacaSwap DEX","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Constellation"],"usd":90750.0,"lo":90750.0,"hi":90750.0,"ret":90750.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited an arithmetic flaw in Tessellation’s metagraph fee-transaction accounting. A specially constructed batch of fee transactions caused an intermediate subtraction to underflow and wrap into a large positive balance, creating SWAP that was not backed by deposits. Because validation focused on the resulting batch state rather than validating each balance-changing operation individually, the final balances remained apparently valid and reconciled. The attacker created the unbacked SWAP in one snapshot and subsequently sold it into PacaSwap’s SWAP/DAG liquidity pool, extracting approximately 12.1M real DAG contributed by LPs. The flaw was specific to Tessellation’s metagraph fee-transaction path; Constellation’s Hypergraph and DAG supply were unaffected","theft":true},{"id":"ht5bc1490407","date":"2026-08-23","name":"TermFinance Vaults","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":8500000.0,"lo":8500000.0,"hi":8500000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/term-labs-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/term_labs/status/2091428394130886740"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/term-finance-governance-attack"}],"desc":"An attacker acquired majority voting power in the thinly held governance tokens controlling Term Vaults and used that voting power to pass malicious governance proposals. The proposals gave the attacker control over the affected vaults, enabling the underlying assets to be withdrawn. The attack therefore did not require stealing an administrative key or bypassing an authorization check—the attacker obtained the required authority through the governance mechanism itself. Recent reporting indicates the affected products were Term’s strategy vaults built on Yearn V3 infrastructure rather than Term Finance’s core fixed-rate repo lending architecture","theft":true},{"id":"ht0c71a1944d","date":"2026-08-23","name":"warp.green","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Chia","Ethereum"],"usd":93000.0,"lo":93000.0,"hi":93000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/warpdotgreen/status/2091772015598325920"}],"desc":"warp.green’s ERC-20 bridge was exploited through a vulnerability in the Chia-side bridge module, resulting in two malicious transactions totaling 93,000 USDC-denominated assets. The attacker subsequently converted the assets to ETH. warp.green said it verified that there were no additional malicious transactions and offered the attacker a 10% white-hat bounty in exchange for returning 90% of the funds within 48 hours","theft":true},{"id":"ht8014f16a30","date":"2026-08-23","name":"Arrakis V1","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":7100.0,"lo":7018.0,"hi":7100.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/exvulsec/status/2091521539585999337"}],"desc":"The attacker flash-loaned 1,800 WETH and swapped approximately 145 WETH for ENS to manipulate the ENS/WETH Uniswap V3 pool’s instantaneous spot price. The Arrakis V1 vault used pool.slot0() to value its Uniswap V3 position during mint() and burn() without a TWAP or price-deviation guard. The attacker minted vault shares while the price was distorted, restored the pool price, then burned the shares for a more valuable token mix, resulting in approximately 2.94 WETH profit","theft":true},{"id":"ht7cf9d1a939","date":"2026-08-23","name":"Surf Lending","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Cardano"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A machine with access to Surf Lending’s admin key was compromised. According to Surf’s lead developer, the incident was not caused by a smart-contract bug. Surf placed the protocol into maintenance mode, temporarily migrated user vaults and supplied assets to its multisig treasury wallet, and began migrating the V1 contracts while rebuilding the affected infrastructure in a more secure environment. Surf subsequently described the event as a security incident and prioritized restoring V1","theft":true},{"id":"ht65ccd97db1","date":"2026-08-22","name":"KiiChain","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Chain","chains":["KiiChain","Cosmos"],"usd":9700000.0,"lo":9160000.0,"hi":9700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kiichain-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/KiiChainio/article/2091721027583709214"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cosmos-based-blockchain-exploits"}],"desc":"An attacker exploited chained balance-accounting defects in the shared Cosmos EVM module used by KiiChain. By deploying a contract at a precomputed vesting-account address and delegating one wei more KII than its spendable balance, the attacker triggered an arithmetic underflow in the staking precompile’s EVM balance write-back. Combined with a missing overflow guard in the EVM value-transfer path, this allowed real KII to be redirected from victim accounts to attacker-controlled addresses without increasing total supply. The sequence was repeated against 18 targets","theft":true,"review":["possible duplicate within one source"]},{"id":"ht33d86cbccd","date":"2026-08-22","name":"TAC","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"Chain","chains":["TAC"],"usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tac-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/TacBuild/status/2091873937655574938"}],"desc":"An attacker exploited a vulnerability in the shared Cosmos EVM precompile layer and transferred 2,985,651,403 TAC from a single account to another account without authorization. TAC states that the incident was a drain rather than a mint: no new TAC was created and total supply remained unchanged. The network was halted at block 24,671,475 to contain the incident","theft":true},{"id":"ht4eab1560d4","date":"2026-08-22","name":"The Sandbox","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Base","BNB Chain","Ethereum"],"usd":675000.0,"lo":517170.0,"hi":675000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TheSandboxGame/status/2091978565256417332"}],"desc":"The Sandbox’s SAND cross-chain bridge was exploited after an attacker abused approveAndCall on the Base SAND OFT contract to hijack LayerZero delegate permissions. The attacker changed trusted cross-chain configuration, minted unbacked SAND on Base and BNB Chain, and used the compromised bridge path to extract approximately 14.75M backed SAND from the Ethereum OFT adapter. The Sandbox disabled bridging on Base and BNB Chain and stated that SAND on Ethereum and Polygon was unaffected at the token-contract level","theft":true},{"id":"ht0480e51806","date":"2026-08-21","name":"MANTRA Chain","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Chain","chains":["MANTRA"],"usd":3600000.0,"lo":3600000.0,"hi":3600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mantra-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/MANTRA_Chain/status/2093311678205374867"}],"desc":"MANTRA Chain halted its network after detecting an exploit involving its Cosmos EVM module. The incident was isolated to two MANTRA-controlled wallets and was traced to a vulnerability in an upstream dependency. MANTRA contained the immediate threat, prepared a patched release, and stated that no user funds were exploited","theft":true},{"id":"htd7a50f892c","date":"2026-08-19","name":"BounceBit","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Chain","chains":["BounceBit","Bitcoin","Ethereum","BNB Chain"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/bouncebit/article/2090785561800061430"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bouncebit-exploit"}],"desc":"BounceBit Chain was exploited through an authorization flaw in a protocol-level module inherited from the Evmos stack. A function supporting vesting/lockup operations allowed the caller to specify another account as the source of funds without correctly verifying that the source account had authorized the debit. The attacker used this flaw to transfer 286.54M BB from nine accounts without stealing private keys or forging signatures. BounceBit subsequently halted the chain and decided to retire its Layer 1 and reissue BB on BNB Chain from a pre-exploit snapshot","theft":true},{"id":"ht91b63cd90c","date":"2026-08-19","name":"Allbridge","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":190000.0,"lo":189751.554381,"hi":191000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2090994186346790999"}],"desc":"Allbridge’s CCTPTokenMessenger treated a valid Circle-attested message as proof that USDC had actually been transferred. An attacker created an arbitrary CCTP message on Polygon declaring a 1,000,000 USDC transfer without burning any USDC and directed its recipient to an attacker-controlled contract rather than Circle’s TokenMessengerV2. Circle legitimately attested the generic message, but redeeming it on Base minted no USDC. Allbridge nevertheless trusted the attacker-controlled amount encoded in the message and recorded a 1,000,000 USDC deposit without checking for a corresponding token balance increase. The attacker flash-loaned 808,844 USDC to temporarily bring the router’s balance to the declared amount, redeemed the phantom credit for 999,000 USDC, repaid the loan, and drained the router’s existing liquidity. A copycat subsequently used the same technique to take the remaining funds","theft":true},{"id":"ht152b5b9dfd","date":"2026-08-18","name":"Maya Protocol","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Mayachain"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/AaluxxMyth/status/2089792721086996703"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mayachain-exploit"}],"desc":"A multi-bug interaction in MayaChain’s outbound/slashing and pool-accounting flow caused a staged ARB.LINK pool to be credited with approximately 49.45M CACAO that was never actually transferred into the pool. Multiple messages sharing one native transaction ID caused the final DONATE message to overwrite outbound tracking state, making legitimate LINK outbounds appear missing. MayaChain consequently treated them as unauthorized vault outbounds and invoked slashing. During the resulting subsidy calculation, pool state was updated with an uncapped CACAO credit before the corresponding Reserve-to-Asgard transfer was attempted. That transfer failed because the Reserve lacked sufficient CACAO, but the inflated pool state was not rolled back. The attacker then added liquidity to the effectively asset-empty ARB.LINK pool, obtained nearly all pool ownership, and withdrew approximately 48.87M CACAO from Asgard liquidity","theft":true},{"id":"ht6df9a2f486","date":"2026-08-15","name":"Fox Market","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":120000.0,"lo":118700.0,"hi":120000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2089196291800908164"}],"desc":"On August 15, 2026 Fox Market was exploited through its FoxLpBondsPool.stake() bond minting path. The contract read the FOX spot price from the PancakeSwap V2 FOX/USDT pool before allowing the same transaction to move that pool. The attacker used flash liquidity to buy almost all FOX from the pool, while the mint calculation continued using the pre-swap price snapshot, resulting in approximately 88.66M sFOX and 91.3M FOX of reported issuance. The attacker then sold an immediately unlocked ~2.66M FOX referral allocation into the USDT-heavy pool, repaid the flash liquidity, and retained approximately $120K in realized profit","theft":true},{"id":"ht533f721ada","date":"2026-08-14","name":"Bodega Market","kind":"hack","fam":"market","tech":"Unknown","target":"DeFi Protocol","chains":["Cardano"],"usd":3600.0,"lo":3600.0,"hi":3600.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited a vulnerability in Bodega Market’s prediction-market contracts to drain rewards and market seed funds. The team associated the exploit with a transaction involving an M-EVIL_ORACLE token, but has not yet disclosed the underlying vulnerability or explained how that token enabled the drain. Because the exploit mechanism remains under investigation, the precise root cause is not yet confirmed","theft":true},{"id":"ht5178ce1a33","date":"2026-08-11","name":"Harmony Bridge","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"Chain","chains":["Harmony"],"usd":3200000.0,"lo":3200000.0,"hi":3200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/harmony-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/harmonyprotocol/status/2087487246148542527"}],"desc":"On August 11, 2026, the Harmony chain was affected by an infinite mint exploit, per a CertiK alert. The loss amount was not disclosed and no dedicated post-mortem has been published.","theft":true},{"id":"ht66e4c1354d","date":"2026-08-09","name":"Coinsbuy","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Wallet","chains":["Ethereum","Tron"],"usd":7900000.0,"lo":7900000.0,"hi":8000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/coinsbuy-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/DarkWebInformer/status/2086566165665522120"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinsbuy-exploit"}],"desc":"On August 9, 2026, Coinsbuy’s wallet infrastructure was exploited via improper access control, allowing an attacker to drain approximately $7.9M across Ethereum and Tron. Flagged by PeckShield; no dedicated post-mortem has been published.","theft":true},{"id":"ht54055cf67b","date":"2026-08-09","name":"Coreum Bridge","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["XRPL","Coreum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/txEcosystem/status/2087269579190046895"}],"desc":"On August 9, 2026, the Coreum Bridge connecting XRPL and Coreum was exploited via a flaw in its bridge logic, resulting in a loss of approximately $200,000. No dedicated post-mortem has been published.","theft":true},{"id":"ht6c12b90fcf","date":"2026-08-09","name":"USM","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":136000.0,"lo":136000.0,"hi":136000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2086644725143183639"}],"desc":"On August 9, 2026, USM on Ethereum was exploited via an arithmetic error in its token accounting logic, resulting in a loss of approximately $136,000. Flagged by SlowMist; no dedicated post-mortem has been published.","theft":true},{"id":"ht2c0432a0b6","date":"2026-08-08","name":"Oraichain","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"Chain","chains":["Oraichain"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/oraichain/status/2086774707882451012"}],"desc":"On August 8, 2026, the Oraichain network was exploited via an unbacked cross-chain mint, allowing tokens to be minted without matching collateral on the origin chain. Flagged by the Oraichain team; the loss amount was not disclosed and no dedicated post-mortem has been published.","theft":true},{"id":"ht5bfd5fd661","date":"2026-08-08","name":"Atomic Green","kind":"hack","fam":"code","tech":"Signature Replay","target":"DeFi Protocol","chains":["Arbitrum"],"usd":29984.0,"lo":29984.0,"hi":29984.27,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2086042810265055619"}],"desc":"On August 8, 2026, Atomic Green on Arbitrum was exploited via a signature replay vulnerability, resulting in a loss of approximately $29,984. Flagged by SlowMist with the exploiter address and transaction identified on-chain.","theft":true},{"id":"htb2f3c16968","date":"2026-08-07","name":"Ravencoin","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"Chain","chains":["Ravencoin"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 7, 2026, the Ravencoin network was affected by a missing input validation issue. Flagged by the Ravencoin project; the loss amount was not disclosed and no dedicated post-mortem has been published.","theft":true},{"id":"htf5baeeeb9f","date":"2026-08-06","name":"RRWallet","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Wallet","chains":["Bitcoin"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/coinspect/status/2085430121670811898"}],"desc":"On August 6, 2026, RRWallet was exploited via weak key generation on Bitcoin, allowing an attacker to derive private keys and steal approximately $2,000,000. Flagged by Coinspect; no dedicated post-mortem has been published.","theft":true},{"id":"ht734c7a0247","date":"2026-08-06","name":"Unistreets","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":17750.0,"lo":17750.0,"hi":17750.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/unistreetapp/status/2085225140690751793"}],"desc":"On August 5, 2026, Unistreets on Ethereum was exploited via an arbitrary external call vulnerability, resulting in a loss of approximately $17,750. The exploiter address and transaction were identified on-chain.","theft":true},{"id":"ht2f409798ab","date":"2026-08-06","name":"Panther Protocol","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Base"],"usd":7578.0,"lo":7578.0,"hi":7578.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 6, 2026, Panther Protocol on Base was exploited via a malicious governance proposal, resulting in a loss of approximately $7,578. No dedicated post-mortem has been published.","theft":true},{"id":"ht153a46e449","date":"2026-08-06","name":"Hyperliquid Malaysia","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Wallet","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 6, 2026, a wallet associated with Hyperliquid Malaysia was exploited via a compromised private key on Solana. The exploiter address was identified on-chain; the loss amount was not disclosed and no dedicated post-mortem has been published.","theft":true},{"id":"ht34c5a050a4","date":"2026-08-05","name":"KITE Foundation","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Wallet","chains":["Ethereum"],"usd":13340000.0,"lo":13340000.0,"hi":13340000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/KiteAIFDN/status/2090006296628253137"}],"desc":"Sixteen wallets associated with KITE Foundation were drained simultaneously in a coordinated private-key compromise. The transfers were ordinary ERC-20 transfer() calls authorized by the affected wallets rather than an exploit of the KITE token contract. KITE Foundation subsequently paused Ethereum KITE transfers and cross-chain bridges, then deployed a replacement ERC-20 and migrated legitimate balances 1:1 from a pre-incident snapshot while excluding attacker-controlled addresses","theft":true},{"id":"ht99a8c10530","date":"2026-08-05","name":"StrongBlock","kind":"hack","fam":"insider","tech":"governance takeover of an abandoned Governor","usd":72000.0,"lo":72000.0,"hi":72000.0,"conf":"C","n":1,"theft":true},{"id":"ht4ae5bc7084","date":"2026-08-05","name":"ZEUS","kind":"hack","fam":"keys","tech":"Infrastructure Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/ZeusLN/status/2085113369367871605"}],"desc":"ZEUS (Bitcoin Lightning Network wallet and LSP provider) infrastructure suffered a cybersecurity incident/attack within the last few hours; the attack was mitigated. Services were temporarily taken offline for a full systems audit out of caution; no customer funds were lost or at risk, and closed LSP channels will be replaced upon restoration. The incident appears limited to ZEUS infrastructure, with no evidence of a Lightning node software vulnerability.","theft":true},{"id":"htcda73847cf","date":"2026-08-03","name":"RISEx","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Chain","chains":["RISE","Ethereum"],"usd":673012.0,"lo":673011.56,"hi":673012.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/risextrade/status/2084350396609520105"}],"desc":"On August 3, 2026, a misconfigured withdrawal permission in RISEx's RWA strategy, deployed July 13, allowed an unauthorized address to withdraw 673,011.56 USDC. RISEx patched the contract within minutes and compensated XLP depositors from monthly fees.","theft":true},{"id":"ht4a14fb36a7","date":"2026-08-03","name":"AIC","kind":"hack","fam":"other","tech":"pair skim / reserve-mismatch exploit, flash-swap leveraged","usd":21500.0,"lo":21500.0,"hi":21500.0,"conf":"C","n":1,"theft":true},{"id":"ht50fa8c8435","date":"2026-08-02","name":"MOKE","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Liquidity Pool","chains":["BNB Chain"],"usd":907000.0,"lo":907000.0,"hi":907700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2084102947500368164"}],"desc":"MOKE token on BNB Chain suffered a $907K exploit in early August 2026 via suspected liquidity pool manipulation, detected by TenArmor. The exact attack vector remains unconfirmed.","theft":true},{"id":"hta72c678ea4","date":"2026-08-02","name":"LOOPSDAO","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Liquidity Pool","chains":["BNB Chain"],"usd":693500.0,"lo":690000.0,"hi":693500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2084157533204197380"}],"desc":"On August 2, 2026, LpdFi (LOOPSDAO's lending product on BNB Chain) was drained of ~$690K when an attacker flash-borrowed USDC and manipulated the PancakeSwap LPD/USDC pair price via donate-and-sync. The inflated price was used to compute interest owed, which the protocol paid by burning its own LP position and forwarding 99% of the USDC proceeds to the attacker.","theft":true},{"id":"ht65c6843bfd","date":"2026-07-31","name":"COLDCARD","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Wallet","chains":["Bitcoin"],"usd":116000000.0,"lo":100000000.0,"hi":130000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/coldcard-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/glxyresearch/status/2084411904924045370"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coldcard-hardware-wallet-flaw"}],"desc":"Starting 30 July 2026 attackers drained BTC in four waves from thousands of addresses whose seeds were generated on Coldcard hardware wallets running firmware 4.0.0+ (March 2021 onward), where a firmware bug bypassed the dedicated hardware RNG during key generation, cutting effective key strength to as little as 40 bits and allowing offline brute-forcing.","theft":true},{"id":"htcc1d94c1dc","date":"2026-07-30","name":"Two arrested after Flare Network staking site scammed users out of 3.4 million XRP (~$8.5 million)","kind":"followup","fam":"other","chains":["ripple"],"usd":8500000.0,"lo":8500000.0,"hi":8500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-flare-network-staking-site"}],"headline":true},{"id":"ht87fbe5231f","date":"2026-07-30","name":"Swan Treasury","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain"],"usd":625000.0,"lo":625000.0,"hi":625000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2083039796784410802"}],"desc":"On July 30, 2026 an attacker used Swan Treasury's leaked off-chain signer key to generate valid signatures with the discount parameter set to 1, buying ~687,000 STY on BNB Chain at roughly 1/100 of intended price using a ~19,700 USDT PancakeSwap flash loan, then dumping the tokens for a ~$625K protocol loss.","theft":true},{"id":"htcdfb23cda0","date":"2026-07-30","name":"Set Protocol","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":9600.0,"lo":9600.0,"hi":9600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2082767887245410320"}],"desc":"On July 30, 2026, Set Protocol was exploited for ~$9.6K via reentrancy in Index Coop's ExchangeIssuance contract. Attacker supplied malicious manager pre-issue hook that inflated positionMultiplier mid-issuance. Unlocked state allowed the hook to mutate position accounting, causing overpayment of assets.","theft":true},{"id":"htc662f73211","date":"2026-07-28","name":"Crypto DAO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":8200000.0,"lo":8200000.0,"hi":8200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 28, 2026, an unprotected exec() function in Crypto DAO's vault on BNB Chain allowed any caller to execute transfers, draining $8.2M USDT.","theft":true},{"id":"ht243d4bd170","date":"2026-07-28","name":"LULA","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":578100.0,"lo":578000.0,"hi":578300.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CertiKAlert/status/2082309959484911845"}],"desc":"On July 29, 2026, LULA (BEP-20 token on BSC) suffered a ~$578K exploit via business logic flaw. Attacker exploited an accessible recycle() function in the Rental contract to transfer LULA directly from PancakeSwap V2 pair, then manipulated pair reserves via sync() call. Repeated recycle() calls drained LULA reserves to near-zero, allowing small swap for nearly all USDT.","theft":true},{"id":"ht40362ca1ca","date":"2026-07-28","name":"Crypto DAO","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":52000.0,"lo":52000.0,"hi":52000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/GoPlusSecurity/status/2082353004980707444"}],"desc":"The Pro token contract of Crypto DAO was exploited due to missing access control, with the attacker calling publicly accessible vault functions. According to GoPlus Security’s analysis, the attacker’s actual profit was approximately $52,000, while the contract lost around 167,200 Pro tokens. The related addresses monitored by Blockaid collectively held approximately $8.2 million worth of USDT (not the actual stolen amount).","theft":true},{"id":"ht3dc2bf01fc","date":"2026-07-26","name":"WEMIX.FI Lend","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["WEMIX3.0"],"usd":737000.0,"lo":737000.0,"hi":6250000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/coinbureau/status/2081559245653483870?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On July 26, 2026, an attacker obtained administrative control of the WEMIX$ stablecoin contract and minted 5.23M counterfeit WEMIX$ tokens. These were swapped for real WEMIX and USDC.e and dispersed across Ethereum and BNB Chain. The total exploit was estimated at $6.25M.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht560a5fb5d2","date":"2026-07-26","name":"ChainConnect","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Avalanche","Polygon"],"usd":650000.0,"lo":650000.0,"hi":650000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/VenomFoundation/status/2082101022928040063"}],"desc":"On July 26, 2026, ChainConnect's EVM integration was compromised through unauthorized access, allowing attackers to drain ~$650,000 in tokens from bridge contracts on Ethereum, BNB Chain, Avalanche C-Chain, and Polygon across 23 transactions. Venom Network assets were unaffected.","theft":true},{"id":"htba534f78a9","date":"2026-07-26","name":"Garden","kind":"hack","fam":"keys","tech":"Database Breach","target":"DeFi Protocol","chains":["Ethereum","Base","Arbitrum","BNB Chain"],"usd":450000.0,"lo":450000.0,"hi":450000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2081409252489298100"}],"desc":"On July 26, 2026, Garden Finance lost $450K across Ethereum, Base, Arbitrum, and BSC when an attacker breached an independent solver's off-chain database and inserted fraudulent transaction records to trigger unauthorized HTLC fund releases.","theft":true},{"id":"ht7a971726a6","date":"2026-07-25","name":"Projekt","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":560000.0,"lo":560000.0,"hi":560000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2081781283584106959"}],"desc":"Projekt reward vault attacked July 25, 2026 for $560K via flashloan exploit. Attacker flash-loaned 14K WETH from Morpho to create fake purchase records in the unvalidated trackPurchase function, inflating reward allocations and draining ~301.7 ETH via massWithdraw.","theft":true},{"id":"ht3c6ee4e714","date":"2026-07-25","name":"Bankr","kind":"hack","fam":"social","tech":"Social Account Takeover","target":"Wallet","chains":["Base"],"usd":479885.0,"lo":479885.0,"hi":479885.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xdeployer/status/2081155362968015159?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"The Bankr AI wallet's X account was compromised on July 25, 2026. The attacker posted fake airdrop links while draining the project's wallet of approximately 1.5 billion BNKR tokens that lacked MFA protection.","theft":true},{"id":"ht81e19258d6","date":"2026-07-24","name":"Triple-A","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Payments","chains":["Ethereum","Tron","Arbitrum","Bitcoin"],"usd":11800000.0,"lo":9700000.0,"hi":11800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TripleAHQ/status/2081622020932948328"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/triple-a-hack"}],"desc":"On July 24-25, 2026, Triple-A's hot wallets were drained across 7 blockchains (TRON, Ethereum, Arbitrum, TON, Solana). The initial $9.7M loss was revised to $11.8M as attackers maintained access for 31+ hours.","theft":true},{"id":"ht1fe34fbd7b","date":"2026-07-23","name":"Solido Cash","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Supra"],"usd":900000.0,"lo":73400.0,"hi":900000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SolidoMoney/status/2081323242854469730"}],"desc":"On July 23, 2026, Solido Cash's CDP suffered an oracle attack when the SOLID price feed went stale and fell back to near-par CASH valuation (0.99919999) while SOLID was trading at 22.2 SUPRA per unit. An attacker looped acquire-collateral, mint-CASH, sell-CASH twice across 18:21 UTC and 21:12 UTC transactions, minting 809,052 CASH of unbacked debt and selling it for 293.7M SUPRA.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht939e6ba841","date":"2026-07-23","name":"Lien","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":542000.0,"lo":542000.0,"hi":542000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2080555677811171459"}],"desc":"On July 23-24, 2026, Lien Finance on Ethereum suffered a $542,000 exploit when an attacker bypassed the burn-before-swap logic in the GeneralizedDotc contract. The attacker minted unbacked bond tokens and swapped them for USDC from OTC pools.","theft":true},{"id":"ht16c0aad0f5","date":"2026-07-22","name":"AFX Bridge","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Arbitrum"],"usd":24150000.0,"lo":24150000.0,"hi":24150000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/afx-trade-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/AFX_XYZ/status/2080126901205770734"}],"desc":"On July 22, 2026, AFX Trade's Arbitrum bridge was exploited when the attacker obtained 5 of 7 validator private keys, bypassing the 2/3 multisig threshold and draining $24.15M in USDC. The attacker converted funds to ETH and consolidated them in a single wallet. AFX offered a 30% bounty for fund recovery.","theft":true},{"id":"ht430f9964af","date":"2026-07-22","name":"Verus-Ethereum Bridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Verus"],"usd":7530000.0,"lo":7530000.0,"hi":7540000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/veruscoin-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2080143099561496896"}],"desc":"On July 23, 2026 (second of two exploits in 66 days), Verus-Ethereum Bridge was drained of $7.54M via the import path; a small 0.01 VRSC transaction triggered unbacked ETH/tBTC payouts due to missing deposit verification. The vulnerability repeated from May and was never patched.","theft":true},{"id":"htf360cbd8c4","date":"2026-07-22","name":"Zilliqa","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Chain","chains":["Zilliqa"],"usd":1640000.0,"lo":1640000.0,"hi":1640000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A buffer-copy error in the Zilliqa Ledger app's Schnorr signing code since 2019 fixed the top 64 bits of every nonce at zero. Attackers recovered private keys from ~5 on-chain signatures using lattice reduction and stole approximately 683.13M ZIL, with exploitation first spotted on July 19, 2026.","theft":true},{"id":"ht0875f27345","date":"2026-07-21","name":"Wanchain","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"Chain","chains":["Cardano"],"usd":10000000.0,"lo":9000000.0,"hi":10000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/wanchain_org/status/2079444149066244340"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cardano-midnight-bridge-exploit"}],"desc":"On July 21, 2026, Wanchain's Cardano-BNB Chain bridge was drained of ~515M NIGHT tokens. The TreasuryCheck validator concatenated 14 variable-length fields without separators, allowing a signature authorizing ~3,110 NIGHT to be reused for vastly larger redemptions.","theft":true},{"id":"ht4f2578baa0","date":"2026-07-21","name":"42DAO","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":912000.0,"lo":912000.0,"hi":915000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2079759793192132810"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/balance-coin-algorithmic-stablecoin-crashes"}],"desc":"42DAO's Balance Coin collapsed from $1 to $0.0012 on July 22, 2026 when attacker fed a fake low BTCB price to the oracle via the Spotter module. The oracle lacked drawdown limits and price floors, triggering liquidations of BTCB vaults at far-below-market prices.","theft":true},{"id":"ht06afa7824a","date":"2026-07-21","name":"FlashTrade","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Solana"],"usd":98000.0,"lo":98000.0,"hi":98000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/FlashTrade/status/2079727481574334544"}],"desc":"Flash Trade's Solana perpetuals exchange suffered a $98K unauthorized withdrawal when an attacker exploited an incomplete validation path in MagicBlock's SDK. The ephemeral macro's undelegation callback failed to validate a fake account, allowing the attacker to trigger a fake withdrawal.","theft":true},{"id":"ht7e3ff61c41","date":"2026-07-19","name":"Allbridge Core","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Solana"],"usd":1650000.0,"lo":1650000.0,"hi":1650000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Allbridge_io/status/2078932561036722319"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/allbridge-exploit"}],"desc":"On July 20, 2026, Allbridge Core on Solana was drained of $1.65M. An attacker used a 1.12M USDC flashloan through Kamino to swap USDC/USDT and distort the pool ratio, then withdrew liquidity at the inflated rate.","theft":true},{"id":"ht308f9d764b","date":"2026-07-19","name":"Zilliqa exchange partner","kind":"hack","fam":"keys","tech":"Private Key Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zilliqa/status/2079847348780536050"}],"desc":"Zilliqa announced that ZIL was stolen from a cold wallet of one of its exchange partners. Investigation confirmed the root cause was a nonce-generation vulnerability in the Zilliqa Ledger app (present since 2019), allowing private key recovery from on-chain Schnorr signatures (after ~5+ native transactions). It was not due to the exchange’s operations. Native transactions were suspended and a fix is being coordinated.","theft":true},{"id":"htcafecdefcd","date":"2026-07-17","name":"Across","kind":"hack","fam":"bridge","tech":"Spoofed Event Log","target":"DeFi Protocol","chains":["Solana"],"usd":4500000.0,"lo":3350000.0,"hi":4500000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://startupfortune.com/across-protocol-got-hacked-on-solana-and-no-user-lost-a-cent/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/across-protocol-exploit"}],"desc":"Between 05:07 and 06:14 UTC on 17 July 2026 an attacker submitted 1,627 forged Solana deposits (face value ~$41.7M) from single-use wallets across 18 destination chains; Risk Labs' relayer filled 581 of them, paying out roughly $4.5M of its own capital before Solana was disabled as an origin chain. No user funds were affected.","theft":true},{"id":"hteae5a7f07f","date":"2026-07-17","name":"FlyCow","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":65300.0,"lo":65300.0,"hi":65300.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"FlyCow's FCOW token burned its own LP pair balance mid-swap and synchronized reserves immediately after, allowing an attacker to manipulate the liquidity pool state and drain approximately $65.3K USDT through a subsequent swap.","theft":true},{"id":"htc6f2f23075","date":"2026-07-16","name":"DefiTuna Lending","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Solana"],"usd":580000.0,"lo":580000.0,"hi":580000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DeFiTuna/status/2077772502521053668"}],"desc":"DefiTuna Lending on Solana exploited for $580K on July 16, 2026. Attackers created a highly illiquid TUNA/USDC pool and routed borrowed USDC through it. The negligible swap output caused position value to round to zero, bypassing the solvency check.","theft":true},{"id":"ht28542b50f8","date":"2026-07-16","name":"CrowdRingCircle","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":209100.0,"lo":201360.0,"hi":209100.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"CrowdRingCircle's token contract allowed the pair's recorded reserves to desynchronize with actual balances by burning CRC directly from the pair address before calling sync(). An attacker exploited this to artificially inflate CRC's price and drain USDT from the PancakeSwap V2 CRC/USDT pool.","theft":true},{"id":"ht2a6f671ce0","date":"2026-07-16","name":"PerpetualProtocol","kind":"hack","fam":"other","tech":"v2 (Curie) unguarded OrderBook funding-growth update lets anyone poison cached funding, draining the Vault","usd":3062.21,"lo":3062.21,"hi":3062.21,"conf":"C","n":1,"theft":true},{"id":"htca312b4dc1","date":"2026-07-15","name":"Ostium","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum"],"usd":23750000.0,"lo":18000000.0,"hi":24000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ostium-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/kaledora/status/2077525044733837736"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ostium-exploit"}],"desc":"On July 15, 2026, Ostium perpetuals DEX on Arbitrum suffered a $23.75M exploit when an attacker used a compromised price oracle private key to sign fraudulent Bitcoin price reports ($5,000 vs. real ~$60,000), opening positions at fake prices and closing at market rates.","theft":true},{"id":"ht69150563a3","date":"2026-07-15","name":"Cascade Liquidity Strategy","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1340000.0,"lo":1340000.0,"hi":1343921.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/cascade_xyz/status/2077747846011306123"}],"desc":"On July 15, 2026, Cascade Liquidity Strategy's perpetuals vault suffered a $1.34 million USDC drain through oracle price feed manipulation affecting deposit/withdrawal logic.","theft":true},{"id":"ht9f40ea86d6","date":"2026-07-15","name":"TeleSwap","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Bitcoin"],"usd":735000.0,"lo":735000.0,"hi":735000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://t.me/s/investigations"}],"desc":"TeleSwap's Bitcoin hot wallet was compromised, resulting in suspicious outflows of over $735K. The wallet ceased processing transactions shortly after discovery, with stolen funds subsequently moved toward Tornado Cash mixer.","theft":true},{"id":"htfad73d988f","date":"2026-07-15","name":"Sonic ICP","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["ICP"],"usd":276000.0,"lo":276000.0,"hi":276000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Sonic DEX, a decentralized exchange on Internet Computer, suffered an exploit involving transaction atomicity failures during asynchronous canister execution. The attacker submitted coordinated, high-frequency requests that exploited race conditions during intermediate state transitions, allowing unauthorized withdrawals before the protocol completed reconciliation. The attack affected 26 liquidity pools and resulted in approximately $276,000 in losses. Sonic paused the protocol and began implementing changes to prevent similar state inconsistencies","theft":true},{"id":"ht02341e9ded","date":"2026-07-14","name":"BarnBridge","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":776000.0,"lo":776000.0,"hi":776000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/FortaNetwork/status/2077364671275769860"}],"desc":"BarnBridge suffered a governance attack on July 15, 2026 when an attacker passed a malicious proposal, replaced the SMART Yield provider contract, and drained ~$776K by exploiting pre-existing USDC approvals from 50 users.","theft":true},{"id":"ht007d2de281","date":"2026-07-14","name":"Drips Network","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":24883.0,"lo":24883.0,"hi":24900.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://olympixai.medium.com/summer-fi-lumi-finance-drips-network-6-3m-lost-to-assumptions-nobody-tested-57f1769bda14"}],"desc":"On July 14, 2026, legacy DaiDripsHub on Ethereum was exploited for 24,883 DAI via unsafe unsigned-to-signed integer conversion that reversed transfer direction from deposit to withdrawal.","theft":true},{"id":"ht4c01bbec2a","date":"2026-07-13","name":"Lumi Finance","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":270000.0,"lo":270000.0,"hi":270000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2076669154036527314"}],"desc":"On July 13, 2026, Lumi Finance on Arbitrum lost ~$270K through Sodium smart account ERC-1271 validation flaws. The exploit required two bugs: (1) Sodium accepted attacker-controlled contracts as valid signers and session keys, and (2) validateUserOp granted unlimited ERC-20 allowances via attacker-controlled paymasterAndData. Attackers systematically stripped tokens from user accounts, leaving persistent allowances.","theft":true},{"id":"ht1f3238e8fe","date":"2026-07-13","name":"Chi Protocol","kind":"hack","fam":"code","tech":"Redeem Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":8500.0,"lo":8500.0,"hi":8500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2076887008773829119"}],"desc":"Chi Protocol exploited on July 13, 2026 for ~$8.5K. Attacker flash-loaned 5 WETH, bought depegged USC from a thin Uniswap V2 pool, and burned it against the ReserveHolder. The burn() function assumed a $1 peg without checking, redeeming full-value collateral.","theft":true},{"id":"ht08c42c83b8","date":"2026-07-12","name":"PHX","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":89500.0,"lo":89500.0,"hi":89500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"PHX token's transfer-fee logic burned tokens from the pair before crediting post-fee amounts, causing recorded reserves to desynchronize with actual balances. An attacker used a flash loan to fund the manipulation, exploiting the mismatch to drain WBNB from the liquidity pool.","theft":true},{"id":"ht2f32266f17","date":"2026-07-11","name":"Bonzo Lend","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Hedera"],"usd":9050000.0,"lo":9050000.0,"hi":9050000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bonzo-finance-rekt"},{"s":"SlowMist Hacked","u":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bonzo-lend-exploit"}],"desc":"On July 11, 2026 at 00:51 UTC, an attacker deposited 250 SAUCE tokens (~$5 worth) as collateral on Bonzo Lend on Hedera. Attacker pushed a fabricated SAUCE price into Supra's oracle inflated by ~12 orders of magnitude, then borrowed 6.63M USDC and 34.5M WHBAR. Bonzo's TVL fell 77%; Hedera's network TVL dropped 40% within 24 hours.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht3776256b83","date":"2026-07-11","name":"BlueMove DEX","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Sui"],"usd":529000.0,"lo":529000.0,"hi":529000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BlueMove DEX's liquidity pools were drained on July 11, 2026 totaling 700K+ SUI ($500K-700K) via either an LP token double-minting mechanism introduced in a May 31 upgrade or an arithmetic overflow in the legacy AMM code. BlueMove announced shutdown and promised compensation.","theft":true},{"id":"ht6eb29a329b","date":"2026-07-08","name":"BFB","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":197800.0,"lo":197800.0,"hi":197800.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BFB token's custom price-defense deflationary logic could be triggered by zero-value transferFrom calls without per-transaction limits. An attacker used flash loans to repeatedly invoke the burn function ~151 times in one transaction, destroying BFB reserves and draining WBNB from the PancakeSwap liquidity pool.","theft":true},{"id":"ht488db55bb0","date":"2026-07-06","name":"BonkDAO","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"Token","chains":["Solana"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bonkdao-rekt"},{"s":"SlowMist Hacked","u":"https://cryptonews.net/news/security/33109969/"}],"desc":"On July 6, 2026, attacker purchased enough BONK to control ~99.88% of governance votes, then passed proposal BIP #76 to drain 4.43T BONK from treasury. Missing timelocks and 1% quorum threshold enabled the attack.","theft":true},{"id":"ht9f8407212d","date":"2026-07-06","name":"Lazy Summer Protocol","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":6040000.0,"lo":6000000.0,"hi":6040000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/summer-finance-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/summerfinance_/status/2074214443261509721"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/summer-finance-exploit"}],"desc":"On July 6, 2026, Summer.fi's Lazy Summer Protocol USDC vaults were exploited when an impaired Silo vault (from November 2025 Stream Finance collapse) remained in NAV calculations. The attacker accumulated vault tokens whose value hadn't reflected economic impairment, transferred them to inflate totalAssets, and redeemed at inflated price for $6.04M in genuine USDC.","theft":true,"onchain":true},{"id":"htf0e3975826","date":"2026-07-02","name":"Hinkal","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":820000.0,"lo":820000.0,"hi":820000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/hinkal_protocol/status/2073136163880149417"}],"desc":"Attackers exploited deprecated note format in Hinkal's shielded-pool, performing unauthorized proofless deposits and bypassing proof verification for withdrawals. Attack was isolated to Ethereum.","theft":true},{"id":"ht4cb4347595","date":"2026-07-01","name":"Edel","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":403000.0,"lo":204215.57,"hi":403000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/edeldotfinance/status/2072154468058022033"}],"desc":"On June 30, 2026, Edel Finance's xStock lending protocol was exploited via flash loan-enabled oracle manipulation. The attacker manipulated the wGOOGLx (tokenized Google shares) exchange rate, inflating collateral value by ~7,700% due to a missing price oracle fallback, allowing extraction of $403K in bad debt.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht31d11c45fe","date":"2026-06-30","name":"Dutch Knaken crypto platform collapses with $8 million in customer funds missing","kind":"collapse","fam":"insider","usd":7989345.0,"lo":7989345.0,"hi":7989345.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/knaken-crypto-platform-collapses"}],"headline":true},{"id":"ht9606197a05","date":"2026-06-29","name":"Vault4626","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Base"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht53dae0c1cd","date":"2026-06-28","name":"AIDC","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"usd":121000.0,"lo":121000.0,"hi":121000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2071437371590238249"}],"desc":"On June 28, 2026, AIDC's _sellTransfer() accumulated a 30% burn without deducting it from the seller. An attacker exploited this to withdraw from the PancakeSwap LP at inflated rates, stealing ~$121K.","theft":true,"onchain":true},{"id":"ht1fc23668f5","date":"2026-06-27","name":"CookFinanceIssuance","kind":"hack","fam":"market","tech":"Price Oracle Manipulation","chains":["BNB Chain"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0feab10152","date":"2026-06-25","name":"Polymarket International","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Polygon"],"usd":3000000.0,"lo":2940000.0,"hi":3100000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/polymarkettrade/status/2070155882906730671?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polymarket-vendor-exploit"}],"desc":"On June 25, 2026, Polymarket frontend was compromised via third-party vendor, injecting malicious JavaScript that phished users into approving fraudulent token transfers, draining $3M from at least 11 wallets.","theft":true},{"id":"ht28cbd812ee","date":"2026-06-25","name":"Ocean Protocol","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Polygon"],"usd":127861.0,"lo":127861.0,"hi":127861.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Ocean Protocol's SideStaking-managed BPool clones on Polygon were exploited via asymmetric join/exit math. An attacker flash-borrowed mOCEAN tokens, cycled them through eight BPool clones, and extracted a net profit by exploiting the single-sided liquidity operation calculations.","theft":true,"onchain":true},{"id":"ht78b241b1da","date":"2026-06-25","name":"Lixir Finance","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":12300.0,"lo":4477.72,"hi":12300.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2070362661691207935"}],"desc":"On June 25, 2026, Lixir Finance vaults were exploited via insufficient nonce validation in permit() function. Attacker reused a single non-owner signature across 41 calls on six vault clones to gain allowances and extract USDC, USDT, ETH, and LIX tokens.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htdef50d7c60","date":"2026-06-24","name":"DLMC","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":222600.0,"lo":222560.22,"hi":222600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DLMC on BSC was exploited via flash loan price manipulation. The attacker used a flash loan to manipulate the protocol's internal token price, allowing redemption of referral rewards at an inflated rate. Referral rewards were minted and immediately sellable, providing efficient value extraction without holding positions.","theft":true,"onchain":true},{"id":"ht57ab65ec8d","date":"2026-06-24","name":"Yield Yak","kind":"hack","fam":"keys","tech":"Frontend Attack","chains":["Avalanche"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2069630359973539844"}],"desc":"According to security firm Blockaid, Yield Yak suffered a frontend attack. Its subdomain vote.yieldyak.com was injected with Eleven Drainer malicious code, posing risks of asset theft upon access. This mirrors a similar frontend attack previously experienced by Gitcoin.","theft":true},{"id":"ht38168befb0","date":"2026-06-23","name":"Secondfi","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Wallet","chains":["Cardano"],"usd":2400000.0,"lo":2400000.0,"hi":2400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/secondfi-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/secondfiapp/status/2071558652641870076"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/secondfi-exploit"}],"desc":"Between June 21-23, 2026, deterministic nonce reuse in SecondFi's Cardano signing code (one missing line) exposed 374 wallet private keys through all historical signatures. Attacker drained 16.1M ADA (~$2.4M); white hat protected $18.5M ADA. Total exposure: $20M+.","theft":true},{"id":"ht5505da90c4","date":"2026-06-23","name":"Royal.io","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"NFTfi","chains":["Polygon"],"usd":263000.0,"lo":261162.93,"hi":263000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cryptorank.io/news/feed/c9d17-legacy-polygon-royalties-contract-exploit-drains-261k-through-reward-logic-flaw"}],"desc":"Royal.io's legacy royalties contract (Royal1155LD) on Polygon was exploited via a flash loan combined with 100 zero-value ERC1155 transfers that manipulated the beforeLdaTransfer reward accounting hook through a logic flaw in the pro-rata royalty accounting function.","theft":true,"onchain":true},{"id":"ht9b53c28730","date":"2026-06-22","name":"Aztec Escape Hatch","kind":"hack","fam":"code","tech":"proof_id Accounting Bypass (whitehat reproduction)","usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"theft":true},{"id":"hteeb38e07ba","date":"2026-06-22","name":"ATM","kind":"hack","fam":"other","tech":"LP Token Burn","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6ba1837639","date":"2026-06-21","name":"Taiko Bridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Chain","chains":["Taiko","Ethereum"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/taikoxyz/status/2068858818352865626"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/taiko-bridge-exploit"}],"desc":"On June 21, 2026, an SGX signing key leaked on GitHub allowed an attacker to forge invalid proofs and drain approximately $1.7M from Taiko's ERC20 Vault on Ethereum.","theft":true},{"id":"htaafc4620f8","date":"2026-06-21","name":"Quicksilver Zone","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"DeFi Protocol","chains":["Quicksilver"],"usd":3500.0,"lo":3500.0,"hi":3500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Cosmos_Airdrops/status/2069848864643858660"}],"desc":"On June 21, 2026, Quicksilver Zone was exploited via unchecked ZK proof verification in the minting function. An OLPC token owner had previously set malicious parameters and renounced ownership, allowing an attacker to forge proofs and mint ~505K unbacked qATOM and ~10M qOSMO.","theft":true},{"id":"htf68b62d452","date":"2026-06-21","name":"Gitcoin","kind":"hack","fam":"keys","tech":"Front-end Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2068534795684946308"}],"desc":"Blockchain security firm Blockaid detected a front-end attack on Gitcoin’s subdomain files.gitcoin.co. The compromised site contained malicious “Eleven drainer” code designed to steal users’ cryptocurrency wallet assets. Users were advised not to interact with the site while the issue is being investigated and remediated. This is a frontend compromise incident rather than an on-chain smart contract exploit.","theft":true},{"id":"ht077a0008d6","date":"2026-06-20","name":"JaredFromSubway MEV Bot","kind":"hack","fam":"market","tech":"MEV Bot Drained","target":"Other","chains":["Ethereum"],"usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2068457314416545978"}],"desc":"On June 20, 2026, Ethereum's prominent MEV bot JaredFromSubway.eth was drained of $7.5M+ in WETH, USDC, and USDT when an attacker deployed 66 fake token contracts as profitable MEV opportunities. The bot automatically granted large spending approvals to malicious contracts over weeks, which were then swept in a coordinated transaction and laundered through Tornado Cash.","theft":true},{"id":"htb1d60c2990","date":"2026-06-20","name":"LABUBU/OLPC","kind":"hack","fam":"code","tech":"Decimal Miscalculation","target":"Liquidity Pool","chains":["BNB Chain"],"usd":1100000.0,"lo":1100000.0,"hi":1115903.66,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2068314444422402515"}],"desc":"On June 20, 2026, a PancakeSwap V2 pool pairing OLPC and LABUBI on BNB Chain was exploited when the OLPC token's _update function had a maliciously configured decimalsValue parameter (7326680472586200649), causing massive unintended burns. This desynchronized cached reserves, allowing an attacker to drain ~$1.115M USDT via LABUBI swaps.","theft":true,"onchain":true,"review":["attack tx contradicts the date"]},{"id":"htd4009fa672","date":"2026-06-19","name":"Secret Network","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"Chain","chains":["Secret"],"usd":4670000.0,"lo":4670000.0,"hi":4670000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The Axelar-Secret Network ICS-20 bridge was exploited on June 10, 2026. An attacker created a custom IBC channel and forged deposit packets, minting $4.67M in unbacked tokens without validating the packet source channel.","theft":true},{"id":"ht3e50547bb7","date":"2026-06-19","name":"Namada Shielded Pools","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"DeFi Protocol","chains":["Namada"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/f12sec/status/2068065239187218505?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On June 19, 2026, approximately $600K in assets (ATOM, USDC, OSMO, TIA, NYM) were drained from Namada's Multi-Asset Shielded Pool via an IBC transfer logic flaw. The loss went initially undetected due to a stale indexer continuing to display funds as available while live RPC queries showed zero balance.","theft":true},{"id":"ht82e79a2d1a","date":"2026-06-19","name":"mySwap CL","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Starknet","Ethereum"],"usd":305000.0,"lo":300000.0,"hi":305000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/mySwapxyz/status/2067941891010711560"}],"desc":"On June 19, 2026, at 7:15 AM UTC, mySwap's concentrated liquidity pools were exploited when an attacker created a fake EVIL token to manipulate pool accounting and share calculations. The attacker drained approximately $305K in liquidity (137.96 ETH, 45K USDC, 19.9K USDT, 230K STRK).","theft":true},{"id":"ht79cc5dbb9c","date":"2026-06-18","name":"JB","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":50000.0,"lo":49958.06,"hi":50000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"JB token gateway contract on BNB Chain was drained of 49,958 USDT on June 18-19, 2026. Attacker flash-borrowed WBNB, borrowed 70M USDT from Venus as collateral, and exploited poolTransferToDeadAndSync/tradeRouterBurnPool/poolRewardTransfer functions that sync the PancakeSwap pair after each manipulation, allowing repeated arbitrage of skewed reserves until USDT released exceeded costs. Venus loan was repaid in the same transaction.","theft":true,"onchain":true},{"id":"ht7fc91639b4","date":"2026-06-17","name":"Aztec Bridge","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":2130000.0,"lo":2000000.0,"hi":2200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/aztec-bridge-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/aztecFND/status/2067511967237939636"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aztec-hack-2"}],"desc":"Aztec's private rollup bridge escape-hatch mechanism was exploited via incomplete proof validation, allowing an attacker to manipulate proof data and withdraw 1,158 ETH, 150,000 DAI, and ~0.47 renBTC. This was the second Aztec exploit in June 2026; the June 14 attack drained ~$2.1M via similar proof manipulation.","theft":true,"onchain":true},{"id":"htec4f9afd71","date":"2026-06-17","name":"Little Boy Plus","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"usd":367000.0,"lo":367000.0,"hi":367000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2067424733747122259"}],"desc":"On June 17, 2026, Little Boy Plus was exploited for ~$377.6K USDT when a zero-value transferFrom call bypassed authorization checks in the custom transfer logic. This enabled the attacker to mint LBP tokens directly into the PancakeSwap pair, creating a reserve imbalance exploitable via swap.","theft":true},{"id":"ht7ccbb48e50","date":"2026-06-17","name":"WHALE","kind":"hack","fam":"code","tech":"Transfer Accounting Reserve Desync","chains":["BNB Chain"],"usd":3460.41,"lo":3460.41,"hi":3460.41,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd0dbd05b95","date":"2026-06-17","name":"LBP","kind":"hack","fam":"code","tech":"LBP balanceOf reward accounting","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htfdff25caec","date":"2026-06-16","name":"RetoSwap","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Monero"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"RetoSwap (Haveno protocol) on Monero was exploited on June 16-17, 2026 (second incident in 30 days) when dispute resolution logic permitted fund release without proper two-way settlement. Attacker took buy offers, forced arbitration, and released XMR after Bitcoin confirmations without sending BTC.","theft":true},{"id":"htb77e49af94","date":"2026-06-16","name":"DIP","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":111000.0,"lo":111000.0,"hi":111097.59,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2067078816514908286"}],"desc":"DIP token on BSC was exploited on June 17, 2026 when missing return statement in _transfer function caused swap transactions through PancakeSwap to execute twice, allowing attacker to manipulate pool prices.","theft":true,"onchain":true},{"id":"htb92d260545","date":"2026-06-15","name":"Thetanuts Finance","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":105471.5,"lo":105000.0,"hi":105471.5,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ThetanutsFi/status/2066795181123543070"}],"desc":" A deprecated Thetanuts Finance Index Vault was exploited through an integer-division rounding flaw in its mint accounting. Using a flash loan, the attacker reduced the index token supply to a minimal level and repeatedly minted replacement shares while required underlying-token deposits rounded to zero, allowing the attacker to retain assets redeemed from the vault. The attacker extracted 105,471.499078 USDC plus residual option-token positions. About one hour later, a whitehat used the same vulnerability to secure approximately $2M of assets from another vulnerable legacy vault","theft":true,"onchain":true},{"id":"ht40c196fb4f","date":"2026-06-14","name":"Aztec Connect","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum"],"usd":2100000.0,"lo":2100000.0,"hi":2190000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/aztec-connect-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/AztecLabs_/status/2066175340926345555"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aztec-connect-exploit"}],"desc":"Aztec Connect's proof verification failed to match L1 state updates, letting attacker submit unvalidated transactions crediting themselves with value. They withdrew $2.1M in ETH, DAI, wstETH and other tokens.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht9e2883ec5c","date":"2026-06-10","name":"Axelar Secret IBC Bridge","kind":"hack","fam":"bridge","tech":"Unbacked Cross-Chain Mint","target":"DeFi Protocol","chains":["Ethereum","Secret","Cosmos"],"usd":4670000.0,"lo":4670000.0,"hi":4670000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/secret-network-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/axelar/status/2068355855565594885"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/secret-bridge-exploit"}],"desc":"An attacker exploited the Axelar Secret bridge ics20-for-axelar contract to mint $4.67M of unbacked saTokens by forging IBC deposit packets from a malicious blockchain. The attacker created a minimal Cosmos blockchain with a single validator, opened a fake IBC channel to Secret Network, and sent forged deposit packets that bypassed channel validation. The minted tokens were redeemed back over the legitimate IBC channel to drain Axelar's escrow account, remaining undetected for seven days until a failed cross-chain transfer revealed the empty escrow.","theft":true},{"id":"ht128386be9d","date":"2026-06-10","name":"Raydium AMM","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Solana"],"usd":1340000.0,"lo":1340000.0,"hi":1340000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xINFRA/status/2064738005697384476"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/raydium-legacy-smart-contract-exploit"}],"desc":"Raydium on Solana lost $1.34M on June 10, 2026 in its deprecated AMM V3 program when attacker bypassed LP token validation using a fake token address. Attacker drained inactive pools containing USDC, SOL and RAY by bypassing proportion checks.","theft":true},{"id":"htdef5fc49f6","date":"2026-06-09","name":"Token of Power","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"Token","chains":["Ethereum"],"usd":1580000.0,"lo":1580000.0,"hi":1580000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://crypto.news/token-of-power-exploit-drains-1-58m-from-balancer-pool/"}],"desc":"Attacker acquired >50% voting power of TOP token via Balancer pool and passed malicious governance proposal to mint massive tokens, draining $1.58M WETH from Balancer V1 pool. Vulnerability stemmed from extremely low token supply (16,384 TOP total).","theft":true},{"id":"ht0c40447bbf","date":"2026-06-09","name":"Haedal Vault","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","usd":915179.0,"lo":915179.0,"hi":915179.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/HaedalProtocol/status/2064337754969055568"}],"desc":"Haedal Protocol’s Vault pools on Sui suffered an exploit due to a hidden cross-version logic flaw from a 2025 upgrade. The attacker used deprecated old deposit paths to mint inflated LP shares and redeemed them via new paths for excess underlying assets, causing ~$915k in direct losses. Haedal has paused the affected contracts, will fully compensate users, and is preparing a patched upgrade.","theft":true},{"id":"htf3afc9138b","date":"2026-06-09","name":"NovaBox","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Chain","chains":["Ethereum"],"usd":107000.0,"lo":93600.0,"hi":107000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/f12sec/status/2064610827554922679"}],"desc":"On June 9, 2026, NovaBox suffered a timing flaw where dividend calculations executed before stake balance updates were finalized, allowing an attacker to claim phantom dividends and drain 99.86% of the reward pool (~$107K).","theft":true,"onchain":true},{"id":"ht31c0495db5","date":"2026-06-09","name":"Asterix","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"NFTfi","chains":["Ethereum"],"usd":40000.0,"lo":40000.0,"hi":40000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/asterixlabs/status/2063916673724555336"}],"desc":"Asterix exploited June 9, 2026 for ~$40K, replicating the same DN404 vulnerability that hit Flooring Protocol the day before. The vulnerability stems from DN404's inherent design flaw in interlinked ERC20/ERC721 mechanics. Downstream forks inherited this flaw without re-auditing.","theft":true},{"id":"ht1cd5ea56c6","date":"2026-06-09","name":"TOPBPool","kind":"hack","fam":"market","tech":"Governance-controlled token mint and Balancer pool drain","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5874b8b5eb","date":"2026-06-08","name":"Humanity","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":32000000.0,"lo":31000000.0,"hi":36000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/humanity-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Humanityprot/status/2064167144120877127"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/humanity-protocol-theft"}],"desc":"Humanity Protocol's admin wallets were drained of $32M and 447M H tokens were unauthorized minted after a Humanity Foundation member's private key was compromised.","theft":true},{"id":"ht4efe7a7604","date":"2026-06-08","name":"Flooring Protocol","kind":"hack","fam":"code","tech":"Infinite Mint","target":"NFTfi","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/mfigge/status/2063782936399544740"}],"desc":"Flooring Protocol was exploited on June 8, 2026 via a packed storage and token-indexing vulnerability in its DN404/BT404 implementation. Attacker deposited small WETH to mint near-infinite fpToken balances, draining multiple NFT pools. Yuga Labs white hats rescued 68 blue-chip NFTs ($500K+) including 29 BAYC, 4 Mutant Apes and 2 CryptoPunks.","theft":true},{"id":"ht907dd5177d","date":"2026-06-08","name":"OpenMonero P2P","kind":"hack","fam":"keys","tech":"Supply Chain Attack","usd":62900.0,"lo":62900.0,"hi":62900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/orangefren/status/2064714742296441178?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On June 8, 2026, OpenMonero's P2P trading platform server was breached. The hacker gained root access and stole approximately 200 XMR. The project owner announced on Telegram that all funds were lost; the attack was not at the application layer.","theft":true},{"id":"htc3b841a0ec","date":"2026-06-07","name":"Syscoin Bridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Syscoin"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/syscoin-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/syscoin/status/2063749418365665413"}],"desc":"Syscoin bridge exploited via parsing inconsistency between Syscoin Core and NEVM relay. A malformed UTXO burn proof with duplicate asset commitments was accepted as valid by the relay, enabling unauthorized minting of ~5B SYS tokens.","theft":true},{"id":"ht96f41a3b90","date":"2026-06-07","name":"Ambient","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":110600.0,"lo":110600.0,"hi":110600.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cryptotimes.io/2026/06/08/ethereum-defi-protocol-ambient-finance-suffers-110k-drain/"}],"desc":"An attacker exploited Ambient Finance's single-contract architecture by transferring 50 ETH to a newly created contract and extracting ~83.72 ETH via insufficient access controls in the deposit/withdrawal logic.","theft":true,"onchain":true},{"id":"htdcde40fef8","date":"2026-06-06","name":"BOSS","kind":"hack","fam":"code","tech":"BOSS helper mint/burn and transfer-tax pool skew","chains":["BNB Chain"],"usd":10207.54,"lo":10207.54,"hi":10207.54,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htca92812b4a","date":"2026-06-05","name":"DTXT/USDT liquidity pair on BSC","kind":"hack","fam":"code","tech":"Business Logic Vulnerability","chains":["BNB Chain"],"usd":35041.0,"lo":35041.0,"hi":35041.11,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2062876917045608594"}],"desc":"The DTXT/USDT liquidity pair on BSC was exploited. The attacker exploited a forgeable liquidity-addition detection logic in the DTXT contract (by sending a small amount of USDT directly to the pair address, tricking the contract into classifying large sells as liquidity additions). This bypassed sell fees and drained the pool, resulting in a loss of approximately $35,041 USDT.","theft":true,"onchain":true},{"id":"htdb45970ab0","date":"2026-06-05","name":"AISOTHPresale","kind":"hack","fam":"other","tech":"Fixed-price presale arbitrage","chains":["BNB Chain"],"usd":30314.76,"lo":30314.76,"hi":30314.76,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht99892a9afc","date":"2026-06-04","name":"ATM","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":243500.0,"lo":243000.0,"hi":243543.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2062351507056460166"}],"desc":"On June 4, 2026, ATM token on BSC was exploited for $243K via improper loop control in automatic swap-on-transfer mechanism. Contract was designed to convert 20% of transfers to BSC-USD, but flaw allowed repeated triggering beyond standard limits.","theft":true},{"id":"ht584cb2e5ca","date":"2026-06-04","name":"BYToken","kind":"hack","fam":"market","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":87402.0,"lo":87402.0,"hi":87402.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2062708160700322257"}],"desc":"The public triggerAutoBurn() maintenance function in BYToken contract on BSC was abused. The attacker took a Moolah flashloan (~422k WBNB), performed Pancake swaps, then called the unprivileged function. This burned ~67.8 quadrillion BY directly from the BY/WBNB pair and called pair.sync(), rewriting reserves to 1 BY + full WBNB. The extreme skew allowed massive BY sells to drain nearly all WBNB liquidity, netting the attacker ~146.60 BNB ($87,402).","theft":true},{"id":"ht963a5f0d06","date":"2026-06-04","name":"BYToken","kind":"hack","fam":"other","tech":"Permissionless triggerAutoBurn Reserve Manipulation","usd":87402.0,"lo":87402.0,"hi":87402.0,"conf":"C","n":1,"theft":true},{"id":"htcd80014731","date":"2026-06-03","name":"GPU.NET","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":10600.0,"lo":10600.0,"hi":10600.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Unverified incident claimed on Ethereum involving GPU.NET on 2026-06-03 (~$10,600); no news coverage, security report, or on-chain confirmation.","theft":true},{"id":"htba5620efc6","date":"2026-06-03","name":"ApeBond","kind":"hack","fam":"market","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":3421.0,"lo":3421.0,"hi":3421.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/clarahacks/status/2062564868130029636"}],"desc":"ApeBond's ApeYieldVault smart contract on BSC was exploited. The attacker used a public helper contract to call migrateToVotingEscrow with duplicate pool IDs, inflating a lock amount from ~1.71 quadrillion ABOND to ~29 quadrillion ABOND. They then unlocked, claimed the inflated lock, sold ABOND in the public ABOND/WBNB pool, repaid a Moolah flashloan, and kept ~5.72 WBNB profit. The entire flow was permissionless and on-chain.","theft":true},{"id":"ht3ce16357db","date":"2026-06-01","name":"TSR","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Token","chains":["BNB Chain"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On June 1, 2026 TesseraDAO's mint function was exploited via inadequate access control, allowing an attacker to mint approximately 99 million TSR tokens, immediately selling them on PancakeSwap for ~2.5M USDT, then bridging to Ethereum and laundering funds via Tornado Cash.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht035ccb1a13","date":"2026-06-01","name":"TesseraDAO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2400000.0,"lo":2400000.0,"hi":2400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tesseradao-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SpecterAnalyst/status/2061704532761956614"}],"desc":"An attacker gained control of TesseraDAO's core contract and used ownership privileges to mint 99M TSR tokens from nothing, swapping them for $2.49M USDT. The attacker reassigned roles, seized ownership, and drained the treasury by dumping the freshly-minted tokens on Uniswap before withdrawing through Tornado Cash. The exploit went undetected for 19 hours after the mint.","theft":true},{"id":"ht23ba1ce14a","date":"2026-06-01","name":"Gnosis Pay","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"Other","chains":["Gnosis","Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/gnosispay/status/2061372038628196356"}],"desc":"On June 1, 2026, Gnosis Pay's Zodiac modules were exploited via a flawed ERC-1271 signature verification check that failed to validate contract call success. The attack affected 5,281 wallets, but Gnosis detected it within 2 hours and refunded users 100%.","theft":true},{"id":"htc7f7aefbcb","date":"2026-06-01","name":"ATOHook","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["Ethereum"],"usd":25000.0,"lo":25000.0,"hi":25000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2063576945552462201"}],"desc":"ATOHook smart contract was exploited due to a storage slot collision between the rewards mapping and Solady’s fixed ReentrancyGuard slot. The nonReentrant modifier in getReward() wrote a sentinel value that was misinterpreted as a reward balance for a colliding address, allowing the attacker to repeatedly claim and drain a fixed amount of ETH (200 times), stealing approximately 14.41 ETH.","theft":true},{"id":"htecc5361bfb","date":"2026-06-01","name":"The X account of crypto KOL Jadoodoo","kind":"hack","fam":"keys","tech":"Social Engineering","usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/GoPlusZH/status/2061305938297143567"}],"desc":"GoPlus issued a security alert stating that the X account of crypto KOL Jadoodoo (@jadoodoo_\r\n) has been hacked. The attacker is sending phishing links via direct messages to fans under the guise of collaboration offers. Multiple KOLs have already fallen victim, with total losses of around $5,000.","theft":true},{"id":"ht2b3b9690d9","date":"2026-05-31","name":"Fluid Lending","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":215000.0,"lo":215000.0,"hi":215000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xfluid/status/2061124908277538827"}],"desc":"An attacker compromised operational keys used exclusively by Fluid’s Merkle rewards distribution infrastructure. The attacker used these permissions to submit and approve fraudulent reward allocations, allowing them to claim approximately 125,109 FLUID, 51,946 GHO, and a small amount of cbBTC. The incident was isolated to reward distribution contracts and did not compromise Fluid’s core protocol contracts, lending markets, or user deposits","theft":true},{"id":"ht7d04845056","date":"2026-05-31","name":"Phala Cloud","kind":"hack","fam":"code","tech":"API endpoint vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/phalanetwork/status/2061523264783237153?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"A vulnerability in the Phala Cloud API endpoint allowed unauthorized modifications to some Offchain KMS CVMs. The attacker deployed a malicious pre-launch script to affected CVMs, which may have accessed decrypted environment variables after boot. The issue was identified, patched, and contained on June 1, 2026. Affected users/CVMs have been directly notified via email.","theft":true},{"id":"ht1d0305bf1e","date":"2026-05-30","name":"Gravity Bridge","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Cosmos"],"usd":5400000.0,"lo":5400000.0,"hi":5400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gravity-bridge-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2060636956984594521"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gravity-bridge-theft"}],"desc":"On May 30, 2026, Gravity Bridge suffered a $5.4 million exploit via compromised validator signing key. Stolen assets included $4.3M USDC, 274 ETH (~$553K), and $434K USDT; attacker laundered most through ChangeNow and Binance.","theft":true},{"id":"ht333f18807b","date":"2026-05-30","name":"Alephium Bridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum"],"usd":815000.0,"lo":815000.0,"hi":815000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/alephium/status/2060768639100268782"}],"desc":"On May 30, 2026, Alephium TokenBridge was exploited via off-chain backend flaw in guardian message verification. Attackers deployed fake contracts to forge VAAs, disrupted node connectivity to trigger fallback validation, and authorized transfers totaling $815K across Ethereum and BNB Chain, plus 13.76M unbacked ALPH minting.","theft":true},{"id":"htcee9d2f34d","date":"2026-05-30","name":"AFI Protocol","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":480000.0,"lo":480000.0,"hi":480000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On 30 May 2026 the afiUSD vault of AFI Protocol, a proof-of-reserve and yield-vault platform for RWAs on Ethereum, was drained of approximately $480,000. AFI paused the affected vault within hours, rotated operational keys across the platform, and reported that its other vaults and the remaining ~$225M TVL were unaffected. The attacker swapped ~$252k DAI to ETH and sent ~150 ETH through Tornado Cash. AFI has not published the exploit path.","theft":true},{"id":"hte892cea105","date":"2026-05-30","name":"AROS","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":295000.0,"lo":295000.0,"hi":295300.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2061289921990570349"}],"desc":"Suspicious attack on BSC drained ~$295.3K USDT from AROS/USDT PancakeSwap; suspected contract logic flaw or price oracle manipulation but mechanism unconfirmed pending technical analysis.","theft":true,"onchain":true},{"id":"ht84e6c38b94","date":"2026-05-29","name":"YSDAO","kind":"hack","fam":"market","tech":"Reserve Manipulation Attack","chains":["BNB Chain"],"usd":19500.0,"lo":19490.0,"hi":19500.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2061278221497254013"}],"desc":"Computility-associated YSDAO project on BSC suffered a liquidity pool attack on PancakeSwap V2. The hacker manipulated reserves via contract calls and extracted funds, resulting in approximately $19.5K loss.","theft":true,"onchain":true},{"id":"ht71605e6b7a","date":"2026-05-28","name":"DxSale","kind":"hack","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["BNB Chain"],"usd":7300000.0,"lo":7300000.0,"hi":7300000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dxsale-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/eyeonchains/status/2060083479631843408"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dxsale-exploit"}],"desc":"Attacker exploited unprotected owner key in DxSale's legacy 2021 locker contract on May 26-27, 2026, draining over 1,400 liquidity pools on BNB Chain for $7.3M using EIP-7702 batch delegation. Key had no timelocks or multisig controls.","theft":true},{"id":"ht5b4ba4589b","date":"2026-05-28","name":"ONTR","kind":"hack","fam":"code","tech":"Ownership Takeover","target":"Token","chains":["Ethereum"],"usd":98200.0,"lo":98200.0,"hi":98200.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2060190914547449936"}],"desc":"When ONTR's creator renounced ownership to signal trustworthiness, the onlyOwner modifier contained a flawed require statement that treated owner == address(0) as permission rather than denial. This turned the ownership renunciation into a backdoor, allowing anyone to reclaim ownership and drain the contract of $98.2K in funds within minutes.","theft":true},{"id":"ht9c56a1a5f5","date":"2026-05-28","name":"MoneyMon","kind":"hack","fam":"keys","tech":"Smart Contract Vulnerability","usd":85519.47,"lo":85500.0,"hi":85519.47,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2060205558687486441"}],"desc":"The LegendaryMoneyMonNft contract’s cliamRewred function had a signature verification flaw. The verify() only checked if recoverSigner(...) == admin, without properly validating cases where ecrecover returns address(0). The attacker set admin to zero address, then used an invalid signature (r=0, s=0, v=27) to bypass checks, arbitrarily claim rewards, drain all tokens from the contract, and swap them for USDT via PancakeSwap.","theft":true},{"id":"htb213132fc0","date":"2026-05-27","name":"SUPERFORTUNE AI","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["Ethereum","BNB Chain"],"usd":15180000.0,"lo":15180000.0,"hi":15180000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SUPERFORTUNE888/status/2059818459421372485"}],"desc":"An attacker exploited insufficient verification controls in the multisig transaction process to redirect an airdrop transfer. A lookalike address was substituted for the GUA token claim contract, allowing the attacker to intercept the transfer.","theft":true},{"id":"ht06407a2c62","date":"2026-05-27","name":"Stake DAO Yield","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Arbitrum"],"usd":91000.0,"lo":91000.0,"hi":91000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/stakedaohq/status/2064366142685094064?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On May 27, 2026, Stake DAO on Arbitrum was exploited when a compromised deployer key reconfigured the LayerZero v2 OFT peer. The attacker minted 5.4 trillion vsdCRV tokens; despite massive nominal value, poor liquidity limited actual extraction to ~$91K.","theft":true},{"id":"ht5b3225fe90","date":"2026-05-27","name":"Joe Agent","kind":"hack","fam":"code","tech":"Reentrancy Attack","chains":["BNB Chain"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2059887450663551352"}],"desc":"The Joe Agent ($JOE) project smart contract had a single-function reentrancy vulnerability. The attacker exploited the logic in _removeLiquidityViaContract where BNB was sent via low-level call before updating lpInfo[user].lpAmount, performing ~25 reentrancy loops to steal 62.5 BNB and ~1.196M JOE.","theft":true},{"id":"htee6f66791f","date":"2026-05-26","name":"SKP Token","kind":"hack","fam":"insider","tech":"Owner Backdoor LP Burn + Price Manipulation","usd":212000.0,"lo":212000.0,"hi":212000.0,"conf":"C","n":1,"theft":true},{"id":"htacd56b82e4","date":"2026-05-25","name":"New Market Trading","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Other","chains":["Ethereum","Base","Arbitrum"],"usd":3980000.0,"lo":3980000.0,"hi":3980000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/newmarkettrading-rekt"}],"desc":"On May 25, 2026, New Market Trading's SquidRouterModule was exploited across 88 user Gnosis Safes on Ethereum, Base, and Arbitrum. The module validated permissions against caller-supplied delegate addresses instead of msg.sender, allowing attackers to route assets through attacker-controlled pools, stealing ~$3.98M.","theft":true},{"id":"ht24a8ce1cbe","date":"2026-05-25","name":"Third-party Gnosis Safe Module (SquidRouterModule)","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","target":"Wallet","chains":["Ethereum"],"usd":3200000.0,"lo":3200000.0,"hi":3200000.0,"conf":"A","n":3,"src":[{"s":"SlowMist Hacked","u":"https://x.com/squidrouter/status/2058890710611276238"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/squidroutermodule-exploit"}],"desc":"A third-party Gnosis Safe module named SquidRouterModule was exploited, draining approximately $3-3.2 million from 86 Gnosis Safe wallets on Ethereum and Base within about 2 hours. The module has no affiliation with the official Squid Router protocol—confusion arose solely due to the contract name on Basescan. Victims had previously added this faulty third-party module as a trusted Safe Module, granting it permission to spend any tokens without signatures. The attacker exploited weak authentication (accepting a publicly visible constant string as \"message security\" proof) to execute arbitrary calldata, forcing fake Uniswap V3 swaps (real tokens for worthless 'u' token in attacker-controlled pools) and draining funds, which were consolidated into ~3.07M DAI. Squid confirmed its core router and user funds/integrations remain fully secure.","theft":true,"onchain":true},{"id":"htbb82c77cb5","date":"2026-05-25","name":"WUSD.fi/Glove","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"Liquidity Pool","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/exvulsec/status/2058803971947385330"}],"desc":"WUSD.fi's GLOVE reward system lacked Sybil protection. On May 25, 2026, attackers created Sybil wallets and used flashloans to repeatedly collect rewards, draining ~$200K from Uniswap V3.","theft":true},{"id":"ht32600eaca2","date":"2026-05-25","name":"Bitmor","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Base"],"usd":6000.0,"lo":6000.0,"hi":6000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"In May 2026, Bitmor DCA contract on Base was exploited; access control flaw allowed attackers to drain wallets of any users with active token approvals.","theft":true},{"id":"htb8ff18c641","date":"2026-05-23","name":"StablR","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":2800000.0,"lo":2800000.0,"hi":2800000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2058372418557595890"}],"desc":"On May 24, 2026, one of StablR's three multisig keys was compromised. The attacker minted 8.35M USDR and 4.5M EURR against zero collateral and dumped them for ~$2.8M in ETH.","theft":true},{"id":"ht670e70ed72","date":"2026-05-22","name":"Polymarket","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Polygon"],"usd":700000.0,"lo":573200.0,"hi":700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/devjoshstevens/status/2057768173915484505"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polymarket-private-key-compromise"}],"desc":"Polymarket's internal operations wallet was drained on May 22, 2026 of ~$700K in POL tokens. An attacker obtained a 6-year-old private key and withdrew funds in 5,000 POL batches, but Polymarket confirmed user funds were unaffected.","theft":true},{"id":"ht9f2641ab3c","date":"2026-05-22","name":"SKP","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":212000.0,"lo":212000.0,"hi":212850.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2059454844201562191"}],"desc":"An attacker exploited SKP's transfer hook that called pair.sync() prematurely during token transfers, before the router completed the corresponding swap. This allowed the attacker to manipulate reserve ratios mid-transaction by calling sync() from inside the transfer flow. The attacker assembled $204M in capital from flash loan sources and nearly completely drained the SKP/USDT pair, extracting $212K.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht21b386ab63","date":"2026-05-22","name":"Fractal Protocol","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Arbitrum"],"usd":13700.0,"lo":13700.0,"hi":13700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2058619391776878967"}],"desc":"Fractal Protocol's USDF vault on Arbitrum was drained of 13,700 USDC.e via re-entrant flashloan attack. The attacker looped through Balancer V2 batchSwap callbacks to recursively call the vault's deposit and withdraw functions. The vault's tokenPrice accrued only once daily and its share arithmetic rounded favorably for the depositor, allowing each re-entrant round-trip to extract more than it put in.","theft":true,"onchain":true},{"id":"htc84ada8157","date":"2026-05-21","name":"Mure","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":11700.0,"lo":11700.0,"hi":11700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/clarahacks/status/2058341669603307880"}],"desc":"Mure's MureDistribution proxy on Ethereum was drained in a single transaction on 21 May 2026 after a caller-controlled signer address was passed to SignatureChecker, causing it to fall through to the ERC-1271 path and return true for a forged signature. This authorized transferFrom of 4.85M QUEST tokens pre-approved to the proxy, which sold for ~5.45 ETH (~$11.7K).","theft":true,"onchain":true},{"id":"ht030f8c1d99","date":"2026-05-20","name":"RetoSwap","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Monero","monero"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/retoswap/status/2056984875383632226?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/retoswap-theft"}],"desc":"On May 20, 2026, RetoSwap (Haveno fork on Monero) failed to verify ACK message sources. Attackers registered attacker-controlled addresses as arbitrators for multisig wallets, stealing $2.7M from traders.","theft":true,"review":["possible duplicate within one source"]},{"id":"htb5c5fcf637","date":"2026-05-20","name":"Butter Bridge","kind":"hack","fam":"bridge","tech":"Smart Contract Vulnerability","target":"Bridge","usd":180000.0,"lo":180000.0,"hi":180000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ourcryptotalk.com/news/butter-bridge-exploit-mints-1-quadrillion-mapo-tokens"}],"desc":"The Butter Bridge V3.1 (part of MAP Protocol and Butter Network) was exploited. An attacker used a vulnerability in the OmniServiceProxy contract’s retry message verification logic, specifically an abi.encodePacked hash collision with dynamic-bytes fields. This allowed forging a cross-chain retry message that bypassed authentication, resulting in the minting of approximately 1 quadrillion (10^15) MAPO tokens (about 4.8 million times the legitimate ~208 million circulating supply). The attacker dumped ~1 billion fake MAPO into the Uniswap V4 ETH/MAPO pool, extracting roughly $180,000 in liquidity (≈52.21 ETH). The teams immediately paused the bridge and related swaps. User funds in pending swaps are safe, and a patch/audit/redeployment is in progress. The remaining ~999 trillion fake tokens stay in the attacker’s wallet, posing ongoing dilution risk.","theft":true},{"id":"ht69ac25ec2e","date":"2026-05-20","name":"MAP Protocol","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Chain","chains":["Ethereum","BNB Chain"],"usd":110000.0,"lo":110000.0,"hi":180000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On May 20, 2026 MAP Protocol's Butter Bridge suffered a critical exploit enabling attackers to mint 1 quadrillion MAPO tokens via a collision in the bridge's retry message verification using keccak256(abi.encodePacked). The attacker triggered unauthorized minting on Ethereum and BSC, extracting approximately 52.2 ETH (~$110,000) in value before the MAPO token crashed 96%.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htbc1d997713","date":"2026-05-19","name":"Bankr","kind":"hack","fam":"keys","tech":"Session Key Compromised","target":"AI Agent","chains":["Base"],"usd":170000.0,"lo":170000.0,"hi":440000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/bankrbot/status/2056824330999533747"}],"desc":"Bankr paused on May 19, 2026 after $170K was drained from 14 user wallets on Base. Attackers exploited phishing of session tokens or signing keys to make direct transfer() calls, bypassing token approvals.","theft":true,"review":["sources disagree on the loss"]},{"id":"hte24570b7ef","date":"2026-05-19","name":"HermesVault","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Algorand"],"usd":30000.0,"lo":29466.0,"hi":30000.0,"ret":26000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/giuliopizzini/status/2056858969403183292?referrer=grok-com"}],"desc":"On May 19, 2026, HermesVault, an Algorand privacy protocol, was exploited when an attacker bypassed ZK proof verification via a flaw in the withdrawal verification script's key reset defense logic, stealing 261,000 ALGO (~$29.5K).","theft":true},{"id":"ht1c7028e3f1","date":"2026-05-19","name":"ElevateFi","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Polygon"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker manipulated the EFI/DAI Uniswap V2 pair's spot price mid-transaction using flash-loan-funded buying pressure, then exploited ElevateFi's staking vault which relied on raw pair reserves without any time-weighted or external oracle guard. By inflating EFI's spot price during staking, the attacker received disproportionate staking positions: creating $2.5M recorded staking principal for only 713.5 EFI of actual principal, repeated 100 times.","theft":true,"onchain":true},{"id":"htae99146eab","date":"2026-05-18","name":"Echo Bridge","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Monad"],"usd":821000.0,"lo":821000.0,"hi":821700.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.kucoin.com/zh-hant/news/flash/peckshield-reports-821-000-stolen-in-echoprotocol-hack-on-monad"}],"desc":"Echo Protocol's Monad bridge was compromised on May 18, 2026 when attacker obtained admin key with minting privileges, minting 1,000 eBTC and executing swaps to extract 385 ETH (~$821K realized).","theft":true},{"id":"htd8fda2e4ed","date":"2026-05-18","name":"TesseraSwap","kind":"hack","fam":"other","tech":"Callback Repayment Price Spread","chains":["Base"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1a34879d54","date":"2026-05-17","name":"Verus-Ethereum Bridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Verus","Ethereum"],"usd":11580000.0,"lo":11500000.0,"hi":11600000.0,"ret":8500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/MetaEraHK/status/2056192367716380711"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/verus-bridge-hack"}],"desc":"On May 17-18, 2026, the Verus-Ethereum bridge was exploited when an attacker forged a cross-chain payload that passed all cryptographic checks but lacked amount reconciliation between chains, converting ~$10 in VRSC fees into $11.58 million in Ethereum assets (103.6 tBTC, 1,625 ETH, 147,000 USDC).","theft":true,"onchain":true},{"id":"htb3dc211abb","date":"2026-05-17","name":"SEA Token","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["Arbitrum"],"usd":153000.0,"lo":110000.0,"hi":153000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/procur3/status/2057004818145952190"}],"desc":"Suspicious attack on Arbitrum drained ~$153K from SEA token interactions; suspected price oracle or liquidity manipulation but mechanism unconfirmed pending technical analysis.","theft":true,"onchain":true},{"id":"htd5f6a89dad","date":"2026-05-17","name":"MetaSea","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"MetaSea's redeemPosition function overpaid SEA yield from a shared distributor without blocking just-in-time openings and redemptions in the same block. An attacker used Aave flash loans to atomically deposit USDT into the settlement adapter, redeem disproportionately large SEA amounts (17-27M vs 1.2M input), and sell the SEA back for USDT. Running 8 identical attacks back-to-back, the attacker extracted $110K aggregate across multiple blocks.","theft":true},{"id":"ht6d60943239","date":"2026-05-15","name":"THORChain DEX","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"Chain","chains":["Bitcoin","Ethereum","Base","BNB Chain"],"usd":10700000.0,"lo":10700000.0,"hi":10800000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/thorchain-rekt3"},{"s":"SlowMist Hacked","u":"https://x.com/THORChain/status/2055300162331742233"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thorchain-exploit"}],"desc":"On May 15, 2026, a flaw in the GG20 threshold-signature scheme securing Asgard vaults allowed a newly churned malicious node to authorize unauthorized withdrawals, draining approximately $10.7-$10.8 million across Bitcoin, Ethereum, BNB Chain, and Base.","theft":true},{"id":"ht0a5b7b3f2d","date":"2026-05-15","name":"Adshares","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Other","chains":["Ethereum"],"usd":628000.0,"lo":628000.0,"hi":628000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cryptoadventure.com/adshares-bridge-exploit-drains-about-628k-after-fake-wads-mint/"}],"desc":"On May 16-17, 2026, the Adshares cross-chain bridge was exploited when the bridge-minter EOA signed three wrapTo() calls with non-existent native-chain transaction IDs. The attacker minted fake wrapped ADS tokens and dumped ~$628K worth (148.5 ETH + 305K USDC) on Ethereum.","theft":true,"onchain":true},{"id":"htd2ea1216a8","date":"2026-05-13","name":"Transit Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Tron"],"usd":1880000.0,"lo":1880000.0,"hi":1880000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/BSCNews/status/2054613633460777265"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/transit-finance-hack"}],"desc":"On May 12, 2026, Transit Finance on Tron was exploited for $1.88M via deprecated contract officially discontinued in 2022 but left active on-chain. Attacker exploited historical vulnerabilities to drain DAI and other assets.","theft":true},{"id":"hta1222905be","date":"2026-05-13","name":"ShapeShift FOX Colony","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Arbitrum"],"usd":132700.0,"lo":132700.0,"hi":132700.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2054593377438421492?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"An attacker exploited the EtherRouterCreate3 contract's meta-transaction mechanism by abusing the arbitrary self-call capability combined with DSAuth's automatic authorization logic for address(this). The attacker bypassed the auth modifier, replaced the contract's core routing component (resolver) with a malicious version, then used delegatecall to drain all ERC20 assets. A second related exploit shortly after brought total losses to $182.7K.","theft":true},{"id":"htc88a8b49b9","date":"2026-05-12","name":"Aurellion","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"RWA","chains":["Arbitrum"],"usd":456442.0,"lo":456000.0,"hi":456442.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2054163700035289446"}],"desc":"Aurellion Labs on Arbitrum was drained of $456,442.53 USDC on May 12, 2026 after incomplete Diamond Proxy initialization left the SafeOwnable facet's _initialized slot at zero. The attacker called initialize() to seize ownership and inject a draining facet.","theft":true},{"id":"ht882aa47596","date":"2026-05-12","name":"SQTokenStaking","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":346100.0,"lo":346100.0,"hi":346137.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Defi_Nerd_sec/status/2054425936746148148"}],"desc":"SQ Protocol was exploited when an attacker used EIP-7702 authorized transactions to call privileged staking functions via a hardcoded owner backdoor, minting fake positions and draining USDT.","theft":true,"onchain":true},{"id":"htdbd5a13d0f","date":"2026-05-12","name":"BoostHook","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":187000.0,"lo":187000.0,"hi":187000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BoostHook was exploited via a flash loan attack that manipulated the ETH/PERP Uniswap v4 pool price. An attacker used a 120 WETH Morpho flash loan to temporarily push the pool price upward, opened nine leveraged long positions at the inflated price through BoostHook.openLong(), then reversed the price move. The protocol's hard-capped MAX_LIQS_PER_BLOCK limit prevented liquidation of all toxic positions, leaving four 8 ETH-debt positions open and causing significant bad debt.","theft":true},{"id":"htd2372d2f61","date":"2026-05-12","name":"IEXCBP","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":97000.0,"lo":97000.0,"hi":97000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"IEXCBP's reward withdrawal logic valued USD-denominated rewards using Pancake's live spot price quotes. An attacker flash-loaned WBNB and USDT, posted WBNB as collateral on Venus to borrow larger USDT amounts, then recycled capital through helper accounts interacting with IEXCBP. Each attacker-driven IEX token sale affected subsequent accounts' payout calculations, allowing complete reward pool draining through Pancake spot price manipulation.","theft":true},{"id":"ht2869ccfa6c","date":"2026-05-11","name":"TAC Protocol","kind":"hack","fam":"bridge","tech":"Proof Verifier Bug","target":"DeFi Protocol","chains":["TON","TAC","Ethereum"],"usd":2854000.0,"lo":2800000.0,"hi":2854486.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TacBuild/status/2054620834879381870?s=20"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tac-bridge-exploit"}],"desc":"The TON-TAC bridge lacked code-hash verification on jetton wallets. An attacker deployed a counterfeit USD₮ wallet and sent a fraudulent bridge message to receive unbacked minted TAC tokens, draining legitimate locked assets.","theft":true},{"id":"htc1c92b1a04","date":"2026-05-11","name":"INK Finance","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["Polygon"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"}],"desc":"INK Finance's Workspace Treasury Proxy on Polygon was exploited on May 11, 2026 for $140K USDT. Attacker deployed a malicious contract matching a whitelisted claimer address to bypass authorization checks and trigger unauthorized treasury transfers, facilitated by a $25K flash loan.","theft":true,"onchain":true},{"id":"htca4686f2f0","date":"2026-05-11","name":"Huma","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Polygon"],"usd":101400.0,"lo":101000.0,"hi":101400.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/humafinance/status/2053858499378258198"}],"desc":"Huma Finance's deprecated V1 BaseCreditPool contracts on Polygon were exploited via a credit-lifecycle logic error combined with unrestricted access control. An attacker created Requested credit records through an open requestCredit() path with preApproved=false, then advanced those unapproved records to GoodStanding using an unrestricted refreshAccount() call. The attacker then exploited drawdown() to borrow the pools' residual balances.","theft":true,"onchain":true},{"id":"ht8b4acc5b68","date":"2026-05-11","name":"Roaring Kitty‘s X account","kind":"hack","fam":"code","tech":"The X account was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ourcryptotalk.com/news/roaring-kitty-x-account-hacked-to-scam-rkc-token"}],"desc":"Keith Gill’s (Roaring Kitty) verified X account was apparently hacked on May 11, 2026. Attackers posted the contract address of a newly launched Solana meme coin $RKC (Red Kitten Crew) on Pump.fun, along with related images. This briefly pumped the token’s market cap to around $11-12 million. The posts were deleted within an hour, causing a 90%+ crash. The developer used 10 wallets to acquire ~39.52% of the supply (with ~$1,950 investment) and dumped for over $611K profit. Over 80 wallets lost approximately $2.86 million in total. Keith Gill has not issued any statement regarding the incident.","theft":true},{"id":"ht840b2b843f","date":"2026-05-10","name":"Renegade","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Arbitrum"],"usd":209000.0,"lo":209000.0,"hi":209000.0,"ret":209000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/renegade_fi/status/2053531772634427599?s=46"}],"desc":"On May 10, 2026, Renegade V1 on Arbitrum was exploited for $209K via unprotected initializer function and proxy version counter desynchronization. Attacker injected malicious logic via delegatecall to drain 27 ERC-20 tokens; whitehat recovered ~$190K within 45 minutes.","theft":true,"onchain":true},{"id":"htdb1d7b6a3f","date":"2026-05-07","name":"TrustedVolumes","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"Other","chains":["Ethereum"],"usd":6700000.0,"lo":5870000.0,"hi":6700000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/trustedvolumes-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/trustedvolumes/status/2052235435292910005"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trustedvolumes-exploit"}],"desc":"An attacker exploited missing access control in TrustedVolumes' RFQ swap proxy to add themselves to the order signer allowlist, forge trade orders, and drain funds across 85 transactions in WETH, WBTC, USDT, and USDC.","theft":true},{"id":"htab6c799a77","date":"2026-05-05","name":"Ekubo","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2051757787714118125"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ekubo-exploit"}],"desc":"On May 5, 2026, Ekubo's EVM swap router contracts were exploited when attackers discovered the contracts failed to verify whether the payer had authorized transactions. Attackers stole 17 wBTC ($1.4 million) and laundered funds via Tornado Cash.","theft":true,"onchain":true},{"id":"hte905860f52","date":"2026-05-04","name":"SquidRouterModule","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Base"],"usd":3200000.0,"lo":3200000.0,"hi":3200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"SquidRouterModule, a third-party Gnosis Safe module for Squid Router, was exploited via a verification error in executeSameChainActions(). The function accepted a publicly available constant string as proof of message security. An attacker with this fixed string could impersonate Safe wallet owners and execute arbitrary calldata to drain 86 Gnosis Safe vaults over two hours, consolidating ~$3.2M worth into DAI.","theft":true},{"id":"ht530d7926cf","date":"2026-05-04","name":"SmartCredit","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":72000.0,"lo":72000.0,"hi":72000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/smartcredit_io/status/2051361795789496337"}],"desc":"On May 4, 2026, SmartCredit's Leveraged Lido staking module was exploited for 26.382 ETH (~$72K) via an undisclosed vulnerability. The team paused the feature and compensated users from the Loss Provision Fund; technical details were never published.","theft":true},{"id":"ht6276d0a765","date":"2026-05-01","name":"Bisq","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Bitcoin"],"usd":550000.0,"lo":550000.0,"hi":876000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/bisq_network/status/2050917431699460231"}],"desc":"Bisq v1 was exploited via missing validation on negative miner fee values in trade protocol. Modified client allowed attacker to pull value from multisig outputs; ~11 BTC stolen from 10 users. Bisq v2 and Easy unaffected.","theft":true,"review":["sources disagree on the loss"]},{"id":"htaeef8d7e35","date":"2026-05-01","name":"Sharwa.Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":32850.0,"lo":32850.0,"hi":32850.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Sharwa.Finance lost $32.85K on May 1, 2026 on Arbitrum via oracle price manipulation. Attack leveraged incorrect oracle price data to extract value from the protocol.","theft":true,"onchain":true},{"id":"ht800a65c213","date":"2026-04-30","name":"Wasabi Perps","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Base","Berachain","Blast"],"usd":5500000.0,"lo":5000000.0,"hi":5700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/wasabi-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/wasabi_protocol/status/2052856772717682724"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wasabi-protocol-exploit"}],"desc":"On April 30, 2026, Wasabi Protocol's deployer EOA was compromised, which held the sole ADMIN_ROLE without timelock or multisig protections. The attacker executed unauthorized UUPS proxy upgrades on vaults and pools across Ethereum, Base, Berachain, and Blast, sweeping approximately $5.5M in collateral and pool balances.","theft":true},{"id":"htafaaf8a4d5","date":"2026-04-29","name":"Sweat Foundation","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["NEAR"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SweatEconomy/status/2049588862352060474"}],"desc":"On April 29, 2026, an attacker exploited a logic flaw in the SWEAT token contract on NEAR Protocol, draining 13.71B SWEAT tokens (~$3.5M) from foundation wallets within 30 seconds via a malicious drain contract. Stolen tokens were quickly liquidated via MEXC and Rhea Finance; Sweat Foundation patched the contract and restored all external user balances.","theft":true},{"id":"ht30fdff4a2a","date":"2026-04-29","name":"Aftermath Perps","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Sui"],"usd":1140000.0,"lo":1140000.0,"hi":1140000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/AftermathFi/status/2049681357559808130"}],"desc":"Aftermath Finance's perpetual futures on Sui exploited for $1.14M via missing validation in fee accounting. Attackers set negative builder code fees to inflate synthetic collateral, enabling unauthorized vault withdrawals.","theft":true},{"id":"htc5c9251802","date":"2026-04-29","name":"Syndicate","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":380000.0,"lo":380000.0,"hi":380000.0,"ret":380000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://crypto.news/syndicate-labs-suffers-380k-synd-bridge-exploit-pledges-full-user-compensation/"}],"desc":"On April 29, 2026, a private key leak allowed attackers to maliciously upgrade Syndicate's Commons bridge contracts and drain approximately 18.5M SYND tokens ($330K-$400K) across two networks.","theft":true},{"id":"ht06193a4952","date":"2026-04-28","name":"YieldCore-3rd-deal","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":398764.0,"lo":398000.0,"hi":398764.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2049365873069097237"}],"desc":"YieldCore's RWAVault overrode ERC4626 withdraw() and redeem() functions but removed the standard authorization check when msg.sender ≠ owner. Any caller could specify an arbitrary depositor as owner and direct withdrawn assets to an arbitrary receiver. An attacker drained 392,764 USDC of principal from eight depositors across multiple calls.","theft":true},{"id":"htead88b1e7a","date":"2026-04-28","name":"RWAVault","kind":"hack","fam":"other","tech":"Missing ERC4626 allowance check","chains":["Ethereum"],"usd":398655.47,"lo":398655.47,"hi":398655.47,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb947b791a6","date":"2026-04-28","name":"JUDAO","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"usd":228000.0,"lo":205000.0,"hi":228000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2049019388947321334"}],"desc":"On April 28, 2026, JUDAO was exploited on BSC via a double-sync bug in the token transfer hook that miscalculated pool balances. The attacker used a Moolah flash loan (2.3M USDT) to manipulate pricing and sell JUDAO at artificially inflated prices.","theft":true,"onchain":true},{"id":"ht70b45aa0ae","date":"2026-04-28","name":"Quant","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"Token","chains":["Ethereum"],"usd":138000.0,"lo":138000.0,"hi":138000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A QNT reserve pool on Ethereum was drained of 1,988.5 QNT (~54.93 ETH, ~$138K) on 28 April 2026 via an EIP-7702 delegation chain: the pool's admin EOA delegated its code to a BatchExecutor which trusted an open, permissionless BatchCall helper; BatchCall.batch() had no caller check, allowing any address to execute arbitrary calls with admin authority.","theft":true},{"id":"ht6e742818fd","date":"2026-04-27","name":"ZetaChain","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"Chain","chains":["Ethereum","Base","Polygon","Arbitrum","Avalanche","BNB Chain"],"usd":333868.0,"lo":333868.0,"hi":334000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ZetaChain/status/2048854107633631356?s=20"}],"desc":"On April 26-27, 2026, ZetaChain's GatewayZEVM contract was exploited due to missing access control in call() and unrestricted external calls in GatewayEVM.execute(). Attacker drained $333,868 in USDC/USDT across four chains from team wallets by leveraging standing token approvals.","theft":true},{"id":"ht474b6cfc28","date":"2026-04-27","name":"Unverified_a152","kind":"hack","fam":"code","tech":"AllowanceTarget approval drain","chains":["Ethereum"],"usd":229000.0,"lo":229000.0,"hi":229000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht64e1be6bc9","date":"2026-04-26","name":"Scallop Lend","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Sui"],"usd":142000.0,"lo":142000.0,"hi":142000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Scallop_io/status/2048976878997041499"}],"desc":"Attacker exploited deprecated V2 contract from November 2023; uninitialized 'last_index' variable in rewards logic allowed unbounded claims. Using flashloan and oracle manipulation, attacker drained the sSUI rewards pool.","theft":true},{"id":"hta02529bb81","date":"2026-04-26","name":"Litecoin","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"Chain","chains":["Litecoin"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A zero-day in Litecoin's MWEB transaction validation allowed attackers to craft malformed transactions that non-updated nodes accepted, enabling unauthorized peg-outs. Fixed via 13-block chain reorganization.","theft":true},{"id":"hta0c9237d5d","date":"2026-04-25","name":"Polish Zondacrypto exchange stops processing withdrawals amid possible insolvency","kind":"collapse","fam":"insider","usd":96000000.0,"lo":96000000.0,"hi":96000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zondacrypto-withdrawal-halt"}],"headline":true},{"id":"hte4ad2e2aa4","date":"2026-04-25","name":"Purrlend","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["MegaETH","Hyperliquid"],"usd":1500000.0,"lo":1500000.0,"hi":1520000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/purrlend/status/2049807764944458094?s=46"}],"desc":"Purrlend's 2-of-3 admin multisig was compromised on HyperEVM and MegaETH, allowing attackers to assign themselves the bridge role and inherit elevated permissions to drain liquidity pools.","theft":true},{"id":"ht2f85b77c69","date":"2026-04-25","name":"Singularity Finance","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Base"],"usd":413000.0,"lo":413000.0,"hi":413130.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xSalazar/status/2048762346143666656"}],"desc":"Singularity Finance on Base exploited for $413K in April 2026 via misconfigured oracle price validation. Attacker manipulated DEX pairs to inflate collateral values.","theft":true,"onchain":true},{"id":"ht1367f26762","date":"2026-04-23","name":"Giddy","kind":"hack","fam":"code","tech":"Incomplete Signature Coverage","target":"DeFi Protocol","chains":["Ethereum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2047334517535642024"}],"desc":"On April 23, 2026, GiddyVaultV3 on Ethereum was exploited for $1.3M via incomplete EIP-712 signature coverage. Unvalidated parameters (aggregator, fromToken, toToken, amount) in SwapInfo structure allowed attackers to manipulate transaction approvals.","theft":true,"onchain":true},{"id":"ht16c35a9841","date":"2026-04-21","name":"Volo Vault","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Sui"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"ret":3440000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/volo-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/volo_sui/status/2046715584201511351"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/volo-protocol-exploited-for-3-5-million-most-recovered"}],"desc":"On April 21, 2026, Volo Protocol on Sui was exploited when a high-privilege admin key was compromised, likely via social engineering. The attacker drained three vaults: WBTC (~$2.1M), XAUm (~$0.9M), and USDC (~$0.5M). The team recovered ~$3.44M (90%) of funds after blocking a $500K bridge attempt.","theft":true},{"id":"hte3f3238e6e","date":"2026-04-21","name":"Kipseli","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Base"],"usd":72350.0,"lo":72350.0,"hi":72350.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TheDEFIac/status/2046973478595641435"}],"desc":"On April 22, 2026, an MEV bot exploited Kipseli's PropAMM Router on Base via a denomination/decimals mismatch in the quote logic, swapping 0.04 WETH for 0.926 cbBTC worth ~$72.35K.","theft":true,"onchain":true},{"id":"ht054b9d9f16","date":"2026-04-20","name":"Transit Finance","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":257800.0,"lo":257800.0,"hi":257800.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Transit Finance, a cross-chain aggregation protocol, suffered an exploit draining approximately $257.8K via an unauthenticated swap callback mechanism. The exploit allowed unauthorized parties to trigger callback functions during swap operations without proper authorization, enabling fund extraction from the protocol.","theft":true},{"id":"ht58a45ae76b","date":"2026-04-20","name":"Juicebox V3","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":52000.0,"lo":52000.0,"hi":52000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://academy.teleswap.xyz/defi-protocol-hacks-april-2026-exploits-analyzed/"}],"desc":"On April 20, 2026, Juicebox V3 REVLoans was exploited for 21.77 ETH (~$52,000). Attacker exploited unvalidated source struct in borrowFrom to forge accounting context; by matching forged and destination currencies, attacker bypassed oracle and priced loan against inflated share price using attacker-controlled decimals.","theft":true,"onchain":true},{"id":"hte922d865f0","date":"2026-04-20","name":"Thetanuts Finance","kind":"hack","fam":"code","tech":"First Depositor Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://academy.teleswap.xyz/defi-protocol-hacks-april-2026-exploits-analyzed/"}],"desc":"On April 20, 2026 Thetanuts Finance's vault contract on Ethereum was exploited for $50,000 via a first-depositor inflation flaw: an attacker minted 1 share, donated 1,000 ETH directly to the contract, then redeemed the share for nearly all vault assets when the next user deposited.","theft":true,"onchain":true},{"id":"ht4ac3e793b6","date":"2026-04-19","name":"Custom sAVAX Rebalancer","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Avalanche"],"usd":64000.0,"lo":64000.0,"hi":64000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://telemetr.io/uz/channels/2360854548-defimon_alerts"}],"desc":"On April 19, 2026, a custom rebalancer contract on Avalanche was exploited via an arbitrary external call vulnerability. The attacker abused a public function that executed unchecked external calls while the contract held delegated credit from Aave V3, allowing them to borrow WAVAX on behalf of victims and extract approximately $64K.","theft":true},{"id":"ht385614ae1c","date":"2026-04-19","name":"Vercel","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/rauchg/status/2045995362499076169"}],"desc":"Vercel CEO Guillermo Rauch stated on X that the company is currently conducting a full investigation into a security incident. The incident originated from a compromise of Context.ai, an AI platform used by a Vercel employee. This breach led to the attacker gaining access to the employee’s Google Workspace account associated with Vercel. From there, the attacker carried out a series of actions that further escalated access within the environment. Vercel clarified that all customer environment variables are fully encrypted at rest. However, the platform allows some variables to be explicitly marked as “non-sensitive.” The attacker was able to enumerate these and leverage them to gain additional access. The company noted that the speed of the attacker’s actions and their understanding of Vercel’s architecture were beyond expectations.","theft":true},{"id":"ht6d483ab674","date":"2026-04-19","name":"AaveRebalancerCreditDelegation","kind":"hack","fam":"code","tech":"Arbitrary External Call / Credit Delegation Abuse","chains":["Avalanche"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht00074fb232","date":"2026-04-18","name":"Kelp","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":293000000.0,"lo":292000000.0,"hi":293000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kelpdao-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/LayerZero_Core/status/2046081551574983137"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kelp-dao-hack"}],"desc":"On April 18, 2026, Kelp DAO's rsETH bridge was exploited for $293 million when attackers compromised LayerZero's RPC nodes via social engineering and injected fraudulent cross-chain messages. Kelp's 1-of-1 verifier configuration created a single point of failure, affecting validation across 20 chains. The attack was attributed to Lazarus Group.","theft":true},{"id":"ht3d60abafc6","date":"2026-04-18","name":"DNS registrar for eth.limo","kind":"hack","fam":"keys","tech":"Supply Chain Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/VitalikButerin/status/2045413438659416215"}],"desc":"Vitalik Buterin stated on X that the DNS registrar for eth.limo has been attacked. He advised users to temporarily avoid accessing vitalik.eth.limo or any other eth.limo-related pages until official confirmation is given that the issue has been resolved and services are back to normal.","theft":true},{"id":"htb43d2bf644","date":"2026-04-16","name":"Rhea Lend","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["NEAR"],"usd":18400000.0,"lo":18400000.0,"hi":18400000.0,"ret":10000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/rhea-finance-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/rhea_finance/status/2045203607856042118"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rhea-finance-exploit"}],"desc":"On April 16, 2026, Rhea Lend on NEAR was exploited via chained swap path that defeated margin module's slippage protection. Attacker spent April 13-15 deploying fake token contracts and eight Ref Finance pools, then executed complex swap reusing intermediate assets to drain reserves. Oracle accepted attacker-created pool prices as legitimate.","theft":true},{"id":"htf054c558a0","date":"2026-04-16","name":"Grinex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Tron","Ethereum"],"usd":13740000.0,"lo":13000000.0,"hi":15000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/397814/russia-linked-grinex-exchange-suspends-operations-15-million-hack-hostile-states"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/grinex-hack"}],"desc":"Grinex custodial wallets on Tron and Ethereum were compromised in April 2026, resulting in ~$13.74M drained. Attackers immediately swapped USDT into TRX and ETH to defeat stablecoin freezes before the exchange suspended operations.","theft":true},{"id":"ht69d6466208","date":"2026-04-15","name":"LootBot AI","kind":"hack","fam":"insider","tech":"Smart Contract Vulnerability","usd":9600.0,"lo":9600.0,"hi":9600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/DefimonAlerts/status/2044709964091187660"}],"desc":"LootBot AI’s xLoot NFT Staking contract was exploited via a Logic Error (Duplicate NFT ID in Redemption). The redeem() function did not validate duplicate token IDs in the input array. The _redeemable() logic accumulated ETH rewards per epoch for each ID without checking for duplicates, and the nextRedeem mapping was only updated after payout. The attacker flash-loaned 2.1 ETH, triggered a new epoch, called redeem() with 7 NFT IDs each duplicated 155 times, draining ~6.21 ETH. After repaying the flash loan, net profit was ~4.1 ETH ($9,600). The project appears largely abandoned (last official X activity in 2025).","theft":true},{"id":"ht4b48e5f116","date":"2026-04-15","name":"XLootStaking","kind":"hack","fam":"other","tech":"Duplicate xLOOT Redemption","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7921d5cafd","date":"2026-04-14","name":"CoW Swap","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CoWSwap/status/2044089359058501893"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cow-swap-dns-hijacking"}],"desc":"The cow.fi domain was hijacked through social engineering at the .fi domain registrar. For 4.5 hours, users were redirected to a pixel-perfect phishing clone where they unknowingly signed malicious transactions draining funds.","theft":true},{"id":"ht85d4dbaff9","date":"2026-04-14","name":"Zerion Wallet","kind":"hack","fam":"social","tech":"Phishing","target":"Wallet","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/zerion/status/2044167535231414727?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"Lazarus hackers used AI-assisted social engineering over weeks to compromise Zerion employee credentials on Telegram, LinkedIn, Slack, gaining access to internal hot wallet private keys and draining $100K. User funds remained unaffected.","theft":true},{"id":"htb5f8216832","date":"2026-04-14","name":"MONA","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":60950.0,"lo":60950.0,"hi":60950.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.darknavy.org/web3/exploits/burnaddress-mona-deferred-lp-burn/"}],"desc":"On April 14, 2026, an attacker created 25 accounts to farm MONA using a flash loan and Venus USDT borrow, exploiting flawed accounting in the deferred burn mechanism to drain 60,950 USDT from the liquidity pair.","theft":true,"onchain":true},{"id":"ht10cea5f434","date":"2026-04-14","name":"Saturn Protocol","kind":"hack","fam":"code","tech":"Vulnerability Disclosure","conf":"C","n":1,"theft":true},{"id":"htc5353881f5","date":"2026-04-13","name":"Users lose $9.5 million to fake Ledger wallet app on the Apple App Store","kind":"hack","fam":"other","usd":9500000.0,"lo":9500000.0,"hi":9500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-ledger-app"}],"theft":true,"headline":true},{"id":"ht5122ae07f1","date":"2026-04-13","name":"Dango","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Dango"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"ret":410000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/dango/status/2043710283244331409"}],"desc":"On April 13, 2026, Dango Protocol was exploited for $1.9M via missing validation on donation amounts. Attackers donated negative amounts to manipulate protocol balances, cashing out $410K before the team recovered $1.49M in tokens.","theft":true},{"id":"ht38be57b0ac","date":"2026-04-12","name":"Hyperbridge","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum","Base","BNB Chain","Arbitrum"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hyperbridge-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/CertiKAlert/status/2043557571609731268"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hyperbridge-exploit"}],"desc":"On April 13, 2026, Hyperbridge's Token Gateway was exploited via unbound Merkle proof verification and a zero-second challenge period. Attacker forged a cross-chain message, minted 1 billion bridged DOT, and liquidated for approximately $2.5M in ETH and incentive pool losses; funds traced to Binance and partially frozen.","theft":true},{"id":"ht62f2269493","date":"2026-04-12","name":"SubQuery Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Base"],"usd":134000.0,"lo":134000.0,"hi":134000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://subquery.network/blog/subquery-network-security-incident-report"}],"desc":"SubQuery Network Settings contract on Base was exploited on April 12, 2026 due to missing owner guard on functions, allowing attacker to drain 382.4M SQT from pooled staking, 272 individual staker wallets, RewardsBooster, and treasury across five transactions.","theft":true,"onchain":true},{"id":"ht5c07f1fb08","date":"2026-04-09","name":"Aethir","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":400000.0,"lo":90000.0,"hi":400000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://crypto.news/aethir-contains-bridge-hack-while-losses-stay-below-90k/"}],"desc":"On April 9, 2026, attacker took over AethirOFTAdapter on BNB Chain and drained ~423K ATH via unprotected ownership/admin function with no multisig or timelock. Funds were bridged to TRON via Symbiosis; Aethir disconnected contracts and coordinated blacklisting with major exchanges.","theft":true,"review":["sources disagree on the loss"]},{"id":"htc78b71ffaf","date":"2026-04-07","name":"SquidMulticall","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Arbitrum","BNB Chain","Avalanche","Optimism","Base"],"usd":517000.0,"lo":517000.0,"hi":517000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-apr-6-apr-12-2026"}],"desc":"SquidMulticall exposes a permissionless run() function that executes arbitrary external calls with no access control. When users mistakenly approved tokens directly to SquidMulticall (instead of Squid Router), attackers could call run() with transferFrom() payloads to drain those approvals across multiple chains. A wallet with $623K in infinite approvals was compromised, resulting in $517K extracted.","theft":true,"onchain":true},{"id":"ht760bc8b61e","date":"2026-04-07","name":"TGAI","kind":"hack","fam":"market","tech":"Reserve Manipulation Attack","chains":["BNB Chain"],"usd":11940.0,"lo":11940.0,"hi":11940.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/exvulsec/status/2041447720016396698"}],"desc":"Computility-associated TGAI project on BSC suffered a reserve manipulation attack on PancakeSwap V2 liquidity pool. The hacker used a ~$2.4M USDT flash loan, deployed multiple helper contracts to buy TGAI, manipulated reserves via sync() function with ~17.5K USDT injection, then swapped to extract profits, resulting in approximately $11.94K loss.","theft":true},{"id":"ht6831783d66","date":"2026-04-05","name":"Denaria vAMM","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Linea","Ethereum"],"usd":165618.0,"lo":165000.0,"hi":165618.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/DenariaFinance/status/2041056361186771054"}],"desc":"Denaria's perpetual exchange was exploited through virtual AMM manipulation where an attacker used a flash loan to provide one-sided liquidity, skew the price ratio, and execute oversized trades that inflated PnL calculations without any manipulation guard.","theft":true},{"id":"ht9df78f6fb0","date":"2026-04-05","name":"PerpPair","kind":"hack","fam":"other","tech":"Virtual AMM Manipulation","chains":["Linea"],"usd":165000.0,"lo":165000.0,"hi":165000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4252a5e006","date":"2026-04-04","name":"BSC TMM/USDT","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1665000.0,"lo":1665000.0,"hi":1665000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/exvulsec/status/2040649377803546859"}],"desc":"On April 4, 2026, attacker used flashloans to burn ~850M TMM tokens, reducing the TMM reserve to 1 token in the TMM/USDT pool. This price distortion allowed swapping for 272M USDT, netting $1.665M profit after flashloan repayment. Inadequate access controls enabled the large-scale burn.","theft":true},{"id":"ht537d80f045","date":"2026-04-03","name":"Silo V2","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Arbitrum"],"usd":359000.0,"lo":359000.0,"hi":392000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://smartcontractshacking.com/hacks/silo-v2-hack-2026"}],"desc":"Silo's soUSDC vault was exploited through an immutable oracle that priced wstUSR at 1.133 while market price had collapsed to 0.12, combined with accounting flaws that didn't mint shares for external deposits, allowing attackers to inflate redemption payouts.","theft":true},{"id":"htf09ab26809","date":"2026-04-03","name":"EIP-7702 Victim","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":17200.0,"lo":17200.0,"hi":17200.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-30-apr-5-2026"}],"desc":"A user EOA on BNB Chain (with EIP-7702 delegation) that had set delegated code via an EIP-7702 Type-4 transaction was drained for ~$17.2K. The delegated code included a pancakeV3SwapCallback() function without proper access control. The attacker directly called this callback with crafted calldata, forcing the victim account to transfer its tokens to an attacker-controlled address. The victim had enabled the delegation to support swap-related logic.","theft":true},{"id":"htb95676a4c5","date":"2026-04-03","name":"Adobe","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/IntCyberDigest/status/2039774692085526854"}],"desc":"GoPlus has issued a security alert regarding a suspected cyberattack on Adobe, involving the potential leak of approximately 13 million users' data. Affected users may face heightened risks, including phishing emails or calls impersonating Adobe customer support, precision social engineering scams leveraging leaked ticket information, and credential stuffing attacks.","theft":true},{"id":"htb05a11188c","date":"2026-04-03","name":"HypurrFi","kind":"hack","fam":"keys","tech":"Domain Hijacking","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/HypurrFi/status/2040186175483416995"}],"desc":"DeFi lending protocol HypurrFi tweeted that the hypurr.fi domain has been hijacked. The team has migrated its infrastructure to hypurrfi .com. The protocol itself, user funds, and team infrastructure remain unaffected.","theft":true},{"id":"ht5eada11afa","date":"2026-04-02","name":"SAS Token","kind":"hack","fam":"code","tech":"Smart Contract Vulnerability","chains":["BNB Chain"],"usd":12000.0,"lo":12000.0,"hi":12000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-30-apr-5-2026"}],"desc":"The SAS Token on BNB Chain was exploited via a flawed custom transfer logic (Deferred Burn Exploit). The token’s custom transfer logic had a flaw: sending SAS to the LP pool only incremented a global sellBurn counter, while any subsequent ordinary transfer could burn SAS directly from the pool and call sync() to rewrite reserves, bypassing the AMM’s swap logic. The attacker accumulated sellBurn credit through sells, triggered an unrelated ordinary transfer to burn SAS from the pool down to ~1 wei, and then reverse-swapped to extract profit.","theft":true},{"id":"ht324d402d7e","date":"2026-04-02","name":"Trust Wallet","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://t.me/investigations/309"}],"desc":"According to ZachXBT, the Trust Wallet Discord vanity URL (discord[.]gg/trustwallet) has been hijacked and currently directs users to a phishing server. Users are advised to avoid using links from official channels—including the official website, Telegram, and blogs—to join the Discord at this time.","theft":true},{"id":"ht94538fd91a","date":"2026-04-01","name":"Drift Trade","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"DeFi Protocol","chains":["Solana"],"usd":285000000.0,"lo":285000000.0,"hi":295000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/drift-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/OnchainLens/status/2039507495044194391"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/drift-exploit"}],"desc":"On April 1, 2026, Drift Protocol on Solana was exploited for ~$295M when attackers tricked Security Council members into pre-signing transactions via Solana durable nonces, handing over admin control. Attackers whitelisted a worthless fake token (CVT) as collateral, deposited 500M CVT, and withdrew $285M in real assets (USDC, SOL, ETH) in ~12 minutes. Security firms linked the attack to DPRK/Lazarus Group.","theft":true},{"id":"ht1b9ae60a75","date":"2026-04-01","name":"Galaxy Digital","kind":"hack","fam":"keys","tech":"Unknown","usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2026/04/01/galaxy-digital-suffers-hack-but-no-client-funds-or-information-were-compromised"}],"desc":"A spokesperson for Galaxy Digital disclosed that the company recently contained a cybersecurity incident. Unauthorized access was strictly limited to an isolated development and testing environment; production systems, trading platforms, and customer accounts remained unaffected. The company quickly detected and contained the intrusion. The affected area was a standalone R&D environment unrelated to core infrastructure, resulting in a loss of less than $10,000 in corporate testing funds. Following a review, it was confirmed that no customer funds or account information were accessed or at risk, and all platforms and services remain fully operational. Galaxy stated they will continue to review the incident and provide updates as appropriate.","theft":true},{"id":"ht81d7d43cf5","date":"2026-03-31","name":"LML/USDT staking protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":950000.0,"lo":950000.0,"hi":950000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2039211832947408928"}],"desc":"On April 1, 2026, the LML/USDT staking protocol on BSC was exploited for $950K via price manipulation. Attacker purchased nearly all LML supply from PancakeSwap using 309.5M USDT, burned tokens, and manipulated TWAP to claim rewards at artificially inflated rates, causing LML to crash 99.6% to $0.1758.","theft":true},{"id":"htbb91993cdf","date":"2026-03-31","name":"WhalebitOracleManipulation","kind":"hack","fam":"market","tech":"Algebra spot-price oracle manipulation","chains":["Polygon"],"usd":824000.0,"lo":824000.0,"hi":824000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht44ad13665b","date":"2026-03-31","name":"WhaleBit","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Polygon"],"usd":10500.0,"lo":10500.0,"hi":10500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"WhaleBit's staking system was exploited through same-transaction spot price depression via flash loan, where the attacker dumped CES tokens into the Algebra pool to depress price and inflated staking redemption payouts by 14.4-15.7%.","theft":true},{"id":"htee9adc7958","date":"2026-03-31","name":"Arf's official X account","kind":"hack","fam":"keys","tech":"Account Compromised","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/humafinance/status/2038810915802611834"}],"desc":"Huma Finance issued a warning on X stating that the official X account of its partner Arf, @arf_one, has been compromised. Please refrain from interacting with any posts from that account until it has been fully secured.","theft":true},{"id":"htb821925013","date":"2026-03-31","name":"axios npm package","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Cointelegraph/status/2038843819760734636"}],"desc":"Socket has detected an active supply chain attack targeting version 1.14.1 of the core npm package, axios. The attacker injected malicious code into axios by introducing a malicious dependency that first appeared today. Developers using axios are advised to pin their versions immediately and review their project lockfiles.","theft":true},{"id":"htb0a0c3aff4","date":"2026-03-30","name":"Steakhouse Financial","kind":"hack","fam":"keys","tech":"Social Engineering","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SteakhouseFi/status/2038714374592852085"}],"desc":"Steakhouse Financial disclosed yesterday that it was targeted by a phone-based social engineering attack against its provider, OVH Cloud. The attacker modified the DNS A records of the main website and app subdomains to point to a malicious IP address and attempted to initiate a 5-day domain transfer. These changes have now been reverted, and the DNS records have been cleared. The team is currently  working with OVH Cloud to fully resolve the issue. All vaults and smart contracts were not affected, and depositor funds remain safe. No other service accounts were compromised.Users are advised not to interact with the official website or emails until the issue is fully resolved. A detailed post-incident report will be released as soon as possible. Earlier today, Steakhouse Financial further stated that during the period when the website’s DNS records were cleared, vaults remained accessible directly via Morpho, with all functions — including deposits and withdrawals — operating normally. A confirmation will be provided once the frontend is fully restored.","theft":true},{"id":"ht4e8feaafba","date":"2026-03-28","name":"GoonFi","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Solana"],"usd":254000.0,"lo":254000.0,"hi":254000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Cetipo/status/2037892924982038893"}],"desc":"GoonFi v2's WSOL/USDC pool on Solana was drained of ~$254,000 in March 2026 via a program configuration bug in the AMM pricing logic.","theft":true},{"id":"ht332101e5aa","date":"2026-03-28","name":"VTSwapHook","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"VTSwapHook on Uniswap V4 was exploited through a pricing curve approximation error where the hook used midpoint averages instead of proper logarithmic curve integration, combined with fee accounting bugs that inflated virtual reserves.","theft":true,"onchain":true},{"id":"ht0db120000a","date":"2026-03-27","name":"EST Token","kind":"hack","fam":"other","tech":"Incorrect Token Burn Mechanism","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte3f2889eae","date":"2026-03-26","name":"TUR Staking","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":133000.0,"lo":133000.0,"hi":133000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On March 26, 2026, the TUR staking protocol on BSC was exploited via a spot price manipulation attack. The attacker manipulated the TUR-NOBEL liquidity pool to artificially inflate the spot price, then used this inflated price to trigger oversized reward calculations in the staking contract. The attacker claimed amplified rewards through a referral account and profited approximately $133K by swapping the stolen TUR for USDT.","theft":true},{"id":"htf765b6faec","date":"2026-03-26","name":"Unknown Stake Contract","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":133000.0,"lo":133000.0,"hi":133000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2037245722454876304"}],"desc":"According to monitoring by BlockSec Phalcon, a suspicious transaction targeting an unknown contract (Stake) on the BSC chain has been detected, resulting in a loss of approximately $133,000. The attacker exploited a spot price dependency vulnerability within the Stake contract. By manipulating the price of TUR in the TUR-NOBEL pool and subsequently staking TUR, the attacker triggered reward calculations based on the artificially inflated price. They then claimed the amplified rewards through a referral account and ultimately profited by swapping the stolen TUR for USDT.","theft":true},{"id":"ht41745747de","date":"2026-03-24","name":"Univ3CollateralToken","kind":"hack","fam":"code","tech":"Logic Error","chains":["Optimism"],"usd":57000.0,"lo":57000.0,"hi":57000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht54922a4982","date":"2026-03-24","name":"UdonFi Lending","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Chromia"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Udon Finance’s lending pool was exploited through a vulnerability in its withdrawal function that allowed an attacker to extract funds without proper authorization. The team confirmed that the stolen assets remained on Chromia and offered the attacker a 10% bounty in exchange for returning the remaining 90%. The precise technical mechanism and total loss were not disclosed","theft":true},{"id":"hte18bc15a35","date":"2026-03-24","name":"LiteLLM","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/im23pds/status/2036599387267428713"}],"desc":"SlowMist's CISO 23pds warned on X: \"A major supply chain attack has hit LiteLLM (97M monthly downloads) via PyPI. Simply executing pip install litellm allows attackers to steal sensitive data: SSH keys, cloud logins (AWS/GCP/Azure), K8s configs, Git credentials, API keys, shell history, crypto wallets, and DB passwords.\"","theft":true},{"id":"ht1dab172dc3","date":"2026-03-24","name":"Moonwell","kind":"hack","fam":"market","tech":"Governance Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/395272/moonwell-governance-attack"}],"desc":"According to The Block, DeFi lending protocol Moonwell is facing a governance attack on its Moonriver deployment, where an unknown attacker spent approximately $1,800 to acquire 40 million MFAM tokens and managed to buy, propose, and pass a initial vote within just 11 minutes. The attacker is seeking to transfer administrative control of seven lending markets, the comptroller, and the oracle to a malicious contract, which would enable the extraction of roughly $1.08 million in user funds. Although the proposal reached a quorum early on, \"No\" votes have since taken the lead, and while the voting is set to continue until March 27, the final outcome remains dependent on the remaining votes and community coordination.","theft":true},{"id":"ht4b5ed6fb81","date":"2026-03-24","name":"XocolatlLiquidator","kind":"hack","fam":"code","tech":"Access Control / Input Validation","chains":["Base"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht39928df43f","date":"2026-03-23","name":"Bitcoin Depot","kind":"hack","fam":"other","tech":"Credential Compromise","chains":["Bitcoin"],"usd":3665000.0,"lo":3665000.0,"hi":3665000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/363734/bitcoin-depot-atm-operator-3-6-million-btc-stolen-security-breach"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoin-depot-hack"}],"desc":"According to Decrypt, Bitcoin ATM operator Bitcoin Depot disclosed in a filing with the U.S. Securities and Exchange Commission that it experienced a security breach on March 23. Approximately 50.9 BTC, valued at around $3.665 million, was stolen by attackers. The hackers infiltrated the company’s IT systems and obtained credentials for its digital asset settlement accounts, enabling unauthorized fund transfers. Bitcoin Depot stated that it has activated its incident response procedures, engaged external cybersecurity experts to investigate the attack vector and secure remaining assets, and notified law enforcement authorities. The company also noted that its customer platform and user data were not affected by the breach.","theft":true,"review":["sources disagree on the date"]},{"id":"htd2e2b1307e","date":"2026-03-23","name":"BCE-USDT liquidity pool","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":679000.0,"lo":679000.0,"hi":800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/2035998829296984572?s=46"}],"desc":"BCE token's flawed burn mechanism was exploited to manipulate AMM reserves via malicious contracts that triggered burns inside the PancakeSwap pool, distorting the BCE-USDT balance and enabling reserve extraction.","theft":true},{"id":"ht6491f94a7c","date":"2026-03-22","name":"Cyrus Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":5000000.0,"lo":516840.0,"hi":5000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://certik.medium.com/cyrus-finance-incident-analysis-91f1754a058f"}],"desc":"On March 22, 2026, Cyrus Finance on BSC was exploited through price manipulation. Attacker abused reliance on live PancakeSwap V3 spot price in withdrawal logic, with no TWAP or oracle resistance, to extract liquidity and tokens.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht9b84d81ae5","date":"2026-03-21","name":"Resolv USR","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Ethereum"],"usd":24500000.0,"lo":24000000.0,"hi":25000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/resolv-labs-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2035565047133401563"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/usr-stablecoin-depeg"}],"desc":"Resolv's AWS KMS-hosted SERVICE_ROLE private key was compromised, enabling the minting of 80M unbacked USR stablecoins. The attacker swapped USR to wstUSR and then to ETH, extracting $24.5M before the protocol depeg.","theft":true},{"id":"ht8c597b0f82","date":"2026-03-19","name":"ATMBlindBox","kind":"hack","fam":"other","tech":"Weak Randomness / Predictable RNG","chains":["BNB Chain"],"usd":99000.0,"lo":99000.0,"hi":99000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5204280fba","date":"2026-03-19","name":"Revamp","kind":"hack","fam":"code","tech":"Reward Accounting Drain","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht9931baa58a","date":"2026-03-18","name":"Neutrl","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Neutrl/status/2034445580840370211"}],"desc":"On March 18, 2026, Neutrl DeFi protocol experienced DNS hijacking redirecting the official domain to a malicious interface. Users accessing the spoofed frontend were prompted to approve token transfers, but no funds were stolen as user assets remained in custodial wallets.","theft":true},{"id":"hte9d10cedfd","date":"2026-03-17","name":"dTRINITY dLEND","kind":"hack","fam":"code","tech":"First Depositor Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":257000.0,"lo":257000.0,"hi":257000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/dTRINITY_DeFi/status/2033934153738010779"}],"desc":"On March 17, 2026, dTRINITY dLEND was exploited for ~$257K through an empty market vulnerability. The attacker manipulated the liquidityIndex via repeated flashloan premium accrual on a newly-deployed cbBTC reserve with near-zero liquidity, inflating collateral valuations and enabling borrowing of the entire dUSD supply.","theft":true},{"id":"ht900d960641","date":"2026-03-16","name":"CheckoutPool","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Polygon"],"usd":85700.0,"lo":85700.0,"hi":85730.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Fun.xyz's legacy CheckoutPool contract on Polygon exposed a bridge() function without access control or recipient binding, allowing attackers to redirect execution into trusted settlement paths and drain funds to attacker-controlled accounts.","theft":true,"onchain":true},{"id":"ht5d27afe196","date":"2026-03-15","name":"Venus Core Pool","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["BNB Chain"],"usd":3700000.0,"lo":2150000.0,"hi":3700000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/venus-protocol-rekt4"},{"s":"SlowMist Hacked","u":"https://x.com/VenusProtocol/status/2033241018704044377"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/venus-protocol-bad-debt"}],"desc":"On March 15, 2026, an attacker drained $3.7M from Venus Protocol THE market on BSC by directly transferring THE tokens to inflate the exchange rate 3.81x, enabling massive borrowing. The attacker had spent 9 months accumulating 84% of the supply cap. The vulnerability was in getCashPrior() reading contract balance directly instead of tracking internal accounting.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht4a1324ed08","date":"2026-03-15","name":"StakeOnMe","kind":"hack","fam":"other","tech":"Owner-privileged JAKE burn reserve drain","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb10cebe414","date":"2026-03-14","name":"Goose Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":8435.0,"lo":8435.0,"hi":8435.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-9-mar-15-2026"}],"desc":"Goose Finance on BSC exploited for $8K via share accounting flaw in vault withdrawal logic on March 14, 2026. The bug evaded prior audits.","theft":true},{"id":"htffae058f12","date":"2026-03-12","name":"Trader loses almost $50 million in Aave swap gone wrong","kind":"other","fam":"other","usd":49962385.0,"lo":49962385.0,"hi":49962385.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aave-swap-loss"}],"headline":true},{"id":"ht40e7584d63","date":"2026-03-12","name":"Aave V3","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":862000.0,"lo":862000.0,"hi":26900000.0,"ret":862000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/aave-rekt"},{"s":"SlowMist Hacked","u":"https://www.rektautopsy.com/rekt/aave-v3-ethereum-2026-03-12"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/chaos-labs-aave-liquidations"}],"desc":"Aave V3 oracle misconfiguration on March 10-12, 2026 caused ~$862K in losses. Chaos Labs' CAPO system reported wstETH at 1.1939 instead of 1.228, triggering liquidations of 34 otherwise-healthy E-Mode positions due to inconsistent snapshot configuration.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht33f565cd36","date":"2026-03-12","name":"Stake DAO Yield","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["Arbitrum","Base"],"usd":176000.0,"lo":176000.0,"hi":176000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/StakeDAOHQ/status/2036029009054642461"}],"desc":"Stake DAO suffered multiple 2026 exploits: March 12 Oracle Message Spoofing caused $176K loss; May 27 deployer key compromise enabled minting 5.4T vsdCRV on Arbitrum in 25 seconds via LayerZero v2 OFT bridge. Incomplete ownership handover since March 2024 left deployer EOA as owner.","theft":true},{"id":"ht61a00d0d51","date":"2026-03-12","name":"AM","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":131572.0,"lo":131572.0,"hi":131572.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"AM token's deferred burn mechanism was exploited where accumulated toBurnAmount caused unbounded burns on the next sell transaction. Flash loan-funded attackers inflated pair USDT reserves before triggering the deferred burn to sell at exaggerated effective prices.","theft":true},{"id":"ht08365d7eea","date":"2026-03-12","name":"AM/USDT pool","kind":"hack","fam":"code","tech":"Reserve Manipulation Attack","chains":["BNB Chain"],"usd":131000.0,"lo":131000.0,"hi":131000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2031957703451688970"}],"desc":"The AM/USDT pool on the BSC chain was exploited several hours ago, with estimated losses of approximately $131,000. The root cause lies in a vulnerability within the burn mechanism, which was exploited to manipulate the AM reserves in the pool and artificially inflate the token price. The attacker first manipulated the toBurnAmount and then triggered the burn logic after the AM balance in the pool had been adjusted. This drove the AM reserves down to an unnaturally low level, allowing the attacker to sell AM back to the pool at an inflated price to realize a profit.","theft":true},{"id":"ht67ed9b83c6","date":"2026-03-11","name":"DBXen","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2031955394025996688"}],"desc":"DBXen's ERC2771 meta-transaction implementation had an identity confusion bug where burnBatch() used _msgSender() to identify the actual user but onTokenBurned() used msg.sender() to identify the forwarder, allowing attackers to claim accumulated fees from 1,085 cycles using brand-new addresses.","theft":true},{"id":"ht8f8a1efa35","date":"2026-03-11","name":"BONK Fun","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"ICO","chains":["Solana"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SolportTom/status/2031930573342519702"}],"desc":"BONK Fun's domain was hijacked via social engineering of registrar support to remove 2FA. The attacker replaced the site with a cloned frontend running Inferno Drainer, a wallet-draining contract that prompted users to sign malicious transactions.","theft":true},{"id":"ht5fc4eccdd7","date":"2026-03-10","name":"Movie Token","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":242000.0,"lo":242000.0,"hi":242000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Movie Token's extractFromPoolForLpMining function burned tokens directly from the PancakeSwap MT/WBNB LP pair without the pair's knowledge. Combined with a flash swap callback, this allowed the attacker to collapse the pool's MT reserve from 6.76M to 21K, enabling massive sell orders at inflated prices.","theft":true},{"id":"htd4ff8c8980","date":"2026-03-10","name":"MT-WBNB liquidity pool","kind":"hack","fam":"other","tech":"Reserve Manipulation Attack","chains":["BNB Chain"],"usd":242000.0,"lo":242000.0,"hi":242000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/2031226066572837313?s=46"}],"desc":"According to BlockSec Phalcon's monitoring, a suspicious transaction targeting the MT-WBNB liquidity pool on BSC was detected several hours ago, resulting in an estimated loss of approximately $242,000. The root cause lies in a flaw within the buyer restriction mechanism: under deflationary mode, normal buy orders were reverted; however, the router and pair addresses were whitelisted. The attacker bypassed these restrictions by swapping and removing liquidity through the router to acquire MT tokens from the pair. Subsequently, the attacker sold MT to accumulate a pendingBurnAmount and invoked the distributeFees() function to directly burn MT from the trading pair, artificially inflating the price. This allowed the attacker to swap MT back for WBNB to realize a profit. Furthermore, a referral rule that allowed the transfer of the first 0.2 MT to bypass buyer restrictions enabled the attacker to initiate the exploit.","theft":true},{"id":"ht2009e6bf6b","date":"2026-03-10","name":"AlkemiEarn","kind":"hack","fam":"code","tech":"Business Logic","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht113f7dee4a","date":"2026-03-09","name":"Gondi V3","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"NFTfi","chains":["Ethereum"],"usd":230000.0,"lo":230000.0,"hi":230000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/392909/nft-platform-gondi-moves-users-whole-230000-contract-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gondi-theft"}],"desc":"Gondi V3 exploited March 9, 2026 when the Purchase Bundler lacked caller verification. Attacker drained 78 NFTs (~$230K) with lingering approvals from prior loan operations by calling the unprotected buy() function.","theft":true},{"id":"ht0e9a94d86d","date":"2026-03-07","name":"Molt EVM","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Other","chains":["Base"],"usd":127000.0,"lo":127000.0,"hi":127000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/MeiMighty1/status/2031160110714679490"}],"desc":"On March 7, 2026, Molt EVM on Base was exploited for ~$127K via missing access control on the setSpawnerToken() function. The attacker overwrote the authorized spawner with their own contract, then called the protected spawnTokens() function to mint 100 million mEVM tokens at zero cost and swapped them for WETH.","theft":true},{"id":"htf36a64bd51","date":"2026-03-06","name":"SolvBTC","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum","Bitcoin"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/solv-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SolvProtocol/status/2029612210490933697"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/solv-protocol-exploit"}],"desc":"Solv Protocol BRO vaults were exploited on March 6, 2026 when ERC-3525 NFT deposit triggered callbacks that minted tokens before parent transaction completed, allowing double-minting. 135 BRO inflated to 567M tokens (~38 SolvBTC, ~$2.7M).","theft":true},{"id":"hta97ece4bc8","date":"2026-03-03","name":"Returned crypto stolen again from Korean authorities","kind":"hack","fam":"other","usd":4920000.0,"lo":4920000.0,"hi":4920000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/returned-crypto-stolen-again-from-korean-authorities"}],"theft":true,"headline":true},{"id":"hta982439385","date":"2026-03-02","name":"FOOM Cash","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum","Base"],"usd":2260000.0,"lo":2260000.0,"hi":2260000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/gopluszh/status/2027002497911623960?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On March 2, 2026, a misconfigured Groth16 verifier allowed attackers to submit forged zero-knowledge proofs and withdraw $2.26M from FOOM Cash. A white-hat recovered $1.84M (81%) of the stolen funds.","theft":true},{"id":"ht5c81a83c10","date":"2026-03-02","name":"Curve LlamaLend","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":240000.0,"lo":240000.0,"hi":240000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CurveFinance/status/2032917563051553092"}],"desc":"Attacker flash-loaned 10M USDC and 15,986 WETH from Morpho Blue to manipulate sDOLA vault exchange rate, triggering liquidations of 27 borrowers in sDOLA/crvUSD market for ~$240K profit. Oracle vulnerability: CryptoFromPoolVaultWAgg used sDOLA.convertToAssets() as spot price without atomic-manipulation protection.","theft":true},{"id":"ht4994b43001","date":"2026-03-02","name":"Inverse Finance","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":240000.0,"lo":240000.0,"hi":240000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/2028337639737491748?s=46"}],"desc":"According to BlockSec Phalcon’s monitoring, its system detected a suspicious transaction targeting an Inverse Finance contract on Ethereum several hours ago, resulting in a loss of approximately $240,000. The incident appears to involve DOLA price manipulation, which forced multiple users to liquidate their positions.","theft":true},{"id":"ht237008d2d0","date":"2026-03-01","name":"Bitrefill","kind":"hack","fam":"keys","tech":"APT Endpoint Compromise Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/393974/crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect"}],"desc":"Bitcoin payment service provider Bitrefill disclosed on X that it suffered a cyberattack on March 1, 2026, resulting in a customer data breach. The attack originated from a compromised employee laptop, which allowed the attacker to access parts of the company’s databases and cryptocurrency wallets.The investigation indicates that the attack methods closely resemble those previously used by the North Korean DPRK Lazarus Group / Bluenoroff hacking organization in targeting crypto companies.Approximately 18,500 purchase records were affected, involving limited customer information such as email addresses, crypto payment addresses, and IP metadata. Among these, around 1,000 records contained customer names stored in encrypted form, which may also have been accessed.Bitrefill stated that customers do not need to take specific action but are advised to remain vigilant for any suspicious communications.The company added that the affected systems have been shut down and isolated, and it is working with security experts, on-chain analysts, and law enforcement agencies. Operations have now largely returned to normal.Bitrefill emphasized that it remains financially strong and profitable, capable of absorbing the losses from this incident, and will continue strengthening its cybersecurity measures, including internal access controls, monitoring, and incident response mechanisms.","theft":true},{"id":"ht1c5e130a60","date":"2026-02-28","name":"Wise Lending V2","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":66000.0,"lo":66000.0,"hi":66000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://smartcontractshacking.com/hacks/wise-lending-v2-hack-2026"}],"desc":"Wise Lending V2 suffered a flashloan exploit on Arbitrum and Ethereum with significant losses. The exact attack vector remains unclear from available public sources.","theft":true},{"id":"htd86e78c073","date":"2026-02-27","name":"Stake Nova","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Solana"],"usd":137014.0,"lo":137014.0,"hi":137014.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/chrisdior777/status/2027080169983295538?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"Stake Nova suffered a loss of approximately $137,014, representing about 95% of user deposits. The root cause was an unchecked validation issue in the RedeemNovaSol() function, which led to a flash-loan exploit that drained the liquidity pool. The vulnerability has now been fixed, the dApp has been taken offline, and the website is currently under maintenance. The team is offering a 10% on-chain bounty to the attacker; otherwise, they stated they will continue to pursue accountability.","theft":true},{"id":"htef9bc789ea","date":"2026-02-26","name":"Crypto stolen from Korean authorities after they post wallet seed phrase","kind":"hack","fam":"other","usd":4920000.0,"lo":4920000.0,"hi":4920000.0,"ret":4920000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-stolen-from-korean-authorities-after-they-post-wallet-seed-phrase"}],"theft":true,"headline":true},{"id":"ht8b1368b36d","date":"2026-02-26","name":"Ploutos Money","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":390000.0,"lo":390000.0,"hi":390000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2026943448734114011"}],"desc":"Ploutos Money oracle misconfigured to use BTC/USD feed for USDC pricing. Attacker borrowed 187 ETH by depositing only 8 USDC (~10^12x discrepancy), exploiting the misconfiguration within one block.","theft":true},{"id":"ht207d3aa78c","date":"2026-02-25","name":"Holdstation","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","usd":462000.0,"lo":462000.0,"hi":462000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/HoldstationW/status/2026487570751008932"}],"desc":"the Holdstation team confirmed that its DeFAI Smart Wallet product suffered a supply chain attack targeting the application distribution infrastructure. This resulted in unauthorized transactions in some user wallets, with a confirmed loss of approximately $462,000 USDT. Smart contracts were not directly exploited. The team committed to 100% compensation for affected users and is reinforcing security measures.","theft":true},{"id":"ht205a52bc8b","date":"2026-02-23","name":"DGLD","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Base"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://dgld.ch/news/post-incident-report-february-2026-exploit"}],"desc":"DGLD (gold-backed stablecoin) cross-chain bridge on Base was exploited on February 23, 2026. Attackers discovered they could mint over 100M unbacked DGLD tokens on Base within 2.5 hours, where legitimate circulation was ~70.8M. Economic impact was ~$250,000, absorbed by DGLD as the primary liquidity provider.","theft":true},{"id":"htae01ee5aca","date":"2026-02-23","name":"WLFI","kind":"hack","fam":"keys","tech":"Social Engineering","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/worldlibertyfi/status/2025951491287089384"}],"desc":"WLFI announced on X that USD1 experienced an organized attack this morning. The attackers reportedly compromised the accounts of several WLFI co-founders, paying influencers to spread FUD (Fear, Uncertainty, and Doubt) and heavily shorting $WLFI in an attempt to profit from artificially created market chaos. WLFI stated that the operation failed. Thanks to USD1’s robust minting and redemption mechanisms and its 100% 1:1 asset backing, USD1 remains stable and is currently trading near its par value. The team emphasized that no bad actors can shake their long-term commitment to USD1. Meanwhile, WLFI reminded users to obtain accurate information only through officially verified channels and to be wary of misleading content.","theft":true},{"id":"htf0ec826f47","date":"2026-02-22","name":"Blend Pools V2","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Stellar"],"usd":10970000.0,"lo":10200000.0,"hi":10970000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/yieldblox-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/blockaid_/status/2057118828740374669?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On February 22, 2026, an attacker pumped Stellar's thin USTRY market from ~$1.06 to ~$106.74, inflating collateral values. Two transactions drained $10.97M (1M USDC + 61M XLM) from YieldBlox DAO's Blend V2 lending pool, exploiting the lack of liquidity checks and anomaly detection in the oracle.","theft":true},{"id":"ht3ef378f79f","date":"2026-02-22","name":"LAXO","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":190000.0,"lo":190000.0,"hi":190000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"LAXO token's flawed burn mechanism allowed an attacker to execute a burn-before-sync exploit via flash loans. By burning LAXO directly from the PancakeSwap pool without triggering a reserve sync, the attacker artificially collapsed pool reserves and extracted 487k USDT through manipulated swaps.","theft":true},{"id":"ht61531e2675","date":"2026-02-21","name":"IoTeX’s ioTube bridge","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":4400000.0,"lo":2000000.0,"hi":4400000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/iotex-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/iotex_io/status/2025824807120412842"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/iotex-bridge-exploit"}],"desc":"On February 21, 2026, ioTube bridge's Ethereum-side Validator contract private key was compromised via social engineering targeting an employee. The attacker performed a malicious upgrade bypassing validation and signature checks, gaining control of TokenSafe and MintPool. Approximately $4.3M in USDC, USDT, IOTX, WBTC, and BUSD were drained within hours. Attackers were credited to the same group behind the Infini exploit.","theft":true,"review":["sources disagree on the loss"]},{"id":"htba3f19773d","date":"2026-02-21","name":"YieldBlox lending pool drained of $10.2 million","kind":"hack","fam":"other","usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yieldblox-theft"}],"theft":true,"headline":true},{"id":"htdf5c8a54cc","date":"2026-02-21","name":"Veil Cash","kind":"hack","fam":"bridge","tech":"Proof Verifier Bug","target":"DeFi Protocol","chains":["Base"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Veildotcash/status/2025293773891404225"}],"desc":"On February 20-21, 2026, Veil Cash on Base was exploited for 2.9 ETH (~$5.7K). Attacker exploited a misconfigured Groth16 SNARK verifier with identical delta and gamma parameters, breaking the soundness equation and enabling proof forgery to withdraw 29 times from the privacy pool without depositing.","theft":true},{"id":"ht6ebcf4af4b","date":"2026-02-20","name":"Goliath Ventures CEO charged with running $328 million Ponzi scheme","kind":"fraud","fam":"insider","usd":328000000.0,"lo":328000000.0,"hi":328000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/goliath-ventures-ceo-charged"}],"headline":true},{"id":"hta6944ca8e6","date":"2026-02-19","name":"South Korean prosecutors lose $22 million of seized crypto to the wallet inspector, later recover it","kind":"followup","fam":"other","chains":["Bitcoin"],"usd":22000000.0,"lo":22000000.0,"hi":22000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phishing-attack-on-south-korean-prosecutors"}],"headline":true},{"id":"htb3467943e5","date":"2026-02-19","name":"Velar Perps","kind":"hack","fam":"market","tech":"Predictable Oracle Update","target":"DeFi Protocol","chains":["Mezo"],"usd":401000.0,"lo":401000.0,"hi":401000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On February 19, 2026, Velar's PerpDEX on Mezo was exploited via predictable oracle price updates. Attacker manipulated BTC/MUSD perpetual pool by systematic trading patterns, flowing ~$72M volume and draining ~$401K through exploitable oracle timing.","theft":true},{"id":"ht2dd8a9a012","date":"2026-02-16","name":"XDKRecycle","kind":"hack","fam":"other","tech":"XDK recycle reserve manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht98dea08e85","date":"2026-02-15","name":"Moonwell Lending","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":1780000.0,"lo":1780000.0,"hi":1780000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/moonwell-rekt"},{"s":"SlowMist Hacked","u":"https://decrypt.co/358374/oracle-error-leaves-defi-lender-moonwell-1-8-million-bad-debt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moonwell-exploit"}],"desc":"Moonwell Lending on Base suffered a $1.78M loss when AI-generated code misconfigured the cbETH oracle to price it at $1.12 instead of nearly $2,200, failing to multiply the exchange rate by the price feed. This enabled abnormal liquidations and borrowing.","theft":true},{"id":"ht69bc824255","date":"2026-02-07","name":"Bithumb accidentally gives away $44 billion to customers","kind":"other","fam":"other","chains":["Bitcoin"],"usd":44000000000.0,"lo":44000000000.0,"hi":44000000000.0,"ret":43868000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bithumb-giveaway-error"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht02c68986f1","date":"2026-02-03","name":"Arbitrum Governance","kind":"hack","fam":"market","tech":"The X account was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/arbitrum/status/2018658275588485142"}],"desc":"Arbitrum has issued a security alert: The official X account for Arbitrum Governance (@arbitrumdao_gov) has been compromised. Do not click on any links posted by this account or engage with it. The team is working to restore access and will provide further updates soon.","theft":true},{"id":"htd2c5063284","date":"2026-02-01","name":"CrossCurve","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/387939/crosscurve-bridge-exploited-for-approximately-3-million-across-multiple-chains-via-spoofed-messages"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crosscurve-users-exploited-for-around-3-million"}],"desc":"CrossCurve's ReceiverAxelar contract failed to validate message origin, letting attackers forge cross-chain messages. Attackers crafted messages to release tokens without offsetting deposits on other chains, draining $3M across multiple blockchains.","theft":true},{"id":"hte88e32dce5","date":"2026-01-31","name":"Step Finance","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Solana"],"usd":40000000.0,"lo":28700000.0,"hi":40000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/step-finance-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/StepFinance_/status/2018379876642804213"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/step-finance-theft"}],"desc":"On January 31, 2026, Step Finance suffered a $40 million operational loss when attackers compromised executive team devices, gaining unauthorized access to treasury and fee wallet signing keys/credentials. The protocol had no smart contract vulnerabilities.","theft":true},{"id":"htea73477b08","date":"2026-01-29","name":"Revert Lend","kind":"hack","fam":"code","tech":"Staking Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":50000.0,"lo":50000.0,"hi":50101.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/revertfinance/status/2017087480772600157"}],"desc":"Revert Lend's Aerodrome Lend vault on Base was exploited on January 29-30, 2026 for $50,101 when missing validation allowed withdrawal of collateral that was still backing an active loan.","theft":true},{"id":"ht248c0d73eb","date":"2026-01-27","name":"PGNLZ","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/2016154398817505595?s=46"}],"desc":"PGNLZ's flawed burn mechanism allowed attackers to burn tokens directly from the PancakeSwap USDT-PGNLZ pool's balance without proper synchronization. This artificially reduced pool reserves, creating sharp price distortions that enabled attackers to execute reverse swaps and drain approximately $100K in USDT.","theft":true},{"id":"ht834b681dc1","date":"2026-01-27","name":"Solar","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/xueqiu88/status/2015990208471437490"}],"desc":"Solar, the official Solana Mandarin community, highly suspects its official X account (@Solana_zh) has been hacked. The team currently lacks access and is working urgently with X support to resolve the issue. Recovery time is TBD.","theft":true},{"id":"ht4cd17e3360","date":"2026-01-25","name":"Matcha","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":13430000.0,"lo":13430000.0,"hi":13430000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2015608261119217671"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/matcha-meta-exploit"}],"desc":"Matcha Meta users lost $13.43M on January 25, 2026 when the SwapNet aggregator was exploited for arbitrary-call ability. The vulnerability allowed unauthorized access to user-approved tokens across Base and Ethereum. The frontend UI inadequately warned about approval risks.","theft":true},{"id":"htc9a568bf3a","date":"2026-01-25","name":"Aperture LM","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum","Base","BNB Chain","Polygon","Avalanche"],"usd":3670000.0,"lo":3400000.0,"hi":3670000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ApertureFinance/status/2015938720453820752"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aperture-finance-exploit"}],"desc":"On January 25, 2026, Aperture Finance V3/V4 contracts across Ethereum, Base, and Arbitrum were exploited for $3.67M via arbitrary external call vulnerability. Insufficient validation allowed attackers to abuse existing ERC-20 and ERC-721 approvals and drain assets without key compromise.","theft":true},{"id":"ht629413b1a9","date":"2026-01-25","name":"Scroll","kind":"hack","fam":"other","tech":"The X account was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Scroll_ZKP/status/2014427453062524999"}],"desc":"Scroll alerted on X that the X account of co-founder @shenhaichen has been compromised. They are actively working to recover the account and advise users not to interact with any links or direct messages.","theft":true},{"id":"ht61ce5e2b72","date":"2026-01-21","name":"Saga","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Chain","chains":["Saga","Ethereum"],"usd":7000000.0,"lo":7000000.0,"hi":7000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/saga-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Sagaxyz__/status/2014144936631738532"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/saga-exploit"}],"desc":"On January 21, 2026, attackers exploited an inherited vulnerability in SagaEVM's Ethermint EVM precompile to bypass IBC messaging validation and mint unbacked Saga Dollars, causing a $7M exploit and protocol pause.","theft":true},{"id":"ht93aec9d62f","date":"2026-01-21","name":"Paradex","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/paradex/status/2013819618499141651?s=20"}],"desc":"According to an announcement from Paradex, the internal systems of the Mithril trading bot were compromised by an attacker, resulting in the exposure of approximately 57 user subkeys. While these subkeys do not allow withdrawals, they grant trading permissions and are commonly used to connect third-party applications and trading bots. Paradex has suspended all XP transfers and revoked all subkeys associated with Mithril. The affected users are limited to accounts that had previously authorized the Mithril bot. The team also reminded users to exercise caution when authorizing third-party services and to independently assess the associated risks.","theft":true},{"id":"ht13de72ebfd","date":"2026-01-20","name":"Makina","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":4200000.0,"lo":4130000.0,"hi":5100000.0,"ret":3410000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/makina-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2013468943193645085"}],"desc":"An attacker took a $280M flashloan and used $170M to manipulate Makina's sharePrice oracle via three compounding flaws: permissionless oracle updates, synchronous Curve spot prices with no TWAP, and pre-approved Weiroll paths. Extracted ~$4.2M.","theft":true},{"id":"htdcd5ce611d","date":"2026-01-20","name":"SynapLogic","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Base"],"usd":144000.0,"lo":3450.0,"hi":186000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2013439544595562898"}],"desc":"A business logic flaw in SynapLogic's referral system allowed attackers to mint 144k SYP tokens without proper validation. The exploit involved 193 suspicious transactions where attackers repeatedly called the referral function with flashloan-backed ETH, receiving 10% referral rewards for each fraudulent transaction.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht7ae95b29ac","date":"2026-01-17","name":"Meteora DAMM V2","kind":"fraud","fam":"social","tech":"Impersonation Scam","target":"DeFi Protocol","chains":["Solana"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.mexc.com/zh-TW/news/1064102"}],"desc":"On January 17, 2026, Meteora DAMM V2 lost $1.5M when the team transferred funds to a fraudulent OTC counterparty impersonating a legitimate token buyer on Solana, which never delivered tokens."},{"id":"ht06399ba748","date":"2026-01-13","name":"YO Protocol","kind":"hack","fam":"code","tech":"Missing Slippage Check","target":"DeFi Protocol","chains":["Ethereum"],"usd":3600000.0,"lo":3600000.0,"hi":3600000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"YO Protocol's Automated Harvesting System executed a rebalance with a misconfigured slippage tolerance of 17,872,058 (disabling protection). The order routed through high-fee Uniswap v4 pools (85-88%), returning only 112,036 USDC for 3,840,651 stkGHO, costing ~97% of vault stkGHO. YO's multisig bought the position back the same day.","theft":true},{"id":"ht25c527345d","date":"2026-01-12","name":"Former NYC Mayor Eric Adams accused of rug pull as NYC Token crashes ","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nyc-token-crash"}],"theft":true,"headline":true},{"id":"ht2139a24798","date":"2026-01-12","name":"MTToken","kind":"hack","fam":"code","tech":"Incorrect Fee Logic","usd":37000.0,"lo":37000.0,"hi":37000.0,"conf":"C","n":1,"theft":true},{"id":"htce64d389ab","date":"2026-01-10","name":"Crypto holder loses $283 million to scammer impersonating wallet support","kind":"scam","fam":"social","chains":["Bitcoin","monero","Litecoin"],"usd":282000000.0,"lo":282000000.0,"hi":282000000.0,"ret":700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trezor-support-scam"}],"theft":true,"headline":true},{"id":"ht34db120886","date":"2026-01-10","name":"FutureSwap","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":395000.0,"lo":74000.0,"hi":433000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/2011404828115866061?s=46"}],"desc":"FutureSwap's changePosition collateral accounting was exploited via a large short position opened with an Aave V3 flash loan. The attacker corrupted the protocol's internal stableBalance tracking, enabling withdrawal of far more collateral than deposited, resulting in the loss of $395K in USDC.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht8225534f29","date":"2026-01-08","name":"Truebit","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":26440000.0,"lo":26400000.0,"hi":26600000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/truebit-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/lookonchain/status/2009303499927154909"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/truebit-exploit"}],"desc":"Truebit Protocol suffered $26.44M exploit on January 8, 2026 from integer overflow in token purchase logic (Solidity 0.6.10 unpatched). Attacker minted TRU at negligible cost and sold to bonding-curve for ~$26M; TRU crashed 99.9%.","theft":true,"onchain":true},{"id":"htd1f4ba5fd8","date":"2026-01-08","name":"Darren Lau's X account","kind":"hack","fam":"other","tech":"The X account was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/CertiKAlert/status/2009259852007190682"}],"desc":"CertiK Alert tweeted that the X account of Darren Lau, founder of The Daily Ape, has been compromised by hackers. The CertiK security team warns users not to click any links or approve any transactions before control of the account is restored, and to remain vigilant.","theft":true},{"id":"hte1eac77f05","date":"2026-01-07","name":"Polycule","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Polygon"],"usd":230000.0,"lo":230000.0,"hi":230000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/pmx_trade/status/2008997887678820862?s=20"}],"desc":"On January 13, 2026, Polycule's Telegram bot for Polymarket was hacked when the server storing user private keys was breached. The bot stored keys unencrypted on a central server with inadequate security, allowing attackers to drain $230,000 from affected users.","theft":true},{"id":"ht400be4188c","date":"2026-01-06","name":"IPOR Fusion","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Arbitrum"],"usd":336000.0,"lo":336000.0,"hi":336000.0,"ret":336000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ipor_io/status/2008728627190321480"}],"desc":"On January 6, 2026, Fusion PlasmaVault on Arbitrum was exploited via EIP-7702 delegation; missing instantWithdraw validation allowed malicious fuse contracts to execute arbitrary code and drain $336K USDC. ~$267K was moved to Tornado Cash.","theft":true},{"id":"hte044a8b781","date":"2026-01-05","name":"USDGambit and TLP","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CyversAlerts/status/2008100710483685488?s=20"}],"desc":"Attackers compromised a shared deployer account that managed both USDGambit and TLP contracts, likely through key theft or credential compromise. This allowed them to deploy a new ProxyAdmin contract with full control over both protocols, draining $1.5M before moving funds to Ethereum and depositing into Tornado Cash.","theft":true},{"id":"htc457b7a498","date":"2026-01-05","name":"TMX TRIBE","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tmztribe-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/certikalert/status/2008360565010559045?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On January 5-6, 2026, attacker exploited TMX TRIBE perpetual futures (Arbitrum/Optimism) via flawed AUM calculation ignoring USDG liabilities. Repeated mint-stake-swap loops allowed artificially inflated redemptions, draining $1.4M.","theft":true},{"id":"ht06ff249932","date":"2026-01-05","name":"OLY","kind":"hack","fam":"other","tech":"Sandwich attack","chains":["BNB Chain"],"usd":63400.0,"lo":63400.0,"hi":63400.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/2007999080794833369"}],"desc":"According to TenArmorAlert, a sandwich attack involving OLY has been detected on BSC, causing estimated losses of around $63,400.","theft":true},{"id":"ht682e91db4b","date":"2026-01-05","name":"Bitlight Labs X Account","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/BitlightLabs"}],"desc":"The X (formerly Twitter) account of Bitlight Labs, a Bitcoin RGB protocol and Lightning Network stablecoin payment infrastructure provider, was suspected of being compromised and posted content related to a meme token.","theft":true},{"id":"hte3ae5f353f","date":"2026-01-01","name":"PRXVT","kind":"hack","fam":"code","tech":"Staking Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":97000.0,"lo":97000.0,"hi":97000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://smartcontractshacking.com/hacks/prxvt-hack-2026"}],"desc":"On January 1, 2026, attacker exploited PRXVT staking contract on Base via Sybil attack; deployed numerous CREATE2 addresses to bypass per-address limits and farm rewards, draining 32.8 ETH (~$97K). No cost/identity constraints protected the per-address logic.","theft":true},{"id":"htd7f843b40c","date":"2025-12-30","name":"Unleash Protocol","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Story"],"usd":3900000.0,"lo":3900000.0,"hi":3900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/UnleashProtocol/status/2005907998691229933"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unleash-protocol-exploit"}],"desc":"On December 30, 2025, Unleash Protocol was exploited when an attacker compromised the multisig governance system and deployed a malicious contract. The attacker siphoned $3.9M in assets, bridged them to Ethereum, and laundered them via Tornado Cash.","theft":true},{"id":"ht4b12c307d0","date":"2025-12-28","name":"MSCST","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":129900.0,"lo":129900.0,"hi":130000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Phalcon_xyz/status/2005518274864595002"}],"desc":"On December 29, 2025, an attacker exploited missing access control in MSCST's releaseReward() function, flash loaning 46.8M GPC tokens to inflate GPC/WBNB price on PancakeSwap and extract ~$130K in BNB profit.","theft":true},{"id":"htc743a9e310","date":"2025-12-27","name":"Flow","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Layer 1","chains":["Flow"],"usd":3900000.0,"lo":3900000.0,"hi":3900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/findlabs/status/2005021008156078274"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/flow-infinite-mint-exploit"}],"desc":"Flow's execution layer was exploited on December 27, allowing the attacker to mint FLOW tokens and bridge assets (WBTC, WETH, and stablecoins) via Celer and Debridge for $3.9M. The exploit was likely enabled by a compromised privileged admin key.","theft":true},{"id":"hta8a835c6d1","date":"2025-12-27","name":"Debot","kind":"hack","fam":"keys","tech":"Private Key Leakage","usd":255000.0,"lo":255000.0,"hi":255000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/2004936235949981886"}],"desc":"SlowMist founder Cos stated on the X platform that the team is currently following up on the DeBot incident and monitoring on-chain activity. According to him, users’ private keys associated with DeBot have been compromised, and the hacker has so far profited approximately $255,000, with theft still ongoing. Previously, in response to community claims that the DeBot wallet may have been hacked and user funds stolen, the DeBot official team said that the secure wallet addresses are operating normally and have not been affected. They added that they have noticed the issue concerning certain addresses and are actively following up and handling the matter. On December 30, all compensation applications for Debot were fully processed and issued. The team stated that if any security issues occur in the future, they will continue to uphold a 100% compensation commitment.","theft":true},{"id":"ht94a29cb782","date":"2025-12-26","name":"FilDA","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Elastos"],"usd":166800.0,"lo":166800.0,"hi":166800.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker manipulated token pricing used by FilDA’s Glide LP price oracle on Elastos Smart Chain, allowing the attacker to exploit distorted asset valuations and drain more than 140,000 ELA and 5,800 USDC from the lending protocol. FilDA subsequently suspended its ESC deployment and announced that it would permanently shut it down","theft":true},{"id":"htba579f6119","date":"2025-12-25","name":"Trust Wallet Wallet","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","chains":["Ethereum","Bitcoin","Solana"],"usd":8500000.0,"lo":7000000.0,"hi":8500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TrustWallet/status/2006029258209005699"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trust-wallet-hack"}],"desc":"The Shai-Hulud npm worm compromised developer accounts and harvested Trust Wallet's Chrome Web Store API key. On December 24, 2025, the attacker published a malicious Trust Wallet Browser Extension v2.68 to the Chrome Web Store, exfiltrating private keys from users until December 26 at 11:00 UTC.","theft":true},{"id":"ht4e4a1e630a","date":"2025-12-18","name":"Rari Capital","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 10, 2025, Rari Capital Fuse lending pools (dormant after prior $80M+ hacks) were exploited for $2M via unprotected proxy upgrade vulnerability. Attacker hijacked implementation contract to gain admin privileges and enable uncollateralized borrowing.","theft":true},{"id":"htd7e5c2530e","date":"2025-12-17","name":"ICRYPEX Global","kind":"hack","fam":"code","tech":"Security Vulnerability","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2001117011699753029"}],"desc":"SlowMist has issued a security alert to the cryptocurrency exchange ICRYPEX Global, stating that a potentially critical vulnerability has been identified.","theft":true},{"id":"ht2a3bb25a81","date":"2025-12-16","name":"Yearn Finance","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":304400.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/yearn-rekt4"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/2001080131360842011"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yearn-finance-exploit-4"}],"desc":"Yearn Finance's legacy V1 TUSD vault was exploited for $300K via a donation attack. Attackers deposited Fulcrum sUSD tokens to artificially inflate share price, allowing Yearn TUSD tokens to be minted at minimal cost before the price collapsed.","theft":true},{"id":"ht66fe359946","date":"2025-12-16","name":"FutureSwap","kind":"hack","fam":"market","tech":"Flashloan Governance Attack","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":270000.0,"lo":270000.0,"hi":830000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2001138489656766726"}],"desc":"In December 2025, attacker exploited FutureSwap on Arbitrum using flash loans to acquire temporary governance voting power and pass a malicious proposal transferring protocol funds.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht99e4e487f1","date":"2025-12-16","name":"Azbitm","kind":"hack","fam":"code","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/2000784214472692072"}],"desc":"SlowMist sent a security alert to the cryptocurrency exchange Azbitm, stating that a potential vulnerability has been detected.","theft":true},{"id":"htdc06320f96","date":"2025-12-14","name":"Mars Perps","kind":"hack","fam":"market","tech":"Funding Rate Arbitrage","target":"DeFi Protocol","chains":["Neutron"],"usd":960000.0,"lo":960000.0,"hi":960000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 14, 2025, Mars Protocol's Perps market on Neutron was exploited for ~$973K via skew-based pricing arbitrage. The attacker executed the same-block arbitrage pattern 15 times, exploiting that funding rates were only applied between blocks rather than within them, eliminating downside risk.","theft":true},{"id":"hte5dc765d46","date":"2025-12-12","name":"Ribbon","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/aevo-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/ribbonfinance/status/2000003294563905765"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ribbon-finance-exploit"}],"desc":"Aevo's legacy Ribbon DOV vaults were drained of $2.7 million on December 12, 2025. An oracle upgrade created a decimal mismatch (8 vs 18 decimals) with legacy assets. The attacker exploited a publicly-accessible oracle price-setting function and minimal collateral requirements to create undercollateralized positions and drain the vaults.","theft":true},{"id":"ht36cb866962","date":"2025-12-12","name":"ZEROBASE","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["BNB Chain"],"usd":250000.0,"lo":123000.0,"hi":250000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/zerobasezk/status/1999466921314648585"}],"desc":"Attackers deployed a malicious phishing contract on BSC that impersonated the ZEROBASE frontend, tricking users into authorizing USDT transfers. The fake contract collected token approvals, then drained hundreds of connected wallets of approximately $250K total, with one user losing $123K.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht716f7d4a5b","date":"2025-12-11","name":"0G Foundation","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["0G"],"usd":516000.0,"lo":516000.0,"hi":520000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0G_Foundation/status/1999781517283737670"}],"desc":"0G Labs emergencyWithdraw function had improper access control or validation, allowing unauthorized withdrawals of $516K.","theft":true},{"id":"htbffe5518e7","date":"2025-12-11","name":"Almanak","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/almanak/status/1999141226319155492"}],"desc":"According to an announcement by Almanak, during today’s airdrop, operational errors and a DDoS attack caused delays in claims and failures in wallet deployment. The claim function was originally scheduled to open at 12:15 UTC, but was actually delayed until 12:35 UTC. About 1,100 users encountered a “PENDING” status issue while creating wallets.The team has restored the system, cleared the backlog, and confirmed that users’ tokens remain safe and intact.","theft":true},{"id":"ht6acbc36b09","date":"2025-12-04","name":"Prysm consensus client bug causes Ethereum validators to lose over $1 million","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1180000.0,"lo":1180000.0,"hi":1180000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/prysm-bug"}],"theft":true,"headline":true},{"id":"ht324a13dfb7","date":"2025-12-04","name":"USPD","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/uspd-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/1996826080741937213"}],"desc":"In December 2025, USPD stablecoin protocol was exploited through its smart contract deployment process. Attacker used Multicall3 to claim admin role before the official deployment script, then deployed a malicious proxy that forwarded to the audited code while using event manipulation and storage slot spoofing. After months, attacker minted 98M USPD and drained ~$1M in stETH.","theft":true},{"id":"ht2c0b2e4665","date":"2025-12-04","name":"PEPE","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/pepe-memecoin-site-hacked"}],"desc":"According to cybersecurity firm Blockaid, the official website of the meme coin PEPE was compromised by attackers, who modified the website’s front-end code, causing users visiting the site to be redirected to a malicious page.","theft":true},{"id":"htf85caef7c6","date":"2025-12-03","name":"React","kind":"hack","fam":"code","tech":"Remote Code Execution Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://financefeeds.com/zh-CN/hackers-exploit-javascript-library-to-deploy/"}],"desc":"According to Finance Feeds, hackers exploited a vulnerability in the React JavaScript library to inject code into websites that steals funds from cryptocurrency wallets, primarily targeting cryptocurrency platforms. On December 3, the React team released a patch for CVE-2025-55182, a vulnerability that allowed unauthenticated code to execute on remote computers. The React team strongly advised all affected modules to upgrade immediately to prevent further exploitation.","theft":true},{"id":"hte7d9d0b0cb","date":"2025-12-02","name":"Goldfinch","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":330000.0,"lo":330000.0,"hi":330000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/GoPlusZH/status/1995842787078475801"}],"desc":"A flaw in Goldfinch's legacy collectInterestRepayment() function permitted transfers from any approved address without proper safeguards. An attacker deposited USDC to manipulate share price, then repeatedly withdrew inflated amounts, draining the victim's holdings through the contract's misconfigured approval logic.","theft":true},{"id":"htddd3191ae5","date":"2025-12-01","name":"Yearn Ether","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Ethereum"],"usd":9000000.0,"lo":9000000.0,"hi":9000000.0,"ret":2400000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/yearn-rekt3"},{"s":"SlowMist Hacked","u":"https://x.com/PeckShieldAlert/status/1995311852310675537"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yearn-finance-hack-3"}],"desc":"Yearn Finance yETH stableswap pool drained for $9M on deposit of 16 wei. Attacker minted 235 septillion yETH via accounting flaw caused by cached storage variables not resetting at zero liquidity, then swapped for legitimate derivatives.","theft":true},{"id":"ht18d3a5cb54","date":"2025-11-26","name":"Upbit","kind":"hack","fam":"social","tech":"Malware","target":"CEX","chains":["Solana"],"usd":30300000.0,"lo":30200000.0,"hi":36000000.0,"ret":1770000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://upbit.com/service_center/notice?id=5803&view=share"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/upbit-hack"}],"desc":"Upbit hot wallet was drained on November 27, 2025 in 54 minutes for $36M in Solana tokens (USDC, BONK, JTO, SONIC, RAY, RENDER, ORCA, PYTH). Attacker exploited weak digital signature infrastructure that allowed private key derivation from on-chain transaction history.","theft":true},{"id":"ht9781bf92bc","date":"2025-11-24","name":"Agentic FoF","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum","Base"],"usd":531000.0,"lo":531000.0,"hi":531000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/BasisOS/status/1992689112491725207?s=20"}],"desc":"Agentic FoF suffered a security vulnerability that allowed attackers to drain approximately $531K from its vaults. All vaults were subsequently suspended pending an internal investigation, with the Basis vault secured but also halted as a precaution.","theft":true},{"id":"ht4f7e484ed4","date":"2025-11-23","name":"Port3 Network","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["BNB Chain"],"usd":166000.0,"lo":166000.0,"hi":830000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Port3Network/status/1992471015948210277"}],"desc":"Port3 Network's CATERC20 bridge from NEXA was exploited on November 22, 2025, via missing signature verification on mint function and unset owner address, allowing attacker to mint 1 billion PORT3 tokens.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht648a39957a","date":"2025-11-22","name":"Raga Finance","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Hyperliquid"],"usd":18500.0,"lo":18500.0,"hi":18500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"No credible sources found documenting a specific Raga Finance hack on November 22, 2025. Raga Finance operates on Hyperliquid L1, but no evidence of a direct exploit was found.","theft":true},{"id":"ht8a394ef4b2","date":"2025-11-21","name":"Aerodrome V1","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum","Optimism","Base"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/AerodromeFi/status/1992693120614727758"}],"desc":"The centralized domains for both Aerodrome and Velodrome were hijacked via a NameSilo registrar compromise. Attackers bypassed multisig controls, removed DNSSEC, and redirected domains to malicious pages. Users were silently redirected to phishing interfaces with malicious signature flows and unlimited approval prompts, resulting in $700K in losses. The underlying smart contracts remained uncompromised.","theft":true},{"id":"htb91c0bed97","date":"2025-11-20","name":"GANA Payment","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["BNB Chain"],"usd":3100000.0,"lo":3100000.0,"hi":3100000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gana-payment-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articles/8fe34b80-9db2-47df-97ca-a2ac53668e45"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gana-payment-hacked-for-3-1-million"}],"desc":"On November 20, 2025, an attacker obtained GANA Payment's private keys, manipulated reward rates and the unstake function to drain approximately $3.1 million in tokens, then laundered 1,140 BNB and 346 ETH through Tornado Cash.","theft":true},{"id":"htd06b8f85e1","date":"2025-11-20","name":"Dexmax AI","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"Token","chains":["Ethereum","Solana"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/GoPlusZH/status/1991436599461319047"}],"desc":"Attackers exploited the DMT token airdrop claiming process by tricking users into signing additional authorization transactions. After users claimed the airdrop, attackers triggered secondary signatures to approve asset transfers. Thieves stole from thousands of users and cross-chain bridged over $130K in assets to Ethereum, with most funds flowing through HitBTC.","theft":true},{"id":"ht6713b6aeb7","date":"2025-11-20","name":"WLFI","kind":"phishing","fam":"social","tech":"Phishing Attack & Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/worldlibertyfi/status/1991243561715519933"}],"desc":"According to a WLFI announcement, prior to the platform’s official launch, some user wallets were compromised due to phishing attacks or mnemonic phrase leaks. WLFI emphasized that the incident was not caused by any platform or smart contract vulnerability, but originated from third-party security issues. The team has developed new smart contract logic that allows assets to be reassigned to secure new wallets after completing KYC verification. Wallets that have not submitted a request or failed verification will remain frozen, though users can initiate the recovery process through customer support. According to Emmett Gallic, World Liberty Fi burned a total of 166.67 million WLFI tokens (worth approximately $22.14 million) from a suspected compromised wallet and reallocated an equal amount of tokens to a new secure address.","theft":true},{"id":"ht386a96fe16","date":"2025-11-17","name":"Nofx AI","kind":"hack","fam":"keys","tech":"Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1990275471318401394"}],"desc":"SlowMist founder Cos reminded users of the NOFX AI open-source automated trading system to be aware of potential security risks. Although the NOFX AI open-source work has shown good intentions, real theft incidents have already occurred, and some users’ wallet private keys as well as CEX/DEX API keys have been leaked as a result. Cos confirmed that this vulnerability also affects the wallet private key security of Aster users. He stated that SlowMist has collaborated with relevant security teams to notify affected users as much as possible to help reduce risks, and advised users to stay vigilant and take timely security measures.","theft":true},{"id":"htcd260f008e","date":"2025-11-16","name":"Cardano holder loses $6 million to slippage","kind":"other","fam":"other","chains":["Cardano"],"usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cardano-holder-loses-6-million-to-slippage"}],"headline":true},{"id":"ht04765194dc","date":"2025-11-14","name":"Aftermath","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SuiNetwork/status/1989137508907774053"}],"desc":"Sui’s official X account issued a reminder stating that the X account of Aftermath, a liquid staking protocol in the Sui ecosystem, has been compromised. Users are advised not to interact with the account until the team regains control.","theft":true},{"id":"ht3d34d97bc7","date":"2025-11-13","name":"Hyperliquid","kind":"fraud","fam":"insider","tech":"Price Manipulation","usd":4950000.0,"lo":4950000.0,"hi":4950000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/arkham/status/1988662381535216125"}],"desc":"According to Arkham’s monitoring, an attacker allegedly carried out a deliberate exploit against HLP (Hyperliquidity Provider) on Hyperliquid. The attacker used 19 wallets and $3 million in principal to open a leveraged long position worth $20–30 million on POPCAT with 5× leverage, while placing large buy walls to support the price. Subsequently, the attacker suddenly removed the buy walls, causing a flash crash in POPCAT’s price and triggering the liquidation of their $3 million collateral to zero. Due to the lack of liquidity, HLP was forced to absorb the position, ultimately resulting in a bad debt loss of $4.9 million. Analyst @mlmabc noted that losing $3 million within seconds was not a mistake or negligence, but rather a deliberate attack targeting both HLP and Hyperliquid."},{"id":"ht637ce8358f","date":"2025-11-11","name":"Polymarket","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Polygon","Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/25usdc/status/1987948736228511992?s=20"}],"desc":"Hackers injected malicious scripts into Polymarket's comment sections, posting phishing links that appeared to offer access to private markets. Users clicking the links were redirected to a fake Polymarket interface where attackers captured their credentials. Over $500K in user funds were drained via compromised email-login accounts.","theft":true},{"id":"htbc8bf679dc","date":"2025-11-11","name":"Impermax V3","kind":"hack","fam":"code","tech":"Liquidation Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":380000.0,"lo":380000.0,"hi":380000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 11, 2025, Impermax V3 on Base suffered a $380K exploit. The attacker created tiny positions in low-liquidity cbBTC-tBTC pairs to push totalBalance toward zero, collapsing the exchange rate and enabling exponential minting of borrowable tokens. When totalBalance hit zero, all deposits were redirected to the attacker.","theft":true},{"id":"htafbb5f1c79","date":"2025-11-10","name":"DRLVaultV3","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DRLVaultV3, a USDC-WETH rebalance vault, was exploited by an attacker who manipulated the Uniswap spot price. The attacker first borrowed 14M USDC from Morpho Blue and bought WETH to spike its price, then triggered the vault's swapToWETH function to force it to buy WETH at the inflated price, and finally sold the pre-purchased WETH back into the pool to capture the profit spread. A whitehat hacker (c0ffe.babe.eth) captured the approximately $100K in USDC that should be recoverable.","theft":true,"onchain":true},{"id":"ht9d0f7311bd","date":"2025-11-07","name":"DIMO","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":40000.0,"lo":40000.0,"hi":40000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 7, 2025, DIMO token was exploited when a compromised developer key held proxy-upgrade authority over a Wormhole bridge contract with no timelock or multisig. The attacker withdrew 30M DIMO tokens (~3% supply, ~$2.49M), dumped them on the market, then the proxy was reverted and ownership moved to a multisig.","theft":true},{"id":"ht26c6ce3555","date":"2025-11-04","name":"Stream Finance halts activity after $93 million loss","kind":"hack","fam":"other","usd":93000000.0,"lo":93000000.0,"hi":93000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stream-finance-loss"}],"theft":true,"headline":true},{"id":"ht68bfdbdc12","date":"2025-11-04","name":"Moonwell Lending","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Base","Optimism","Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":3680000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CertiKAlert/status/1985620452992253973"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moonwell-oracle-malfunction"}],"desc":"On November 4, 2025, Moonwell on Base and Optimism was exploited for $1 million when the Chainlink oracle incorrectly priced wrapped restaked Ethereum (wrstETH) at ~$5.8M instead of actual value, allowing a flash loan attack to repeatedly borrow against false collateral.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5b2e086d42","date":"2025-11-03","name":"Balancer V2","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Base","Polygon","Sonic","Optimism"],"usd":120550000.0,"lo":110000000.0,"hi":128000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/balancer-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/balancer/status/1990856260988670132"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/balancer-exploit-2"}],"desc":"On November 3, 2025, Balancer V2's Composable Stable Pools were exploited for $128M via a rounding-down flaw in batchSwap invariant calculation. Minuscule discrepancies in each transaction compounded across rapid successive swaps, gradually deflating pool reserves across chains.","theft":true},{"id":"ht7d26c459cb","date":"2025-11-03","name":"Berachain","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":12800000.0,"lo":12800000.0,"hi":12800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/berachain/status/1985742874361651206"}],"desc":"Berachain announced that approximately USD 12.8 million in funds lost due to the BEX/Balancer v2 vulnerability have been fully returned to the Berachain Foundation’s deployer address, and the blockchain has now resumed normal operations.","theft":true},{"id":"ht90204cd757","date":"2025-10-30","name":"Garden","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Base","Solana","Bitcoin"],"usd":11000000.0,"lo":10800000.0,"hi":11400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/jzgulati/status/1984127214959624421"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/garden-hacked-for-11-million"}],"desc":"On October 30, 2025, one of Garden Finance's solvers was compromised, enabling an attacker to control cross-chain interactions and drain over $10M in a coordinated exploit across Ethereum, Arbitrum, Base, and Solana.","theft":true},{"id":"ht7e1005505d","date":"2025-10-28","name":"GMGN","kind":"phishing","fam":"social","tech":"Phishing Attack","usd":10300.0,"lo":10300.0,"hi":10300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/haze0x/status/1983042747406651440"}],"desc":"GMGN co-founder Haze posted on X (Twitter):\"We have noticed a deliberate external phishing attack targeting GMGN. The attacker induced users to click by forging a third-party token website, triggering unauthorized transactions not initiated by the users themselves.Currently, this issue has been completely resolved, affected accounts have been restored to safety, and similar phishing attacks have been fully blocked.This incident affected approximately 107 users.For losses caused by unauthorized control of accounts, we will provide 100% full compensation and distribute it to GMGN accounts within today.\"","theft":true},{"id":"ht29749706b7","date":"2025-10-27","name":"402bridge","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"DeFi Protocol","chains":["Base"],"usd":17693.0,"lo":17693.0,"hi":17693.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/402bridge/status/1982859472629559796"}],"desc":"On October 27, 2025, 402bridge on Base was compromised just days after mainnet launch, affecting over 200 users and losing 17,693 USDC. Attackers accessed private keys stored on servers with excessive authorization permissions in the x402 mechanism.","theft":true},{"id":"htdea2f710b5","date":"2025-10-25","name":"GMGN","kind":"hack","fam":"other","tech":"Sandwich Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/haze0x/status/1982635884341272897"}],"desc":"On October 27, GMGN Co-founder Haze posted on X, stating that the team has completed compensation payments to users affected by the MEV attack. He noted that 48 hours earlier, GMGN had suffered an MEV attack involving 729 affected transactions. The team has since finished calculating the losses and distributed compensation to the affected users’ wallets yesterday.","theft":true},{"id":"ht96783aba9a","date":"2025-10-23","name":"Noble","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1981138805337051345"}],"desc":"According to monitoring by Scam Sniffer, the official X account of Noble was compromised, and the attacker used it to post phishing tweets.","theft":true},{"id":"ht2d14de5fb0","date":"2025-10-22","name":"Fortress Trust is insolvent","kind":"collapse","fam":"insider","usd":11000000.0,"lo":11000000.0,"hi":11000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fortress-trust-insolvency"}],"headline":true},{"id":"ht50028d6044","date":"2025-10-21","name":"DoodiPals","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Token","chains":["Solana"],"usd":171000.0,"lo":171000.0,"hi":171000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1980443998461608427"}],"desc":"The DoodiPals project on Solana suffered a private key security vulnerability. Hackers exploited the flaw to sell tokens from multiple wallets, converting them into approximately 917 SOL (valued at $171K). The team announced plans to relaunch after a security audit and committed to providing 1:1 compensation to holders prior to the attack.","theft":true},{"id":"ht46869e396a","date":"2025-10-20","name":"Sharwa.Finance","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":146000.0,"lo":146000.0,"hi":146000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/phalcon_xyz/status/1980219745480946087?s=46"}],"desc":"Sharwa Finance on Arbitrum was exploited in October 2025 via sandwich attacks on margin trading. Attackers created margin accounts, borrowed additional assets via leverage, and sandwiched their own swaps to extract ~$61K and ~$85K before the platform paused.","theft":true},{"id":"ht1e64c17576","date":"2025-10-19","name":"Astra Nova","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"AI Agent","chains":["Ethereum"],"usd":9090000.0,"lo":9090000.0,"hi":9090000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Astra__Nova/status/1979828018295316582"}],"desc":"Astra Nova's RVV token launch was disrupted when a third-party market maker account was compromised. The attacker gained access and liquidated 8.6% of the token supply for approximately $10.2M in USDT, causing the token price to plummet 75%. The attacker held stolen funds in USDT on a centralized exchange, allowing the team to coordinate recovery efforts.","theft":true},{"id":"hteb4b1bea80","date":"2025-10-15","name":"Typus Perp","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Sui"],"usd":3440000.0,"lo":3440000.0,"hi":3440000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@TypusFinance/typus-finance-tlp-oracle-exploit-post-mortem-report-response-plan-ce2d0800808b"}],"desc":"On October 15, 2025, Typus Finance's custom price oracle was exploited via missing assertion logic and improper access control. The attacker called update_v2 to arbitrarily set token pair prices to extreme values and drained $3.44M in SUI, USDC, xBTC, and suiETH.","theft":true},{"id":"hte15d1c2f24","date":"2025-10-10","name":"Hyperliquid user loses $21 million to private key leak","kind":"hack","fam":"other","chains":["Hyperliquid"],"usd":21000000.0,"lo":21000000.0,"hi":21000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0x0cdc-theft"}],"theft":true,"headline":true},{"id":"ht6de12ab749","date":"2025-10-09","name":"Astera.fi","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Linea"],"usd":573000.0,"lo":573000.0,"hi":573000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 9, 2025, Astera's lending markets on Linea were exploited through a liquidity-index inflation attack. The attacker inflated the index to overvalue their collateral, then borrowed across asUSD, LINEA, and WETH minipools for ~8% of the protocol's TVL. Linea's security team detected the pattern and froze the attack within minutes.","theft":true},{"id":"ht0a715d0b1e","date":"2025-10-09","name":"Watt Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1976284421448925574"}],"desc":"According to monitoring by Scam Sniffer, the official X account of Watt Protocol was compromised, and the attacker used it to post phishing tweets.","theft":true},{"id":"ht38f35d9eca","date":"2025-10-08","name":"TokenHolder","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":26000.0,"lo":26000.0,"hi":26000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"TokenHolder suffered an insufficient access control vulnerability where unauthorized callers could invoke restricted functions. The attacker exploited missing permission checks in the contract to drain approximately $26K from the protocol.","theft":true,"onchain":true},{"id":"ht6105f31cc1","date":"2025-10-04","name":"Abracadabra Spell","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":1795000.0,"lo":1700000.0,"hi":1800000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/abracadabra-rekt3"},{"s":"SlowMist Hacked","u":"https://x.com/MIM_Spell/status/1975130787486831018"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/abracadabra-exploit-3"}],"desc":"On October 4, 2025 Abracadabra Money on Ethereum suffered a critical exploit of the cook() multi-action function where improper state handling allowed attackers to bypass solvency checks: Action 5 set needsSolvencyCheck=true, but Action 0 reset the CookStatus, enabling under-collateralized borrowing and withdrawal of 1.79 million MIM tokens.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht8733dd7d93","date":"2025-10-04","name":"MIMSpell3","kind":"hack","fam":"other","tech":"Bypassed Insolvency Check","chains":["Ethereum"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht81a6b5dfcd","date":"2025-10-01","name":"BNB Chain","kind":"phishing","fam":"social","tech":"Phishing Attack","usd":8000.0,"lo":8000.0,"hi":8000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/BNBCHAIN/status/1984143649584902620"}],"desc":"On October 1, BNB Chain officially announced that its English Twitter account had been compromised and was under emergency recovery, warning users not to click on any links.Subsequent investigation revealed that the incident involved a total of 10 phishing links, resulting in losses of approximately $8,000, with a single user losing as much as $6,500.The attacker deployed a phishing contract address, injected $17,800, and exchanged it for $22,000 worth of tokens. Following the incident, the team implemented additional security measures to prevent similar occurrences and further strengthened account protection.As of October 31, all user compensations related to this phishing incident have been completed, and transaction details are available on Etherscan. The root cause of the incident has been confirmed as phishing links, which have since been removed and brought under control.","theft":true},{"id":"htef82d2160d","date":"2025-09-28","name":"dTRINITY","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Sonic"],"usd":56000.0,"lo":56000.0,"hi":56000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/dTRINITY_DeFi/status/1972564217904644557"}],"desc":"The dTRINITY swap adapter suffered a missing authorization check in its swapLiquidity() function. The attacker called the swap function using addresses of victims who had previously approved the adapter during testing. Malicious swap routes sent collateral deposits directly to attacker-controlled addresses while returning minimal amounts to pass validation, draining $56K.","theft":true},{"id":"ht7a56ce4e09","date":"2025-09-27","name":"Hyperdrive HL Lending","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Hyperliquid"],"usd":782000.0,"lo":782000.0,"hi":782000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/hyperdrivedefi/status/1972095669403111519"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hyperdrive-exploit"}],"desc":"On September 27, 2025 Hyperdrive (lending protocol on Hyperliquid L1) lost approximately $782,000 to an exploit where attackers exploited an arbitrary router call vulnerability, making repeated withdrawals from the Primary USDT0 Market and Treasury USDT Market and extracting ~673,000 USDT0 and 110,244 thBILL, with stolen funds bridged to Ethereum ($494k) and BNB Chain ($279k).","theft":true},{"id":"ht9a137deac7","date":"2025-09-26","name":"HyperVault","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Hyperliquid"],"usd":3600000.0,"lo":3600000.0,"hi":3610000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/zh-CN/newsflash/450084"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hypervault-rug-pull"}],"desc":"HyperVault on Hyperliquid L1 conducted a rug pull in late September 2025, draining $3.6M in user funds. Developers falsely claimed audits by Spearbit and Pashov, then disappeared after moving assets through privacy tools.","theft":true},{"id":"ht102f46480e","date":"2025-09-24","name":"SBI Crypto","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Other","chains":["Bitcoin","Ethereum","Litecoin","Doge","Bitcoin Cash"],"usd":21000000.0,"lo":21000000.0,"hi":21000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sbi-crypto-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2025/10/01/sbi-crypto-reportedly-hit-by-usd21m-hack-with-suspected-dprk-links"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sbi-crypto-theft"}],"desc":"On September 24, 2025 roughly $21M in BTC, ETH, LTC, DOGE and BCH flowed out of hot wallets belonging to SBI Crypto (Japanese SBI Group's mining pool) through five instant exchangers and into Tornado Cash. ZachXBT and Cyvers linked the laundering pattern to DPRK-affiliated actors; SBI Group never publicly confirmed the incident.","theft":true},{"id":"ht76bbb993ca","date":"2025-09-24","name":"GriffinAI","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/griffinai-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/OliFeldmeier/status/1972367705023103244"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/griffin-ai-exploit"}],"desc":"GriffinAI on BSC lost $3M on September 24, 2025 when misconfigured LayerZero peer validation let attacker initialize a fake peer on Ethereum and mint 5B unauthorized GAIN tokens on BSC. Attacker swapped ~150M tokens before GAIN crashed 90%.","theft":true},{"id":"htc6be22efbe","date":"2025-09-23","name":"Seedify","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain","Avalanche","Polygon","Ethereum"],"usd":1700000.0,"lo":1200000.0,"hi":1700000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SeedifyFund/status/1970537553515417918"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/seedify-bridge-exploit"}],"desc":"On September 23, 2025 at 12:05 UTC, attackers linked to North Korean 'Contagious Interview' operation used a compromised developer key to reconfigure Seedify's Avalanche bridge contract, enabling unauthorized SFUND minting across Ethereum, Arbitrum, and Base. The attacker sold ~$1.2M on BNB Chain before ~$200K was frozen at an exchange.","theft":true},{"id":"htfa82e5665f","date":"2025-09-23","name":"Corepound","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["CORE"],"usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/CommunityofCore/status/1970916743628587292"}],"desc":"Corepound (AI yield aggregator on Core DAO) rug-pulled on 23 September 2025 when the team used privileged control over the aggregator's vaults to withdraw roughly $400,000 of deposited user funds. The Core community acknowledged the incident and organized an impacted-user response with promises of stricter ecosystem vetting.","theft":true},{"id":"ht09160df644","date":"2025-09-22","name":"UXLINK","kind":"hack","fam":"code","tech":"Delegatecall Hijack","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":11300000.0,"lo":11000000.0,"hi":28100000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/uxlink-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/UXLINKofficial/status/1998228868365529555"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uxlink-exploit"}],"desc":"An attacker exploited a delegatecall in UXLINK's multisig wallet to rewrite the owner set without signer approval. This enabled draining ~$11.3M in stablecoins/ETH/WBTC, seizing ~490M UXLINK tokens, and minting 1-2B more before the token crashed over 70%.","theft":true,"review":["sources disagree on the loss"]},{"id":"htc5c78f308e","date":"2025-09-18","name":"New Gold Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/newgold-protocol-rekt"}],"desc":"New Gold Protocol (NGP) was exploited on its launch day when the attacker exploited a flashloan-powered price oracle manipulation. The protocol relied on DEX pair reserves to calculate the NGP token price, allowing a single Uniswap pool to be manipulated. The attacker used a flash loan to distort pool balances, artifically lowering the reported price to bypass transaction limits and acquire massive amounts of tokens at unrealistic prices. Stolen assets were bridged to Ethereum through Tornado Cash.","theft":true},{"id":"hta497ba9030","date":"2025-09-17","name":"NGP","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht95eb9191a4","date":"2025-09-14","name":"Yala","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"Token","chains":["Solana","Ethereum","Bitcoin"],"usd":7640000.0,"lo":7600000.0,"hi":7640000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.yala.org/yala-post-mortem-september-14/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yala-stablecoin-depegs"}],"desc":"During Yala's deployment of its Solana Layer Zero OFT bridge, attackers compromised temporary deployment keys. They used this access to create unauthorized bridge contracts and establish a backdoor for later exploitation. Over a month later, the attacker deployed this infrastructure to mint 120M unauthorized $YU tokens and extract $7.64M in real value. Thai authorities arrested the attacker approximately 45 days after the exploit, and most funds were clawed back.","theft":true},{"id":"ht6be272d114","date":"2025-09-13","name":"Shibarium","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Shibarium"],"usd":2400000.0,"lo":2400000.0,"hi":4100000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/shibarium-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/370536/shibarium-bridge-suffers-sophisticated-flash-loan-attack-with-2-4-million-drained"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/shibarium-bridge-hit-with-2-4-million-flash-loan-attack"}],"desc":"On September 12, 2025 at 18:44 UTC, an attacker compromised 10 of Shibarium's 12 validator keys and used a 4.6M BONE flash loan delegated to Ryoshi Validator 1 to push past the two-thirds threshold, then co-signed a false L2 state and drained 17 tokens worth ~$4.1M from the canonical bridge. The dev team suspects key exposure from a developer machine or the server's KMS.","theft":true,"review":["sources disagree on the loss"]},{"id":"hte8c252a408","date":"2025-09-13","name":"Kame Aggregator","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Sei"],"usd":1300000.0,"lo":18167.8,"hi":1320000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://kameagg.substack.com/p/post-mortem-kame-aggregator-exploit"}],"desc":"On September 13, 2025 Kame Aggregator on the Sei network was exploited due to missing validation in the swap() function that allowed arbitrary executor calls, affecting 830 users who had granted unlimited token spend permissions to Kame contracts and draining approximately $1.325 million in total value.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht53e12235cc","date":"2025-09-10","name":"Evoq Finance","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain"],"usd":420000.0,"lo":420000.0,"hi":420000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On BNB Chain, Evoq Finance's smart contract was compromised when an attacker stole the owner's private key. The attacker transferred contract ownership, deployed a malicious upgrade, and drained approximately $420K from the protocol and user-approved token accounts.","theft":true},{"id":"ht69e1a1354a","date":"2025-09-09","name":"SwissBorg","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"CEX","chains":["Solana","Ethereum"],"usd":41500000.0,"lo":41500000.0,"hi":41500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/swissborg-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/swissborg/status/1965123506477359471"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/swissborg-exploit"}],"desc":"SwissBorg's SOL Earn program lost 192,600 SOL (~$41.5M) when staking partner Kiln's API credentials were compromised. Attacker embedded malicious authorization instructions in unstaking transactions to transfer withdrawal authority to attacker-controlled addresses.","theft":true},{"id":"ht81aa6d85f3","date":"2025-09-09","name":"Thorchain founder exploited for $1.35 million","kind":"hack","fam":"other","usd":1350000.0,"lo":1350000.0,"hi":1350000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thorchain-founder-exploited"}],"theft":true,"headline":true},{"id":"ht7327892013","date":"2025-09-08","name":"Aqua","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":4650000.0,"lo":4650000.0,"hi":4650000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/zh-CN/newsflash/447163"}],"desc":"On-chain investigator ZachXBT reported that the Solana project Aqua has likely executed a rug pull involving approximately 21,770 SOL (~$4.65M). A few hours ago, the funds were split into four parts, moved through multiple intermediary addresses, and then sent to various instant exchanges.","theft":true},{"id":"ht4fd1a22d85","date":"2025-09-08","name":"Nemo Yield Trading","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Sui"],"usd":2400000.0,"lo":2400000.0,"hi":2590000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nemo-protocol-exploit"}],"desc":"Nemo on Sui was drained of ~$2.59M when unaudited code left an internal flash-loan function publicly callable and a query function able to mutate state, enabling the attacker to drain the Market pool and bridge to Ethereum.","theft":true},{"id":"hta2aa39b816","date":"2025-09-02","name":"Venus Protocol user exploited for $13.5 million; most funds later recovered","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":13500000.0,"lo":13500000.0,"hi":13500000.0,"ret":11400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/venus-protocol-user-exploited"}],"theft":true,"headline":true},{"id":"ht2f4d411241","date":"2025-09-02","name":"Bunni V2","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum","Unichain"],"usd":8400000.0,"lo":8400000.0,"hi":8400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bunni-rekt"},{"s":"SlowMist Hacked","u":"https://blog.bunni.xyz/posts/exploit-post-mortem/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bunni-exploit"}],"desc":"On September 2, 2025, a rounding error in Bunni V2's withdrawal logic allowed attackers to systematically withdraw more tokens than entitled, draining $8.4M across Ethereum ($2.4M) and UniChain ($5.9M).","theft":true},{"id":"htd7d02c60cf","date":"2025-09-01","name":"OlaXBT","kind":"hack","fam":"social","tech":"Signer Phishing","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"In September 2025 OlaXBT suffered a multisig wallet compromise resulting in the theft of 32 million AIO tokens (valued at approximately $2 million). The team responded by deploying a new token contract and migrating user holdings.","theft":true},{"id":"ht432ff02923","date":"2025-08-31","name":"Hexotic","kind":"hack","fam":"code","tech":"Incorrect Input Validation","chains":["Arbitrum","Ethereum"],"usd":500.0,"lo":500.0,"hi":500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht258f1a9fed","date":"2025-08-30","name":"Cozy V2","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Optimism"],"usd":427000.0,"lo":427000.0,"hi":427000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Cozy Finance lost $427K on August 29, 2025 on Optimism when completeWithdraw function lacked caller verification, letting attacker complete withdrawals using only a user's redemption ID.","theft":true},{"id":"ht8d41542803","date":"2025-08-30","name":"EverValueCoin","kind":"hack","fam":"other","tech":"Arbitrage","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"theft":true},{"id":"ht22144d24f0","date":"2025-08-27","name":"0xf340","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":4000.0,"lo":4000.0,"hi":4000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc9853a8987","date":"2025-08-26","name":"BetterBank","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["PulseChain"],"usd":5000000.0,"lo":4100000.0,"hi":5000000.0,"ret":2700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/betterbank-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=betterbank-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/betterbank-exploit"}],"desc":"On August 26-27, 2025, BetterBank on PulseChain was exploited via its reward mechanism using flash loans to manipulate liquidity pools, create a fake ERC20 paired with PDAIF, and trigger ESTEEM minting. ~$5M was stolen; the attacker later returned $2.7M, leaving net losses of ~$1.4M. The issue had been flagged during audit but dismissed.","theft":true},{"id":"ht0c051e3f93","date":"2025-08-25","name":"Panoptic V1.1","kind":"hack","fam":"code","tech":"Hash Collision","target":"DeFi Protocol","chains":["Base","Unichain","Ethereum"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 25, 2025, a critical hash-collision vulnerability was discovered in Panoptic V1.1's position fingerprinting scheme. The non-collision-resistant XOR-hashing would have allowed attackers to bypass collateral checks and drain liquidity pools, but was reported by security researchers before exploitation.","theft":true},{"id":"ht0376a57ffb","date":"2025-08-23","name":"Equilibria Finance","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":62500.0,"lo":62500.0,"hi":62661.57,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Equilibriafi/status/1959296722930483668"}],"desc":"According to an announcement from Equilibria Finance, a vulnerability was discovered in the ePENDLE auto-compounder contract on Ethereum, resulting in a loss of approximately 13.36 ETH.\r\n\r\nThe issue stemmed from the stk-ePENDLE contract on Ethereum mainnet not being configured as non-transferable. The attacker used flash loans via Balancer to acquire ePENDLE, staked it into stk-ePENDLE, and then repeatedly transferred stk-ePENDLE across multiple addresses. Each transfer triggered a reward claim, enabling the attacker to drain the unclaimed rewards from the contract.","theft":true,"onchain":true},{"id":"ht625395393b","date":"2025-08-23","name":"ABCCApp","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":10100.0,"lo":10100.0,"hi":10100.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"ABCCApp on BSC was reportedly attacked, resulting in a loss of approximately $10.1K.\r\n\r\nThe root cause was that the contract’s addFixedDay() function lacked access control, and fixedDay was used in calculating claimable USDT.","theft":true,"onchain":true},{"id":"hteb805a15cf","date":"2025-08-22","name":"Unverified_6f7a","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":7630.46,"lo":7630.46,"hi":7630.46,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht67a935d418","date":"2025-08-20","name":"0x8d2e","kind":"hack","fam":"code","tech":"Access Control","chains":["Base"],"usd":40000.0,"lo":40000.0,"hi":40000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht36321c0a6b","date":"2025-08-20","name":"MulticallWithXera","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"usd":17000.0,"lo":17000.0,"hi":17000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht84c502ff1f","date":"2025-08-20","name":"Puffer Finance","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1957993905133072617"}],"desc":"According to SlowMist Threat Intelligence, puffer[.]fi and @puffer_finance have been compromised.","theft":true},{"id":"ht939c2b913a","date":"2025-08-19","name":"Bitcoiner socially engineered out of $91 million","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":91000000.0,"lo":91000000.0,"hi":91000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoiner-socially-engineered-out-of-91-million"}],"theft":true,"headline":true},{"id":"ht2868b09d49","date":"2025-08-19","name":"PresaleV5","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":9769.23,"lo":9769.23,"hi":9769.23,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4fab2efe0f","date":"2025-08-17","name":"AutoPooledTradingBot","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8465e094ee","date":"2025-08-16","name":"D3X AI","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":158900.0,"lo":158900.0,"hi":158900.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"D3X AI (@D3X_AI) was attacked on BSC, resulting in a loss of approximately $158.9K.\r\n\r\nThe root cause was that the exchange() function of contract 0xb8ad relied on the spot price of the d3xat token from a UniswapV2 pair, which the attacker exploited through a price manipulation attack.","theft":true,"onchain":true},{"id":"ht1d9d63f94a","date":"2025-08-16","name":"unverified","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Polygon"],"usd":3131.11,"lo":3131.11,"hi":3131.11,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1908ff13c9","date":"2025-08-16","name":"PDZ","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht44a31ff6be","date":"2025-08-15","name":"SizeCredit","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":19700.0,"lo":19700.0,"hi":19700.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht91d7f616a4","date":"2025-08-15","name":"SizeFlashLoanLooping","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Ethereum"],"usd":533.05,"lo":533.05,"hi":533.05,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7212a703d0","date":"2025-08-15","name":"Level","kind":"fraud","fam":"insider","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/levelusd/status/1956389199407698099"}],"desc":"The official X account of the stablecoin protocol Level was reportedly compromised, and a fraudulent airdrop link was posted."},{"id":"ht4a9e2c1b7f","date":"2025-08-14","name":"BtcTurk","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","Avalanche","Arbitrum","Base","Optimism","Mantle","Polygon"],"usd":49000000.0,"lo":48000000.0,"hi":54000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/btcturk-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/BtcTurkKripto/status/1955973500583170252"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/btcturk-exploit-2"}],"desc":"In August 2025, Turkish CEX BtcTurk suffered a second major hack, with $48M drained from hot wallets across 7 blockchains (Ethereum, Avalanche, Arbitrum, Base, Optimism, Mantle, Polygon) after private keys were compromised.","theft":true},{"id":"ht5f4a261d45","date":"2025-08-13","name":"Coinbase","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"CEX","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/drained-by-design"}],"desc":"Coinbase's corporate DEX wallet lost $300,000 on August 13, 2025 when MEV bots exploited misconfigured token approvals granted to a 0x protocol swapper contract.","theft":true,"onchain":true},{"id":"htfbbb64906c","date":"2025-08-13","name":"YuliAI","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":78000.0,"lo":78000.0,"hi":78000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd51f5c3121","date":"2025-08-13","name":"Grizzifi","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":61000.0,"lo":61000.0,"hi":61000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 13, 2025, Grizzifi, a BSC-based staking protocol, was exploited via a flaw in its reward mechanism. The attacker created multiple controlled wallets to amplify the milestoneReward through the harvestHoney function, then collected additional rewards via collectRefBonus. The root cause was that milestone calculations were based on total cumulative investments rather than active investments.","theft":true,"onchain":true},{"id":"ht35bfa40fc5","date":"2025-08-13","name":"BeefyZapRouter","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Arbitrum"],"usd":6584.95,"lo":6584.95,"hi":6584.95,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htad5bc60fd6","date":"2025-08-12","name":"Odin.Fun","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["ICP","Bitcoin"],"usd":7000000.0,"lo":7000000.0,"hi":7000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/odin-fun-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/BobBodily/status/1955477887701881007"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/odinfun-exploit"}],"desc":"On August 12-13, 2025 Odin.Fun (Bitcoin-based memecoin launchpad on ICP) lost 58.2 BTC (~$7 million) to attackers who deposited worthless tokens (SATOSHI, ODINPEPE), used overweighted deposits and self-trading to artificially inflate token value in the protocol's internal AMM logic (which lacked external oracle validation), and drained the pool.","theft":true},{"id":"ht1ed97a2025","date":"2025-08-12","name":"Bebop","kind":"hack","fam":"code","tech":"Arbitrary user input","chains":["Arbitrum"],"usd":21000.0,"lo":21000.0,"hi":21000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5ed13ea8ea","date":"2025-08-12","name":"BaseBebopSettlement","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Base"],"usd":3875.46,"lo":3875.46,"hi":3875.46,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta595920066","date":"2025-08-11","name":"WXC","kind":"hack","fam":"other","tech":"Incorrect token burn mechanism","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf877bce6d6","date":"2025-08-10","name":"numa.","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Sonic"],"usd":313000.0,"lo":313000.0,"hi":313000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Numa's NumaVault on Sonic was exploited on August 10, 2025 for ~$313,000. Using a flash loan, the attacker inflated synthetic liabilities to collapse the collateral price, then liquidated under-collateralized positions before bridging 74.3 ETH to Ethereum.","theft":true},{"id":"htb38323fb66","date":"2025-08-08","name":"ArbitrumBaseSwapper","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Arbitrum"],"usd":1847.33,"lo":1847.33,"hi":1847.33,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht17429c1de7","date":"2025-08-07","name":"Traders lose $1 million to malicious \"trading bot\" software","kind":"hack","fam":"other","usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mev-bot-scam"}],"theft":true,"headline":true},{"id":"ht579c9580fb","date":"2025-08-05","name":"BscInitcodeToken","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":700.32,"lo":700.32,"hi":700.32,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht24baa144a3","date":"2025-08-05","name":"MyCoinMaster","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":653.49,"lo":653.49,"hi":653.49,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6926d22699","date":"2025-08-04","name":"CrediX","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Sonic","Solana"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/credix-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=credix-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/credix-exploit"}],"desc":"On August 4, 2025, CrediX on Sonic suffered $4.5M loss when attacker gained admin access via ACLManager, minting unbacked acUSDC and draining pools. Funds were moved to Ethereum via Tornado Cash. The team vanished August 8.","theft":true},{"id":"ht34f1bce4d3","date":"2025-08-01","name":"PendleReflector","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Arbitrum"],"usd":2304.18,"lo":2304.18,"hi":2304.18,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd5fc6a5f15","date":"2025-07-29","name":"AnyswapWETHPermit","kind":"hack","fam":"code","tech":"Permit Validation Bypass","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb8972acdf6","date":"2025-07-28","name":"SuperRare","kind":"hack","fam":"code","tech":"Merkle Proof Forgery","target":"DeFi Protocol","chains":["Ethereum"],"usd":730000.0,"lo":730000.0,"hi":731000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1949770231733530682"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/superrare-hack"}],"desc":"On July 28, 2025, SuperRare RareStakingV1 contract was exploited for ~$730K (11.9M RARE) via broken access control in updateMerkleRoot(). Attacker submitted malicious Merkle roots for fraudulent token claims; a frontrunner later hijacked the exploit.","theft":true},{"id":"ht9579f41ddb","date":"2025-07-28","name":"AvaxBIFKNPair","kind":"hack","fam":"code","tech":"Flash Swap Accounting","chains":["Avalanche"],"usd":2400.0,"lo":2400.0,"hi":2400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htda8d4b74e3","date":"2025-07-26","name":"WhereIsMyDragonTreasure","kind":"hack","fam":"code","tech":"Fixed Reward Redemption","chains":["Ethereum"],"usd":47461.35,"lo":47461.35,"hi":47461.35,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht957163078c","date":"2025-07-26","name":"MulticallWithETH","kind":"hack","fam":"code","tech":"arbitrary-call","chains":["BNB Chain"],"usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdd38d0c534","date":"2025-07-26","name":"Unverified670471","kind":"hack","fam":"market","tech":"Unchecked Flash Loan Callback","chains":["Ethereum"],"usd":1818.33,"lo":1818.33,"hi":1818.33,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbce7544047","date":"2025-07-26","name":"Unverified6883","kind":"hack","fam":"other","tech":"Fake Uniswap Callback","chains":["Ethereum"],"usd":1006.89,"lo":1006.89,"hi":1006.89,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2010c0a5ad","date":"2025-07-24","name":"WOO X","kind":"hack","fam":"social","tech":"Phishing","target":"CEX","chains":["Bitcoin","Ethereum","Arbitrum","BNB Chain"],"usd":14000000.0,"lo":14000000.0,"hi":14000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/woox-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/_WOO_X/status/1948573397178339577"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/woo-x-hack"}],"desc":"WOO X exchange suffered a phishing attack via a fake open-source collaboration request that lured a developer to open a malicious development tool. Attackers gained access to the development environment and executed unauthorized withdrawals across nine user accounts, draining $14M across Bitcoin, Ethereum, Arbitrum, and BSC.","theft":true},{"id":"htc818db79aa","date":"2025-07-24","name":"SWAPPStaking","kind":"hack","fam":"code","tech":"Incorrect Reward calculation","chains":["Ethereum"],"usd":32196.28,"lo":32196.28,"hi":32196.28,"conf":"C","n":1,"theft":true},{"id":"htaf32858074","date":"2025-07-24","name":"EmptySetReserve","kind":"hack","fam":"other","tech":"Fixed Order Swap","chains":["Ethereum"],"usd":1509.78,"lo":1509.78,"hi":1509.78,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht49ec8bfa11","date":"2025-07-21","name":"BoJLeverageMarket","kind":"hack","fam":"other","tech":"Liquidity Index Manipulation","chains":["Base"],"usd":7227.59,"lo":7227.59,"hi":7227.59,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht947c7921b4","date":"2025-07-21","name":"Swarms","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/swarms_corp/status/1947156712227824027?s=46"}],"desc":"The AI agent protocol Swarms disclosed on the X platform that its community Discord account had been compromised. Earlier today, a team member’s Discord account was breached after receiving a malicious direct message from a user. As a result, the attacker deleted several channels and removed over 300 community members.","theft":true},{"id":"htda2d6e94e6","date":"2025-07-20","name":"Stepp2p","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":43000.0,"lo":43000.0,"hi":43000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 20, 2025, Stepp2p on Binance Smart Chain suffered a smart contract exploit resulting in approximately $43,000 in losses. The attack exploited a logic vulnerability in the protocol's core functions.","theft":true,"onchain":true},{"id":"ht574aa63e45","date":"2025-07-19","name":"Coindcx","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","usd":44200000.0,"lo":44000000.0,"hi":44200000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/coindcx-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/CoinDCX/status/1947625144379445682"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coindcx-hack"}],"desc":"CoinDCX lost ~$44.2M on July 19, 2025 when a server breach compromised the operational hot wallet's private key used for liquidity provisioning. Stolen assets were bridged from Solana to Ethereum; customer cold storage funds were unaffected.","theft":true},{"id":"htdac4d333f0","date":"2025-07-17","name":"WETC","kind":"hack","fam":"code","tech":"Incorrect Burn Logic","chains":["BNB Chain"],"usd":101000.0,"lo":101000.0,"hi":101000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht561e22359d","date":"2025-07-17","name":"unverified","kind":"hack","fam":"code","tech":"Signature Verification","chains":["BNB Chain"],"usd":502.42,"lo":502.42,"hi":502.42,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3c57e1bc11","date":"2025-07-16","name":"Bigone","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"CEX","chains":["Bitcoin","BNB Chain","Ethereum","Solana","Tron"],"usd":27000000.0,"lo":27000000.0,"hi":27000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bigone-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1945346830222680330"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bigone-hack"}],"desc":"On July 16, 2025, BigONE crypto exchange suffered a supply chain attack where an attacker gained access to production infrastructure and modified critical backend logic to automatically approve fraudulent withdrawal requests. The attack drained approximately $27 million across five blockchains before being detected.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht1252ac3df9","date":"2025-07-16","name":"VDS","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1945672192471302645"}],"desc":"According to monitoring by SlowMist's MistEye security system, VDS on the BSC appears to have been attacked, with an estimated loss of around $13,000.","theft":true,"onchain":true},{"id":"ht8a949a1425","date":"2025-07-16","name":"StrategyLlamaLendConvex","kind":"hack","fam":"market","tech":"Share Price Manipulation","chains":["Ethereum"],"usd":563.12,"lo":563.12,"hi":563.12,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf42f768f9a","date":"2025-07-15","name":"Arcadia V2","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":3500000.0,"lo":2500000.0,"hi":3600000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/arcadiafi-rekt"},{"s":"SlowMist Hacked","u":"https://arcadiafinance.notion.site/Arcadia-Post-Mortem-14-07-2025-23104482afa780fdb291cd3f41b7fc99"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/arcadia-finance-exploit"}],"desc":"On July 15, 2025, Arcadia V2 RebalancerSpot was exploited through an unvalidated router address parameter. Attacker registered a malicious router, flash-loaned $1.5B from Morpho Blue, bypassed health checks, and drained LP positions for $2.5M-$3.6M profit.","theft":true},{"id":"ht9c07e06e7b","date":"2025-07-13","name":"UPENG","kind":"hack","fam":"code","tech":"Incorrect Burn Logic","chains":["BNB Chain"],"usd":1035.06,"lo":1035.06,"hi":1035.06,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd75ffdb091","date":"2025-07-12","name":"Pundi AI","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":6570000.0,"lo":6570000.0,"hi":6570000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://forum.pundi.ai/t/fx-pundiai-swap-bug-and-response-not-pundix/6520/2"}],"desc":"Pundi AI recently experienced a security breach resulting in the unauthorized minting of 1 million tokens. The incident was caused by a vulnerability in the token swap contract, which was exploited via a front-running attack during deployment. According to Pundi AI co-founder Danny Lim, the exploit led to the creation of tokens valued at approximately $6 million at the time of the incident. Through coordinated asset freezes and recovery efforts, the team successfully retrieved around 87% of the affected funds. The remaining loss—nearly $2 million—will be fully covered by the project team.","theft":true},{"id":"htc2cad78c1e","date":"2025-07-11","name":"MoonPay apparently gets scammed out of a $250,000 donation to Trump inaugural fund","kind":"scam","fam":"social","usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moonpay-donation-scam"}],"theft":true,"headline":true},{"id":"ht04f9bbaba9","date":"2025-07-11","name":"Plasma","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1943507167975198964"}],"desc":"The official X account of @PlasmaFDN has been compromised. The attacker is posting phishing links using the X Bot UA spoofing trick—the URLs appear legitimate at first glance but redirect to a phishing site: https://vault-plasma[.]to. Do not click on any recent links or interact with the account until an official statement is released.","theft":true},{"id":"ht06e9420f40","date":"2025-07-10","name":"Kinto Bridge","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1550000.0,"lo":1550000.0,"hi":1550000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ramonrecuero/status/1943426114468352006"}],"desc":"Kinto K token contract on Arbitrum was exploited on July 10, 2025 via hidden/uninitialized proxy implementation slot (CPIMP-class vulnerability), allowing attacker to mint ~110K counterfeit tokens and drain ~577 ETH from lending pools; K token lost ~95% value.","theft":true},{"id":"ht0601341fba","date":"2025-07-09","name":"GMX V1 EVM","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":42000000.0,"lo":41000000.0,"hi":42000000.0,"ret":40000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gmx-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1942949653231841352"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gmx-hack"}],"desc":"On July 9, 2025, GMX V1 perpetuals on Arbitrum suffered a $42M exploit through reentrancy in executeDecreaseOrder(). Attacker exploited the assumption that _account is an EOA, using a contract to reenter, manipulate short positions, inflate GLP price, and profit via redemptions; attacker returned funds July 12, keeping a $5M bounty.","theft":true,"review":["possible duplicate within one source"]},{"id":"htf39da0df08","date":"2025-07-09","name":"ZKSwap","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blockaid.io/blog/how-zkswaps-5m-exploit-couldve-been-prevented-with-onchain-monitoring"}],"desc":"On July 9, 2025, ZKSwap's Ethereum Layer 1 bridge was exploited through its emergency withdrawal mechanism (Exodus Mode). The attacker exploited a critical flaw where the verifyExitProof() function failed to perform actual cryptographic verification of zero-knowledge proofs. By forging withdrawal proofs, the attacker artificially inflated their balance and withdrew approximately $5 million in assets.","theft":true},{"id":"ht4652451425","date":"2025-07-09","name":"Texture","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Solana"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/texture_fi/status/1942972150631002245"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/texture-hack"}],"desc":"Texture's Solana lending protocol lost $2.2M to a vault access control vulnerability. Attacker returned $1.98M after being offered a 10% bounty.","theft":true},{"id":"hte43e88f55c","date":"2025-07-08","name":"Peapods Finance","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":207000.0,"lo":207000.0,"hi":207000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Peapods Finance's aspLONGsUSDe pod on July 8, 2025 exploited for $207K via oracle misconfiguration. Attacker manipulated the WETH/aspLONGsUSDe price to inflate collateral values. The issue was in user-created pod logic, not core contracts.","theft":true},{"id":"ht05316a3dd6","date":"2025-07-06","name":"Synthetix","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SNX_Exchange/status/1941544156452835498"}],"desc":"The @synthetix_io main X(Twitter) account has been hacked. Please DO NOT interact with links from this account while we work to regain control.","theft":true},{"id":"ht038149195c","date":"2025-07-05","name":"Unverified","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":285700.0,"lo":285700.0,"hi":285700.0,"conf":"C","n":1,"theft":true},{"id":"hta237e356de","date":"2025-07-05","name":"RANT","kind":"hack","fam":"code","tech":"Incorrect Fee Accounting","target":"Token","chains":["BNB Chain"],"usd":204000.0,"lo":204000.0,"hi":204000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 5, 2025, RANT token on Binance Smart Chain was exploited through a vulnerability in the _sellBurnLiquidityPairTokens() function. The flaw allowed attackers to manipulate the token burn process and steal approximately $204,000 from the protocol.","theft":true,"onchain":true},{"id":"ht340ffc8ff7","date":"2025-07-05","name":"ActivePoolScrvUsd","kind":"hack","fam":"other","tech":"Urgent Redemption","chains":["Ethereum"],"usd":4204.55,"lo":4204.55,"hi":4204.55,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3b9ddbfc61","date":"2025-07-02","name":"FPC","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["BNB Chain"],"usd":4700000.0,"lo":4700000.0,"hi":4700000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2338110e5d","date":"2025-07-02","name":"Future Protocol","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":4600000.0,"lo":4600000.0,"hi":4600000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 2, 2025, Future Protocol (FPC) on Binance Smart Chain was exploited via a flash loan attack combined with token burn manipulation. The attacker borrowed 23M USDT, swapped it all for FPC to manipulate the pool price, then leveraged the tokenomics that burned FPC from the pool to create a price imbalance and extract approximately $4.6 million.","theft":true},{"id":"ht31249a124b","date":"2025-07-02","name":"ActivePoolUrgentRedemption","kind":"hack","fam":"other","tech":"Urgent Redemption","chains":["Ethereum"],"usd":2696.49,"lo":2696.49,"hi":2696.49,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0a6b50321c","date":"2025-06-29","name":"Stead","kind":"hack","fam":"code","tech":"Access Control","chains":["Arbitrum"],"usd":14500.0,"lo":14500.0,"hi":14500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht44b3f3c324","date":"2025-06-28","name":"InitcodeFactoryFees","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":2383.25,"lo":2383.25,"hi":2383.25,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htaa1abb776a","date":"2025-06-27","name":"PANews","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1938442696944980343"}],"desc":"The @PANewsCN X account has been compromised. Do not click on any recent links or interact with its posts. Please wait for an official update.","theft":true},{"id":"ht403ea5eb5b","date":"2025-06-26","name":"Resupply","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":9600000.0,"lo":9500000.0,"hi":9600000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/resupplyfi-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1938073225503908072"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/resupply-exploit"}],"desc":"On June 25, 2025, Resupply's newly-deployed (2 hours old) crcrvUSD vault on Ethereum was exploited. Attacker performed ERC4626 donation attack, minting 1 wei shares against 2,000 crvUSD, then deposited 1 wei collateral to borrow entire $9.6M vault through exchange rate rounding.","theft":true,"onchain":true},{"id":"ht136fe077ac","date":"2025-06-25","name":"MEV Bot","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A suspicious attack involving MEV bot 0xb5cb occurred on BSC, resulting in losses of approximately $2 million.","theft":true,"onchain":true},{"id":"ht8c9cf58e1a","date":"2025-06-25","name":"Silo Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":546000.0,"lo":542000.0,"hi":546000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://silofinance.medium.com/post-mortem-unreleased-leverage-contract-exploitd-0ab8f37afcbb"}],"desc":"On June 25, 2025, Silo Finance lost $546,000 when an experimental leverage contract was mistakenly deployed to mainnet. Attacker exploited unchecked borrow() return values, using a malicious token (MalCoin) that reported constant balance=1 to drain ETH without repaying.","theft":true,"onchain":true},{"id":"ht4316af8b60","date":"2025-06-25","name":"ParaSwapDAIApproval","kind":"hack","fam":"code","tech":"Stale Approval","chains":["Ethereum"],"usd":2298.68,"lo":2298.68,"hi":2298.68,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta893df5823","date":"2025-06-23","name":"Self Chain fires founder after $50 million scam allegations","kind":"scam","fam":"social","usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/self-chain-fires-founder"}],"theft":true,"headline":true},{"id":"ht21f8085fcb","date":"2025-06-23","name":"New York scammer \"daytwo\" steals $4 million from Coinbase users, blows most of it gambling","kind":"scam","fam":"social","usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/daytwo-thefts"}],"theft":true,"headline":true},{"id":"ht10556c8a91","date":"2025-06-23","name":"GradientMakerPool","kind":"hack","fam":"market","tech":"Price Oracle Manipulation","chains":["Ethereum"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb58ab8855f","date":"2025-06-23","name":"CoinTelegraph","kind":"hack","fam":"keys","tech":"Frontend Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1936956218423320916"}],"desc":"According to monitoring by Scam Sniffer, the front end of CoinTelegraph has been hacked—exercise caution. Reportedly, clicking the CoinTelegraph website triggers a pop-up containing “airdrop” information that cannot be closed within the page.","theft":true},{"id":"ht2a7b65ad88","date":"2025-06-21","name":"CoinMarketCap","kind":"hack","fam":"keys","tech":"Frontend Attack","usd":21624.0,"lo":21624.0,"hi":21624.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1936218055765619057"}],"desc":"According to monitoring by Scam Sniffer, the front end of CoinMarketCap has been compromised. Users are advised to remain vigilant. Following an investigation, CoinMarketCap confirmed that a total of 76 accounts were affected, with losses amounting to $21,624.47. The platform has pledged to fully reimburse the impacted users.","theft":true},{"id":"ht7f62b59647","date":"2025-06-20","name":"Hacken Token","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Other","usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hacken-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=hacken-token-crash"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacken-token-crash"}],"desc":"Hacken's HAI token private key was exposed during bridge architecture changes on Ethereum and BNB Chain. The compromised key allowed minting of 900 million HAI tokens, which were dumped on decentralized exchanges, causing the token price to crash 99%.","theft":true},{"id":"ht7291245e7f","date":"2025-06-20","name":"Gangsterfinance","kind":"hack","fam":"other","tech":"Incorrect dividends","chains":["BNB Chain"],"usd":16500.0,"lo":16500.0,"hi":16500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf62eafdd03","date":"2025-06-20","name":"HoldSafe","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":4824.96,"lo":4824.96,"hi":4824.96,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2474956ba6","date":"2025-06-20","name":"TokenVault","kind":"hack","fam":"code","tech":"Incorrect dividends calculation","chains":["BNB Chain"],"usd":3226.51,"lo":3226.51,"hi":3226.51,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf0733265d0","date":"2025-06-20","name":"Abstract Chain","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articles/lwhpdubx"}],"desc":"According to reports from social media users, the official X account of Abstract Chain appears to have been compromised. The attacker is impersonating the project to promote a fake “official token” scam.","theft":true},{"id":"ht9e32cdcdda","date":"2025-06-19","name":"BankrollStack","kind":"hack","fam":"code","tech":"Incorrect dividends calculation","chains":["BNB Chain"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht981533cab8","date":"2025-06-19","name":"BasePricePool","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":802.57,"lo":802.57,"hi":802.57,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6797db4e60","date":"2025-06-19","name":"SinstakeZombie","kind":"hack","fam":"code","tech":"Incorrect dividends calculation","chains":["BNB Chain"],"usd":705.13,"lo":705.13,"hi":705.13,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht94a30491a3","date":"2025-06-19","name":"Mehdi Farooq","kind":"hack","fam":"keys","tech":"Social Engineering","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/MehdiFarooq2/status/1935502598221533185"}],"desc":"Mehdi Farooq, a partner at crypto VC firm Hypersphere, disclosed on X that he fell victim to a fake Zoom meeting phishing attack, resulting in the draining of six crypto wallets and the loss of his savings accumulated over several years. The attack began when an acquaintance, “Alex Lin,” reached out via Telegram to schedule a meeting. Citing compliance reasons, the attacker convinced Farooq to switch to Zoom Business and tricked him into downloading a malicious update.","theft":true},{"id":"htd572448c65","date":"2025-06-19","name":"a16z","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/a16z/status/1935467524042407955"}],"desc":"a16z stated on social media:“Earlier today, our X account was briefly compromised. During that time, the account promoted a token and other fake content — none of which originated from a16z. Apologies for any confusion caused by the clowns who temporarily took over our account.\"","theft":true},{"id":"htae95756393","date":"2025-06-19","name":"BankrollNetwork","kind":"hack","fam":"code","tech":"Incorrect dividends calculation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3285b423aa","date":"2025-06-18","name":"Nobitex","kind":"hack","fam":"social","tech":"Malware","target":"CEX","chains":["Tron","Ethereum","BNB Chain","Avalanche","Arbitrum","Polygon","Bitcoin"],"usd":90000000.0,"lo":82000000.0,"hi":90000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1935246606095593578"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nobitex-hack"}],"desc":"Nobitex hot wallet private keys compromised on June 18, 2025, leading to $82-90M theft across blockchains. Attackers deliberately destroyed the stolen funds by sending to inaccessible addresses as a political statement.","theft":true},{"id":"ht6b489c6775","date":"2025-06-18","name":"Bankroll Network","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":65000.0,"lo":12234.48,"hi":65000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On June 19, 2025, old BankrollStack contracts containing an integer underflow vulnerability in the sell() function were exploited. Attackers manipulated dividend accounting through lingering token approvals, draining funds from users who had previously interacted with the abandoned contracts.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht9912ffe908","date":"2025-06-17","name":"Meta Pool","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":25000.0,"lo":25000.0,"hi":130000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=meta-pool-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/meta-pool-exploit"}],"desc":"On June 17, 2025, Meta Pool's ERC4626 vault contract on Ethereum was exploited via an unprotected mint() function in Staking.sol. An attacker called the public mint function to create 9,705 mpETH tokens (~$27M at face value) without depositing collateral, extracting only $130K due to low liquidity in affected pools.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htc484f1e655","date":"2025-06-15","name":"FixedTokenBSwap","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":2200.0,"lo":2200.0,"hi":2200.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"FixedTokenBSwap swap contract was exploited on June 15, 2025 via attacker-supplied path parameters combined with a fake token's transferFrom bypass, circumventing the on-chain price check and allowing extraction of fixed RTV amounts per transaction.","theft":true,"onchain":true},{"id":"ht6a3a56d34c","date":"2025-06-15","name":"WaleCoin","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"usd":918.83,"lo":918.83,"hi":918.83,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht184bc7b602","date":"2025-06-14","name":"TSAggregatorGeneric","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":1300.0,"lo":1300.0,"hi":1300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte8bd6b9a9c","date":"2025-06-14","name":"Echo Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1933860692123131939"}],"desc":"Echo Protocol, a project built on the Bitcoin ecosystem, has experienced a compromise of its official X (formerly Twitter) account. Users are advised to refrain from interacting with any recent posts or links and to await official updates through verified channels.","theft":true},{"id":"hte5e3fd67c8","date":"2025-06-12","name":"AAVEBoost","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["Ethereum"],"usd":14800.0,"lo":14800.0,"hi":14800.0,"conf":"C","n":1,"theft":true},{"id":"ht7080370bff","date":"2025-06-10","name":"Unverified_8490","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain","Ethereum"],"usd":48300.0,"lo":48300.0,"hi":48300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htab84e43b39","date":"2025-06-09","name":"BitCrown","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"usd":7939.27,"lo":7939.27,"hi":7939.27,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3b88904761","date":"2025-06-08","name":"TokenFactory","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":657.17,"lo":657.17,"hi":657.17,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht57d9b5ec73","date":"2025-06-07","name":"ether.fi","kind":"fraud","fam":"insider","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/ether_fi/status/1931235102815900130"}],"desc":"The official ether.fi Discord was hacked, and fraudulent messages containing scam links were posted. ether.fi urges users not to interact with any links within the Discord."},{"id":"ht3bc808680a","date":"2025-06-06","name":"ALEX","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["Stacks"],"usd":8370000.0,"lo":8300000.0,"hi":8373000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/alexlab-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/ALEXLabBTC/status/1931014419133169734"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alex-lab-exploit-2"}],"desc":"On June 6, 2025, ALEX Protocol suffered an $8.37M exploit. Attacker deployed a malicious token with custom transfer logic, used it to spoof as-contract origin and masquerade as the vault, draining 8.4M STX, 21.85 sBTC, and stablecoins due to failed access control verification.","theft":true},{"id":"hte4f11feef0","date":"2025-06-03","name":"PegaBall","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"usd":1512.85,"lo":1512.85,"hi":1512.85,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8fa26b7b70","date":"2025-06-02","name":"Crypto exchange BitoPro belatedly discloses $11.5 million hack","kind":"hack","fam":"other","usd":11500000.0,"lo":11500000.0,"hi":11500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitopro-hack"}],"theft":true,"headline":true},{"id":"ht09db025f47","date":"2025-06-01","name":"ForceBridge","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Nervos"],"usd":3900000.0,"lo":3700000.0,"hi":3900000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/force-bridge-rekt"},{"s":"SlowMist Hacked","u":"https://talk.nervos.org/t/force-bridge-incident-root-cause-analysis-user-commitment/8801"}],"desc":"On June 2, 2025, Force Bridge (Nervos Network) was exploited via missing access controls on privileged functions. Attackers drained $3.9M across ETH and BSC (539 ETH, 898,300 USDC, 257,800 USDT, 0.79 WBTC).","theft":true},{"id":"ht3d6065a90b","date":"2025-06-01","name":"MegaETH","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/megaeth_labs/status/1929043277652660229"}],"desc":"MegaETH stated that its X (formerly Twitter) account has been compromised, warning users not to click on any links or view recent posts.","theft":true},{"id":"ht4cb0cf156a","date":"2025-05-31","name":"DogeAlliance","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":990.33,"lo":990.33,"hi":990.33,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htfc8b775109","date":"2025-05-30","name":"Malda","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":285000.0,"lo":285000.0,"hi":285000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The vulnerability originated in the Migrator.sol contract. The contract allowed the Mendi Comptroller address to be passed dynamically, rather than being hardcoded. This enabled the attacker to supply their own malicious Comptroller, mint a synthetic position on Malda, and withdraw approximately $285,000.","theft":true},{"id":"ht4c65e073dd","date":"2025-05-28","name":"Cork V1","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cork-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1928100756156194955"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cork-protocol-hack"}],"desc":"On May 28, 2025, Cork Protocol suffered a $12 million exploit when an attacker created fraudulent market structures with an unprotected beforeSwap hook lacking authorization checks. Missing input validation on market configuration and token validation logic allowed the attacker to create fake token derivatives, draining 3,761 wstETH.","theft":true},{"id":"ht509d4af166","date":"2025-05-28","name":"Unverified_91a1","kind":"hack","fam":"code","tech":"Access Control","chains":["Base"],"usd":551.22,"lo":551.22,"hi":551.22,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf957597ad2","date":"2025-05-27","name":"Usual USD0","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":43000.0,"lo":42800.0,"hi":43000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1927627465717055574"}],"desc":"Usual USD0++ Investment vault lost $43K on May 27, 2025 via an arbitrage exploit. Attacker abused a capped unwrapping mechanism lacking proper validation while depositing into the fund; no user funds were affected.","theft":true,"onchain":true},{"id":"ht35c0708f57","date":"2025-05-26","name":"Dexodus Finance","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Base"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"ret":300000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On May 26, 2025, Dexodus Finance's leverage module was exploited for ~$291K via a stale Chainlink oracle report. The attacker used the valid but outdated data to enter a 100x leveraged long position at artificially low ETH price, then closed at the correct price within the same transaction. Dexodus recovered 100% of affected liquidity within 24 hours.","theft":true},{"id":"htda727fe028","date":"2025-05-26","name":"YDT","kind":"hack","fam":"code","tech":"Logic Flaw","usd":41000.0,"lo":41000.0,"hi":41000.0,"conf":"C","n":1,"theft":true},{"id":"ht681679dbcb","date":"2025-05-25","name":"Unverified_0000","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"usd":5658.46,"lo":5658.46,"hi":5658.46,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht08fe1fb1ef","date":"2025-05-25","name":"Dumbo","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":628.45,"lo":628.45,"hi":628.45,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb8e5177674","date":"2025-05-24","name":"RICE","kind":"hack","fam":"code","tech":"Lack of Access Control","chains":["Base"],"usd":88100.0,"lo":88100.0,"hi":88100.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht20e34e603c","date":"2025-05-22","name":"Cetus CLMM","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Sui"],"usd":223000000.0,"lo":223000000.0,"hi":230000000.0,"ret":163000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cetus-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/CetusProtocol/status/1925515662346404024"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cetus-exploit"}],"desc":"Cetus CLMM on Sui suffered a math error in its checked_shlw function where an incorrect overflow threshold (0xffffffffffffffff << 192 instead of 1 << 192) allowed attackers to craft positions with phantom liquidity. Using flashloans to manipulate prices and create tight tick ranges, attackers minted enormous liquidity while depositing minimal real tokens, then withdrew actual reserves.","theft":true},{"id":"ht9b97c2603e","date":"2025-05-22","name":"Nexo","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":31535.0,"lo":31535.0,"hi":31535.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1925384887600828669"}],"desc":"According to monitoring by the SlowMist security team, the digital asset wealth management platform Nexo suffered a sandwich attack due to a lack of access control in one of its contracts, resulting in a loss of approximately $31,000.","theft":true},{"id":"ht0df825d0f7","date":"2025-05-20","name":"IRYS AI","kind":"hack","fam":"insider","tech":"Backdoor Contract","target":"Token","chains":["BNB Chain"],"usd":69600.0,"lo":69600.0,"hi":69600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"IRYS AI token on BSC deployed with a backdoor admin function that allowed the deployer to bypass standard permission checks. The _taxWallet was given privileged drain capability, enabling extraction of $69.6K directly from user wallets in a single transaction.","theft":true,"onchain":true},{"id":"ht60559b628e","date":"2025-05-19","name":"BetaPresale","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"usd":46.47482165973826,"lo":46.47482165973826,"hi":46.47482165973826,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6e7a6f5025","date":"2025-05-18","name":"KRC","kind":"hack","fam":"other","tech":"deflationary token","chains":["BNB Chain"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb242e01e88","date":"2025-05-16","name":"Demex","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":950559.0,"lo":950559.0,"hi":950559.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.dem.exchange/nitron-post-mortem/"}],"desc":"Demex's Nitron lending market was exploited via donation-based oracle manipulation targeting a deprecated dGLP vault. An attacker donated a small amount of fsGLP to inflate the GLP redemption rate, which Nitron's oracle accepted as accurate pricing for dGLP. The attacker then used the falsely inflated dGLP value as collateral to borrow legitimate assets.","theft":true},{"id":"ht1106286940","date":"2025-05-16","name":"Bitallx","kind":"hack","fam":"other","tech":"Payout Amount Mismatch","chains":["BNB Chain"],"usd":2029.47,"lo":2029.47,"hi":2029.47,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2927d53375","date":"2025-05-15","name":"Zunami Protocol","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/zunami-protocol-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/ZunamiProtocol/status/1922993510925435267"}],"desc":"On May 15, 2025, Zunami Protocol's stablecoin collateral (zunUSD and zunETH) was drained for $500K via the god-mode withdrawStuckToken() function using a compromised admin key. The exploit occurred 7 minutes after the admin role was granted on May 14, suggesting key theft. Stolen funds were laundered through Tornado Cash.","theft":true},{"id":"hta243c61567","date":"2025-05-14","name":"Unwarp","kind":"hack","fam":"other","tech":"lack-of-access-control","chains":["Base"],"usd":9000.0,"lo":9000.0,"hi":9000.0,"conf":"C","n":1,"theft":true},{"id":"ht7a27938e71","date":"2025-05-13","name":"ZKsync","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zkSyncDevs/status/1922085897509732721"}],"desc":"ZKsync Developers posted on X that the official X accounts of both ZKsync and Matter Labs have been compromised. Please do not interact with these accounts or click on any related links.","theft":true},{"id":"ht829c463ecd","date":"2025-05-12","name":"Sheffield United","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articles/pqc46e02"}],"desc":"The English football club @SheffieldUnited has confirmed that its official X account was hacked. The attacker posted a Solana token address.","theft":true},{"id":"htb0f74e6940","date":"2025-05-11","name":"Mobius Token","kind":"hack","fam":"code","tech":"Decimal Miscalculation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2150000.0,"lo":2150000.0,"hi":2160000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mobiusdao-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/MobiusDAO123/status/1921847836548735142"}],"desc":"Mobius Token's minting function applied 10^18 decimal scaling twice to price data, allowing an attacker to mint ~9.73 quadrillion tokens and swap them for stablecoins, stealing $2.15M.","theft":true,"onchain":true},{"id":"ht4927c3194c","date":"2025-05-10","name":"Cointelegraph","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articles/rqs9k79c"}],"desc":"Cointelegraph’s official X account was reportedly compromised and used to send phishing links to contributors on the platform. Crypto KOL @thedefiedge reported receiving a DM from the account, asking him to review an article that allegedly mentioned him. When he clicked the link in a private browsing window, it prompted an X login — but the domain was “Cointetegraph,” a misspelled version of Cointelegraph.\r\n\r\nPreviously, there were also market reports that Cointelegraph’s account had posted an on-chain token contract and disabled comments. That post has since been deleted.","theft":true},{"id":"ht7a7e5afe77","date":"2025-05-09","name":"LND","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Sonic","Hyperliquid"],"usd":1180000.0,"lo":1180000.0,"hi":1180000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/LNDFi-rekt"}],"desc":"LND, a Sonic-based Aave fork, lost $1.18M in May 2025 when a developer with unilateral deployment control introduced a malicious access-control modification that reached production unreviewed. Halborn identified the developer as a DPRK IT worker.","theft":true},{"id":"htb4af21393a","date":"2025-05-09","name":"Nalakuvara_LotteryTicket50","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Base"],"usd":105500.0,"lo":105500.0,"hi":105500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8cf69d7b4d","date":"2025-05-08","name":"BitoPro","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Tron","Solana","Polygon"],"usd":11500000.0,"lo":11500000.0,"hi":11500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/zachxbt/status/1929417001296146868"}],"desc":"BitoPro exchange hot wallets compromised through malware deployment on a cloud operations team member via social engineering. Unauthorized withdrawals executed across multiple blockchains during a system update. Attackers attributed to North Korean Lazarus group based on attack patterns and methodology.","theft":true},{"id":"htba3d76434a","date":"2025-05-06","name":"Crosswise","kind":"hack","fam":"other","tech":"Trusted Forwarder Spoof","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8d01b0c5ee","date":"2025-05-05","name":"Curve Finance","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=curve-finance-website-and-twitter-account-hacked"}],"desc":"Curve Finance’s official website and X account were compromised in quick succession. On May 5, attackers first took control of the project’s X account and used it to post a phishing message promoting a fake airdrop. Then on May 12, the project issued a warning that the Curve frontend had been “hijacked,” in what appeared to be a domain takeover incident.","theft":true},{"id":"hta628858be5","date":"2025-05-02","name":"TRON DAO","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/trondao/status/1918459819310367216"}],"desc":"TRON DAO stated on X that its account was compromised on May 2, 2025, at 9:25 AM PST. During the breach, an unauthorized party published a post containing contract address, sent private messages, and followed several unknown accounts.","theft":true},{"id":"ht69bc46ce53","date":"2025-05-01","name":"Hyperliquid","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articles/7teyhf6w"}],"desc":"Hyperliquid's X account is suspected to have been compromised. Please do not trust any content it posts or click on any links, to avoid potential losses.","theft":true},{"id":"hte060ba8b99","date":"2025-04-29","name":"FlyLong","kind":"hack","fam":"other","tech":"Balance Forgery","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2bc366d1b7","date":"2025-04-28","name":"tcdp","kind":"hack","fam":"other","tech":"Broken transferFrom Allowance Check","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7c34c80ebc","date":"2025-04-27","name":"$330 million in Bitcoin apparently stolen; laundering spikes Monero price by over 40%","kind":"hack","fam":"other","chains":["monero","Bitcoin"],"usd":330700000.0,"lo":330700000.0,"hi":330700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bc1qcry-theft"}],"theft":true,"headline":true},{"id":"ht7471287014","date":"2025-04-27","name":"QuantMaster","kind":"hack","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/thomsonYang_147/status/1916719524327686385"}],"desc":"QuantMaster smart contract drain via malicious backdoor embedded by an insider developer. The backdoor allowed the attacker to extract funds through a deliberately compromised contract.","theft":true},{"id":"ht18a1a39f07","date":"2025-04-27","name":"LIFE Protocol","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":51000.0,"lo":51000.0,"hi":51000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1916391258664174045"}],"desc":"According to the SlowMist MistEye security monitoring system, LIFE Protocol has been attacked, resulting in a loss of over $51,000.","theft":true},{"id":"hte08da941a7","date":"2025-04-27","name":"Aventa","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1916405508833218995"}],"desc":"Aventa Web3 utilities protocol exploited via flash loan attack. The attack mechanism drained approximately 3.9 ETH from the protocol through flashloan-funded exploitation of a protocol vulnerability.","theft":true,"onchain":true},{"id":"ht5cbf494fbf","date":"2025-04-27","name":"bitdog","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf72369e712","date":"2025-04-27","name":"multitransferswap","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5df451c85d","date":"2025-04-26","name":"Loopscale","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Solana"],"usd":5800000.0,"lo":5800000.0,"hi":5800000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/loopscale-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/LoopscaleLabs/status/1916230435291713786"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/loopscale-exploit"}],"desc":"Loopscale was exploited two weeks after launch when an attacker manipulated RateX PT token pricing to obtain undercollateralized loans, draining 5.7M USDC and 1,200 SOL.","theft":true},{"id":"htaec97c379d","date":"2025-04-26","name":"Term Finance","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":1650000.0,"lo":1600000.0,"hi":1650000.0,"ret":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/term_labs/status/1916941405173485897"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/term-finance-misconfiguration"}],"desc":"Term Finance's tETH oracle update introduced a decimal precision mismatch between oracle components. The incorrect decimal handling caused tETH to be priced incorrectly, triggering unintended liquidations of ~918 ETH as positions were force-closed at wrong prices.","theft":true},{"id":"ht0ab1037f7a","date":"2025-04-26","name":"Impermax V3","kind":"hack","fam":"code","tech":"Incorrect Fee Accounting","target":"DeFi Protocol","chains":["Base"],"usd":300000.0,"lo":62628.66,"hi":400000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://impermax.medium.com/impermax-v3-exploit-post-mortem-6b0818897b25"}],"desc":"On April 26, 2025, Impermax V3 on Base was exploited for $300K via fee accounting mismatch in collateral valuation. Attacker manipulated LP pool price ticks, accumulated fees, then overborrowed against LP collateral with incorrectly valued uncollected fees.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht2d2c6b1125","date":"2025-04-26","name":"Lifeprotocol","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":15114.0,"lo":15114.0,"hi":15114.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1eb588ee61","date":"2025-04-26","name":"Grafana","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://grafana.com/blog/2025/04/27/grafana-security-update-no-customer-impact-from-github-workflow-vulnerability/?mdm=social&src=x&camp=blog"}],"desc":"The open-source data visualization tool Grafana has responded to a recent attack, stating that the attacker forked a Grafana repository, executed a curl command to inject malicious code, and exported environment variables into a file encrypted with a private key, thereby stealing access tokens. The attacker then deleted the fork to conceal their activity. Using the compromised credentials, the attacker replicated the attack against four private repositories. This unauthorized access was limited to automation systems and did not affect production environments or release artifacts. Based on the attack behavior, the goal appeared to be token theft and stealthy persistence for future use.","theft":true},{"id":"ht8481d15744","date":"2025-04-24","name":"ACB","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":22804.0,"lo":22804.0,"hi":22804.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1915239816486412697"}],"desc":"ACB token exploited through staking reward manipulation via spot price oracle manipulation on Binance Smart Chain. Attacker manipulated oracle prices to artificially inflate reward calculations.","theft":true},{"id":"hta253737c6e","date":"2025-04-22","name":"Bitcoin Mission","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Bitcoin Mission lost ~$1.3M in wrapped BTC in April 2025 when a privileged wrapped BTC handling function lacked access-control checks, allowing an unauthorized caller to move the protocol's holdings.","theft":true},{"id":"htd7ad70d596","date":"2025-04-20","name":"Bitget","kind":"hack","fam":"market","tech":"Market Maker Bot Exploited","target":"CEX","usd":100000000.0,"lo":20000000.0,"hi":100000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/voxel-manipulation"}],"desc":"Bitget's market-making bot on the VOXEL/USDT futures pair malfunctioned on April 20, 2025, entering a predictable buy-low/sell-high loop. Traders exploited the pattern with high leverage to extract ~$100M before Bitget froze accounts and rolled back trades.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht72dc72db84","date":"2025-04-18","name":"Numa","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":506000.0,"lo":506000.0,"hi":530000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/officer_cia/status/1913979776953356722"}],"desc":"Numa on Arbitrum was exploited when the protocol's cNuma collateral valuation logic lacked protection against spot price manipulation. The attacker flash-minted nuBTC to artificially inflate synthetic liabilities and deflate collateral valuations.","theft":true},{"id":"ht63dd0fa04e","date":"2025-04-18","name":"BTNFT","kind":"hack","fam":"code","tech":"Claim Rewards Without Protection","chains":["BNB Chain"],"usd":19025.919331278623,"lo":19025.919331278623,"hi":19025.919331278623,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf68bae6d98","date":"2025-04-16","name":"R0AR","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":780000.0,"lo":780000.0,"hi":780000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1912417097269014825"}],"desc":"R0ARStaking contract contained a backdoor embedded by an external developer during deployment. The backdoor directly modified storage slots to set a falsified balance for the attacker's address, which was then extracted using the emergency withdrawal function.","theft":true},{"id":"hte595c97c44","date":"2025-04-16","name":"Roar","kind":"hack","fam":"insider","tech":"Rug Pull","usd":777000.0,"lo":777000.0,"hi":777000.0,"conf":"C","n":1,"theft":true},{"id":"ht30db0e7b11","date":"2025-04-16","name":"YVToken","kind":"hack","fam":"other","tech":"Not Slippage Protection","chains":["BNB Chain"],"usd":15261.68240413122,"lo":15261.68240413122,"hi":15261.68240413122,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht78c09b706c","date":"2025-04-16","name":"DIN","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/din_lol_/status/1912694123028705786"}],"desc":"The official X account of AI blockchain project DIN (@din_lol_) has been compromised by a hacker. Current posts from the account are not from the official team, and users are advised not to click any links or engage with related content. Additionally, the X accounts of DIN founder Harold and the DIN Foundation (@Foundation_DIN) have also been hijacked. The DIN team is actively addressing the incident and urges users to rely on official channels for further updates.","theft":true},{"id":"ht9366c3be6a","date":"2025-04-15","name":"Victims lose $12 million to CBEX \"AI-powered\" crypto trading Ponzi scheme","kind":"fraud","fam":"insider","usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cbex-scam"}],"headline":true},{"id":"ht59a6f3c9fe","date":"2025-04-15","name":"ZKsync","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Other","chains":["zkSync Era","Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"ret":4500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://zksync.mirror.xyz/W5vPDZqEqf2NuwQ5x7SyFnIxqqpE1szAFD69iaaBFnI"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zksync-theft"}],"desc":"ZKsync airdrop contracts were compromised on April 15, 2025 when attacker obtained admin private key with inadequate key management. Attacker minted 111M ZK tokens ($5M) via sweepUnclaimed() function; core protocol and user funds remained unaffected.","theft":true},{"id":"htc8f78ef224","date":"2025-04-14","name":"KiloEx","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain","Base","Taiko","Ethereum"],"usd":7500000.0,"lo":7500000.0,"hi":8440000.0,"ret":6750000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kiloex-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/KiloEx_perp/status/1913168299292328115"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kiloex-exploit"}],"desc":"On April 14, 2025, at 18:53 UTC, KiloEx was exploited for $7.5M via ETH/USD price oracle manipulation across Base, BSC, and opBNB. The attacker opened positions at artificially low prices and closed at real high prices without the oracle system validating feed freshness or enforcing rate limits.","theft":true},{"id":"htaf55c7cad1","date":"2025-04-14","name":"Aergo","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/aergo_io/status/1911684243530616856"}],"desc":"The official website of hybrid blockchain project Aergo is temporarily unavailable due to a DDoS attack. The technical team is actively working on the issue and aims to restore access as soon as possible. Aergo reminds users to stay alert for impersonation and scam attempts — the team will never initiate DMs or request funds or wallet information.","theft":true},{"id":"htee0344f47f","date":"2025-04-11","name":"Jake Gallen","kind":"hack","fam":"keys","tech":"Social Engineering","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/8uw580kk.html"}],"desc":"Jake Gallen, CEO of digital asset trading platform Emblem Vault, was hacked after a suspicious Zoom video call, resulting in the loss of over $100,000 worth of Bitcoin and Ethereum. The attacker posed as a YouTube content creator with over 90,000 subscribers and exploited Zoom’s default remote access settings during the interview to install malicious software named “GOOPDATE” on Gallen’s computer.","theft":true},{"id":"ht30db20a294","date":"2025-04-11","name":"Unverified 0x6077","kind":"hack","fam":"code","tech":"Lack of Access Control","chains":["Base"],"usd":62300.0,"lo":62300.0,"hi":62300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hteaa0fecafa","date":"2025-04-08","name":"MEV Bot","kind":"hack","fam":"code","tech":"Lack of Strict Access Control","chains":["Ethereum"],"usd":210000.0,"lo":210000.0,"hi":210000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1909459139715023097"}],"desc":"According to the SlowMist MistEye security monitoring system, a MEV bot (address: [address]) has lost approximately 116.7 ETH due to a lack of access control.","theft":true},{"id":"ht005eaae4f3","date":"2025-04-08","name":"Next Earth","kind":"hack","fam":"code","tech":"Reentrancy Attack","usd":17000.0,"lo":17000.0,"hi":17000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1909458997113164232"}],"desc":"According to the SlowMist MistEye security monitoring system, the NFT project Next Earth has suffered a reentrancy attack on Polygon.","theft":true},{"id":"ht880c84f0f7","date":"2025-04-08","name":"Laundromat","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["Ethereum"],"usd":1500.0,"lo":1500.0,"hi":1500.0,"conf":"C","n":1,"theft":true},{"id":"ht50e60c9aa7","date":"2025-04-07","name":"Tenderize V2","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":10850.0,"lo":10850.0,"hi":10850.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Tenderize V2 suffered an exploit involving its proxy upgrade mechanism, resulting in a small loss on Ethereum due to improper proxy upgrade validation.","theft":true},{"id":"ht2d5e730c96","date":"2025-04-07","name":"AmpKashi","kind":"hack","fam":"market","tech":"AMP Collateral Borrow Price Manipulation","chains":["Ethereum"],"usd":572.31,"lo":572.31,"hi":572.31,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht440fed46db","date":"2025-04-04","name":"AIRWA","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":33600.0,"lo":33600.0,"hi":33600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"AIRWA token exploited on Binance Smart Chain through improper access control vulnerability. Lack of proper permission checks allowed unauthorized fund extraction from the protocol.","theft":true,"onchain":true},{"id":"ht3a4168474d","date":"2025-04-01","name":"UPCX","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":70000000.0,"lo":70000000.0,"hi":70000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Upcxofficial/status/1907024397497749647"}],"desc":"On April 1, 2025, UPCX payment platform was exploited when an attacker used a compromised private key to upgrade the ProxyAdmin contract, enabling execution of withdrawByAdmin to drain 18.4M UPC tokens (~$70M) from three management accounts.","theft":true},{"id":"ht3b933b8bb0","date":"2025-04-01","name":"Zapper","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Optimism","Polygon","Base"],"usd":7900000.0,"lo":7900000.0,"hi":7900000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/zapper_fi/status/1907089451223781877"}],"desc":"Zapper's .fi domain registrar was compromised via social engineering of Netim's support team, allowing attackers to redirect traffic to a malicious domain. Users visiting the fake zapper.fi were exposed to credential harvesting and unauthorized transactions. Zapper immediately notified users to use only zapper.xyz while working to recover the domain.","theft":true},{"id":"htdabfdfc833","date":"2025-03-30","name":"LeverageSIR","kind":"hack","fam":"other","tech":"Storage SLOT1 collision","chains":["Ethereum"],"usd":1781486.0,"lo":1781486.0,"hi":1781486.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5fdb4d8388","date":"2025-03-30","name":"SIR.trading","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":355000.0,"lo":355000.0,"hi":355000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sirtrading-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1906722264059674893"}],"desc":"On March 30, 2025, SIR.trading on Ethereum was exploited for $355K via callback validation flaw. Vault contract's callback did not validate Uniswap pool address, allowing replacement with attacker-controlled address via transient storage manipulation (one of first Dencun-targeted exploits).","theft":true},{"id":"hte40746dd3c","date":"2025-03-29","name":"Venus Core Pool","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["zkSync Era"],"usd":902000.0,"lo":902000.0,"hi":902000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On March 29, 2025 Venus Core Pool on zkSync Era suffered a donation attack when an attacker directly transferred tokens to the cToken contract, distorting exchange rates and accumulator calculations and bypassing collateral accounting and supply cap logic, resulting in $902,000 in losses and bad debt.","theft":true},{"id":"ht49c231f33f","date":"2025-03-28","name":"Coinbase customer loses $35 million in bitcoin theft","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":46000000.0,"lo":46000000.0,"hi":46000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bc1qvl-theft"}],"theft":true,"headline":true},{"id":"ht624620a5e4","date":"2025-03-28","name":"Alkimiya","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":95500.0,"lo":95500.0,"hi":95500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Alkimiya's SilicaPools contract unsafely downcast shares from uint256 to uint128 in the collateralizedMint function. An attacker used a flash loan to manipulate the truncated shares value, causing the contract to believe it had issued fewer shares than it actually had and allowing redemption of more collateral than deposited.","theft":true,"onchain":true},{"id":"htab2563a1ff","date":"2025-03-28","name":"Min Token (MIN)","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":21415.0,"lo":21415.0,"hi":21415.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1905448377980256401"}],"desc":"According to monitoring by SlowMist's security team, Min Token (MIN) is suspected to have been attacked on BSC, resulting in a loss of approximately $21,400.","theft":true},{"id":"ht5ae77055f1","date":"2025-03-27","name":"HyperLiquid loses $13.5 million in alleged JELLYJELLY manipulation incident","kind":"other","fam":"other","chains":["Hyperliquid"],"usd":13500000.0,"lo":13500000.0,"hi":13500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hyperliquid-manipulation"}],"headline":true},{"id":"htd81d8eb76c","date":"2025-03-27","name":"Polymarket suffers governance attack as whale manipulates Ukraine bet resolution; refuses refunds","kind":"fraud","fam":"insider","usd":7000000.0,"lo":7000000.0,"hi":7000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polymarket-governance-attack"}],"headline":true},{"id":"ht0ce3e4b6d1","date":"2025-03-27","name":"Vicuna Lending","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Sonic"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Vicuna Finance’s S Market and Stablecoin Market were exploited through an oracle manipulation vulnerability, resulting in approximately $700K in losses. The Main Protocol market was unaffected. Following the exploit, Vicuna removed liquidity from the affected submarkets and planned to distribute the remaining assets pro rata to affected users based on their net supplied positions","theft":true},{"id":"ht00bbd1398f","date":"2025-03-27","name":"YziAI","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":239400.0,"lo":239400.0,"hi":239400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht926f060f2b","date":"2025-03-25","name":"Abracadabra Spell","kind":"hack","fam":"code","tech":"Liquidation Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":13000000.0,"lo":13000000.0,"hi":13000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/abracadabra-rekt2"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=abracadabra-exploit-2"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/abracadabra-exploit-2"}],"desc":"Abracadabra.Money suffered a $13M exploit on March 25, 2025 via a flash loan attack on cauldrons accepting GMX V2 LP tokens as collateral. The attacker manipulated liquidation logic to self-liquidate and extract liquidation incentives.","theft":true},{"id":"ht67b856b64f","date":"2025-03-21","name":"Zoth ZeUSD","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":8850000.0,"lo":8290000.0,"hi":8850000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/zoth-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1903020756830974217"}],"desc":"Zoth's admin key was compromised, allowing the attacker to upgrade the proxy contract and execute unauthorized transfers of $8.85M in USD0++ stablecoins, converting them to 4,223 ETH.","theft":true,"review":["possible duplicate within one source"]},{"id":"hteafd1c6033","date":"2025-03-21","name":"Watcher.Guru","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/WatcherGuru/status/1902956367222071664"}],"desc":"The media platform Watcher.Guru, which focuses on cryptocurrency and financial market news, posted on X that its account was hacked today. Watcher.Guru is still investigating the specific method of the breach and has contacted X's official team for further clarification.","theft":true},{"id":"ht19a6fefca1","date":"2025-03-20","name":"BBXToken","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":12000.0,"lo":11902.0,"hi":12000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BBXToken's transfer function includes a burn mechanism that transfers liquidity pool tokens to a dead address before calling sync(). An attacker exploited this to artificially manipulate PancakeSwap's pool reserves, creating an imbalance that allowed extraction of value from the pool.","theft":true,"onchain":true},{"id":"hta1475b76a0","date":"2025-03-18","name":"Voltage V3","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Fuse"],"usd":322113.0,"lo":320000.0,"hi":322113.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@voltage.finance/voltage-finance-transparency-post-mortem-report-simple-staking-hack-ecde06c6b8bc"}],"desc":"An attacker compromised the SimpleChefStaking proxy contract, replacing its implementation with a malicious one. The attacker then used the forceWithdraw function to drain collateral from the Simple Staking pools, extracting USDCE and WETH. Voltage offered a $50k bounty for recovery of the remaining funds.","theft":true},{"id":"ht89149f935e","date":"2025-03-18","name":"four.meme","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":80000.0,"lo":19500.0,"hi":130000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1901845958767657072"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fourmeme-hack-2"}],"desc":"Four.Meme's launch feature improperly restricted token transfers before public listing. An attacker used a low-level function to bypass MODE_TRANSFER_RESTRICTED, creating unauthorized trading pairs for pre-launch tokens and extracting liquidity at attacker-controlled prices.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht22ca83c77c","date":"2025-03-18","name":"DCFToken","kind":"hack","fam":"other","tech":"Lack of Slippage Protection","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"review":["attack tx contradicts the date"]},{"id":"htfff944a864","date":"2025-03-18","name":"unverified","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Avalanche"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbaa40e5862","date":"2025-03-16","name":"WebKeyDAO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":73000.0,"lo":73000.0,"hi":73000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"WebKeyDAO's buy() function lacked proper access controls, allowing an attacker to purchase WKEYDAO tokens at artificially low prices set via an unprotected setTokenInfo() call. The attacker exploited this to acquire tokens at 1/10th market price and immediately sold them on DEX for profit, limited only by a built-in 67-token sale cap.","theft":true},{"id":"hte1431122f8","date":"2025-03-16","name":"Kaito AI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/sandraaleow/status/1900999678466126100?s=46&t=C99FI4Hm9YFZrc41IlEaog"}],"desc":"Kaito official representative Sandra (@sandraaleow) posted on X that Kaito AI founder Yu Hu and Kaito's X account have been compromised. However, no KAITO wallets have been affected.","theft":true},{"id":"ht470c44c5ed","date":"2025-03-16","name":"wKeyDAO","kind":"hack","fam":"other","tech":"unprotected function","conf":"C","n":1,"theft":true},{"id":"ht0a44ebdc7c","date":"2025-03-14","name":"Berally","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Berachain"],"usd":90000.0,"lo":86725.0,"hi":90000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Berally_io/status/1900855059069759571"}],"desc":"On March 14, 2025, Berally on Berachain suffered a hack when the deployer key was compromised, allowing the attacker to drain all vesting tokens from the liquidity pool. The core dApp contracts remained unaffected.","theft":true},{"id":"ht38cc07973c","date":"2025-03-14","name":"H2O","kind":"hack","fam":"code","tech":"Weak Random Mint","chains":["BNB Chain"],"usd":22470.0,"lo":22470.0,"hi":22470.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb2e8f7369b","date":"2025-03-11","name":"DUCKVADER","kind":"hack","fam":"code","tech":"Free Mint Bug","chains":["Base"],"usd":9600.0,"lo":9600.0,"hi":9600.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht571c241774","date":"2025-03-11","name":"ZeroExSettler","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Ethereum"],"usd":3008.0,"lo":3008.0,"hi":3008.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb5bb468494","date":"2025-03-08","name":"StackMarket","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Base"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta60ff6941a","date":"2025-03-07","name":"SBR Token","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":18400.0,"lo":18400.0,"hi":18400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htba3fd10e8d","date":"2025-03-07","name":"UNI","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["Ethereum"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"C","n":1,"theft":true},{"id":"ht64947e1bca","date":"2025-03-06","name":"RnsPay","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Ethereum"],"usd":1050.0,"lo":1050.0,"hi":1050.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht13ba326c1d","date":"2025-03-06","name":"unverified","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Base"],"usd":980.32,"lo":980.32,"hi":980.32,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc7dbb1720b","date":"2025-03-06","name":"PTM","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":552.63,"lo":552.63,"hi":552.63,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6323b9aadf","date":"2025-03-05","name":"1inch Swap","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/1inch-rekt"},{"s":"SlowMist Hacked","u":"https://blog.1inch.io/vulnerability-discovered-in-resolver-contract/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/1inch-loses-5-million-to-smart-contract-bug"}],"desc":"On March 5, 2025, 1inch disclosed a $5M exploit in Fusion v1 resolver contracts when a buffer overflow in _settleOrder() allowed an attacker to trigger integer underflow and hijack control flow to impersonate resolvers and execute unauthorized swaps. Most funds were recovered after negotiation.","theft":true},{"id":"ht51519fb2fa","date":"2025-03-05","name":"Pond.fun","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Linea"],"usd":145000.0,"lo":145000.0,"hi":145000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/wb4id59q.html"}],"desc":"Pond.fun's lead software engineer Genesis exploited privileged access to the platform's smart contracts, manipulating withdrawal functions to drain 64.8 ETH from the liquidity pools. The stolen funds were bridged to Railgun for privacy before moving to centralized exchanges. Chainalysis and Elliptic were contracted to track and prevent laundering of the stolen assets.","theft":true},{"id":"ht3c74e60b7b","date":"2025-03-05","name":"Meow","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/421865"}],"desc":"Jupiter co-founder Meow's X account was reportedly hacked and posted token CA-related content, which has now been deleted. Users are advised to stay vigilant.","theft":true},{"id":"htb1e839e84c","date":"2025-03-04","name":"Pump","kind":"hack","fam":"other","tech":"Not Slippage Protection","chains":["BNB Chain"],"usd":6400.0,"lo":6400.0,"hi":6400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc56637241b","date":"2025-03-01","name":"Zoth ZeUSD","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":285000.0,"lo":285000.0,"hi":285000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=zoth-hack-1"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zoth-hack-1"}],"desc":"Zoth's collateral accounting incorrectly calculated LTV (Loan-To-Value) after swapping collateral via Uniswap V3. An attacker used flash loans to manipulate V3 exchange rates, making a minimal deposit swap for far fewer tokens than should be received, then minting ZeUSD against the phantom collateral difference.","theft":true},{"id":"ht6236db71a6","date":"2025-03-01","name":"Hegic(old contract)","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":80000.0,"lo":80000.0,"hi":80000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A deprecated Hegic WBTC Puts Pool contract (deployed January 4, 2022) was drained through its unprotected withdrawWithoutHedge() path, which did not decrement share balances. The attacker deposited liquidity, bought put options, withdrew the liquidity, then exercised the options.","theft":true},{"id":"htf98b2f02f4","date":"2025-02-28","name":"Wemix","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Wemix"],"usd":6220000.0,"lo":6200000.0,"hi":6220000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/423515"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wemix-foundation-hack"}],"desc":"An attacker stole authentication credentials for Wemix's Nile NFT platform service monitoring system and used them to gain access to the Play Bridge Vault. The attacker executed 13 successful withdrawals over two months of preparation, extracting 8.65 million WEMIX tokens and selling them on external exchanges. Wemix delayed disclosure by one week citing precautionary measures.","theft":true},{"id":"htf9434b682b","date":"2025-02-27","name":"Crypto holder loses $40 million to sophisticated phishing attack","kind":"scam","fam":"social","chains":["Bitcoin"],"usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mirashi-hack"}],"theft":true,"headline":true},{"id":"hta9f9395ba3","date":"2025-02-27","name":"Pumpfun","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/420883"}],"desc":"Pumpfun's X account has been hacked, and the attacker is using it to promote fake tokens.","theft":true},{"id":"hta4e250fba0","date":"2025-02-27","name":"Venus_ZKSync","kind":"hack","fam":"other","tech":"Donation Attack","chains":["zkSync Era"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht78160e1dca","date":"2025-02-26","name":"Suji Yan","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=suji-yan-wallet-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/suji-yan-wallet-hack"}],"desc":"Suji Yan, the founder of the Mask Network, suffered the loss of more than $4 million in various cryptocurrency assets to an apparent wallet hack.","theft":true},{"id":"htc2200b74f2","date":"2025-02-26","name":"HenloKart","kind":"hack","fam":"other","tech":"Fake Native Deposit And Immediate Cancel","chains":["Base"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0003a2ca36","date":"2025-02-24","name":"Infini","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":49500000.0,"lo":49500000.0,"hi":50000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/infini-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/MistTrack_io/status/1893926049882239085"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/infini-hack"}],"desc":"Infini suffered a $49.5M exploit on February 24, 2025 when a rogue former developer who had retained vault-draining privileges drained the contract. The attacker immediately converted USDC to ETH (17,696 ETH) through Uniswap, Sky Protocol, and 0x.","theft":true},{"id":"htd78ed126c2","date":"2025-02-24","name":"INVISTECH","kind":"hack","fam":"market","tech":"Pair Tax Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht9f057c03cd","date":"2025-02-23","name":"Zero To Lend","kind":"other","fam":"other","usd":371000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/zero-to-lend"}]},{"id":"ht1462a7f92b","date":"2025-02-23","name":"HegicOptions","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"htb0add841e3","date":"2025-02-22","name":"Unverified_35bc","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":6700.0,"lo":6700.0,"hi":6700.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An unverified smart contract on BSC was exploited via reentrancy, where the attacker repeatedly triggered a function that transferred funds before updating state.","theft":true},{"id":"ht42886485d2","date":"2025-02-21","name":"Bybit","kind":"hack","fam":"social","tech":"Signer Phishing","target":"CEX","chains":["Ethereum"],"usd":1460000000.0,"lo":1400000000.0,"hi":1500000000.0,"ret":42890000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bybit-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1892963250385592345"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bybit-hack"}],"desc":"On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deployed a rogue hot-wallet policy. This drained approximately $1.4-1.5 billion in ETH and assets.","theft":true,"onchain":true,"actor":"North Korea (TraderTraitor)","attr":{"by":"FBI / IC3","date":"2025-02-26","title":"North Korea Responsible for $1.5 Billion Bybit Hack","url":"https://www.ic3.gov/PSA/2025/PSA250226"},"official":"about $1.5B","note":"FBI reports the stolen assets were being converted and laundered across thousands of addresses. DefiLlama's returned figure for this incident reflects client losses Bybit covered, not funds taken back from the attacker."},{"id":"ht2879cf46fc","date":"2025-02-21","name":"StepHeroNFTs","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The StepHeroNFTs claimReferral function was vulnerable to reentrancy, allowing an attacker to repeatedly trigger transfers before state updates. The attacker drained approximately 90K USD in a single transaction.","theft":true,"onchain":true},{"id":"ht42230612a6","date":"2025-02-18","name":"Cardex","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Abstract","Ethereum"],"usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/0xCygaar/status/1891948692204368122"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/abstract-cardex-hack"}],"desc":"On February 18, 2025 Cardex (fantasy trading card game on Abstract layer-2) suffered a session key compromise affecting approximately 9,000 wallets when a session signer private key was exposed on the frontend, allowing attackers to impersonate all active user sessions and drain approximately $400,000 from users who had approved session keys.","theft":true},{"id":"ht64d2de49d7","date":"2025-02-16","name":"Shaw","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/8722ekeb.html"}],"desc":"According to community reports, the X account of ai16z founder Shaw has allegedly been compromised by hackers. Users are advised to exercise caution and avoid interacting with suspicious links.","theft":true},{"id":"ht9d16dc521b","date":"2025-02-15","name":"LIBRA","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":250000000.0,"lo":250000000.0,"hi":250000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/342266/traders-of-solana-based-libra-memecoin-lost-251-million-nansen"}],"desc":"Argentine President Javier Milei promoted a cryptocurrency called $LIBRA on social media. Following his endorsement, the token's price surged rapidly but later suffered a severe crash.","theft":true},{"id":"ht034857969b","date":"2025-02-15","name":"unverified_d4f1","kind":"hack","fam":"other","tech":"access-control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht3004dfbfbe","date":"2025-02-14","name":"Argentinian president Javier Milei promotes memecoin that then crashes 95% in apparent $100 million+ rug pull","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":107000000.0,"lo":107000000.0,"hi":107000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/milei-memecoin-promotion"}],"theft":true,"headline":true},{"id":"ht2ac250a903","date":"2025-02-11","name":"zkLend","kind":"hack","fam":"code","tech":"First Depositor Attack","target":"DeFi Protocol","chains":["Starknet"],"usd":9550000.0,"lo":9500000.0,"hi":9600000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/zklend-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1890351732313714882"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zklend-hack"}],"desc":"zkLend lost $9.57M on February 11, 2025 on Starknet via an integer division rounding vulnerability. Attacker exploited truncated rounding in withdrawal calculations with precise wstETH deposits to inflate their raw_balance to 1724, draining all tokens from other pools. Attacker returned ~$3.2M after negotiation but lost remaining to a Tornado Cash scam.","theft":true},{"id":"htb590350f6b","date":"2025-02-11","name":"Trader accidentally sends 2,000 SOL to bankrupt FTX","kind":"fraud","fam":"insider","usd":396000.0,"lo":396000.0,"hi":396000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trader-accidentally-sends-2000-sol-to-bankrupt-ftx"}],"headline":true},{"id":"ht8c08f40092","date":"2025-02-11","name":"four.meme","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":183000.0,"lo":183000.0,"hi":183000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1889206331644789244"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fourmeme-hack"}],"desc":"On February 11, 2025, four.meme was exploited when an attacker created a malicious PancakeSwap V3 pool with an inflated sqrtPriceX96 parameter (368 trillion times correct). Four.meme's migration logic used the pool without verification, allowing the attacker to drain WBNB by providing minimal tokens at the fake price.","theft":true,"onchain":true},{"id":"ht415c6f68e1","date":"2025-02-11","name":"LimitOrderProtocol","kind":"hack","fam":"code","tech":"Access Control","chains":["Base"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htfd93a138b4","date":"2025-02-11","name":"Scorch","kind":"hack","fam":"market","tech":"Price Oracle Manipulation","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd72d22f3ed","date":"2025-02-09","name":"GMT7","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht9604c5892d","date":"2025-02-08","name":"Cashverse","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":107900.0,"lo":107900.0,"hi":107900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1888125078560452989"}],"desc":"According to monitoring by the SlowMist security team, Cashverse appears to have been attacked on BSC.","theft":true},{"id":"hta0abeb7801","date":"2025-02-08","name":"Peapods Finance","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":3500.0,"lo":3500.0,"hi":3500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc4fd244c89","date":"2025-02-07","name":"BankX","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":43000.0,"lo":43000.0,"hi":43000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1887802943266771423"}],"desc":"According to monitoring by the SlowMist security team, BankX appears to have been attacked on BSC, ETH, and Optimism.","theft":true},{"id":"htb22e45d435","date":"2025-02-06","name":"Jupiter","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/jup_dao/status/1887312135039910354"}],"desc":"JupiterDAO confirmed on X that the official Jupiter X account (@JupiterExchange) has been compromised. Users are advised not to click on any links or copy-paste any contract addresses.","theft":true},{"id":"ht8bce06169b","date":"2025-02-06","name":"Mohammed Dewji MO","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/417013"}],"desc":"The X account of Tanzanian businessman and entrepreneur Mohammed Dewji MO (@moodewji) was compromised. The hacker falsely announced the launch of a TANZANIA token and sold it to investors.","theft":true},{"id":"ht9721a612e5","date":"2025-02-05","name":"Dr Mahathir Mohamad","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1887121596541997097"}],"desc":"According to a post by SlowMist founder Cos on X, the X account of former Malaysian Prime Minister Dr Mahathir Mohamad (@chedetofficial) was compromised and used to promote a fake token. The creator of the associated contract address (CA) has ties to a previously known malicious group.","theft":true},{"id":"htde36cc103e","date":"2025-02-04","name":"Ionic Protocol","kind":"fraud","fam":"social","tech":"Impersonation Scam","target":"DeFi Protocol","chains":["Mode"],"usd":8600000.0,"lo":8600000.0,"hi":12300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ionic-money-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/ionicmoney/status/1888820557887459513"}],"desc":"Attackers impersonated Lombard Finance members to trick Ionic Money into listing counterfeit LBTC. Attackers then minted 250 fake LBTC as collateral to borrow $8.6-8.8M in legitimate tokens, bridging ~$3.5M to Ethereum. Inadequate identity verification enabled the social engineering."},{"id":"ht1d8308723a","date":"2025-02-03","name":"Coinbase accused by crypto sleuth zachxbt of allowing more than $300 million per year in social engineering attacks on its customers","kind":"hack","fam":"other","usd":300000000.0,"lo":300000000.0,"hi":300000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinbase-accused-of-failing-to-prevent-phishing"}],"theft":true,"headline":true},{"id":"htdfee0c7e6f","date":"2025-02-01","name":"Sirio Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Hedera"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Sirio Finance, the first lending protocol on Hedera, exploited for $2M on February 1, 2025 via flashloan attack. Specific technical details of the vulnerability are not publicly available.","theft":true},{"id":"htb2d31a8907","date":"2025-02-01","name":"AlleyCat project developer takes presale money to fund gambling habit","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alleycat-project-developer-creator-takes-presale-money-to-fund-gambling-habit"}],"theft":true,"headline":true},{"id":"ht253b952907","date":"2025-02-01","name":"GoldReserve","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3024811df8","date":"2025-01-31","name":"TIME","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/416261"}],"desc":"The official TIME Magazine X account was allegedly compromised and posted about the TIME token.","theft":true},{"id":"htecc4efc90c","date":"2025-01-31","name":"The Tor Project","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/vxunderground/status/1885029422652174391?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"The Tor Project X account has been compromised. The hacker is using the account to promote a fake token. Users should stay vigilant.","theft":true},{"id":"ht16ae6df2df","date":"2025-01-30","name":"\"On-chain Microstrategy\" clone Ether Strategy loses over $500,000 of ETH","kind":"other","fam":"other","chains":["Ethereum"],"usd":535850.0,"lo":535850.0,"hi":535850.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ether-strategy-destroys-over-500000-of-eth"}],"headline":true},{"id":"ht5487421a4a","date":"2025-01-28","name":"DogWifTools","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"Other","chains":["Solana"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rugpuller-tool-rug-pulls-rugpullers"}],"desc":"DogWifTools, a Solana rug-pull generator tool, was compromised via supply chain attack. Attackers gained control of the GitHub repository token and inserted malware into versions 1.6.3-1.6.6. Updates delivered malicious updater.exe files that acted as Remote Access Trojans, stealing cryptocurrency wallet private keys and extracting $10M from users.","theft":true},{"id":"ht48d6064c6d","date":"2025-01-28","name":"MCAI","kind":"hack","fam":"other","tech":"Tax wallet allowance bypass","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte07b153da2","date":"2025-01-26","name":"AIXBTForcedSwap","kind":"hack","fam":"other","tech":"Hardcoded Auth Key","chains":["Base"],"usd":13597.36,"lo":13597.36,"hi":13597.36,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht11409e9daf","date":"2025-01-26","name":"Dean Norris","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/3999sdys.html"}],"desc":"According to DL News, Dean Norris, the actor who played Hank Schrader in Breaking Bad, became the target of a hack on the X platform for the second time in six months. The attack started with a tweet from Norris' account announcing his decision to launch his own cryptocurrency called Dean, along with the contract address. The attackers even shared a manipulated photo of Norris holding a notebook with the token's symbol and date hastily written on it. Within hours, the meme coin's market value surged to $7 million, but after Norris confirmed the scam, its value plummeted by 90%.","theft":true},{"id":"ht8d96353f78","date":"2025-01-24","name":"AdsPower","kind":"hack","fam":"keys","tech":"Supply Chain Attack","usd":4700000.0,"lo":4700000.0,"hi":4700000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/adspowercn/status/1883698412840698270"}],"desc":"The AdsPower security team discovered a breach in which hackers distributed malicious code, resulting in the compromise of some third-party browser extensions.","theft":true},{"id":"ht97a6bdccb1","date":"2025-01-24","name":"Jair Messias Bolsonaro","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/415315"}],"desc":"The X account of former Brazilian President Jair Messias Bolsonaro was hacked and used to promote the token. The original post has since been deleted.","theft":true},{"id":"htcaeb725aab","date":"2025-01-23","name":"Phemex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","Solana","XRP","Bitcoin","BNB Chain","Sui","Base","Tron","Arbitrum","Avalanche","Polygon","Optimism","zkSync Era"],"usd":70000000.0,"lo":70000000.0,"hi":85000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/phemex-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=phemex-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phemex-hack"}],"desc":"On January 23, 2025, Singapore-based exchange Phemex's hot wallets were drained across more than a dozen chains (ETH, SOL, XRP, BTC, BSC, Tron) in a coordinated attack, with reported losses ranging from $69.1M to $85M. The hot wallet private keys and signing infrastructure were compromised.","theft":true},{"id":"ht4229ef5f10","date":"2025-01-23","name":"Zero Edge crypto casino enters liquidation after founder gambles away its seed money","kind":"collapse","fam":"insider","usd":8300000.0,"lo":8300000.0,"hi":8300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zero-edge-crypto-casino-liquidation"}],"headline":true},{"id":"htb9eeba372e","date":"2025-01-23","name":"ODOS","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Base"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/odosprotocol/status/1882668362045821146"}],"desc":"According to monitoring by the SlowMist security team, due to a lack of input validation in @odosprotocol, the vulnerability has been exploited across multiple chains, resulting in approximately $100,000 in losses. ODOS stated in a post that the attack exploited a vulnerability in its audited executor contract, allowing the theft of revenue stored within the contract but not affecting any user funds.","theft":true,"onchain":true},{"id":"ht259b655ff4","date":"2025-01-23","name":"Nasdaq","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/f3t12h8f.html"}],"desc":"According to The Block, Nasdaq's official X account was hacked, and the attackers used it to promote fraudulent meme coins."},{"id":"ht6bb556d2ca","date":"2025-01-21","name":"Trump crossposting Twitter account advertises fake memecoins that make $1.25 million","kind":"hack","fam":"other","chains":["Solana"],"usd":1250000.0,"lo":1250000.0,"hi":1250000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-trump-twitter-account-memecoins"}],"theft":true,"headline":true},{"id":"htd24e399202","date":"2025-01-21","name":"AST","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":64700.0,"lo":64700.0,"hi":64700.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1881874569042317610"}],"desc":"According to monitoring by the SlowMist security team, AST was allegedly attacked on BSC.","theft":true,"onchain":true},{"id":"ht055b5f39da","date":"2025-01-21","name":"Dan Finlay","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1881476024569069851"}],"desc":"MetaMask posted on X: “This morning, our co-founder Dan Finlay's Farcaster account was compromised and used to promote a memecoin. We are in touch with the Farcaster team to help investigate the incident.\"","theft":true},{"id":"ht9a5e0e544f","date":"2025-01-18","name":"Paribus","kind":"hack","fam":"market","tech":"Bad oracle","chains":["Arbitrum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4df270057f","date":"2025-01-16","name":"Stability AI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/StabilityAI/status/1880348926190186863"}],"desc":"Stability AI's official X account posted information related to the STAI token contract, which appears to have been compromised. Be cautious to avoid falling victim to a scam.","theft":true},{"id":"htc1791044d1","date":"2025-01-16","name":"ZKsync Ignite","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zksync/status/1879706778688266499"}],"desc":"The ZKsync team tweeted that the @ZKsyncIgnite account has been compromised. Do not interact with the account or click any links. Wait for the @zksync account to confirm when the account has been reclaimed.","theft":true},{"id":"ht9f60267e70","date":"2025-01-15","name":"CAT Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/ProtocolCAT/status/1879513892902302197"}],"desc":"The CAT Protocol within the Bitcoin ecosystem posted on Platform X, stating that they recently detected and mitigated an attempted attack on the CAT Protocol, confirming that no user funds were lost. On January 18, CAT Protocol updated on Platform X that the recent security incident had been amicably resolved and classified it as a white-hat action.","theft":true},{"id":"htf5f8c42e97","date":"2025-01-15","name":"DAWN","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1879390837496537466"}],"desc":"According to Scam Sniffer's monitoring, the X account of the decentralized autonomous wireless network project DAWN was compromised and used to post phishing tweets.","theft":true},{"id":"ht620988781b","date":"2025-01-14","name":"The Idols","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":324000.0,"lo":324000.0,"hi":324000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/theidolsnft-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=idols-nft-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/idols-nft-exploit"}],"desc":"The Idols NFT contract had a flaw in the _beforeTokenTransfer function that incorrectly handled reward distribution when sender and recipient were the same address. By repeatedly calling safeTransferFrom with identical from/to addresses, an attacker exploited the logic flaw to drain 97 stETH from the reward pool.","theft":true,"onchain":true},{"id":"htadb9287eeb","date":"2025-01-13","name":"Mosca2","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":37600.0,"lo":37600.0,"hi":37600.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/1878699517450883407"}],"desc":"Mosca2's join() function was a balance multiplier due to composable logic flaws. The function attempted to top-up a member's balance but instead allowed permissionless balance inflation, enabling complete treasury drainage.","theft":true,"onchain":true},{"id":"htbdfee3fbde","date":"2025-01-13","name":"Moonray","kind":"fraud","fam":"insider","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Nourekx/status/1878637201736831061"}],"desc":"Moonray's Discord was Compromised, and the attackers posted fraudulent airdrop messages. Users are advised to stay cautious and aware of potential risks."},{"id":"htf4f920fe42","date":"2025-01-12","name":"Unilend V2","kind":"hack","fam":"code","tech":"Redeem Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":197600.0,"lo":197600.0,"hi":197600.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1878651772375572573"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unilend-exploit"}],"desc":"Unilend V2 lost $197.6K when attacker used a flash loan to deposit 60M USDC, then exploited stale balance references in the userBalanceOfToken function to manipulate health factor calculations and withdraw 60 stETH.","theft":true,"onchain":true},{"id":"htbcf7623c9f","date":"2025-01-12","name":"BUIDL","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":8000.0,"lo":8000.0,"hi":8000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BUIDL was suspected to have been attacked on BSC, resulting in an approximate loss of $8K.","theft":true,"onchain":true},{"id":"ht6d1d2ef6ee","date":"2025-01-12","name":"Foresight Ventures","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/62903"}],"desc":"According to Foresight News, the Foresight Ventures X account was hacked and is currently in the process of being recovered. Please do not click or trust any links or token information posted by this account.","theft":true},{"id":"ht6fcd8cb88b","date":"2025-01-12","name":"Litecoin","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/litecoin/status/1878155290782351756"}],"desc":"Litecoin posted on X, stating that their X account was briefly compromised and some unauthorized content was published. These posts were deleted within seconds. They are still investigating the incident but have immediately found a delegated account that was compromised and removed it.","theft":true},{"id":"htcabedce4d4","date":"2025-01-12","name":"Ryan Zarick","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/412695"}],"desc":"The X account of Ryan Zarick, co-founder and CTO of LayerZero Labs, was briefly compromised and used to post a fraudulent airdrop claim along with a phishing link."},{"id":"htd93725c0d0","date":"2025-01-11","name":"Aizel Network","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/62891"}],"desc":"The official X account of the blockchain AI project Aizel Network was hacked at noon on January 11 and is currently in the process of being recovered. The official reminder to users is to be cautious of the content posted by this account, do not trust any token information, and avoid clicking on any suspicious links or participating in any suspicious activities.","theft":true},{"id":"htf3c5660993","date":"2025-01-11","name":"SuperVerse","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SuperVerse/status/1877839323170500696"}],"desc":"The SuperVerse X account was compromised and used to post a fraudulent airdrop claim containing a phishing link."},{"id":"htb81fda90b8","date":"2025-01-11","name":"RoulettePotV2","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htae2c5a5c02","date":"2025-01-10","name":"Alien Base","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Base"],"usd":38000.0,"lo":38000.0,"hi":38000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1877545774856417400"}],"desc":"Multiple attack transactions targeting the Alien Base BunniHub contract resulted in a loss of approximately $38,000.","theft":true},{"id":"hta21ec8d34e","date":"2025-01-10","name":"FortuneWheel","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":21600.0,"lo":21600.0,"hi":21600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"FortuneWheel was suspected to have been attacked on BSC, resulting in an approximate loss of $21.6K.","theft":true,"onchain":true},{"id":"htf90d2e1dfc","date":"2025-01-10","name":"Holoworld AI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/HoloworldAI/status/1877763633796768224"}],"desc":"tong, the founder of Holoworld AI, posted on X stating that the Holoworld AI X account has been hacked. Please do not click on any links.","theft":true},{"id":"hte22054bace","date":"2025-01-10","name":"JPulsepot","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2a1272f533","date":"2025-01-09","name":"$2.2 million stolen by fake job scammers","kind":"scam","fam":"social","usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/2-2-million-stolen-by-fake-job-scammers"}],"theft":true,"headline":true},{"id":"ht0b6e28f159","date":"2025-01-08","name":"Hengelo man arrested in alleged crypto pyramid scheme","kind":"fraud","fam":"insider","usd":3090000.0,"lo":3090000.0,"hi":3090000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hengelo-man-arrested-in-alleged-crypto-pyramid-scheme"}],"headline":true},{"id":"ht7eeec0cdb4","date":"2025-01-08","name":"Moby","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":1470000.0,"lo":1088500.0,"hi":2500000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mobytrade-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/moby-trade/moby-post-mortem-report-growth-plan-504ad5b0dd35"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moby-trade-loses-over-1-million-to-private-key-leak"}],"desc":"In January 2025, Moby Trade on Arbitrum suffered a $2.5M hack when an attacker compromised a private key controlling the proxy upgrade mechanism. The attacker performed a malicious upgrade and called emergencyWithdrawERC20() to steal stablecoins and wrapped assets, but a whitehat recovered $1.5M.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht660b07d9c6","date":"2025-01-08","name":"Orange Finance","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":840000.0,"lo":830000.0,"hi":840000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/orange-finance-rekt"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/orange-finance-hack"}],"desc":"Orange Finance admin address was compromised on January 8, 2025, and used to upgrade contracts on Arbitrum and transfer $840K. Protocol had inadequate multisig implementation (effectively unisig); ~$731K remained.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht403b190076","date":"2025-01-08","name":"LPMine","kind":"hack","fam":"code","tech":"Incorrect reward calculation","usd":24000.0,"lo":24000.0,"hi":24000.0,"conf":"C","n":1,"theft":true},{"id":"htad52bf5a8a","date":"2025-01-08","name":"HORS","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":10300.0,"lo":10300.0,"hi":10300.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"HORS was suspected to have been attacked on BSC, resulting in an approximate loss of $10.3K.","theft":true,"onchain":true},{"id":"ht7f351a2d2d","date":"2025-01-08","name":"Virtuals Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Base"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/virtuals_io/status/1876921173340246492?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"Virtuals Protocol announced on X that their official Discord server has been compromised. They advised users not to click on any posts or private messages from administrators until further notice.","theft":true},{"id":"htc62c59f961","date":"2025-01-07","name":"IPC AI","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":590000.0,"lo":590000.0,"hi":590000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"IPC AI token deployed on BSC suffered a flash loan attack where the attacker bypassed the flash loan protection mechanism and exploited the deflationary burning mechanism in the token pair. The attacker leveraged the swap() function to circumvent protective measures and extract approximately $590,000 from the liquidity pair.","theft":true,"onchain":true},{"id":"ht7be28674a7","date":"2025-01-07","name":"Man reports losing $100,000 to website spoofing a crypto exchange","kind":"hack","fam":"other","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kraken-spoofing-website-scam"}],"theft":true,"headline":true},{"id":"ht58758679fc","date":"2025-01-06","name":"Mosca","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":37600.0,"lo":19500.0,"hi":37600.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1876156823637770441"}],"desc":"Mosca is an on-chain MLM/membership program where users join by depositing USDT, BUSD, or USDC for internal credits to withdraw later. The exitProgram function had incomplete state resets—only user.balance was zeroed after withdrawal but not user.balanceUSDT and user.balanceUSDC, enabling repeated withdrawals of the same funds from these alternate balance fields.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht3c9ef80a69","date":"2025-01-05","name":"Solv Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SolvProtocol/status/1875890047872053399"}],"desc":"The official X account of Solv Protocol has been compromised. Users are advised not to click on any suspicious links.","theft":true},{"id":"ht38d54655bc","date":"2025-01-04","name":"Sorra Finance","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":41000.0,"lo":41000.0,"hi":41000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/1875582709512188394"}],"desc":"Sorra Finance's staking contract had a critical flaw in the getPendingRewards() function that failed to track and deduct previously claimed rewards. The attacker deposited 122,868 SOR tokens with a 14-day lockup, then repeatedly called withdraw() to claim the same rewards multiple times before the state was updated.","theft":true},{"id":"htbbc5e1a5ae","date":"2025-01-04","name":"98Token","kind":"hack","fam":"other","tech":"Unprotected public function","usd":28000.0,"lo":28000.0,"hi":28000.0,"conf":"C","n":1,"theft":true},{"id":"htdc45908623","date":"2025-01-04","name":"Babylon","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/babylonlabs_io/status/1875614849260253338"}],"desc":"The official X account of the Babylon was compromised, and the hacker used it to post tweets containing phishing links.","theft":true},{"id":"htc7026061ce","date":"2025-01-04","name":"SorStaking","kind":"hack","fam":"code","tech":"Incorrect reward calculation","conf":"C","n":1,"theft":true},{"id":"ht83cd4c043a","date":"2025-01-03","name":"0xScope","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/0xOar/status/1875421459050590449"}],"desc":"lmk.fun (formerly Scopescan) issued an alert on the X platform, warning that the X account of the Web3 knowledge graph protocol 0xScope (@ScopeProtocol) has been hacked. Users are advised not to click on any links or trust any content posted by the account. An investigation and recovery are currently in progress.","theft":true},{"id":"ht7a095dd716","date":"2025-01-03","name":"Centrifuge","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/411298"}],"desc":"The official X account of the RWA lending protocol Centrifuge was compromised, and fake information was posted.","theft":true},{"id":"ht30950ae916","date":"2025-01-02","name":"MoonHacker","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Optimism"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"MoonHacker Vault on Optimism was exploited when an attacker took a flashloan of USDC from Aave, passed a malicious contract as the mToken parameter in the executeOperation function (which lacked validation), gained unauthorized approval to transfer vault USDC, and drained the vault.","theft":true},{"id":"ht0adb980f1c","date":"2025-01-01","name":"NoOnes","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Solana","Tron"],"usd":7900000.0,"lo":7900000.0,"hi":7900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/ray_noOnes/status/1882744360812306885"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/noones-hacked-for-almost-8-million"}],"desc":"NoOnes' Solana cross-chain bridge was exploited via a vulnerability in the relay contract's message processing logic. The attacker crafted malicious bridge messages that bypassed validation, tricking the relayer into authorizing unauthorized withdrawals across multiple blockchains through hundreds of small transactions each under $7,000.","theft":true},{"id":"ht3959cbe85b","date":"2025-01-01","name":"LAURA","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":48200.0,"lo":41200.0,"hi":48200.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/TenArmorAlert/status/1874455664187023752"}],"desc":"LAURA was suspected to have been attacked on ETH, resulting in an approximate loss of $48.2K.","theft":true,"onchain":true},{"id":"ht148ac870d6","date":"2024-12-31","name":"Superchain Eco","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1873937127035330817"}],"desc":"According to monitoring by Scam Sniffer, the X account of Superchain Eco (@SuperchainEco) was compromised and used to post phishing links.","theft":true},{"id":"htc9894112f7","date":"2024-12-29","name":"Fegex","kind":"hack","fam":"bridge","tech":"Cross-Chain Message Spoofing","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Base"],"usd":1070000.0,"lo":1070000.0,"hi":1070000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/feed-every-gorilla-hack-2"}],"desc":"FEG's SmartBridge was drained for ~$1.3M across Ethereum, BSC and Base. The attacker forged Wormhole messages from an unauthorized chain that the relayer accepted as withdrawal requests without verifying the emitter's authority, marking the third major FEG incident.","theft":true},{"id":"htac5d1c78cf","date":"2024-12-29","name":"FEG","kind":"hack","fam":"bridge","tech":"Security Vulnerability","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/FEGtoken/status/1873265905867866294"}],"desc":"The FEG project suffered an attack resulting in a loss of approximately $1 million. Analysis suggests that the root cause of the incident appears to be a composability issue arising from the integration with the underlying Wormhole cross-chain bridge, which facilitates cross-chain message and token transfers.","theft":true},{"id":"ht31f9615d54","date":"2024-12-28","name":"Bizness","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Base"],"usd":15700.0,"lo":15700.0,"hi":15700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Standing on Bizness protocol on Base was exploited via a reentrancy vulnerability in its contract logic. The attacker repeatedly called functions before state was properly updated, enabling them to drain funds through reentrant calls.","theft":true,"onchain":true},{"id":"hte707d13229","date":"2024-12-26","name":"Yat Siu","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/animocabrands/status/1872094029451772161"}],"desc":"Animoca Brands tweeted that @ysiu social media account has been compromised. There is no official token or NFT launch from Animoca Brands. The token launch on Solana as claimed in a post was made by the hacker. Please do not engage with the account and stay vigilant.","theft":true},{"id":"hta7c46e01d1","date":"2024-12-23","name":"Moonhacker","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Optimism"],"usd":320000.0,"lo":320000.0,"hi":320000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Moonhacker contract suffered a flash loan attack, resulting in a loss of approximately $320,000.","theft":true,"onchain":true},{"id":"htc928c85726","date":"2024-12-20","name":"Vivek Ramaswamy","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/j_fishback/status/1869964597957964049"}],"desc":"Regarding rumors about the collaboration between DOGE and USUAL, Azoria CEO James Fishback clarified that he had contacted DOGE's head of department, Vivek Ramaswamy, whose account was compromised.","theft":true},{"id":"ht975b64790c","date":"2024-12-20","name":"zkPass","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1869916249909760339"}],"desc":"According to Scam Sniffer's monitoring, the privacy-preserving data verification protocol zkPass's X account was compromised and used to post phishing tweets.","theft":true},{"id":"hte44576b016","date":"2024-12-18","name":"Two NFT fraudsters charged for rug pulls amounting to over $22 million","kind":"followup","fam":"other","chains":["Ethereum","Solana"],"usd":22400000.0,"lo":22400000.0,"hi":22400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hay-and-mayo-rug-pull-indictment"}],"headline":true},{"id":"ht7069e211bd","date":"2024-12-18","name":"HarryPotterObamaSonic10Inu","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["Ethereum"],"usd":243000.0,"lo":243000.0,"hi":243000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/408096"}],"desc":"A liquidity pool attack on HarryPotterObamaSonic10Inu 2.0 token exploited price manipulation via the pool reserves. The attacker stole 84.7 ETH through manipulation of the pool's price function.","theft":true},{"id":"ht8752e0f007","date":"2024-12-18","name":"SlurpyCoin","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":3000.0,"lo":3000.0,"hi":3000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/408377"}],"desc":"SlurpyCoin was exploited via a flash loan attack that targeted its buyback mechanism. The attacker used sandwiched swaps to manipulate price and profit from the deflationary token's burning logic.","theft":true,"onchain":true},{"id":"htefa7828071","date":"2024-12-18","name":"Anthropic","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/AnthropicAI/status/1869139895400399183"}],"desc":"The official X account of AI startup Anthropic, backed by Amazon, appears to have been compromised, posting an unknown token contract address related to AI Agents.","theft":true},{"id":"ht71819352b1","date":"2024-12-17","name":"Gempad","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum","Base","BNB Chain"],"usd":1900000.0,"lo":1900000.0,"hi":2000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gempad-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/@thegempad/gempad-lockv2-exploit-20eb75930eb8"}],"desc":"On December 17, 2024, GemPad's token launchpad was exploited via reentrancy in the collectFees function across Ethereum, Base, and BNB Chain. Attacker stole $1.9 million from multiple liquidity locker instances using a vulnerable template that 27 projects had deployed.","theft":true},{"id":"hta14664bfcc","date":"2024-12-16","name":"BTC24H","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Polygon"],"usd":85700.0,"lo":85700.0,"hi":85700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BTC24H Lock contract on Polygon was exploited in December 2024 for $85,700. The claim function failed to verify if msg.sender was an eligible claimant, allowing anyone to claim BTC24H tokens without authorization.","theft":true,"onchain":true},{"id":"ht4c17eba1ab","date":"2024-12-15","name":"Decentralized Finance (DCF)","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":8800.0,"lo":8800.0,"hi":8800.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Decentralized Finance (DCF) was attacked on the BSC chain, resulting in a loss of approximately $8,800.","theft":true,"onchain":true},{"id":"ht21f6f8518e","date":"2024-12-15","name":"Drake","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/407375"}],"desc":"Canadian rapper Drake's X account (with over 39 million followers) was allegedly compromised on Saturday evening, promoting a Solana meme coin based on his cartoon \"alter ego\" character. The coin's trading volume reached $5 million at one point, but it was later confirmed to be a scam, and the related posts have been deleted.","theft":true},{"id":"ht1e77abcd73","date":"2024-12-14","name":"JHY Token","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":11200.0,"lo":11000.0,"hi":12000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"JHY Token's TokenDividendTracker contract had a critical flaw where it set user balances to the LP token balance, allowing users to swap more tokens than they owned. This accounting error enabled attackers to drain funds by exploiting the incorrect balance tracking.","theft":true,"onchain":true},{"id":"ht24b82bb028","date":"2024-12-12","name":"Crypto holder loses assets priced at $2.5 million","kind":"hack","fam":"other","chains":["Ethereum","Bitcoin"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-holder-loses-assets-priced-at-2-5-million"}],"theft":true,"headline":true},{"id":"ht3a12041bc3","date":"2024-12-12","name":"BNBS","kind":"hack","fam":"code","tech":"Reentrancy","target":"Token","chains":["BNB Chain"],"usd":20300.0,"lo":20300.0,"hi":20300.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BNBS token on BSC was exploited via a reentrancy vulnerability where the contract failed to update state before transferring funds. The attacker invoked the vulnerable function repeatedly before completion, draining funds from the contract.","theft":true,"onchain":true},{"id":"ht98a63f9db0","date":"2024-12-11","name":"Former pastor charged with crypto scheme in which he stole $5.9 million from his former congregants","kind":"followup","fam":"other","usd":5900000.0,"lo":5900000.0,"hi":5900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cftc-lawsuit-against-francier-obando-pinillo"}],"headline":true},{"id":"ht09b0a120f6","date":"2024-12-10","name":"Alpaca Finance proposes $50,000 restitution for $2.8 million in losses","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":2670000.0,"lo":2670000.0,"hi":2670000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alpaca-finance-oracle-issue"}],"theft":true,"headline":true},{"id":"htc775c777d7","date":"2024-12-10","name":"Clober Liquidity Vault","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":501000.0,"lo":500000.0,"hi":501000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cloberdex-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/CloberDEX/status/1866426442294469033"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/clober-dex-hack"}],"desc":"On December 10, 2024, Clober Liquidity Vault on Base was exploited for ~$501K via reentrancy in the Rebalancer contract's _burn function. The attacker used a malicious contract and 267.4 ETH flashloan to execute repeated state reads before balance updates.","theft":true,"onchain":true},{"id":"ht04fe52ae17","date":"2024-12-10","name":"LABUBU Token","kind":"hack","fam":"code","tech":"Donation Attack","target":"Token","chains":["BNB Chain","Base"],"usd":12000.0,"lo":11900.0,"hi":12000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"LABUBU token's transfer function allowed the same address to be both sender and receiver, enabling balance inflation. The attacker borrowed tokens via a PancakeSwap V3 flash loan, repeatedly executed this flawed transfer to compound their balance, then swapped through multiple chains and mixed the proceeds.","theft":true,"onchain":true},{"id":"ht79db465178","date":"2024-12-10","name":"Haven Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/HavenXHV/status/1866514912362824055"}],"desc":"The algorithmic stablecoin protocol Haven Protocol has issued a warning about a hack exploiting a vulnerability in \"range proof validation.\" This flaw allows attackers to mint illicit XHV undetected. According to reports from exchanges, the amount of XHV exceeds 500 million tokens, while audit data indicates a current supply of only 263 million tokens. The surplus is likely generated through this exploit.\r\nThe team found a weakness in the \"range proof validation\", which was introduced after the Haven 3.2 rebase to Monero and has advised exchanges to halt trading on all pairs.","theft":true},{"id":"hta0dac715b8","date":"2024-12-08","name":"Cardano Foundation","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Cardano/status/1865778999365947698"}],"desc":"The Cardano Community posted on X, stating that the Cardano Foundation's X account has been compromised. They are currently addressing the issue and advised users to temporarily ignore all posts from the account.","theft":true},{"id":"ht2743523db3","date":"2024-12-07","name":"MAAT Protocol","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":168173.0,"lo":168173.0,"hi":240000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/maatprotocol/status/1865092839492759608"}],"desc":"MAAT Protocol's withdrawal logic had a critical edge case where not all shares were burned during withdrawals from the BSC Stargate strategy. This left 1 wei of shares in the contract, allowing third-party addresses to call redeem with minimal share input and drain funds without consuming shares.","theft":true},{"id":"ht4e63ef41f7","date":"2024-12-06","name":"85-year-old painter loses life savings to NFT art dealer scam","kind":"scam","fam":"social","usd":135000.0,"lo":135000.0,"hi":135000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/85-year-old-painter-loses-life-savings-to-nft-art-dealer-scam"}],"theft":true,"headline":true},{"id":"ht60ad443d48","date":"2024-12-06","name":"Arata","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/arataagi/status/1864870322299900188"}],"desc":"Arata tweeted that the Arata ecosystem and CEX wallet have been exploited. The hacker managed to sell a significant portion of the tokens.","theft":true},{"id":"htda5e51e4e1","date":"2024-12-04","name":"Vestra DAO","kind":"hack","fam":"code","tech":"Staking Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Vestra_DAO/status/1864677381459390781"}],"desc":"On December 4, 2024, Vestra DAO's staking contract was exploited less than a month after launch when the unStake() function failed to validate whether a position was still active. The attacker repeatedly extracted rewards from already-unstaked positions, stealing 73.7 million VSTR tokens (~$500K).","theft":true},{"id":"ht0fc17d01dd","date":"2024-12-03","name":"BYC Token","kind":"hack","fam":"code","tech":"Incorrect Fee Accounting","target":"Token","chains":["BNB Chain"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1863774608278929503"}],"desc":"BYC token on BSC was exploited through a vulnerability in its autoBurnLiquidity function. The attacker manipulated the lpBurnFrequency parameter by performing large USDT-for-BYC swaps to inflate the parameter value, then called autoBurnLiquidity to reduce the BYC reserve to 1, enabling drainage of all USDT from the liquidity pool.","theft":true},{"id":"htc97d559211","date":"2024-12-03","name":"Pledge","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2fc5485433","date":"2024-12-02","name":"DeBox","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Ethereum"],"usd":275000.0,"lo":275000.0,"hi":275000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/debox_social/status/1863454873112768864?s=46"}],"desc":"DeBox officially announced that due to the leakage of the private key of an operational account's personal EOA wallet, 31.03 ETH and 4.879 million BOX tokens were stolen.","theft":true},{"id":"ht3cb3a0a4ad","date":"2024-12-02","name":"GAGAW (GAGAW)","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":70000.0,"lo":70000.0,"hi":70000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The GAGAW (GAGAW) on BSC is suspected to have been attacked, resulting in a loss of approximately $70K.","theft":true,"onchain":true},{"id":"ht16d78c0799","date":"2024-12-02","name":"Brett","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Base"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/404460"}],"desc":"According to community feedback, the official X account of the Meme token Brett on the Base chain has reportedly been compromised and used to post false information. Please stay vigilant against related risks.","theft":true},{"id":"htb7fc131954","date":"2024-12-01","name":"Clipper","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Optimism","Base","Ethereum"],"usd":450000.0,"lo":450000.0,"hi":457878.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.clipper.exchange/clipper-dec-24-exploit-post-mortem/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/clipper-dex-hack"}],"desc":"On December 1, 2024, Clipper DEX was exploited for ~$450K via single-asset withdrawal flaw on Optimism and Base. Attacker caused severe pool imbalances and withdrew more than deposited (Optimism: $318K to $23K, Base: $197K to $36K).","theft":true},{"id":"ht067f58c5f4","date":"2024-12-01","name":"Spectral Labs","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Spectral_Labs/status/1863757146543763866"}],"desc":"On December 1, 2024, Spectral Labs' Syntax V2 was exploited for 14,793 SPEC (~$250K) via an unintended infinite ERC-20 approval in AgentToken.sol's tax-calculation path. The attacker used a flashloan and an insufficiently restricted deposit() function to shift token balances and misprice the XYK bonding curve, extracting disproportionate value from the pool.","theft":true},{"id":"htcb1e5fc610","date":"2024-11-28","name":"XT Exchange","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/XTexchange/status/1862072439154569282"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/xtcom-hack"}],"desc":"XT.com lost ~$1.7M on November 28, 2024 when the hot wallet was compromised. Attacker drained twelve token types and swapped to 461.58 ETH. The exchange halted withdrawals and said user funds were covered by 1.5x reserves.","theft":true},{"id":"ht074ddde921","date":"2024-11-26","name":"NFTG","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 26, 2024, the NFTG protocol on BNB Chain suffered an access control vulnerability that allowed unauthorized fund extraction. The vulnerability was in the contract's access controls, permitting unauthorized callers to drain approximately $10K.","theft":true,"onchain":true},{"id":"ht0cdeeaea92","date":"2024-11-25","name":"Pump Science","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/59033"}],"desc":"The DeSci project Pump Science tweeted that the wallet T5j2UB...jjb8sc was exploited due to an oversight in their GitHub repository. The exploiter gained access to the keypair, which had been embedded in the source code of their website.","theft":true},{"id":"ht9722dbc531","date":"2024-11-24","name":"DCF","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":440000.0,"lo":440000.0,"hi":440000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On November 25, DCF on the BNB Chain was attacked, resulting in a loss of approximately $440,000. The root cause of the vulnerability was an error in the logic implemented by the project team in the transfer function of DCF.","theft":true,"onchain":true},{"id":"ht755720609d","date":"2024-11-24","name":"AK1111","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":31500.0,"lo":31500.0,"hi":31500.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On November 23, 2024, the AK1111 contract on BNB Chain was exploited through an access control vulnerability that allowed unauthorized fund extraction of approximately $31.5K.","theft":true,"onchain":true},{"id":"ht414973c63f","date":"2024-11-24","name":"Proxy_b7e1","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":8500.0,"lo":8500.0,"hi":8500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 24, 2024, a proxy-based contract on BNB Chain was exploited via a logic flaw, resulting in approximately $8.5K in losses. The vulnerability was in the contract's logic implementation.","theft":true,"onchain":true},{"id":"ht696aad0cea","date":"2024-11-23","name":"JRNY","kind":"hack","fam":"keys","tech":"Private Key Leakage","usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/402939"}],"desc":"On-chain investigator ZachXBT stated on his personal Telegram channel that the wallet associated with crypto KOL JRNY appears to have been compromised, with approximately $4 million worth of crypto assets transferred and sold. This suggests that the wallet's private key may have been leaked.","theft":true},{"id":"ht76d7e3a3c0","date":"2024-11-22","name":"Matez","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":80000.0,"lo":80000.0,"hi":80000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On November 21, 2024, the Matez protocol on BNB Chain was exploited via an integer truncation vulnerability in its arithmetic operations, resulting in approximately $80K in losses.","theft":true,"onchain":true},{"id":"htfcf3355344","date":"2024-11-22","name":"Sweepr Token (SWEEPR)","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Sweepr Token (SWEEPR) on ETH was suspected to have been attacked, resulting in a loss of approximately $14K.","theft":true,"onchain":true},{"id":"ht7c95f2c7aa","date":"2024-11-20","name":"MainnetSettler","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":66000.0,"lo":66000.0,"hi":66000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 20, 2024, the MainnetSettler contract was exploited through an approval vulnerability that allowed arbitrary calls. Users with Hold token approvals to MainnetSettler had their tokens drained when attackers executed transferFrom calls, resulting in approximately $66K in losses.","theft":true,"onchain":true},{"id":"htaf89c8a834","date":"2024-11-20","name":"13-year-old rug pulls crypto token, then faces retaliation","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/quant-rug-pull"}],"theft":true,"headline":true},{"id":"ht08b5b7340b","date":"2024-11-20","name":"BSCGem (BSCGem)","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":17300.0,"lo":17300.0,"hi":17300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1859263969812443559"}],"desc":"According to monitoring by the SlowMist Security Team, the BSCGem (BSCGem) on BSC is suspected to have been attacked, resulting in a loss of approximately $17.3K.","theft":true},{"id":"ht7016e92f6b","date":"2024-11-18","name":"Tectonic","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Cronos"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Unverified incident claimed for November 18, 2024 on Cronos chain; extensive search found no credible reports, announcements, or news coverage of a Tectonic hack on this date.","theft":true},{"id":"htb429def419","date":"2024-11-17","name":"MFT","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":33700.0,"lo":33700.0,"hi":33700.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On November 17, 2024, the MFT protocol on BNB Chain was exploited via a logic flaw in its contract implementation, resulting in approximately $33.7K in losses.","theft":true,"onchain":true},{"id":"ht65f02103bf","date":"2024-11-16","name":"DEXX","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Wallet","chains":["Solana"],"usd":21000000.0,"lo":21000000.0,"hi":21000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/MistTrack_io/status/1858469058632724493"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dexx-losses"}],"desc":"On November 16, 2024, DEXX memecoin trading terminal suffered a security breach affecting at least 900 users when attackers gained access to private keys and drained wallet contents across Solana. Post-investigation estimates reached $30M, with SlowMist linking 8,620+ wallets to the attacker and one user losing over $1M.","theft":true},{"id":"htf8bf904f74","date":"2024-11-16","name":"Polter Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Fantom"],"usd":10350000.0,"lo":7000000.0,"hi":12000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/polter-finance-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/polterfinance/status/1857971122043551898"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polter-finance-hack"}],"desc":"Polter Finance on Fantom exploited November 16, 2024 via flashloan oracle manipulation. Attacker borrowed ~1.4M BOO from SpookySwap, collapsing the pool and inflating BOO price. With 1 BOO valued at $1.37T by the oracle, attacker extracted massive loans.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htb3217ea664","date":"2024-11-16","name":"Giggle Academy","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/cz_binance/status/1857629129295704410"}],"desc":"Binance co-founder CZ confirmed on X that the official X account of his educational project, Giggle Academy, has been hacked.","theft":true},{"id":"ht4dd47ee21a","date":"2024-11-15","name":"ThalaSwap","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Aptos"],"usd":25500000.0,"lo":25500000.0,"hi":25500000.0,"ret":25200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/thalalabs/status/1857703541089120541?s=46&t=bcMyidYO0QkS5ajIW9CBdg"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thala-hack"}],"desc":"On November 15, 2024, an attacker exploited missing balance validation in Thala's v1 farming contracts to unstake $25.5M in LP tokens without owning them. Thala recovered $25M within 6 hours through white-hat negotiation.","theft":true},{"id":"ht2b528b7d1b","date":"2024-11-15","name":"GMGN","kind":"hack","fam":"other","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/401507"}],"desc":"GMGN stated in the community, \"The GMGN website has suffered a malicious attack, suspected to involve multiple methods, including common crawler attacks and flood attacks. The development team is currently working on emergency repairs, and the token details page, holdings collection feature, and transaction activity records have been restored.\"","theft":true},{"id":"htc9ca573548","date":"2024-11-15","name":"dogwifcoin (WIF)","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/58172"}],"desc":"The X account of the meme project dogwifcoin (WIF) is suspected to have been hacked, posting multiple token contract messages. Users are advised to stay vigilant.","theft":true},{"id":"ht7e9ddb4c44","date":"2024-11-14","name":"vETH","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":447000.0,"lo":447000.0,"hi":450000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1856987988632457708"}],"desc":"On November 14, 2024, vETH on Ethereum was exploited through a vulnerable price dependency mechanism. The protocol's reliance on a manipulable oracle allowed attackers to extract value.","theft":true,"onchain":true},{"id":"ht94969ded85","date":"2024-11-11","name":"DeltaPrime","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Arbitrum","Avalanche","Ethereum"],"usd":4775000.0,"lo":12900.0,"hi":4800000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deltaprime-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1855880812941738311"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/deltaprime-hack-2"}],"desc":"On November 11, 2024, DeltaPrime was exploited across Arbitrum and Avalanche when an attacker created a malicious trading pair, used it to convert borrowed collateral into fake reward tokens, and withdrew them, leaving the protocol with ~$4.8M in uncollateralized bad debt. This was DeltaPrime's second major hack in 2024.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht8e89a76117","date":"2024-11-11","name":"zkFinance","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["zkSync Era"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"No credible sources found documenting a zkFinance hack on November 11, 2024, or proximate dates on zkSync Era.","theft":true},{"id":"hta169af4414","date":"2024-11-10","name":"Trader reveals he lost $28 million to bad copy-paste","kind":"other","fam":"other","chains":["Ethereum"],"usd":28127000.0,"lo":28127000.0,"hi":28127000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/qklpjeth-copypaste"}],"headline":true},{"id":"ht5716b87f18","date":"2024-11-10","name":"BGM","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":450000.0,"lo":450000.0,"hi":450000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On November 10, 2024, BGM token on BNB Chain was exploited via a price manipulation attack. The contract's reliance on spot price allowed the attacker to manipulate the price oracle and extract over $450K.","theft":true,"onchain":true},{"id":"htf3dd11f773","date":"2024-11-09","name":"X319","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":12900.0,"lo":12900.0,"hi":12900.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 9, 2024, the X319 contract on BNB Chain was exploited through an access control vulnerability, resulting in approximately $12.9K in losses.","theft":true},{"id":"ht458bff4660","date":"2024-11-08","name":"CoinPoker","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Gaming","chains":["Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=coinpoker-hack"}],"desc":"On November 8, 2024, CoinPoker's hot wallet was compromised, resulting in the loss of approximately 2000 ETH (~$2M). The attacker performed a series of transactions testing the system before executing 82 transactions within 50 minutes, each under $25K to avoid detection. Funds were laundered through Tornado Cash.","theft":true},{"id":"ht274205d968","date":"2024-11-07","name":"CoW","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":59000.0,"lo":59000.0,"hi":59000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 7, 2024, CoW Protocol on Ethereum was exploited through an access control vulnerability, resulting in approximately $59K in losses.","theft":true,"onchain":true},{"id":"htc205af514c","date":"2024-11-07","name":"ChiSale","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":16300.0,"lo":16300.0,"hi":16300.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 7, 2024, ChiSale on Ethereum was exploited through a logic flaw in its contract implementation, resulting in approximately $16.3K in losses.","theft":true},{"id":"ht8f9b9a4482","date":"2024-11-07","name":"VRug","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"Token","chains":["Ethereum"],"usd":8400.0,"lo":8400.0,"hi":8400.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 7, 2024, VRug executed a rug pull by removing liquidity from its protocol, resulting in approximately $8.4K in losses for users.","theft":true},{"id":"ht05e0742088","date":"2024-11-07","name":"VRug","kind":"hack","fam":"insider","tech":"Rug pull","chains":["Ethereum"],"usd":8400.0,"lo":8400.0,"hi":8400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht11b022899d","date":"2024-11-05","name":"RPP","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":14100.0,"lo":14100.0,"hi":14100.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 5, 2024, RPP protocol on BNB Chain was exploited through a logic flaw, resulting in approximately $14.1K in losses.","theft":true,"onchain":true},{"id":"ht2425707060","date":"2024-11-04","name":"MetaWin","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"Gaming","chains":["Ethereum","Solana"],"usd":4400000.0,"lo":4000000.0,"hi":4400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/398828"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/metawin-casino-hack"}],"desc":"On November 4, 2024, MetaWin casino's hot wallets on Ethereum and Solana were compromised, draining approximately $4.4M. The vulnerability was in the platform's frictionless withdrawal system. The attacker was tracked across 115 addresses and moved stolen funds through KuCoin and HitBTC. MetaWin restored 95% of user withdrawals.","theft":true},{"id":"ht924da90ac1","date":"2024-11-04","name":"Wiz Khalifa","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/398829"}],"desc":"According to on-chain investigator ZachXBT, American rapper Wiz Khalifa's X account was hacked, posting fake announcements about a WIZ token. The hacker responsible is reportedly the same person who compromised Andy Ayrey's (Truth Terminal founder) X account a few days earlier. Please exercise caution and stay aware of potential risks.","theft":true},{"id":"htf0c64b758d","date":"2024-10-31","name":"M2 Exchange","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","Solana","Bitcoin"],"usd":13700000.0,"lo":13700000.0,"hi":13700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/m2-exchange-rekt"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/398576"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/m2-hack"}],"desc":"On October 31, 2024, M2 Exchange's hot wallets were compromised via an access control vulnerability across multiple blockchains, draining 3.7M USDT, 97M SHIB, 1,378 ETH (~$13.7M total). The exchange detected and froze assets within 16 minutes, restoring customer funds from reserves.","theft":true},{"id":"htde96e59cab","date":"2024-10-31","name":"1inch Swap","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"DeFi Protocol","chains":["Avalanche"],"usd":723000.0,"lo":723000.0,"hi":723000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lottiefiles-exploit"}],"desc":"On October 30, 2024, attackers phished a LottieFiles npm account and published malicious lottie-player versions that injected an Ace Drainer wallet-connect prompt into every downstream site, including the 1inch web dApp. The 1inch frontend lacked npm package pinning or integrity checks, leaving it vulnerable to upstream compromise. One user lost 10 wrapped BTC ($723K) from an Avalanche wallet; only the web frontend was affected.","theft":true},{"id":"ht9ce0eac01e","date":"2024-10-31","name":"Lottie Player","kind":"hack","fam":"keys","tech":"Supply Chain Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1851781579141714376"}],"desc":"According to monitoring by Scam Sniffer, Lottie Player suffered a supply chain attack, impacting projects such as 1inch and Movement.","theft":true},{"id":"ht2929a0a2fd","date":"2024-10-30","name":"SUNRAY FINANCE","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":2855000.0,"lo":2855000.0,"hi":3260000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/9crsujac.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sunray-finance-hack"}],"desc":"On October 30, 2024, SUNRAY FINANCE on Arbitrum was attacked when a private key was compromised, enabling malicious contract upgrade and 200 trillion SUN token mint. Attacker swapped ~$2.1M for USDC, collapsing SUN to zero.","theft":true},{"id":"ht5c523eed3a","date":"2024-10-30","name":"Shoebill Finance","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["BOB"],"usd":1520000.0,"lo":1520000.0,"hi":1520000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@shoebill.finance/shoebill-finance-incident-report-btc-market-on-bob-chain-8b5b487eed7c"}],"desc":"On October 30, 2024, Shoebill Finance on BOB Chain was exploited via an oracle misconfiguration during the integration of new solvBTC assets. The vulnerability created an exploitable condition where attackers could borrow funds with minimal collateral. The attacker transferred 19.512 wBTC and 1.597 tBTC across multiple bridges.","theft":true},{"id":"ht9869aac72e","date":"2024-10-30","name":"Keystone","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1851427481464848699"}],"desc":"The official X account of the hardware wallet Keystone is suspected to have been hacked. Users are advised to remain vigilant and be cautious of potential risks.","theft":true},{"id":"ht053de4792e","date":"2024-10-29","name":"BUBAI","kind":"hack","fam":"insider","tech":"Liquidity Rug","target":"Token","chains":["Ethereum"],"usd":131000.0,"lo":131000.0,"hi":131000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 29, 2024, BUBAI token on Ethereum executed a rug pull by removing liquidity, resulting in approximately $131K in losses for users.","theft":true},{"id":"ht11ae973941","date":"2024-10-29","name":"Andy Ayrey","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1qnod0mi.html"}],"desc":"Andy Ayrey, founder of the AI bot project Truth Terminal, announced the launch of a new token IB on X. It is suspected that his account may have been hacked.","theft":true},{"id":"htda9431af4d","date":"2024-10-26","name":"Essence Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/397449"}],"desc":"Scroll ecosystem stablecoin project Essence Finance is suspected of rugpulled, its stablecoin CHI has fallen by more than 92% to $0.077 in the past 24h, more than $20 million of collateral is suspected to have been removed.","theft":true},{"id":"hte7c3cbb6c7","date":"2024-10-25","name":"AARK (Aark Digital)","kind":"hack","fam":"code","tech":"Decimal Miscalculation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://aarkdigital.medium.com/incident-of-october-25th-d074f32d6535"}],"desc":"On October 25, 2024, AARK (a perpetual DEX on Arbitrum) suffered a $1.9M exploit through a conversion-script decimal inflation vulnerability in its vault contracts. The protocol offered a 15% bounty for the return of stolen funds.","theft":true},{"id":"htfba2d52f5c","date":"2024-10-24","name":"US Government Crypto Wallet","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Other","chains":["Ethereum"],"usd":20000000.0,"lo":20000000.0,"hi":20500000.0,"ret":19300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/MistTrack_io/status/1849663895545462919"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/possible-us-government-theft"}],"desc":"A dormant US government wallet holding $20M from 2016 Bitfinex seizures had its private key compromised on October 24, 2024. Attacker drained $20M in ETH, USDC, aUSDC and USDT, but $19.3M was recovered within 24 hours; ~$700K went to instant exchanges.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht4f2838f296","date":"2024-10-24","name":"Base Lending","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Base"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On October 25, 2024, an unverified Compound Fork lending protocol on Base Chain was exploited via a deposit logic flaw, resulting in approximately $1M in losses. The vulnerability was in the improper implementation of deposit verification logic.","theft":true,"onchain":true},{"id":"htebdc052122","date":"2024-10-24","name":"Cryptobottle","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["Polygon"],"usd":490000.0,"lo":490000.0,"hi":527000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Cryptobottle's swap contract was exploited by disabling balance checks after callback, allowing arbitrary swaps that manipulated NAS token price and drained $490K in USDT to the attacker's address.","theft":true,"onchain":true},{"id":"ht7d9ffd2693","date":"2024-10-24","name":"Ramses Exchange","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":93000.0,"lo":93000.0,"hi":93000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Ramses' reward distribution mechanism failed to decrease tokenTotalSupplyByPeriod after reward claims, allowing attackers to claim rewards repeatedly across multiple NFT positions and drain accumulated incentives and fees.","theft":true,"onchain":true},{"id":"ht669c9399aa","date":"2024-10-23","name":"SHARPEI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":3400000.0,"lo":3400000.0,"hi":3400000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=sharpei-memecoin-rug-pull"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sharpei-memecoin-rug-pull"}],"desc":"A dog-themed memecoin project called SHARPEI abruptly cashed out $3.4 million, tanking the token price by more than 96% in seconds. The project had been promoted by crypto influencers, but hit a snag when a pitch deck for the project leaked. The deck contained multiple lies, including claims to have hired multiple \"KOLs\" who later denied involvement, and false claims of partnerships with various platforms and projects. As the token price stuttered along with these revelations, insiders apparently decided to quit while they were ahead, and cashed out in a quick and coordinated sale.","theft":true},{"id":"ht9f67757bb9","date":"2024-10-22","name":"Vista Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":28000.0,"lo":28000.0,"hi":28000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Vista Finance's integration of ERC20FlashMint with staking logic failed to properly distinguish staked from free balances, allowing flashMint to incorrectly calculate available free balance for loans despite tokens being staked.","theft":true},{"id":"ht7876a161db","date":"2024-10-22","name":"Erc20transfer","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["Ethereum"],"usd":14800.0,"lo":14773.35,"hi":14800.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An unverified Ethereum contract intended as an ERC20 transfer utility lacked access control in its erc20TransferFrom function, allowing anyone to transfer tokens from users who had granted approval, draining USDC across multiple victims.","theft":true,"onchain":true},{"id":"ht16cb63104d","date":"2024-10-21","name":"MuratiAI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1848163217643852104"}],"desc":"The X account of MuratiAI (@MuratiAI), an AI network and bot platform centered around anime, is suspected to have been hacked, with phishing links being posted. Until further notice, please refrain from clicking any links or responding to any messages.","theft":true},{"id":"htb3930a7a19","date":"2024-10-21","name":"Transak","kind":"hack","fam":"keys","tech":"Malware Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://transak.com/blog/transak-security-incident-oct-2024"}],"desc":"According to on-chain investigator ZachXBT, the crypto payment service provider Transak recently fell victim to a ransomware attack. Transak reported that the incident occurred when an attacker accessed an employee's laptop without authorization through a sophisticated phishing attack. The attacker used the stolen credentials to log into the system of a third-party KYC vendor used for document scanning and verification services. As a result, the attacker gained access to specific user information stored in the vendor’s dashboard.","theft":true},{"id":"ht416bc6d61e","date":"2024-10-18","name":"IBXtrade","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":21800000.0,"lo":21800000.0,"hi":21800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/u9e4t5ur.html"}],"desc":"DeFi analyst Anon Vee posted on X that several users have reported that the Orderly Network ecosystem project IBXtrade is suspected of a rug pull. It is reported that IBXtrade launched a pre-sale three days ago with a target to raise 2,000 SOL (approximately $3.2 million) and refund any unselected participants. The pre-sale ended up raising over 160,000 SOL (about $24 million), with participants originally expecting the project to return $21.8 million. However, instead of issuing refunds, the IBXtrade team created a poll on a website entirely under their control, asking whether the pre-sale cap should be raised. The poll eventually passed, and IBXtrade claimed to have refunded 65,000 SOL ($9.7 million) to participants. In reality, the team simply transferred these SOL to multiple addresses they created, and users reported not receiving any refunds.","theft":true},{"id":"ht40618b6e0b","date":"2024-10-18","name":"Tapioca DAO","kind":"hack","fam":"social","tech":"Impersonation Scam","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":4700000.0,"lo":4400000.0,"hi":4700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tapioca-dao-rekt"},{"s":"SlowMist Hacked","u":"https://mirror.xyz/tapiocada0.eth/RVcRuKmJAavD05ObYsyYOHLDJ4gkEZKwyY_Y0Gx6gNc"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tapioca-dao-exploit"}],"desc":"Tapioca DAO co-founder was compromised on October 18, 2024 via social engineering and malware download. Attacker gained control of TAP vesting contracts and drained stablecoin pools for $4.4M in USDC and ETH.","theft":true},{"id":"htb8dcdf3458","date":"2024-10-18","name":"Eigenlayer","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/396129"}],"desc":"The official X account of Eigenlayer, the Ethereum re-staking protocol, is suspected to have been hacked. The hacker has posted a fake phishing link; please do not interact with it.","theft":true},{"id":"ht51d32c63d4","date":"2024-10-17","name":"Ambient","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/8euzht4y.html"}],"desc":"On October 17, 2024, Ambient Finance frontend domain was hijacked via compromised registrar credentials and redirected to malicious site. Users were tricked into approving token transfers via the fake site. Ambient recovered the domain and reimbursed affected users; smart contracts remained unaffected.","theft":true},{"id":"ht505f1626c4","date":"2024-10-17","name":"Kabosumama","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/mjgi4ktb.html"}],"desc":"According to AggrNews, the Instagram account of Kabosumama, the owner of the Shiba Inu Kabosu, the inspiration behind the popular DOG project \"Doge\" meme, has been hacked. Kabosumama previously posted on her blog, stating that she was unable to log in. Additionally, BWEnews reported that the hacker is particularly cunning, having posted a fake update about a new family member. The hacker launched a memecoin ahead of time, luring victims into investing, only to pull out and run with the funds shortly after.","theft":true},{"id":"htb5c55e3556","date":"2024-10-17","name":"Lagrange","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1846787087330431236"}],"desc":"ZK startup Lagrange's X account has been allegedly compromised, and a scam link related to the LGR token has been posted. Please stay vigilant and be cautious of potential risks.","theft":true},{"id":"ht6e08247576","date":"2024-10-16","name":"Radiant V2","kind":"hack","fam":"social","tech":"Blind Signing","target":"DeFi Protocol","chains":["BNB Chain","Arbitrum","Ethereum"],"usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/radiant-capital-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/RDNTCapital/status/1846634050100039881"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/radiant-capital-hack-2"}],"desc":"On 16 October 2024 attackers compromised three Radiant core contributors' devices with the INLETDRIFT macOS backdoor (delivered via Telegram impersonation of a former contractor) and manipulated the Safe{Wallet} front-end so signers saw legitimate data while signing malicious transactions, taking ownership of and draining Radiant lending markets on BSC and Arbitrum. Mandiant attributed the attack to DPRK-nexus actors.","theft":true},{"id":"hte608ee29ca","date":"2024-10-14","name":"Kalax","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Blast"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 14, 2024, Kalax founders executed a $350K rugpull by suddenly draining vaults, deleting the website and social accounts, and abandoning the protocol.","theft":true},{"id":"ht1b8d26acc9","date":"2024-10-14","name":"Zulu Network","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1845630285758746914"}],"desc":"The official X account of Bitcoin L2 Zulu Network appears to have been compromised. The hacker has posted a fake phishing link. Please avoid interacting with it.","theft":true},{"id":"ht02b7b7963b","date":"2024-10-13","name":"Permit phisher steals almost $1.4 million in frog tokens","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1390000.0,"lo":1390000.0,"hi":1390000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pepe-token-permit-phishing"}],"theft":true,"headline":true},{"id":"hted318b9458","date":"2024-10-13","name":"MorphoBlue","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":250000.0,"lo":230000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Morpho Blue PAXG/USDC market October 13-14, 2024 misconfigured oracle SCALE_FACTOR to value gold at 10^12x. Attacker deposited $350 in PAXG and withdrew ~$250K via decimal mismatch (USDC 6 vs PAXG 18 decimals).","theft":true,"onchain":true},{"id":"ht88af38ebe2","date":"2024-10-12","name":"KOR Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/realScamSniffer/status/1844965791432892619"}],"desc":"The official X account of the decentralized intellectual property (IP) platform KOR Protocol appears to have been compromised. The hacker has posted a fake phishing link. Please avoid interacting with it.","theft":true},{"id":"ht114d2adca2","date":"2024-10-11","name":"Ordinals Wallet","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/394907"}],"desc":"According to monitoring by Scam Sniffer, the X account of Ordinals Wallet was hacked, and a phishing link was posted. Upon review, the related post has already been deleted.","theft":true},{"id":"ht99cce03945","date":"2024-10-11","name":"SPX6900","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/394977"}],"desc":"According to meme coin KOL Murad (@MustStopMurad), the official X account of SPX6900 (SPX) has been hacked. Users are advised not to click any links.","theft":true},{"id":"ht21ab4081f3","date":"2024-10-11","name":"P719Token","kind":"hack","fam":"market","tech":"Price Manipulation Inflate Attack","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf8615753f7","date":"2024-10-10","name":"HYDT","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":58000.0,"lo":58000.0,"hi":58000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A suspicious attack involving HYDT tokens has occurred on BSC, resulting in a loss of approximately $58,000.","theft":true,"onchain":true},{"id":"htaa865495cf","date":"2024-10-06","name":"Spot On Chain","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/il21k5i9.html"}],"desc":"The X account of the crypto data tracking service Spot On Chain has reportedly been compromised. It was said to have posted a fake EIGEN airdrop phishing link this morning, while also disabling the comment section for the tweet. Users are advised to be cautious and avoid interacting with the link.","theft":true},{"id":"htc82a65e21d","date":"2024-10-06","name":"SASHAToken","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht5bd46a422b","date":"2024-10-05","name":"EigenLayer","kind":"hack","fam":"social","tech":"Impersonation Scam","target":"DeFi Protocol","chains":["Ethereum"],"usd":5700000.0,"lo":3100000.0,"hi":5700000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/eigenlayer/status/1842317191045157099"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/eigen-token-theft"}],"desc":"Attackers gained access to email communications about investor token custody, then impersonated the legitimate party to direct EigenLayer team to send 1.67M EIGEN tokens to an attacker-controlled address. The tokens were swapped and moved to CEXs.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht3814bc9e59","date":"2024-10-05","name":"LEGO Group","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/lego-removes-crypto-token-scam-from-homepage"}],"desc":"According to a report by Cointelegraph, the homepage of toy manufacturer LEGO Group was hacked on October 5th local time, briefly displaying a \"LEGO Coin\" token scam. The fraudulent token was present on the LEGO Group's website for approximately 75 minutes before being removed."},{"id":"ht31360fdfce","date":"2024-10-05","name":"Symbiotic","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1842362952525164812"}],"desc":"The official X account of the staking protocol Symbiotic has been suspected of being hacked. The hacker has already posted a fake phishing link. Please do not interact with it.","theft":true},{"id":"ht8e6ee1d258","date":"2024-10-05","name":"AIZPTToken","kind":"hack","fam":"code","tech":"Wrong Price Calculation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0ffe756546","date":"2024-10-02","name":"LavaLending","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Arbitrum"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta16b4577f7","date":"2024-10-01","name":"FireToken","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["Ethereum"],"usd":20000.0,"lo":20000.0,"hi":24000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"FireToken's transfer function automatically burned tokens sent to Uniswap pools and immediately updated reserve balances, allowing attackers to artificially inflate ETH price by reducing FireToken reserves, then repeatedly swapped FireTokens for overpriced ETH.","theft":true,"onchain":true},{"id":"htbf5da0bb91","date":"2024-09-28","name":"Victim loses over $32 million to wallet drainer","kind":"hack","fam":"other","usd":32000000.0,"lo":32000000.0,"hi":32000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/victim-loses-over-32-million-to-wallet-drainer"}],"theft":true,"headline":true},{"id":"ht796b9b603b","date":"2024-09-26","name":"Onyx V2","kind":"hack","fam":"code","tech":"Liquidation Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":3800000.0,"lo":3800000.0,"hi":3800000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/onyx-protocol-rekt2"},{"s":"SlowMist Hacked","u":"https://x.com/OnyxDAO/status/1839444120060023167"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/onyx-hack-2"}],"desc":"On September 26, 2024, Onyx Protocol (Compound v2 fork) was exploited for $3.8M via decimal precision vulnerability in its low-liquidity VUSD market. Attackers used a Balancer flashloan to manipulate exchange rates by minting and redeeming oETH, then exploited missing validation in the NFTLiquidation contract to drain value through self-liquidation rewards.","theft":true,"onchain":true},{"id":"htd8213b6fb9","date":"2024-09-26","name":"Bedrock","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Ethereum","Bitcoin"],"usd":2000000.0,"lo":1700000.0,"hi":2000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bedrock-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Bedrock_DeFi/status/1839479965685100780"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bedrock-bug"}],"desc":"On September 26, 2024, a former employee planted malware in Bedrock's Cargo.toml file, providing persistent access for three weeks through IDE execution. The attacker then exploited a flaw in the uniBTC minting mechanism that allowed arbitrary minting against ETH, draining $1.7M-$2M from the liquidity pool.","theft":true,"onchain":true},{"id":"htdc64d2d212","date":"2024-09-26","name":"ReHold","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/rehold_io/status/1839070595289329814"}],"desc":"ReHold's CEO and co-founder Renat Gafarov unilaterally withdrew $700K in net profits and initial capital from the protocol's smart contracts without approval from his co-founder, then seized control of company infrastructure and domain access.","theft":true},{"id":"ht3ddb6bbe6b","date":"2024-09-25","name":"Truflation","kind":"hack","fam":"social","tech":"Malware","target":"Other","chains":["Ethereum"],"usd":5200000.0,"lo":5000000.0,"hi":5600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/truflation/status/1839043719124889963"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/truflation-hack"}],"desc":"Malware exfiltrated private keys from Truflation's operational systems, enabling attacker to drain treasury and personal wallets across Ethereum and seven other blockchains for $3.89M in TRUF tokens, $1.07M ETH, and $236K DAI from multisig and personal accounts.","theft":true},{"id":"htb3cc12ee33","date":"2024-09-24","name":"MARA---price-manipulation","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":5300.0,"lo":5300.0,"hi":5300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht57a9d0f450","date":"2024-09-24","name":"ether.fi","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://etherfi.gitbook.io/etherfi/security/sep-24-incident-attempted-domain-account-takeover"}],"desc":"On September 24, ether.fi experienced a security incident involving its domain registrar, Gandi.net, resulting in the compromise of the ether[.]fi domain.","theft":true},{"id":"ht6caf9d075a","date":"2024-09-23","name":"PestoToken","kind":"hack","fam":"market","tech":"Price Manipulation","conf":"C","n":1,"theft":true},{"id":"ht2c3a7c1977","date":"2024-09-22","name":"Bankroll Network","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":234800.0,"lo":230000.0,"hi":234800.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Bankroll Network's token sale contract lacked validation on the _customerAddress parameter, allowing attackers to manipulate profitPerShare_ calculations and extract dividends without sending WBNB tokens.","theft":true,"onchain":true},{"id":"ht0ff2da7220","date":"2024-09-21","name":"Immutable","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Immutable/status/1838169450387996865"}],"desc":"The Immutable Discord server was compromised. According to an official tweet from Immutable, a community support contractor’s Discord was compromised, leading to a phishing link being posted.","theft":true},{"id":"ht4a0d6bc523","date":"2024-09-20","name":"BingX","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":45000000.0,"lo":43300000.0,"hi":52000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bingx-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Vivien_BingX/status/1836940851873992845"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bingx-hack"}],"desc":"On September 20, 2024 (4:00 AM Singapore time), BingX hot wallets were compromised via access control bypass, draining ~$43M in two separate transactions: $26M + $16.5M. Assets stolen included 13.25M ETH, 2.3M BNB, 4.4M USDT, and 360+ altcoin types. BingX promised reimbursement from reserves.","theft":true},{"id":"ht9326d644b3","date":"2024-09-20","name":"OcelotDex","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":4900000.0,"lo":4900000.0,"hi":4900000.0,"ret":3920000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/shezmu-rekt"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=shezmu-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/shezmu-hack"}],"desc":"On September 20, 2024 OcelotDex (a DEX gateway on Zetachain) suffered an infinite mint exploit draining $4.9 million when attackers exploited a vulnerability in the smart contract minting functionality that failed to enforce supply caps, creating unbounded tokens to flood the market and exchange for stable assets.","theft":true,"onchain":true},{"id":"ht94be49cea7","date":"2024-09-20","name":"OcelotDex","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":980000.0,"lo":980000.0,"hi":980000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Shezmu's vault contract vulnerability allowed unauthorized minting of ShezUSD stablecoin without collateral, bypassing required checks and enabling attackers to mint unlimited ShezUSD and borrow assets to drain $4.9M. After negotiation, 80% was recovered.","theft":true,"review":["possible duplicate within one source"]},{"id":"htca6c6b82df","date":"2024-09-20","name":"DOGGO","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"Token","chains":["Ethereum"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DOGGO had a business logic flaw in its withdrawal mechanism where an incorrect formula or missing state update allowed attackers to withdraw more funds than their actual share of the contract.","theft":true},{"id":"ht93aaa274bd","date":"2024-09-20","name":"Compound","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/compoundfinance/status/1837515311983006144"}],"desc":"Compound community’s Discord server has been hacked. Please do not click on any links until the situation is resolved.","theft":true},{"id":"ht82097c3812","date":"2024-09-20","name":"Masa","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zachxbt/status/1847261562039316877"}],"desc":"According to on-chain investigator ZachXBT on the X platform, the decentralized AI data network Masa suffered a hack on September 20, incurring losses exceeding six figures in USD. However, Masa did not disclose this hack to the community.","theft":true},{"id":"hte626acc38f","date":"2024-09-19","name":"Arrests made after $243 million stolen from one individual in Gemini phishing attack","kind":"followup","fam":"other","chains":["Bitcoin"],"usd":243000000.0,"lo":243000000.0,"hi":243000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gemini-phishing-attack"}],"headline":true},{"id":"htbc02ad6111","date":"2024-09-19","name":"Banana Gun","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Ethereum","Solana"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"ret":3000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bananagun-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/BananaGunBot/status/1838660010387116484"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/banana-gun-exploit"}],"desc":"On September 19, 2024, Banana Gun's Telegram message oracle validation failure allowed attackers to forge transfer authorizations and drain $3M from 11 users' wallets. All users were reimbursed from the treasury.","theft":true,"review":["possible duplicate within one source"]},{"id":"htab30895bd3","date":"2024-09-19","name":"DIN","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/din_lol_/status/1837113472968184298"}],"desc":"The official X account of AI Modular Data Preprocessing Layer DIN was hacked, and a large number of phishing posts and links were sent.","theft":true},{"id":"hta9c9be02db","date":"2024-09-19","name":"Decentraland","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/decentraland/status/1836887442986537268"}],"desc":"The official X account of the metaverse project Decentraland has been hacked. The hacker has posted a fake phishing link. Please avoid interacting with it.","theft":true},{"id":"htc182db8060","date":"2024-09-19","name":"Ethena Labs","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/ethena_labs/status/1836450334329155787"}],"desc":"Ethena Labs posted on X platform that their Ethena domain registrar account was recently compromised. They have taken measures to disable the website until further notice. The protocol is not affected, and funds are secure. Please do not interact with any sites or applications claiming to be the Ethena frontend.","theft":true},{"id":"htbc7286cddd","date":"2024-09-18","name":"Unverified_766a","kind":"hack","fam":"code","tech":"Access control","chains":["BNB Chain"],"usd":100.0,"lo":100.0,"hi":100.0,"conf":"C","n":1,"theft":true},{"id":"ht92d1e34b2f","date":"2024-09-16","name":"DeltaPrime","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":5980000.0,"lo":5980000.0,"hi":6000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deltaprime-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/DeltaPrimeDefi/status/1835603279369125893"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/delta-prime-exploit"}],"desc":"DeltaPrime suffered a $5.98M exploit on September 16, 2024 when an attacker compromised the ProxyAdmin private key (not multi-sig protected). The attacker used it to upgrade liquidity pool proxy contracts to malicious implementations that allowed unlimited minting of deposit receipt tokens and systematic draining of USDC, WBTC, and WETH pools.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht60c825715b","date":"2024-09-16","name":"Rivus DAO","kind":"rugpull","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Rivus DAO's Bittensor liquid-staking protocol was drained when a contracted developer inserted a backdoor in the migration contract. The team recovered funds using the developer's identity documents. Rivus relaunched on October 1, 2024.","theft":true},{"id":"ht26fcc4e1e8","date":"2024-09-15","name":"WXETA","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On September 16, 2024, an attacker reinitialized the WXETA contract through its unguarded initialize function, granted themselves minting permissions, and drained USDT/WXETA liquidity pools for $110,000.","theft":true,"onchain":true},{"id":"ht4528abce69","date":"2024-09-13","name":"BaseBros Fi","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Base"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/basebros-fi-defi-rug-pull-smart-contract-base"}],"desc":"The yield-optimizing DeFi protocol BaseBros Fi has vanished after executing a rug pull via an unaudited smart contract.","theft":true},{"id":"htcd52153677","date":"2024-09-13","name":"OTSeaStaking","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":26000.0,"lo":26000.0,"hi":26000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"OTSea's staking contract had a logical defect in reward calculation and state tracking that allowed attackers to manipulate reward variables and continuously withdraw staking rewards beyond their actual stake.","theft":true},{"id":"htbfbb7550a4","date":"2024-09-13","name":"Unverified_5697","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht8d238d0e14","date":"2024-09-12","name":"Unverified_03f9","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3aa7d35bde","date":"2024-09-11","name":"CryptoPunk sells for a fraction of its likely market price due to zombie smart contract","kind":"other","fam":"other","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cryptopunk-niftex-sale"}],"headline":true},{"id":"htb468c92fa4","date":"2024-09-11","name":"Omnipus","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Omnipus_X/status/1833840674602446993"}],"desc":"On September 11, 2024, Omnipus presale contracts were exploited for approximately $30,000 when a commented-out check in OAppSender.sol's payNative() function allowed attackers to bypass validation. The contract mistakenly refunded ETH to attackers who claimed overpayment, enabling unauthorized fund extraction.","theft":true},{"id":"htb304db45a5","date":"2024-09-11","name":"INUMI","kind":"hack","fam":"code","tech":"Access control","usd":11700.0,"lo":11700.0,"hi":11700.0,"conf":"C","n":1,"theft":true},{"id":"ht5df4523a90","date":"2024-09-11","name":"AIRBTC_exp","kind":"hack","fam":"code","tech":"Access control","usd":6800.0,"lo":6800.0,"hi":6800.0,"conf":"C","n":1,"theft":true},{"id":"ht3ab9014106","date":"2024-09-11","name":"INUMI_db27","kind":"hack","fam":"code","tech":"Access control","usd":4700.0,"lo":4700.0,"hi":4700.0,"conf":"C","n":1,"theft":true},{"id":"ht59b1c258c5","date":"2024-09-10","name":"Indodax","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Polygon","Optimism"],"usd":22000000.0,"lo":22000000.0,"hi":25200000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/indodax-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1833757841880158673"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/indodax-hack"}],"desc":"On September 10, 2024, Indodax Indonesian crypto exchange suffered a $25.47 million hack affecting its hot wallet. Attackers obtained approximately 5,204 ETH ($12.37M) along with Polygon, Tron, Bitcoin and various ERC-20 tokens without compromising private keys, suggesting the breach involved the withdrawal protocol itself.","theft":true},{"id":"htf7ca080942","date":"2024-09-10","name":"Caterpillar Coin","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":1400000.0,"lo":1400000.0,"hi":1448974.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cut-token-exploit"}],"desc":"On September 10, 2024, the CUT token on BSC was exploited via a flashloan attack that manipulated its price on PancakeSwap. The attacker used flash-loaned USDT to repeatedly add and remove liquidity, earning rewards based on inflated CUT prices, then drained the pair for approximately $1.4M with 99% slippage.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htbd2f8a9842","date":"2024-09-08","name":"Jules Urbach","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/rendernetwork/status/1832558436598595612"}],"desc":"The Render Network posted on X, stating that the X account of its founder and CEO, Jules Urbach, was hacked and used to post fake airdrop information. Please do not click any links from the account, and carefully verify all information through official sources.","theft":true},{"id":"ht44518becfa","date":"2024-09-06","name":"Fuel","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/fuel_network/status/1831828663677153454"}],"desc":"The Ethereum modular execution layer Fuel posted on X, stating that their official Discord had been attacked. Users are advised not to click on any suspicious links or provide any personal information.","theft":true},{"id":"ht62c8790a26","date":"2024-09-05","name":"PLN","kind":"hack","fam":"code","tech":"Access control","usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"C","n":1,"theft":true},{"id":"ht4df6040b62","date":"2024-09-05","name":"HANAToken","kind":"hack","fam":"market","tech":"Price Manipulation","usd":283.0,"lo":283.0,"hi":283.0,"conf":"C","n":1,"theft":true},{"id":"htd7c51251ac","date":"2024-09-05","name":"Jaylen Brown","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/389177"}],"desc":"NBA star Jaylen Brown's X account was hacked, and a large amount of fake token information was posted. Users are advised to be cautious and avoid interacting with fraudulent contracts."},{"id":"htca30f9852b","date":"2024-09-05","name":"NEAR Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/NEARProtocol/status/1831457196531745013"}],"desc":"NEAR's official account posted on X, stating that the official X account of NEAR Protocol had been hijacked. The hacker posted a series of messages attacking the Crypto ecosystem.","theft":true},{"id":"ht97812d4c44","date":"2024-09-05","name":"Unverified_a89f","kind":"hack","fam":"code","tech":"Access control","conf":"C","n":1,"theft":true},{"id":"htc36a4250cf","date":"2024-09-04","name":"Unverified_16d0","kind":"hack","fam":"code","tech":"Access control","usd":329.0,"lo":329.0,"hi":329.0,"conf":"C","n":1,"theft":true},{"id":"htc306d64cbb","date":"2024-09-03","name":"Penpie","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":27348259.0,"lo":27000000.0,"hi":27348259.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/penpie-rekt"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/388884"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/penpie-hacked-for-27-3-million"}],"desc":"Penpie was drained of ~$27M via a reentrancy attack. The attacker created malicious SY tokens mimicking Pendle yield tokens and exploited missing reentrancy protection in _harvestBatchMarketRewards() to claim real rewards using fake token tickets.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht6f198942cc","date":"2024-09-03","name":"Trump family Twitter accounts compromised ahead of World Liberty Financial launch","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trump-family-twitter-accounts-compromised"}],"theft":true,"headline":true},{"id":"htb46268ce51","date":"2024-09-03","name":"Pythia","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":53000.0,"lo":53000.0,"hi":53000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/pythiafinance/status/1830937365918969929"}],"desc":"On September 2, 2024, Pythia Finance's algorithmic stablecoin protocol was exploited for approximately $53,000 via a reentrancy vulnerability in the claim rewards function. The attacker repeatedly called the function without allowing reward balances to update between calls, extracting unauthorized rewards.","theft":true,"onchain":true},{"id":"htf292972100","date":"2024-09-03","name":"ChainLink","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/PANewsCN/status/1830892629678264341"}],"desc":"The official ChainLink Discord has been hacked. Please do not click on any links until the situation is resolved.","theft":true},{"id":"ht4ff545effc","date":"2024-09-03","name":"Sei","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/flash/262058"}],"desc":"Sei's official Discord has been suspected of being hacked. The hacker has posted a fake phishing link. Please do not interact with it.","theft":true},{"id":"hte611836093","date":"2024-08-31","name":"Usual","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/usualmoney/status/1829721164714828073"}],"desc":"The stablecoin protocol Usual posted on X to alert users that its official Discord server has been hacked. Please do not click on any links.","theft":true},{"id":"ht3878e1b029","date":"2024-08-30","name":"Powerledger","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/PowerLedger_io/status/1829490017687011349"}],"desc":"Australian blockchain energy technology company Powerledger posted on X that its Telegram channel has been hacked. They advise users not to engage with or share any information as they are currently working to resolve the issue.","theft":true},{"id":"htf7bdf61a0d","date":"2024-08-30","name":"Witness Chain","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Shankusu993/status/1829437785750831278"}],"desc":"The official Witness Chain Discord has been hacked. Please do not click on any links until the situation is resolved.","theft":true},{"id":"ht0c6be317d8","date":"2024-08-29","name":"Kylian Mbappe","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/49mf2hb2.html"}],"desc":"French football star Kylian Mbappe's X account was hacked, and a token called MBAPPE was posted. The tweet has since been deleted. The MBAPPE token's market value skyrocketed to tens of millions of dollars within minutes, only to quickly plummet to zero.","theft":true},{"id":"ht63db59aecf","date":"2024-08-29","name":"Orderly Network","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/OrderlyNetwork/status/1829177473902465446"}],"desc":"According to an official tweet from Web3 liquidity provider Orderly Network, their Discord server has been compromised. The official team advises users not to click on any links until the situation is fully resolved to avoid potential losses.","theft":true},{"id":"ht0292d1ab25","date":"2024-08-29","name":"io.net","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/shadid_io/status/1829024547900924118"}],"desc":"Ahmad Shadid, former CEO of the decentralized GPU network io.net, posted on X that the official io.net Discord has been hacked. He has informed the IO team and advised not to click on any shared links.","theft":true},{"id":"htee2aaec489","date":"2024-08-28","name":"Aave","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum","Polygon","Avalanche"],"usd":56000.0,"lo":56000.0,"hi":56000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=peripheral-aave-smart-contract-hackhttps://www.web3isgoinggreat.com/?id=peripheral-aave-smart-contract-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/peripheral-aave-smart-contract-hack"}],"desc":"On August 28, 2024, the ParaSwapRepayAdapter peripheral contract of Aave was exploited for approximately $56,000. The _buyOnParaSwap function had excessive token allowances that weren't properly adjusted after swap failures, allowing attackers to exploit unvalidated paraswapData parameters and drain accumulated slippage tokens.","theft":true,"onchain":true},{"id":"ht45683a60a1","date":"2024-08-28","name":"Unverified_667d","kind":"hack","fam":"code","tech":"Access control","chains":["BNB Chain"],"usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htafe301b6aa","date":"2024-08-28","name":"1inch","kind":"hack","fam":"keys","tech":"Account Compromise","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/MistTrack_io/status/1828643547710701762"}],"desc":"According to monitoring by the SlowMist security team, the official 1inch Discord appears to have been hacked, and phishing links have been posted. Please be cautious with your funds.","theft":true},{"id":"ht49dc6eca85","date":"2024-08-26","name":"Brothers charged by SEC for $60 million \"crypto bot\" Ponzi scheme","kind":"fraud","fam":"insider","usd":60000000.0,"lo":60000000.0,"hi":60000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/adam-brothers-charged-by-sec"}],"headline":true},{"id":"ht2002b79d9b","date":"2024-08-26","name":"Avalanche","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Avalanche"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/avax/status/1827758804471288125"}],"desc":"According to an official tweet from Avalanche, their Discord server has been compromised. The official team advises users not to click on any links until the situation is fully resolved.","theft":true},{"id":"htae42a1d129","date":"2024-08-26","name":"ZkSync","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["zkSync Era"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/9msplk6g.html"}],"desc":"ZkSync's official Discord has been compromised, and hackers have posted a malicious link promoting a fake \"second round airdrop\" plan, falsely promising users free ZK tokens.","theft":true},{"id":"htd6fc52b43d","date":"2024-08-24","name":"Polygon","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Polygon"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Mudit__Gupta/status/1827235421979603352"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/users-suffer-losses-after-polygon-discord-hack"}],"desc":"Mudit Gupta, the Chief Information Security Officer of Polygon, stated on the X platform that the Polygon Community Discord has been compromised. He advised users not to click on any links within the server as the team is working to regain control.","theft":true},{"id":"ht2efd4a1218","date":"2024-08-24","name":"Aquarius","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/evilcos/status/1827172170382103023"}],"desc":"The official X account of the crypto venture capital firm Aquarius was hacked. The attacker has already changed the username, associated email, and phone number. Additionally, the previous username has been taken over by another spam account controlled by the attacker.","theft":true},{"id":"ht8a3a2f3e87","date":"2024-08-24","name":"Artela","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Artela_Network/status/1827174784020733978"}],"desc":"The parallel-execution EVM public chain Artela announced on the X platform that their official Discord was hacked today. The attacker took control of the Discord channel and spread fake airdrop messages. The team took immediate action, removed the fraudulent posts, and the Discord has now been restored."},{"id":"htd421b454d1","date":"2024-08-23","name":"HFLH (HFLH)","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":5300.0,"lo":5300.0,"hi":5300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1826866959482536238"}],"desc":"HFLH (HFLH) was suspected to have been attacked on BNB, resulting in a loss of approximately $5,300.","theft":true},{"id":"hta422844d6f","date":"2024-08-23","name":"HFLH","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1826866959482536238"}],"desc":"According to monitoring by the SlowMist security team, the staking and lending protocol HFLH on BNB Chain has been attacked. Users are advised to stay vigilant.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht261ea7ea86","date":"2024-08-21","name":"McDonald","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1zi3hclx.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mcdonalds-instagram-hack"}],"desc":"On-chain sleuth ZachXBT revealed that McDonald's Instagram account was allegedly hacked and used to promote the meme token GRIMACE.","theft":true},{"id":"ht53cdba8752","date":"2024-08-20","name":"Whale Hunter's Payday","kind":"scam","fam":"social","chains":["Ethereum"],"usd":55473618.0,"lo":55473618.0,"hi":55473618.0,"conf":"A","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/whale-hunters-payday"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-holder-loses-over-55-million-to-apparent-phishing-attack"}],"theft":true},{"id":"ht84f59e4f8c","date":"2024-08-20","name":"Parcl","kind":"hack","fam":"keys","tech":"Frontend Attack","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/386398"}],"desc":"The website frontend of Solana ecosystem real estate trading protocol Parcl has been hacked, extracting tokens from users' Solana wallets and displaying fake transaction results in Phantom. Parcl’s official X account also appears to have been compromised, posting information related to PARCL rewards.","theft":true},{"id":"ht4b71cf7ef4","date":"2024-08-20","name":"Coco","kind":"hack","fam":"code","tech":"Logic flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht7f4f055646","date":"2024-08-19","name":"Former CEO of Heartland Tri-State Bank sentenced to more than 24 years in prison after putting bank funds into crypto scheme","kind":"followup","fam":"other","usd":47100000.0,"lo":47100000.0,"hi":47100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/former-ceo-of-heartland-tri-state-bank-sentenced-to-more-than-24-years-in-prison-after-putting-bank-funds-into-crypto-scheme"}],"headline":true},{"id":"ht1dfca49069","date":"2024-08-19","name":"Luigi D'Onorio DeMeo","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/386203"}],"desc":"The X account of AvaLabs COO Luigi D'Onorio DeMeo appears to have been compromised. Please do NOT interact with any addresses or links it has posted.","theft":true},{"id":"ht93ca2c40d5","date":"2024-08-19","name":"Sahara AI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SaharaLabsAI/status/1825496237514375564"}],"desc":"The decentralized AI blockchain platform Sahara AI announced on the X platform that their official Discord has been compromised. Users are advised not to click on any links or respond to any messages until further notice.","theft":true},{"id":"ht9a58b8bb86","date":"2024-08-16","name":"Zenterest","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Ethereum"],"usd":21000.0,"lo":21000.0,"hi":21000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 16, 2024, Zenterest lending protocol was exploited for approximately $21,000 when an attacker exploited severely stale oracle prices. The ZenterestPriceFeed had not been updated for 570 days, displaying MPH Token at an inflated price of 944,836,858,607,953 versus the actual 0.4677 USD, enabling excessive borrows that the attacker profited on.","theft":true,"onchain":true},{"id":"ht332706f756","date":"2024-08-16","name":"OMPx Contract","kind":"hack","fam":"market","tech":"FlashLoan","chains":["Ethereum"],"usd":11527.0,"lo":11527.0,"hi":11527.0,"conf":"C","n":1,"theft":true},{"id":"ht3cff4a8ed8","date":"2024-08-15","name":"Twitch streamer DNP3 pleads guilty to wire fraud after gambling away funds invested in crypto charity project","kind":"followup","fam":"other","usd":1140000.0,"lo":1140000.0,"hi":1140000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dnp3-pleads-guilty-to-wire-fraud-after-gambling-away-investor-funds"}],"headline":true},{"id":"ht639ef866d5","date":"2024-08-15","name":"Crypto holder loses $100,000 to \"Coinbase support\" scammer, found via a Google ad","kind":"scam","fam":"social","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinbase-support-scammer"}],"theft":true,"headline":true},{"id":"htbaa2994f39","date":"2024-08-13","name":"Vowcurrency","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":1000000.0,"hi":1200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Vowcurrency/status/1823407231658025300"}],"desc":"On August 13, 2024, Vowcurrency Protocol on Ethereum was exploited for approximately $1.2M when the usdRateSetter address changed the VOW/vUSD exchange rate from 1 to 100 without atomic validation. In the 15-30 second window, a bot minted $2 billion in vUSD using exploited rates and swapped 26.1M VOW for 175.4778 ETH and 595,970 USDT.","theft":true,"onchain":true},{"id":"ht135a53f384","date":"2024-08-13","name":"YodlRouter","kind":"hack","fam":"code","tech":"Arbitrary Call","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6c669159c3","date":"2024-08-12","name":"PolyNetwork","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["PolyNetwork"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 12, 2024, an undisclosed vulnerability in Poly Network's Cross-Chain Management Contract drained $4-5M in wrapped assets on Neo N3, de-pegging Flamingo's f- and p-assets. Poly Network suspended the bridge and Flamingo paused cross-chain features; Neo Global Development relaunched and took over in September. This was the third Poly Network compromise.","theft":true},{"id":"ht0781ce2df7","date":"2024-08-12","name":"iVest","kind":"hack","fam":"code","tech":"Unknown","target":"Token","chains":["BNB Chain"],"usd":190000.0,"lo":172000.0,"hi":190000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1822888837670113330"}],"desc":"On August 12, 2024, iVest token on BSC was exploited via a business logic flaw in its custom ERC20 transfer function. The __MakeDonation function, invoked during token transfers, had vulnerabilities that allowed attackers to manipulate token prices and extract value through the donation mechanism.","theft":true},{"id":"ht89a4f8f2ab","date":"2024-08-09","name":"RARI Foundation","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/rarifoundation/status/1821609527449653382"}],"desc":"The official Discord server of RARI Foundation has been hacked. Please refrain from using the server until the team has regained control.","theft":true},{"id":"htf36e88a6bd","date":"2024-08-07","name":"North Korean developers steal $1.3 million from crypto project treasury","kind":"hack","fam":"other","usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/7anpw-theft"}],"theft":true,"headline":true},{"id":"htf1235e0b74","date":"2024-08-07","name":"Nexera","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Ethereum"],"usd":449000.0,"lo":449000.0,"hi":1830000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Nexera_Official/status/1821079381831512315"}],"desc":"Attackers compromised Nexera's token contract credentials via BeaverTail malware on an employee machine, then transferred 47.24M NXRA. They sold 14.75M tokens for ~$449K before Nexera paused the contract and zeroed the remaining 32.5M.","theft":true,"review":["sources disagree on the loss"]},{"id":"htd8a03a62df","date":"2024-08-06","name":"Ronin Bridge","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Ethereum"],"usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/roninnetwork-rektII"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1820783952145355247"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/12-million-taken-by-whitehats-from-ronin-bridge"}],"desc":"On August 6, 2024, Ronin Bridge was exploited for $12M (4K ETH + 2M USDC) due to an incomplete contract upgrade. The bridge manager was upgraded to v4, but the v3 initialization function, which set critical voting weights, was never called, leaving _totalOperatorWeight uninitialized and breaking vote-weight validation.","theft":true},{"id":"ht9926dd4ae6","date":"2024-08-06","name":"Trump-themed $DJT token rug-pulls, people blame Martin Shkreli or Barron Trump","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trump-themed-djt-token-rug-pulls-people-blame-martin-shkreli-or-barron-trump"}],"theft":true,"headline":true},{"id":"ht9fb3c87289","date":"2024-08-06","name":"OMPx","kind":"hack","fam":"other","tech":"Unknown","usd":107000.0,"lo":107000.0,"hi":107000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/2yi1av9u.html"}],"desc":"OMPx was attacked, resulting in a loss of approximately $107,000. The attacker obtained initial funds through Railgun, and the stolen funds have already been deposited into Railgun.","theft":true},{"id":"htb8aa4dfa47","date":"2024-08-06","name":"Novax","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":25000.0,"lo":25000.0,"hi":25000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0ace8c9e8f","date":"2024-08-03","name":"SATOSHI (SATS)","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"According to monitoring by the SlowMist security team, SATOSHI (SATS) was attacked on Ethereum on August 3rd.","theft":true,"onchain":true},{"id":"ht3535397dd8","date":"2024-08-02","name":"Starknet","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Starknet/status/1819079824851320990"}],"desc":"According to an official tweet from Ethereum Layer 2 network Starknet, their Discord server has been compromised. The official team advises users not to click on any links until the situation is fully resolved.","theft":true},{"id":"ht1d027f7d38","date":"2024-08-01","name":"Convergence","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":210000.0,"lo":200000.0,"hi":210000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/convergencefi-hack"}],"desc":"On August 1, 2024, Convergence Finance lost $212K worth of CVG tokens when input validation was missing from the claimMultipleStaking function. The attacker passed an arbitrary malicious contract address to mint 58 million CVG tokens directly, then converted them to 60 WETH and 15.9K crvFRAX.","theft":true,"onchain":true},{"id":"ht1be29a1a6f","date":"2024-07-31","name":"Terra 2.0","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Terra2"],"usd":6400000.0,"lo":5280000.0,"hi":6400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/astroport-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/308440/attacker-exploits-ibc-hooks-vulnerability-to-steal-tokens-on-terra-blockchain"}],"desc":"A June 2024 upgrade to Terra Phoenix reintroduced an unpatched ibc-go 7.3.x fork, reintroducing a reentrancy bug in ibc-hooks timeout callback. An attacker exploited this to mint tokens and swap them through Astroport before the chain halted.","theft":true},{"id":"ht086de8d0d5","date":"2024-07-30","name":"Anzen Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/AnzenFinance/status/1818359128542319069"}],"desc":"Anzen Finance, the issuer of RWA stablecoins, announced on the X platform that on July 30, due to an error in the Blast vault contract, a white hat hacker exploited the vault to steal 500,000 USDz. The white hat returned $450,000 in a timely manner and received a $50,000 bounty as a reward.","theft":true},{"id":"ht30fd8afdd4","date":"2024-07-30","name":"Metis","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/MetisL2/status/1818229099292250207"}],"desc":"The Ethereum Layer 2 network Metis issued a warning on Twitter stating that their Discord has been compromised. They advised users not to click on any \"airdrop links\" or any other links.","theft":true},{"id":"ht2b32210f0d","date":"2024-07-26","name":"Casper Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Casper"],"usd":6700000.0,"lo":6700000.0,"hi":6700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://casper.network/en-us/news/casper-blockchain-security-update-preliminary-incident-report"}],"desc":"On July 26, 2024, the Casper blockchain was exploited via a privilege escalation vulnerability that allowed contract installers to bypass access rights checks on urefs. Attackers gained unauthorized access to 13 accounts and transferred approximately $6.7M in tokens before validators halted consensus to prevent further exploitation.","theft":true},{"id":"ht127ff7bd85","date":"2024-07-26","name":"SAT20 Labs","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SAT20Labs/status/1817882767453216778"}],"desc":"On July 26th, the official Twitter account of SAT20 Labs was hacked, and the attacker posted tweets containing links to install malware.","theft":true},{"id":"ht97605e8f87","date":"2024-07-25","name":"Monoswap","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Blast"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/monoswapio/status/1816151998267547851"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monoswap-hack"}],"desc":"MonoSwap developer was lured on July 24-25, 2024 by fake venture capitalists into installing a malicious 'Kakao' video-call app that stole private keys. Attacker used the keys to withdraw ~$1.3M in staked liquidity and protocol funds from the Blast-based DEX.","theft":true},{"id":"ht12a9b960ed","date":"2024-07-25","name":"Sorta Finance","kind":"fraud","fam":"insider","tech":"Scam","chains":["Arbitrum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zachxbt/status/1816443881447440789"}],"desc":"According to on-chain detective ZachXBT, Sorta Finance is likely to conduct an exit scam on Arbitrum in the future, so do not use the protocol. This scammer has previously stolen over $25 million through scams such as Magnate, Kokomo, Lendora, Solfire, Crolend, and HashDAO."},{"id":"hta6f4302dd9","date":"2024-07-25","name":"TinTinLand","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/OurTinTinLand/status/1816358544402444462"}],"desc":"According to the SlowMist security team, the community TinTinLand's pinned tweet on July 20 contained a phishing link. With the assistance of the SlowMist security team, TinTinLand promptly resolved the account theft issue and conducted an authorization review and security reinforcement of their Twitter account.","theft":true},{"id":"htb6fa978d88","date":"2024-07-24","name":"Spectra Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":73000.0,"lo":73000.0,"hi":550000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/spectra_finance/status/1815813300111786488"}],"desc":"On July 24, 2024, Spectra Protocol's router contract was exploited for approximately $73,000 via an arbitrary call vulnerability in the execute function. The attacker crafted inputData to manipulate contract calls with arbitrary parameters, draining 188 quadrillion asdCRV tokens (inflated representation) from approved wallets.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5e0b78e468","date":"2024-07-23","name":"DeltaPrime","kind":"hack","fam":"code","tech":"Ownership Takeover","target":"DeFi Protocol","chains":["Arbitrum","Avalanche"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@Delta_Prime/deltaprime-post-mortem-report-752bd60a25e6"}],"desc":"DeltaPrime on Arbitrum suffered a $1M loss on July 23, 2024 when a flawed account ownership transfer allowed attackers to take control of accounts and withdraw collateral.","theft":true},{"id":"ht0db69efbb7","date":"2024-07-23","name":"Fake Base Dawgz","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":113000.0,"lo":113000.0,"hi":113000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coinlive.com/news-flash/572638"}],"desc":"The Fake Base Dawgz on Ethereum is suspected of a rug pull, resulting in a loss of over $113,000.","theft":true},{"id":"htd20e6349b7","date":"2024-07-23","name":"dYdX V3","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":31000.0,"lo":31000.0,"hi":31000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://dydx.exchange/blog/dns-nameserver-hijacking-postmortem"}],"desc":"On July 23, 2024, the dYdX domain (dydx.exchange) was compromised when attackers changed DNS nameservers via a compromised Squarespace account. Two users lost approximately $31,000 when redirected to a malicious contract attempting to steal their tokens. The site was restored within three hours and the domain was transferred to Cloudflare.","theft":true},{"id":"ht78ec7e87cd","date":"2024-07-23","name":"MEVbot_0xdd7c","kind":"hack","fam":"code","tech":"Incorrect input validation","chains":["Ethereum"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"C","n":1,"theft":true},{"id":"htae4216a6d5","date":"2024-07-22","name":"Kelp DAO","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.kelpdao.xyz/kelp-dapp-ui-attack-post-mortem-53f3e71d033e"}],"desc":"On July 22, 2024, Kelp's DApp began displaying malicious wallet activity transactions aimed at draining funds. Kelp's engineering team evaluated the situation and identified the root cause to be faulty nameservers routing users to different application code that was attempting to trick the users into phishing. The attackers gained access to Kelp’s domain registrar account impersonating Kelp team and successfully convinced GoDaddy’s customer support that they were the legitimate owners of the account bypassing the 2-FA that was in place.","theft":true},{"id":"ht42c7af5473","date":"2024-07-22","name":"Renzo","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/renzoprotocol/status/1815341217414357311?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"The liquidity restaking protocol Renzo tweeted that the Renzo Discord server has been compromised by malicious attackers. Please do not click on any links posted in the server.","theft":true},{"id":"ht4848674bf1","date":"2024-07-21","name":"ETHTrustFund","kind":"rugpull","fam":"insider","tech":"Treasury Misappropriation","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":2100000.0,"lo":2000000.0,"hi":2200000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ethtrustfund-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/0ctoshi/status/1815026461675335752"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ethtrustfund-rug-pull"}],"desc":"ETHTrustFund, an Olympus DAO fork on Base, suffered a rug pull on July 20-22, 2024 when the developer transferred the entire treasury (607 ETH, $2.1 million) to Tornado Cash and Railgun mixers and deleted all project websites and social media, executing an exit scam.","theft":true},{"id":"hta2df5ad6ed","date":"2024-07-21","name":"UtopiaSphere","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":521000.0,"lo":521000.0,"hi":521000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 21, 2024, UtopiaSphere (UPS) token on BSC was exploited for approximately $521,000 through a flashloan-based price manipulation attack. The attacker exploited the swapBurn() mechanism by flash-loaning 89.672M USDT and 6.424M USDT in vUSDC to manipulate UPS token prices and drain the PancakeSwap pair.","theft":true},{"id":"htbf8604d9f9","date":"2024-07-21","name":"UPS","kind":"hack","fam":"other","tech":"Unknown","chains":["BNB Chain"],"usd":521000.0,"lo":521000.0,"hi":521000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"UPS on BNBChain was attacked again, losing about $521K. On April 8th, UPS was previously attacked on BNBChain, losing about $30K.","theft":true,"onchain":true},{"id":"ht20adc4ceed","date":"2024-07-20","name":"Arbitrum","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Arbitrum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/381295"}],"desc":"The arbitrum.com website appears to have been hacked and is being redirected to the official website of the Meme project MOG. Please stay vigilant and ensure the safety of your assets.","theft":true},{"id":"ht1b092540a3","date":"2024-07-19","name":"Rho Markets","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Scroll","Ethereum"],"usd":7600000.0,"lo":7600000.0,"hi":7600000.0,"ret":7600000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/rho-market-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/wdq528s5.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rho-loss"}],"desc":"Rho Markets on Scroll lost $7.6M on July 19, 2024 when a private key compromise allowed attacker to transfer oracle contract ownership and manipulate price feeds, draining all USDT and USDC.","theft":true,"review":["possible duplicate within one source"]},{"id":"htba9dc9351d","date":"2024-07-18","name":"WazirX: India","kind":"hack","fam":"social","tech":"Signer Phishing","target":"CEX","chains":["Ethereum"],"usd":234900000.0,"lo":230000000.0,"hi":235000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/wazirx-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1813848794360139808"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wazirx-hack"}],"desc":"WazirX Indian exchange was hacked on July 18, 2024, losing $234.9M in 190+ tokens from a Liminal-custodied multisig wallet. Attackers created a fake WazirX account, accessed the hot wallet, then exploited the smart contract controlling the multisig to gain full control without the original keys.","theft":true},{"id":"htfae9aa0aa4","date":"2024-07-16","name":"LiFi Finance","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["zkSync Era","Linea","Metis","Ethereum","Solana"],"usd":10000000.0,"lo":9730000.0,"hi":11600000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/lifi-jumper-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1813195343057866972"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lifi-exploit"}],"desc":"On July 16, 2024 LI.FI protocol was exploited via insufficient input validation in GasZipFacet.sol, where the depositToGasZipERC20 function allowed user-controlled _swapData parameters to reach low-level calls with malicious transferFrom() calldata, draining $8-11M from 153 wallets with infinite approvals across Ethereum and Arbitrum.","theft":true},{"id":"ht3533ab1141","date":"2024-07-16","name":"Lifiprotocol","kind":"hack","fam":"code","tech":"Incorrect input validation","chains":["Ethereum"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"theft":true},{"id":"ht8555f6a4a8","date":"2024-07-16","name":"MALOU (NEVER)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":240000.0,"lo":240000.0,"hi":240000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On BNB Chain, the MALOU (NEVER) token experienced over 99% slippage. The address [address] used a backdoor to sell NEVER tokens, obtaining 428 BNB (approximately $240,000), which were then transferred into Tornado.","theft":true,"onchain":true},{"id":"ht2165f08c3f","date":"2024-07-14","name":"Minterest","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Mantle","Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/Minterest/status/1812540672248820033"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/minterest-hack"}],"desc":"An attacker flash loaned USDY tokens, triggering a reentrancy attack during the transfer fallback function. Exchange rate updates executed immediately after borrow operations, allowing the attacker to manipulate rates and liquidate user positions for mETH and WETH.","theft":true},{"id":"htd1a789aaef","date":"2024-07-14","name":"Ethena","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/e7w888oh.html"}],"desc":"According to on-chain sleuth ZachXBT, the Ethena Discord server has been hacked. Do not click on any links for the time being.","theft":true},{"id":"htc0b6baf6f4","date":"2024-07-12","name":"CoinStats","kind":"hack","fam":"social","tech":"Phishing","target":"Other","usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"CoinStats portfolio service suffered a breach affecting private keys for 1,590 user wallets, resulting in $2.2M in direct theft. Attackers compromised multiple CoinStats internal services and external integrations through sophisticated multi-vector intrusion. Lazarus Group is suspected as the attacker.","theft":true},{"id":"htac5cd333ee","date":"2024-07-12","name":"Dough Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":1880000.0,"lo":1800000.0,"hi":2100000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1811655943056425236"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dough-finance-hack"}],"desc":"On July 12, 2024 Dough Finance on Ethereum was exploited for approximately $1.96 million via unvalidated call data in the ConnectorDeleverageParaswap contract, where attackers combined a flashloan with the arbitrary external call vulnerability to manipulate data and transfer WETH. Stolen funds were swapped to ETH and 600 ETH (~$1.8M) was later deposited into Tornado Cash; a white-hat recovered 69.12 ETH.","theft":true,"review":["possible duplicate within one source"]},{"id":"htf567b4bc2e","date":"2024-07-12","name":"Unstoppable Domains","kind":"hack","fam":"other","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/unstoppableweb/status/1811734634012536888"}],"desc":"Web3 domain provider Unstoppable Domains stated on Twitter that Unstoppabledomains.com was attacked. Until further notice, please do not open any emails from @unstoppabledomains.com or use the website.","theft":true},{"id":"ht996bbc4132","date":"2024-07-11","name":"OPSEC","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":182000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/OpSecCloud/status/1811074256220115283"}],"desc":"A private key controlling the OPSEC staking contract was compromised, allowing the attacker to change ownership from the team wallet to attacker-controlled addresses. Although $800K in tokens were accessible, the attacker was only able to convert ~59 ETH (~$100K at time of sale) to cash due to illiquid pool conditions.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5725f14875","date":"2024-07-11","name":"Smart Bank Token (SBT)","kind":"hack","fam":"code","tech":"Unknown","chains":["BNB Chain"],"usd":56000.0,"lo":56000.0,"hi":56000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Smart Bank Token (SBT) contract on BNBChain was attacked, resulting in a loss of approximately $56,000.","theft":true,"onchain":true},{"id":"ht43ec7e1b6b","date":"2024-07-11","name":"SBT","kind":"hack","fam":"code","tech":"business logic flaw","chains":["BNB Chain"],"usd":56000.0,"lo":56000.0,"hi":56000.0,"conf":"C","n":1,"theft":true},{"id":"htd45f4ba2b2","date":"2024-07-11","name":"Compound","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/LewellenMichael/status/1811303839888261530"}],"desc":"Compound DAO security advisor Michael Lewellen tweeted that the Compound Finance official website (http://compound.finance) has been compromised and is currently hosting a phishing site. Do not interact with the site until further notice.","theft":true},{"id":"htb431934196","date":"2024-07-11","name":"GAX","kind":"hack","fam":"code","tech":"Lack of access control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdc659a8c22","date":"2024-07-10","name":"Wasabi Wallet","kind":"hack","fam":"keys","tech":"Security Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://github.com/WalletWasabi/WalletWasabi/discussions/13249"}],"desc":"According to a message posted by Wasabi Wallet on Twitter, users have reported that a coordinator named WasabiCoordinator is gradually stealing user funds through a complex attack. Wasabi Wallet advises all users connected to this coordinator to immediately stop CoinJoin operations and announces that a new version will be released soon to prevent such attacks. Subsequently, Wasabi Wallet tweeted that there were three types of attacks in this incident: attacks on free coordinators, supply chain (GitHub) compromise, user-targeted attacks.","theft":true},{"id":"ht0a69c529ea","date":"2024-07-09","name":"OmegaPro founder arrested for allegedly running crypto Ponzi","kind":"fraud","fam":"insider","usd":103000000.0,"lo":103000000.0,"hi":103000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/omegapro-founder-arrested"}],"headline":true},{"id":"ht3afdcf4ec1","date":"2024-07-08","name":"Linking The World (LW)","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":80000.0,"lo":80000.0,"hi":80000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1810218484196118748"}],"desc":"According to monitoring by the SlowMist security team, Linking The World (LW) was attacked on BNBChain due to a contract vulnerability, losing approximately $80,000.","theft":true},{"id":"ht2c446ddf38","date":"2024-07-08","name":"LW","kind":"hack","fam":"other","tech":"Integer Underflow","chains":["BNB Chain"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"C","n":1,"theft":true},{"id":"htec25b52c89","date":"2024-07-08","name":"Doja Cat","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=doja-cat-twitter-hack"}],"desc":"On July 8, rapper Doja Cat's Twitter account was hacked to promote a memecoin. Doja Cat quickly posted on her Instagram account, stating that her Twitter account had been compromised.","theft":true},{"id":"ht17566b06df","date":"2024-07-07","name":"Interlay","kind":"hack","fam":"bridge","tech":"Account Compromise","chains":["Polkadot"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Polkadot/status/1809883982533718347"}],"desc":"Polkadot issued a warning on Twitter, alerting users that the official Twitter account of Interlay, a cross-chain interoperability project, was compromised and used to post a scam message. Users are advised to be cautious and avoid clicking any links.","theft":true},{"id":"ht5d635f4fb9","date":"2024-07-05","name":"DefiPlaza","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DeFiPlaza V2 had a complex vulnerability allowing a carefully crafted transaction to drain all liquidity pool tokens. An MEV bot front-ran the attacker and captured ~$24K before being contacted by the team and returning the funds.","theft":true},{"id":"ht39f915840b","date":"2024-07-05","name":"Authy","kind":"hack","fam":"keys","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/im23pds/status/1809047760819400777?mx=2"}],"desc":"23pds, the CISO at SlowMist, tweeted that the 2FA service Authy has been hacked, resulting in the theft of the phone numbers of 33 million users. If you are an Authy user, please be vigilant against phishing attacks. The official developer, Twilio, has confirmed the vulnerability. Many professionals in the crypto industry use this 2FA software, so please ensure the security of your assets.","theft":true},{"id":"ht3efa1159e6","date":"2024-07-03","name":"UnverifiedContr_0x452E25","kind":"hack","fam":"other","tech":"lack-of-access-control","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htec1c6c8214","date":"2024-07-02","name":"Bittensor","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","usd":8000000.0,"lo":8000000.0,"hi":8000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bittensor-rekt"},{"s":"SlowMist Hacked","u":"https://blog.bittensor.com/bittnesor-community-update-july-3-2024-45661b1d542d"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bittensor-wallet-drain"}],"desc":"Bittensor suffered an $8M hack on July 2, 2024 via a supply chain attack. The PyPI package v6.12.2 was compromised with malware that stole coldkeys when users initiated staking, delegation, or transfer operations.","theft":true},{"id":"htb64826fbf9","date":"2024-07-02","name":"TRUMP (MAGA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":957552.0,"lo":957552.0,"hi":957552.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Fake TRUMP (MAGA) on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true,"onchain":true},{"id":"htde22b1eb9f","date":"2024-07-02","name":"MintRisesPrices","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":59000.0,"lo":59000.0,"hi":59000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1808324198861004903"}],"desc":"MintRisesPrices on BNB Chain suffered a reentrancy attack where the attacker repeatedly entered and exited mint and burn functions in a single transaction, manipulating pricing mechanisms to drain approximately $59K from the protocol.","theft":true},{"id":"htc9537dccdd","date":"2024-07-02","name":"Sydney Sweeney","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/sydney-sweeney-x-account-promotes-crypto-memecoin"}],"desc":"According to Cointelegraph, the Twitter account of American actress Sydney Sweeney was hacked, with now-deleted posts promoting a crypto token bearing her name in an apparent pump-and-dump scheme.","theft":true},{"id":"ht7afabd42f9","date":"2024-07-02","name":"MRP","kind":"hack","fam":"code","tech":"Reentrancy","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht63562c3898","date":"2024-07-01","name":"Evolve Bank & Trust","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/c6293xv8.html"}],"desc":"On July 1, according to Protos, the crypto-friendly bank Evolve Bank & Trust recently admitted that despite discovering \"unauthorized activity\"—specifically, the theft of 33 TB of user data—a month ago, they only publicly disclosed the incident last week. Reportedly, the stolen data pertains to 155,586 accounts associated with companies like Bitfinex, Nomad, and Copper. The bank stated that the data breach was due to an employee clicking on a malicious link and that the attack was halted within a few days, with no further unauthorized activity detected.","theft":true},{"id":"ht6cce33e20a","date":"2024-07-01","name":"Particle Network","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/377995"}],"desc":"According to screenshots shared by X user @bmgentile, the modular chain abstraction Layer 1 project Particle Network issued an official apology statement. They stated that their account email was recently hacked and used to send phishing emails, inviting users to participate in the PARTl presale. Please stay vigilant against related risks as the official team investigates the matter.","theft":true},{"id":"ht56186207ea","date":"2024-06-30","name":"BorpaToken","kind":"hack","fam":"bridge","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/377677"}],"desc":"The cross-chain DeFi protocol Entangle announced on X that the official X account of the meme token project BorpaToken, developed by their team, has been compromised. Do not click on any links. The BorpaToken team is in contact with X to resolve the issue.","theft":true},{"id":"hte4e7f68a59","date":"2024-06-28","name":"Will","kind":"hack","fam":"code","tech":"business logic flaw","chains":["BNB Chain"],"usd":52000.0,"lo":52000.0,"hi":52000.0,"conf":"C","n":1,"theft":true},{"id":"ht3767017a53","date":"2024-06-27","name":"Cyber","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/BuildOnCyber/status/1806177364629680347"}],"desc":"According to Cyber's official Twitter, the Discord server @BuildOnCyber of the decentralized social L2 Cyber (formerly CyberConnect) was compromised. A phishing link was posted in the announcements channel and all permissions have been stripped. Do not interact with the attached announcement, Do not click any links.","theft":true},{"id":"ht2ab0e1f9f6","date":"2024-06-26","name":"APEMAGA","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"usd":32000.0,"lo":32000.0,"hi":32000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"APEMAGA smart contract experienced a business logic vulnerability that violated an invariant, allowing attackers to drain approximately 9.4 ETH (~$32K). The exploit was significant enough to be studied for invariant-synthesis security improvements.","theft":true,"onchain":true},{"id":"ht0be7b1fc62","date":"2024-06-25","name":"FBI busts group of crypto-seeking home invaders","kind":"fraud","fam":"insider","usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/remy-st-felix-conviction"}],"headline":true},{"id":"ht77e98a5c83","date":"2024-06-25","name":"Metallica","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/237057/metallica-hacked-celebs-promoting-scam-crypto-tokens"}],"desc":"According to Decrypt, the social media account of the renowned heavy metal band Metallica were recently hacked. The hackers used these accounts to promote scam cryptocurrency tokens. Several celebrities were also implicated, becoming tools for the scam's promotion. The hackers posted false information to entice fans and investors into purchasing worthless tokens.","theft":true},{"id":"ht20d0852b84","date":"2024-06-23","name":"Victim loses $11 million to permit phishing","kind":"scam","fam":"social","chains":["Ethereum"],"usd":11000000.0,"lo":11000000.0,"hi":11000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0xfb94d-theft"}],"theft":true,"headline":true},{"id":"ht8ba10060ed","date":"2024-06-23","name":"Sportsbet","kind":"hack","fam":"other","tech":"Unknown","chains":["Tron"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/376440"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sportsbetio-hack"}],"desc":"According to monitoring by on-chain detective ZachXBT, the online gambling platform Sportsbet was also suspected to be attacked by the same hacker as BtcTurk, resulting in a loss of over $3.5 million.","theft":true},{"id":"htc354859376","date":"2024-06-23","name":"Farcana token plummets 60% amid murky explanations","kind":"hack","fam":"other","chains":["Polygon"],"usd":164000.0,"lo":164000.0,"hi":164000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/farcana-token-plunge"}],"theft":true,"headline":true},{"id":"ht8c53649d5d","date":"2024-06-23","name":"DeFiance","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Arthur_0x/status/1804621271411613766"}],"desc":"Arthur (@Arthur_0x), the founder of DeFiance Capital, posted on X to warn that the official X account of DeFiance Capital has been compromised. Please avoid clicking on any links shared by the account.","theft":true},{"id":"ht737a87ef45","date":"2024-06-23","name":"Ethereum Foundation","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/ethereum-foundation-email-hacked-fake-lido-staking-phishing-scam"}],"desc":"According to the latest official blog post by the Ethereum Foundation, their email account was hacked, and phishing emails were sent to 35,794 recipients. The email falsely claimed that the Foundation was partnering with LidoDAO to offer a 6.8% Ethereum staking yield. If users clicked the link in the email and approved the transaction, their wallets would be drained. The Foundation quickly halted the malicious emails, closed the attack vector, and ensured that the hackers could no longer access the email account. The investigation revealed that the hackers obtained 81 new email addresses during the attack, but no victims lost any funds.","theft":true},{"id":"ht5ea5424b77","date":"2024-06-22","name":"BtcTurk","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","usd":90000000.0,"lo":54000000.0,"hi":90000000.0,"ret":5300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=btcturk-exploited-for-at-least-55-million"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/btcturk-exploited-for-at-least-55-million"}],"desc":"BtcTurk lost $54-55M on June 22, 2024 when attackers compromised private keys to 10 hot wallets targeting Avalanche holdings. Binance froze $5.3M of recovered funds.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht292d7d5545","date":"2024-06-22","name":"CoinStats","kind":"hack","fam":"keys","tech":"Malware Attack","usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/CoinStats/status/1804633869372559788"}],"desc":"Cryptocurrency portfolio management company CoinStats temporarily suspended user activities after 1,590 crypto wallets were affected by a security incident. CoinStats stated, \"The attack has been mitigated, and we have temporarily shut down the application to isolate the security incident. None of the connected wallets and CEXes were impacted. Thanks to the immediate incident reponse from the CoinStats team, only 1.3% of all CoinStats Wallets were affected, totaling 1,590 wallets. The list might change as the investigation is ongoing but we don’t expect significant changes.\" On June 26, Narek Gevorgyan released a security incident update, stating that the security vulnerability was due to the company's AWS infrastructure being hacked. Evidence indicates that it was done through one of employees who was socially engineered into downloading malicious software onto his work computer.","theft":true},{"id":"hta9a977574d","date":"2024-06-22","name":"50 Cent","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=50-cent-account-compromise"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/50-cent-account-compromise"}],"desc":"The rapper 50 Cent has claimed that his Twitter account and website were hacked to promote a memecoin called GUNIT.","theft":true},{"id":"ht7ab6734870","date":"2024-06-21","name":"Fake CGPT","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":19550.0,"lo":19550.0,"hi":19550.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Fake CGPT on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true},{"id":"htf9b0b755f5","date":"2024-06-20","name":"OKX NFT Aggregator","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["BNB Chain"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"OKX's NFT aggregator on BSC was exploited on June 20, 2024 due to an access control vulnerability in withdrawal/transfer functions that had existed for approximately one year. $14K in user funds were stolen.","theft":true},{"id":"ht8b990d15ea","date":"2024-06-18","name":"INcufi","kind":"hack","fam":"code","tech":"business logic flaw","chains":["BNB Chain"],"usd":59000.0,"lo":59000.0,"hi":59000.0,"conf":"C","n":1,"theft":true},{"id":"ht75329fe84a","date":"2024-06-17","name":"Dyson","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":31000.0,"lo":31000.0,"hi":31000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1802606892428177440"}],"desc":"According to monitoring by the SlowMist security team, Dyson on BNBChain was attacked, resulting in a loss of approximately $31,000.","theft":true},{"id":"ht2a942b62af","date":"2024-06-16","name":"WIFCOIN","kind":"hack","fam":"code","tech":"Unknown","target":"Token","chains":["Ethereum"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/WIFCOIN_ETH/status/1803841123204382926"}],"desc":"WIFCOIN_ETH experienced a business logic flaw on June 16, 2024 that allowed fund extraction. Technical details documented in DeFiHackLabs security research.","theft":true,"onchain":true},{"id":"htcee915ad6a","date":"2024-06-16","name":"Crb2","kind":"hack","fam":"code","tech":"business logic flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta3de995e95","date":"2024-06-14","name":"AutoChain Global","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":113000.0,"lo":113000.0,"hi":113000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"AutoChain Global smart contract was exploited on June 14, 2024, resulting in ~$113K in losses. Technical details of the vulnerability remain limited in public sources.","theft":true,"onchain":true},{"id":"htaa6e19eee3","date":"2024-06-14","name":"nftperp","kind":"hack","fam":"code","tech":"Contract Vulnerability","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/spreekaway/status/1801410447637086285"}],"desc":"On June 14, NFT perpetual contract trading platform nftperp announced on Twitter that a critical bug had been found in the clearingHouse contract. All vulnerable contracts have been suspended until further notice. On June 15, nftperp stated that all funds lost due to the vulnerability had been successfully recovered. The developers are currently prioritizing the resumption of the contracts so trading and withdrawal can go live.","theft":true},{"id":"htc8f7e2c494","date":"2024-06-13","name":"UwU Lend","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":3700000.0,"lo":3700000.0,"hi":3720000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1801161421138600443"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uwu-lend-hack-2"}],"desc":"On June 13, 2024, UwU Lend suffered a second $3.7M exploit three days after a $20M hack on June 10. The attacker reused sUSDe tokens stolen in the first exploit as collateral to drain additional pools (uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, uUSDT) because the protocol failed to freeze compromised collateral or revoke stolen token permissions between incidents.","theft":true},{"id":"ht4cb06b457b","date":"2024-06-13","name":"Holograph","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":1200000.0,"hi":14400000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/holographxyz/status/1801702424236990600"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/holograph-hack"}],"desc":"On 13 June 2024 a former Holograph technical contractor exploited inadequate access control on the mint/operator functions to mint 1 billion HLG across nine transactions using internal knowledge, with HLG falling roughly 80% within nine hours of the exploit.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht490aacf1df","date":"2024-06-12","name":"Phishing scammers impersonate Andreessen Horowitz employee to drain crypto wallets","kind":"scam","fam":"social","usd":245000.0,"lo":245000.0,"hi":245000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/andreessen-horowitz-phishing"}],"theft":true,"headline":true},{"id":"ht2453295327","date":"2024-06-11","name":"YOLO Games","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["Blast"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/shoucccc/status/1800353122159833195"}],"desc":"YOLO Games' Bazaar LBP (Liquidity Bootstrapping Pool) on Blast was exploited on June 11, 2024 for $1.5M. The exitPool function failed to verify msg.sender, allowing anyone to withdraw assets as a liquidity provider. Unchecked function arguments permitted use of BazaarLBPFactoryBlast address as sender.","theft":true},{"id":"hte868361040","date":"2024-06-11","name":"JokInTheBox","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":34000.0,"lo":34000.0,"hi":34000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/JokInTheBoxETH/status/1800539599082500106"}],"desc":"JokInTheBox staking contract had an unstaking vulnerability where the state variable was not properly checked, allowing attackers to unstake multiple times from the same balance. Exploiter continuously withdrew funds, draining ~$34K from affected users.","theft":true,"onchain":true},{"id":"ht7ceb4658f1","date":"2024-06-10","name":"UwU Lend","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":20000000.0,"lo":19300000.0,"hi":20000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/uwulend-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1800181916857155761"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uwu-lend-hack"}],"desc":"On June 10, 2024, UwU Lend was exploited for approximately $19.3-20 million. Attacker used flashloans (~$3.8B) to manipulate CurveFinance pools, corrupting 5 of 11 USDe price sources. A second attack on the same protocol followed days later, extracting an additional $3.7 million.","theft":true},{"id":"htc9266c3a5b","date":"2024-06-10","name":"Bazaar","kind":"hack","fam":"other","tech":"Insufficient Permission Check","chains":["Blast"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc12d2a5fab","date":"2024-06-09","name":"Loopring","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"DeFi Protocol","chains":["Loopring","Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/loopringorg/status/1799791898296451515"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/loopring-wallet-hack"}],"desc":"On June 9, 2024, Loopring's Official Guardian 2FA service (off-chain infra) was compromised, allowing attackers to masquerade as wallet owners, reset ownership, and steal $5M from Smart Wallets. Users with single guardian reliance were especially vulnerable.","theft":true},{"id":"ht946dd3a34b","date":"2024-06-09","name":"Certik Kraken","kind":"hack","fam":"other","chains":["Polygon"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"B","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/certik-kraken-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/certik-and-kraken-bug-dispute"}],"theft":true,"review":["sources disagree on the date"]},{"id":"ht36fc2ea85d","date":"2024-06-08","name":"Gemholic","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["zkSync Era"],"usd":3400000.0,"lo":3400000.0,"hi":3400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/0xAA_Science/status/1799333616767635514"}],"desc":"Gemholic, a crypto project, is accused of a rug pull after moving $3.5M in recently recovered funds and vanishing from social media.","theft":true},{"id":"htcc28f2b46c","date":"2024-06-08","name":"YYStoken","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":28000.0,"lo":28000.0,"hi":28000.0,"conf":"C","n":1,"theft":true},{"id":"hte3babedce8","date":"2024-06-07","name":"TLN Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1799028399085949133"}],"desc":"According to monitoring by the SlowMist security team, the TLN Protocol on BNBChain has been attacked again. On May 31, TLN Protocol suffered a loss of approximately $280,000 due to a contract vulnerability exploited by hackers.","theft":true},{"id":"ht97694d86a6","date":"2024-06-06","name":"New York Attorney General sues over $1 billion NovaTech and AWS Mining crypto pyramid schemes","kind":"fraud","fam":"insider","usd":1000000000.0,"lo":1000000000.0,"hi":1000000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/new-york-attorney-general-sues-over-1-billion-novatech-and-aws-mining-crypto-pyramid-schemes"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"htdf5b9548cf","date":"2024-06-06","name":"SteamSwap","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":105000.0,"lo":91000.0,"hi":105000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1798905797440897386"}],"desc":"SteamSwap (STM) on BNB Chain was attacked via price manipulation allowing the attacker to abuse reserve balance calculations and drain approximately $105K from the DEX.","theft":true,"onchain":true},{"id":"ht9c9b2cc4bf","date":"2024-06-06","name":"MineSTM","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":13800.0,"lo":13800.0,"hi":13800.0,"conf":"C","n":1,"theft":true},{"id":"ht779fb21dd0","date":"2024-06-05","name":"Blockchain developer loses over $48,000 after posting private key to Github","kind":"hack","fam":"other","chains":["Cosmos"],"usd":48630.0,"lo":48630.0,"hi":48630.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/br1aneth-private-key-compromise"}],"theft":true,"headline":true},{"id":"hteb92af9dfb","date":"2024-06-05","name":"CoinGecko","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coingecko.com/learn/getresponse-data-breach-june-2024?utm_source=x&utm_medium=social"}],"desc":"CoinGecko reported that its third-party email platform GetResponse experienced a data breach on June 5. The compromised data includes users' names (if provided during registration), email addresses, IP addresses, and metadata related to email open locations. However, user accounts and passwords were not affected.","theft":true},{"id":"ht4fecc53d5f","date":"2024-06-05","name":"Renzo","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/LucasKozinski/status/1798051053080089006"}],"desc":"Renzo's co-founder, Lucas Kozinski, posted a warning on Twitter stating that the @RenzoProtocol Twitter account has been compromised. He advised not to click any links and mentioned that the team is working with Twitter to resolve the issue.","theft":true},{"id":"htcf7bbc4d1e","date":"2024-06-04","name":"Lykke","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","Bitcoin"],"usd":22400000.0,"lo":22400000.0,"hi":22400000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/somaxbt/status/1799812652610511043"}],"desc":"Lykke cryptocurrency exchange hot wallet was compromised by Lazarus Group, resulting in the theft of 158 BTC and 2,161 ETH (~CHF 22.8M / ~$22.4M). The stolen assets represented approximately one-third of Lykke's total holdings, leading to the exchange halting all trading and eventually declaring bankruptcy.","theft":true},{"id":"ht0df098d7fc","date":"2024-06-04","name":"Lykke exchange hacked for over $23 million","kind":"hack","fam":"other","usd":2360000.0,"lo":2360000.0,"hi":2360000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lykke-hack"}],"theft":true,"headline":true},{"id":"ht3e40812735","date":"2024-06-03","name":"NCD","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":20000.0,"lo":6400.0,"hi":20000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1797821034319765604"}],"desc":"According to monitoring by the SlowMist security team, NCD on BNBChain was attacked, resulting in a loss of approximately $20,000.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht13e8e67f40","date":"2024-06-01","name":"Velocore V2","kind":"hack","fam":"code","tech":"Incorrect Fee Accounting","target":"DeFi Protocol","chains":["Linea","zkSync Era","Ethereum"],"usd":6800000.0,"lo":6800000.0,"hi":6880000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/velocore-rekt"},{"s":"SlowMist Hacked","u":"https://velocorexyz.medium.com/velocore-incident-post-mortem-6197020ec3e9"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/velocore-hack"}],"desc":"Velocore V2 was exploited for ~$6.8M when a fee rate calculation allowed values exceeding 100%. The attacker used a flash loan to shrink the pool and trigger LP token underflow, creating excess LP tokens.","theft":true,"onchain":true},{"id":"ht1b18d72b6a","date":"2024-05-31","name":"DMM Bitcoin","kind":"hack","fam":"social","tech":"Phishing","target":"CEX","chains":["Bitcoin"],"usd":305000000.0,"lo":305000000.0,"hi":308000000.0,"ret":305000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dmm-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/3lu51z5z.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dmm-bitcoin-loss"}],"desc":"On May 31, 2024, DMM Bitcoin lost 48 billion yen ($305M) in bitcoin when North Korean Lazarus Group attackers compromised an employee, intercepted legitimate transactions, and drained the hot wallet. The exchange ultimately shut down and transferred to SBI VC Trade.","theft":true,"actor":"North Korea (TraderTraitor)","attr":{"by":"FBI, DC3 and Japan NPA","date":"2024-12-23","title":"FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com","url":"https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom"},"official":"$308M","note":"The FBI release describes the theft, not a recovery. DefiLlama's returned figure here should be read as losses covered, not funds recovered."},{"id":"htaca7e0f7fa","date":"2024-05-31","name":"TLN Protocol","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":280000.0,"lo":280000.0,"hi":280000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1796475220372709776"}],"desc":"TLN Protocol's lending market smart contract was exploited through an undisclosed vulnerability. The attacker drained approximately $280,000 in assets, which were subsequently laundered through Tornado Cash.","theft":true},{"id":"ht516d865598","date":"2024-05-31","name":"Liquiditytokens","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"C","n":1,"theft":true},{"id":"ht4ec1c5dae6","date":"2024-05-31","name":"MixedSwapRouter","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Arbitrum"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1796469028858573023"}],"desc":"MixedSwapRouter on Arbitrum was exploited through an arbitrary external call vulnerability that allowed unauthorized token transfers from the protocol.","theft":true},{"id":"ht9885d00b86","date":"2024-05-29","name":"MetaDragon","kind":"hack","fam":"code","tech":"Improper Access Control","target":"NFTfi","chains":["BNB Chain"],"usd":181000.0,"lo":180000.0,"hi":181000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/MetaDragonDao/status/1795750901820665925"}],"desc":"MetaDragon's NFT contract lacked ownership verification on minted NFTs, allowing attackers to claim and convert over 4,000 NFTs belonging to other users. The attacker sold the stolen META tokens for 321.5 BNB.","theft":true},{"id":"ht46f1ca3eee","date":"2024-05-28","name":"Orion Protocol","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":645000.0,"lo":616000.0,"hi":645000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1795326102157816192"}],"desc":"Orion Protocol was exploited via inadequate access control in the PredyPool contract's trade() function. Attackers manipulated the liabilities array and drained liquidity from trading pairs using flash loans.","theft":true},{"id":"ht388792642f","date":"2024-05-28","name":"EXcommunity","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":37000.0,"lo":37000.0,"hi":37000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1795648617530995130"}],"desc":"EXcommunity was attacked through an undisclosed smart contract vulnerability, resulting in $37,000 in losses. The project team continued operations and announced plans for enhanced security measures.","theft":true},{"id":"hta9edea9c19","date":"2024-05-28","name":"Scroll Token","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The Scroll Token contract contained an arithmetic error in its transfer function allowing integer underflow from zero-balance addresses. Attackers exploited this to mint unlimited tokens, causing the price to collapse 99.99%.","theft":true,"onchain":true},{"id":"ht79a9106112","date":"2024-05-28","name":"Tradeonorion","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht55470f0f8e","date":"2024-05-27","name":"Memecoin team accused of hacking influencer Twitter account to manipulate markets","kind":"other","fam":"other","chains":["Ethereum"],"usd":30500.0,"lo":30500.0,"hi":30500.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cat-memecoin-team-hacks-gcr"}],"headline":true},{"id":"htf1107c3215","date":"2024-05-27","name":"RedKeysGame","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":10584.0,"lo":10584.0,"hi":12000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1794975336192438494"}],"desc":"According to the SlowMist security team, RedKeysGame on BNBChain was attacked, resulting in a loss of approximately $10,000.","theft":true,"onchain":true},{"id":"ht925171a5ce","date":"2024-05-27","name":"Nicola Sebastiani","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/borgetsebastien/status/1794928910284496926"}],"desc":"Sebastiani, co-founder of The Sandbox, posted on X platform that one of The Sandbox team members was hacked and his Twitter account used to send SCAM tweets and DMs, disguised as if these were official.","theft":true},{"id":"ht7b5c39b285","date":"2024-05-26","name":"NORMIE","kind":"hack","fam":"code","tech":"Unknown","target":"Token","chains":["Base","Ethereum"],"usd":881843.0,"lo":490000.0,"hi":882000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/xes9udaz.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/normie-exploit"}],"desc":"NORMIE meme coin was exploited through a flash loan attack that manipulated the contract's tax logic. The attacker extracted 224.98 ETH by disabling taxes and triggering automatic token dumps. The exploiter offered 90% recovery.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht7f0b9ebe41","date":"2024-05-22","name":"YON","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":118000.0,"lo":118000.0,"hi":118000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"YON token's transferFrom function lacked proper permission validation, allowing an attacker's contract to drain tokens directly from the liquidity pool shortly after deployment. Attackers exploited this to steal 190 BNB.","theft":true,"onchain":true},{"id":"ht987c65f407","date":"2024-05-22","name":"TonUP","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["TON"],"usd":107600.0,"lo":107600.0,"hi":107600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/TonUP_io/status/1793006027413258631"}],"desc":"TonUP's staking contract was exploited due to incorrect parameter configuration, allowing attackers to steal 307,264 tokens worth approximately $107,600. The team quickly suspended redemption and bought back stolen tokens.","theft":true},{"id":"htde44c929fb","date":"2024-05-22","name":"Rho Markets","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/370796"}],"desc":"The official Twitter account of Scroll's liquidity layer, Rho Markets, was hacked and posted suspicious links.","theft":true},{"id":"htb69a2dea0c","date":"2024-05-21","name":"Burner","kind":"hack","fam":"other","tech":"sandwich ack","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf949eb8004","date":"2024-05-20","name":"Gala","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":21800000.0,"lo":21451000.0,"hi":22300000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gala-games-rekt"},{"s":"SlowMist Hacked","u":"https://x.com/Benefactor0101/status/1792698768166715776"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gala-games-hack"}],"desc":"Gala Games minter private key was compromised on May 20, 2024, allowing minting of 5B GALA tokens (~$200M). The unused and unrotated key was likely stolen; attacker sold ~$200M before returning $22M (~11% recovery).","theft":true},{"id":"ht665225fd23","date":"2024-05-17","name":"Crypto scam money launderers charged for laundering more than $73 million through Deltec","kind":"fraud","fam":"insider","usd":73000000.0,"lo":73000000.0,"hi":73000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-scam-money-launderers-charged-for-laundering-more-than-73-million-through-deltec"}],"headline":true},{"id":"ht4b482e1fef","date":"2024-05-16","name":"pump.fun","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Solana"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://x.com/pumpdotfun/status/1791235050643636303"}],"desc":"pump.fun exploited on May 16, 2024 when a former employee retained access to a service account after leaving. The attacker flash-loaned SOL, used it to complete bonding curves to 100%, then drained the released liquidity (~$1.9M-$2M or ~12,300 SOL) to repay the loans.","theft":true},{"id":"ht503163b8a0","date":"2024-05-16","name":"Fake Notcoin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":281300.0,"lo":281300.0,"hi":281300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Notcoin on ETH is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true},{"id":"hta03bb4e814","date":"2024-05-16","name":"TCH","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":19000.0,"lo":18000.0,"hi":19000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/SlowMist_Team/status/1791358365194650094"}],"desc":"According to the SlowMist security team's monitoring, the TCH token on the BNBChain has been continuously attacked due to a malleability issue, resulting in a loss of approximately $19,000.","theft":true,"onchain":true},{"id":"htd0b58956ba","date":"2024-05-15","name":"Brothers indicted for $25 million MEV bot exploit","kind":"followup","fam":"other","chains":["Ethereum"],"usd":25000000.0,"lo":25000000.0,"hi":25000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/peraire-bueno-mev-indictment"}],"headline":true},{"id":"ht4fd4a4e3da","date":"2024-05-15","name":"ALEX","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Stacks","Bitcoin","BNB Chain","Ethereum"],"usd":4300000.0,"lo":4300000.0,"hi":6300000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/alexlab-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/ALEXLabBTC/status/1790611871986331855"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alex-xlink-bridge-theft"}],"desc":"On May 15-16, 2024, Alex Lab's XLink bridge private key was compromised through a phishing attack attributed to state-sponsored actors. Attackers transferred approximately $300,000 in BTC, $3.3M in stablecoins, and $75,000 in SKO tokens across the bridge.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht96168ba2b8","date":"2024-05-15","name":"BlockTower Capital","kind":"fraud","fam":"insider","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/5umc1gh3.html"}],"desc":"BlockTower Capital’s main hedge fund has been compromised and partially drained by fraudsters. The company has $1.7 billion in assets under management. Despite hiring blockchain forensic analysts to investigate the specifics of the fund theft and informing its limited partners of the incident, the stolen funds have yet to be recovered, and the hackers have not been apprehended."},{"id":"ht98dc22626b","date":"2024-05-14","name":"Sonne Finance","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sonne-finance-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sonne-finance-hack"}],"desc":"On May 15, 2024, Sonne Finance on Optimism was exploited for $20M through a donation attack. Market setup was split into separate timelock transactions, allowing the attacker to control execution order and manipulate collateral factors in a newly-created market before protective guards were applied.","theft":true,"onchain":true},{"id":"ht39c7521eba","date":"2024-05-14","name":"PI (PI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Polygon"],"usd":490000.0,"lo":490000.0,"hi":490000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The PI (PI) on Polygon is suspected of a rug pull, and the current token price has dropped by 100%, causing losses exceeding $490,000.","theft":true},{"id":"ht62d8095f93","date":"2024-05-14","name":"Predy Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Arbitrum"],"usd":464000.0,"lo":464000.0,"hi":464000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1790326798469001379"}],"desc":"Predy Finance's PredyPool contract lacked adequate access control in the take() function, allowing attackers to manipulate the liabilities array and drain liquidity from existing trading pairs via flash loans.","theft":true,"onchain":true},{"id":"htd93486d2b9","date":"2024-05-14","name":"Equalizer Exchange","kind":"hack","fam":"keys","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/Equalizer0x/status/1790245836716388554"}],"desc":"On May 14th, the decentralized trading protocol Equalizer Exchange within the Fantom ecosystem was suspected to have been attacked. The official team tweeted that they are investigating the incident and advised users not to interact with the Equalizer Exchange frontend. On May 15th, Equalizer Exchange announced that the domain has been restored.","theft":true},{"id":"htf84025ceee","date":"2024-05-13","name":"Cypher contributor admits to stealing over $300,000 due to \"crippling gambling addiction\"","kind":"hack","fam":"other","chains":["Solana"],"usd":316294.0,"lo":316294.0,"hi":316294.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cypher-contributor-theft"}],"theft":true,"headline":true},{"id":"ht7a1513e602","date":"2024-05-13","name":"Patton","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":266000.0,"lo":266000.0,"hi":266000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Patton on the ETH appears to have exit scammed, resulting in a 100% price drop and causing losses exceeding $260,000.","theft":true},{"id":"ht9724b2227e","date":"2024-05-12","name":"TGC","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain","Ethereum"],"usd":32000.0,"lo":32000.0,"hi":32000.0,"conf":"C","n":1,"theft":true},{"id":"ht8aeaa936ec","date":"2024-05-10","name":"Tsuru","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Base"],"usd":410000.0,"lo":410000.0,"hi":410000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1788936928634834958"}],"desc":"Tsuru on Base suffered a smart contract vulnerability due to insufficient validation, resulting in losses of 137.78 ETH. The vulnerability allowed unauthorized fund extraction from the protocol.","theft":true,"onchain":true},{"id":"htd9e373e48c","date":"2024-05-10","name":"Galaxy Fox","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["Ethereum"],"usd":330000.0,"lo":300000.0,"hi":330000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1788757935017079258"}],"desc":"Galaxy Fox token's setMerkleRoot function was publicly accessible without access control, allowing attackers to manipulate the merkle root and falsely claim 108 ETH from the contract's funds.","theft":true},{"id":"ht123566990f","date":"2024-05-10","name":"GFOX","kind":"hack","fam":"code","tech":"lack of access control","chains":["Ethereum"],"usd":330000.0,"lo":330000.0,"hi":330000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3630bb31b7","date":"2024-05-09","name":"Bloom","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Blast"],"usd":540000.0,"lo":540000.0,"hi":540000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BloomOnBlast/status/1788695722952421689"}],"desc":"Bloom was exploited through a mint vulnerability on the Blast blockchain, resulting in $540,000 in losses. The team negotiated with the exploiter who offered a 10% bug bounty, recovering 90% of stolen funds for redistribution to liquidity providers.","theft":true},{"id":"ht1c8dce9814","date":"2024-05-09","name":"Fake Lifeform (LFT)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":243000.0,"lo":243000.0,"hi":243000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Lifeform (LFT) on Ethereum is suspected of an exit scam. The deployer called removeLimits() backdoor to mint additional tokens and dump them on the dex pair to drain 81 ETH (~$243K).","theft":true},{"id":"htc22d12622f","date":"2024-05-09","name":"NEAR Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/952pm5it.html"}],"desc":"The official Twitter account of the public chain project NEAR Protocol appears to have been compromised. Currently, its profile picture on Twitter has been changed to a solid black image, and its bio has been updated to display the word \"Dark\" with garbled characters. Around 4 AM, several strange tweets with garbled characters were posted, including \"re claim your sovereig nty,\" \"darkness,\" \"take back your,\" and \"The sun rises in the east.\" As of now, NEAR has not provided any explanation on its other official social media channels.","theft":true},{"id":"htafb2583582","date":"2024-05-08","name":"GPU","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"usd":32000.0,"lo":32000.0,"hi":32400.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1788153412019978733"}],"desc":"GPU token's balance update logic did not properly account for self-transfers, allowing attackers to arbitrarily inflate their balance by repeatedly transferring tokens to themselves. The vulnerability was amplified via flash loans.","theft":true},{"id":"ht60215cf78c","date":"2024-05-06","name":"Perpy","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":132000.0,"lo":132000.0,"hi":132000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://perpy-finance.beehiiv.com/p/update-recent-exploit"}],"desc":"Perpy Finance's staking contract proxy was not properly initialized, allowing attackers to invoke initialization functions and gain control. The attacker updated the contract and withdrew 58.489M PRY tokens worth 41.895 ETH.","theft":true},{"id":"ht796b45be42","date":"2024-05-06","name":"OSN","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":110000.0,"lo":109000.0,"hi":110000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1787330586857861564"}],"desc":"OSN on BNBChain is suspected to have been attacked. The attacker initiated multiple attack transactions, resulting in a loss of ~$110K. The attacker took advantage of the OSNLpDividendTracker contract which sells its own tokens as a reward for users adding liquidity.","theft":true},{"id":"htc56d2f1eb2","date":"2024-05-06","name":"SATURN","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":9000.0,"lo":8343.0,"hi":9000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"SATURN's transfer logic had a flaw where sync operations were performed before processing incoming token transfers. This allowed attackers to manipulate token reserves via flash loans and extract approximately 15 WBNB from the pool.","theft":true,"onchain":true},{"id":"ht520ca43867","date":"2024-05-05","name":"GeniusAI","kind":"hack","fam":"social","tech":"Social Account Takeover","target":"DeFi Protocol","chains":["Fantom","Ethereum","Polygon"],"usd":1270000.0,"lo":1270000.0,"hi":1270000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GnusAi/status/1787118358862942361"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gnusai-exploi"}],"desc":"Gnus.AI suffered a $1.27M exploit on May 5, 2024 when a Discord breach exposed the team's deployment wallet private key. The attacker minted 100M fake GNUS tokens on Fantom, bridged them to Ethereum, and sold them into Uniswap pools, crashing the price 95%.","theft":true},{"id":"ht04936d5e59","date":"2024-05-03","name":"Wallet loses over $72 million to address poisoning","kind":"hack","fam":"other","chains":["Bitcoin","Ethereum"],"usd":72700000.0,"lo":72700000.0,"hi":72700000.0,"ret":65500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0x1e227-address-poisoning"}],"theft":true,"headline":true},{"id":"ht32445e8dc0","date":"2024-05-02","name":"NOVAMIND_ (NMD)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":123000.0,"lo":123000.0,"hi":123000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"NOVAMIND_ (NMD) on ETH is suspected of a rug pull. ~41 ETH (~$123k) was transferred to a multisig and the token price has dropped ~97%.","theft":true},{"id":"ht84f4f7e1df","date":"2024-04-30","name":"Pike Finance","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":1680000.0,"lo":1680000.0,"hi":1680000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PikeFinance/status/1785572875124330644"}],"desc":"On April 30th, the cross-chain lending protocol Pike Finance tweeted that its Pike Beta protocol had been attacked, resulting in losses of 99,970.48 ARB, 64,126 OP, and 479.39 ETH. The exploit was caused by weak security measures in Pike's contract functions when handling CCTP transfers. On April 26th, Pike Finance's USDC pool was hacked, resulting in losses of approximately $300,000.","theft":true},{"id":"htee5e007d92","date":"2024-04-30","name":"Pike V1","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"DeFi Protocol","chains":["Ethereum","Optimism","Arbitrum"],"usd":1600000.0,"lo":299127.0,"hi":2000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/pike-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/PikeFinance/status/1783989069212799321"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pike-finance-hacks"}],"desc":"Pike upgraded spoke contracts with new dependencies that altered storage layout, particularly the 'initialized' variable. On April 30, 2024, this storage misalignment allowed attackers to upgrade contracts, bypass admin access, and withdraw funds. The second exploit involved 99,970 ARB, 64,126 OP, and 479.39 ETH.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htcf8c2345d3","date":"2024-04-30","name":"Yield Protocol","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Arbitrum"],"usd":181000.0,"lo":181000.0,"hi":181000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/367002"}],"desc":"In April 2024, an attacker drained $181,000 from Yield Protocol on Arbitrum by exploiting a logic error in pool token accounting. Using flash-loaned assets, the attacker created a discrepancy between actual token balance and recorded total supply, then withdrew excess tokens.","theft":true,"onchain":true},{"id":"htfbe9ae5030","date":"2024-04-30","name":"Dune","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DuneAnalytics/status/1785006061348340133"}],"desc":"The blockchain data analysis platform Dune tweeted that its account was compromised earlier today and a fake post about a Dune Airdrop was live for about 15 minutes. The Dune team now has control over the account again.","theft":true},{"id":"ht5b200575a7","date":"2024-04-29","name":"Rain","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin","Ethereum","XRP","Solana","ripple"],"usd":14800000.0,"lo":14800000.0,"hi":16130000.0,"ret":1330000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/u54xv6ns.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rain-hack"}],"desc":"Rain lost ~$14.8M on April 29, 2024 when exchange wallet private keys were compromised across four chains (BTC, ETH, SOL, XRP). Stolen assets were consolidated into 137.9 BTC and 1,881 ETH via instant exchanges; the breach wasn't disclosed until ZachXBT surfaced it two weeks later.","theft":true},{"id":"ht79bf9b57ed","date":"2024-04-28","name":"Ember Sword NFT","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":195000.0,"lo":195000.0,"hi":195000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.binance.com/en/square/post/2024-04-28-unverified-ember-sword-nft-auction-contract-vulnerability-detected-users-cautioned-7364618042609"}],"desc":"A vulnerability has been detected in the unverified Ember Sword NFT auction that allowed the extraction of 60 WETH, equivalent to approximately $195,000, from 159 victims who approved the contract.","theft":true},{"id":"ht298b9a43cc","date":"2024-04-27","name":"xBank Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["zkSync Era"],"usd":550000.0,"lo":550000.0,"hi":550000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/366578"}],"desc":"According to feedback from multiple community members, the zkSync ecosystem lending platform @xBankFinance is suspected of a rug pull. Currently, the official account displays that it has been frozen, and the platform's liquidity is reduced to single-digit assets.","theft":true},{"id":"ht4e284e8bd9","date":"2024-04-27","name":"BNBX","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On April 27, 2024, the BNBX token on BSC was exploited via a precision loss vulnerability in arithmetic operations, allowing attackers to manipulate token accounting and extract value. The exact amount extracted was not publicly disclosed.","theft":true,"onchain":true},{"id":"ht7135f5c476","date":"2024-04-26","name":"Fake IO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":289097.0,"lo":289097.0,"hi":289097.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake IO on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"htc2642e8161","date":"2024-04-25","name":"FENGSHOU","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":191000.0,"lo":191000.0,"hi":191000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ddimitrovv22/status/1784223165251489952"}],"desc":"On April 25, 2024, the FENGSHOU (NGFS) token on BSC was exploited via a public delegateCallReserves function with insufficient access control. An attacker set their own contract as the UniSwap proxy and executed arbitrary code within the vulnerable contract, extracting approximately $191K.","theft":true,"onchain":true},{"id":"ht6011b7a6de","date":"2024-04-25","name":"io.net","kind":"hack","fam":"keys","tech":"Security Vulnerability","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/shadid_io/status/1783499497177256010"}],"desc":"io.net founder and CEO Ahmad Shadid announced on social media that io.net's metadata APIs recently experienced a security incident. A malicious party exploited accessible mappings of User IDs to Device IDs, leading to unauthorized metadata updates. This breach did not compromise GPU access but did affect the metadata displayed to users on the frontend.","theft":true},{"id":"ht90e09f598e","date":"2024-04-24","name":"Instagram influencer Jay Mazini sentenced to seven years in prison for crypto fraud","kind":"followup","fam":"other","usd":8000000.0,"lo":8000000.0,"hi":8000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/jay-mazini-sentenced"}],"headline":true},{"id":"htab8d040a6d","date":"2024-04-24","name":"XBridge","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","target":"Bridge","usd":1440000.0,"lo":1440000.0,"hi":1440000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The cross-chain bridge project XBridge was exploited due to a smart contract vulnerability on the Ethereum Mainnet and the BNB chain, resulting in a loss of approximately $1.44 million.","theft":true,"onchain":true},{"id":"ht26119cdbb1","date":"2024-04-24","name":"XBridge","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":824000.0,"lo":200000.0,"hi":1440000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/6xjzb1bo.html"}],"desc":"XBridge cross-chain bridge built by SaitaChain was exploited on April 24, 2024 on Ethereum and BNB Chain when unprotected listToken and withdrawTokens functions allowed attacker to register as token owner and drain bridge-held assets.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht721526e236","date":"2024-04-24","name":"YIEDL","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":150000.0,"lo":150000.0,"hi":300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1782962346039898473"}],"desc":"On April 24, 2024, the YIEDL protocol on BSC was exploited via insufficient input validation on the dataList parameter in the redeem function. An attacker bypassed redemption share requirements by manipulating the dataList parameter and profited from repeated token exchanges totaling approximately $150K.","theft":true,"review":["sources disagree on the loss"]},{"id":"htad824991ca","date":"2024-04-24","name":"Merlin","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/stv5ix5p.html"}],"desc":"According to community feedback, the official Discord server of Merlin Chain appears to have been targeted in a hacker attack, where a management account posted a notification containing a phishing link.","theft":true},{"id":"ht0212a99784","date":"2024-04-23","name":"Fake Safe Token (SAFE)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":752683.0,"lo":752683.0,"hi":752683.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Fake Safe Token (SAFE) on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true},{"id":"ht2bd0aa0482","date":"2024-04-23","name":"Magpie Protocol","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum","Polygon","BNB Chain","Blast","Avalanche","Arbitrum","Optimism","Base","zkSync Era","Polygon zkEVM"],"usd":129000.0,"lo":129000.0,"hi":129000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@Magpieprotocol/magpie-protocol-smart-contract-vulnerability-post-mortem-f6400db0a25e"}],"desc":"On April 23, 2024, Magpie Protocol's MagpieRouterV2 was exploited for $129K affecting 221 wallets. The router validated selector presence but not position, allowing attackers to embed selectors in call data to bypass access controls.","theft":true},{"id":"ht067e37c4de","date":"2024-04-23","name":"Velvet Capital","kind":"hack","fam":"keys","tech":"Unknown","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Velvet_Capital/status/1782634864392429704"}],"desc":"Users reported abnormal activity on the trading platform of the DeFi asset management protocol Velvet Capital on April 23rd. When attempting to connect to the frontend, users were prompted to approve their wallet's access permissions for the protocol.","theft":true},{"id":"htf6d8ae6a0a","date":"2024-04-22","name":"Z123","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":136000.0,"lo":136000.0,"hi":136000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1782324056647516180"}],"desc":"On April 22, 2024, the Z123 token on BSC was exploited via a flashloan-enabled price manipulation attack. An attacker used a flashloan to acquire large token quantities and manipulate the trading pair price, extracting approximately $136K before repaying the flashloan.","theft":true,"onchain":true},{"id":"ht08a5e625a7","date":"2024-04-22","name":"Fake Cruiz (CRUIZ)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":38556.0,"lo":38556.0,"hi":38556.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Fake Cruiz (CRUIZ) on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true},{"id":"ht38b81fa384","date":"2024-04-20","name":"ZKasino","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["zkSync Era","Ethereum"],"usd":33000000.0,"lo":33000000.0,"hi":33000000.0,"conf":"A","n":3,"src":[{"s":"rekt.news","u":"https://rekt.news/zkasino-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/j5ci23yx.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zkasino-rug-pull"}],"desc":"The decentralized betting platform ZKasino is suspected to have exited. Recently, users on Twitter reported that ZKasino removed the message \"Ethereum will be returned and can be bridged back\" from the Bridge Funds interface, causing users to be unable to withdraw. Subsequently, the project team transferred the ETH assets deposited by users to the 0x791 multi-signature address, and then deposited them into the staking protocol Lido for yield farming.","theft":true},{"id":"ht06f9180af4","date":"2024-04-20","name":"Rico","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Arbitrum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On April 20, 2024, the Rico protocol on Arbitrum was exploited via an arbitrary external call vulnerability. An attacker was able to execute unauthorized calls within the vulnerable contract, extracting funds. The exact amount was not publicly disclosed.","theft":true,"onchain":true},{"id":"ht591a51c2ae","date":"2024-04-19","name":"Hedgey","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":44700000.0,"lo":44700000.0,"hi":48000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hedgey-finance-rekt"},{"s":"SlowMist Hacked","u":"https://cryptonews.com/news/hedgey-finance-suffers-dual-exploits-losing-44-7-million-in-funds.htm"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hedgey-finance-hack"}],"desc":"Hedgey Finance drained for $44.7M (USDC, NOBL, MASA, BONUS) from Arbitrum and Ethereum vaults. Attacker exploited missing validation in createLockedCampaign, using flashloans to bypass access controls and create fraudulent approvals.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htfab90f46d9","date":"2024-04-19","name":"Meson Finance","kind":"hack","fam":"bridge","tech":"Account Compromise","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1781212216605479277"}],"desc":"The Twitter account of the cross-chain bridge Meson Finance posted a tweet containing a phishing link. Meson Finance tweeted that the relevant content has been deleted and confirmed that the issue originated from a third-party API rather than a direct attack on the account.","theft":true},{"id":"htdd0ecc8ca0","date":"2024-04-17","name":"PRCL","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake PRCL on the BNB Chain appears to have exit scammed,  resulting in a 100% price drop and causing losses exceeding $100,000.","theft":true},{"id":"htba85bfb6dc","date":"2024-04-17","name":"UnverifiedContr_0x00C409","kind":"hack","fam":"other","tech":"unverified external call","conf":"C","n":1,"theft":true},{"id":"ht4fa1ba3934","date":"2024-04-16","name":"Mars","kind":"hack","fam":"other","tech":"Unknown","chains":["BNB Chain"],"usd":98000.0,"lo":98000.0,"hi":98000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Mars_DeFi412/status/1780154384107946332"}],"desc":"Token issuance protocol Mars was attacked and lost about 1M MARS 和 137 个 WBNB.","theft":true},{"id":"hte2b7cba758","date":"2024-04-16","name":"SATX","kind":"hack","fam":"code","tech":"Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2cb3e35541","date":"2024-04-15","name":"Grand Base","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":1972305.0,"lo":1700000.0,"hi":2000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/grand-base"},{"s":"SlowMist Hacked","u":"https://twitter.com/grandbase_fi/status/1779842048234840261"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/grand-base-theft"}],"desc":"On April 15, 2024, Grand Base, a real-world asset tokenization platform on Base, was exploited when a developer PC was hacked, exposing the deployer wallet with token minting and LP control. The attacker minted 808.57 ETH worth of GB tokens (~$1.7-2.5M) and sold them, causing a >99% price crash.","theft":true},{"id":"ht5a95798af9","date":"2024-04-15","name":"Chainge Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["BNB Chain"],"usd":716000.0,"lo":716000.0,"hi":716000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On April 15, 2024, ChaingeFinance on BSC was exploited via arbitrary external call in the swap function. Both the target contract and callData parameters were controllable, allowing attackers to execute unauthorized transferFrom calls on victim accounts, draining all approved tokens.","theft":true,"onchain":true},{"id":"ht2114181375","date":"2024-04-15","name":"Fake JILLBODEN","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":335339.0,"lo":335339.0,"hi":335339.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake JILLBODEN on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht571730cf1b","date":"2024-04-15","name":"Fake VDZ","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":323088.0,"lo":323088.0,"hi":323088.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake VDZ on BNBChain is suspected of a rug pull, and the current token price has dropped by 100%.","theft":true},{"id":"ht99728c5e65","date":"2024-04-14","name":"GFA token","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":15000.0,"lo":14000.0,"hi":15000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The GFA token was exploited on the BNB chain, which resulted in a loss of assets worth approximately $15,000. The root cause of the exploit is a lack of access control. The vulnerable contracts had functions for calculating rewards, for which anyone could invoke a call to them. The hacker was able to manually calculate and generate the rewards and drain the tokens. The exploiter has already laundered the stolen assets into Tornado Cash.","theft":true,"onchain":true},{"id":"ht5047603d93","date":"2024-04-14","name":"Leaper Finance","kind":"fraud","fam":"insider","tech":"Scam","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1779333168383791411"}],"desc":"According to on-chain analyst ZachXBT's monitoring, the group of scammers who stole 8 figs with Magnate, Kokomo, Lendora, Solfire, etc is back with a new project on Blast @Leaperfinance. Last week they funded an address on Blast with ~$1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in. Over time, the fraudulent team increased their TVL to over a million dollars, then stole all user funds deposited into the protocol, and forged KYC documents using low-level auditing companies. Currently, this fraudulent group has initiated scams on platforms such as Base, Solana, Scroll, Optimism, Arbitrum, Ethereum, and Avalanche."},{"id":"ht048063e24f","date":"2024-04-14","name":"Hackathon","kind":"hack","fam":"code","tech":"business logic flaw","conf":"C","n":1,"theft":true},{"id":"hte87fa346b4","date":"2024-04-12","name":"Australian DCA Fund collapses with up to $65 million owed to creditors","kind":"collapse","fam":"insider","usd":65000000.0,"lo":65000000.0,"hi":65000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dca-fund-collapse"}],"headline":true},{"id":"htf3bccfd591","date":"2024-04-12","name":"Australian NGS Crypto mining fund collapses","kind":"collapse","fam":"insider","usd":42000000.0,"lo":42000000.0,"hi":42000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ngs-crypto-mining-fund-collapses"}],"headline":true},{"id":"htebd1c64ce9","date":"2024-04-12","name":"Zest","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Stacks"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ZestProtocol/status/1778533650520490342"}],"desc":"On April 12, 2024, Zest Protocol on Stacks was exploited during its public launch via collateral list manipulation. An attacker repeated collateral entries to artificially inflate their perceived collateral value, borrowed well beyond their actual holdings, and removed 322K STX (approximately $1M). Zest paused contracts, offered a $100K bounty, and promised treasury-backed reimbursement.","theft":true},{"id":"ht33b0355b3c","date":"2024-04-12","name":"Fake Masa","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":502000.0,"lo":502000.0,"hi":502000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Masa on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht8439b32e2d","date":"2024-04-12","name":"Sumer.money","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Base"],"usd":350000.0,"lo":310000.0,"hi":350000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On April 12, 2024, SumerMoney (a Compound fork) on Base was exploited via reentrancy vulnerability. An attacker used a flashloan and reentrancy call to manipulate exchange rates and redeem collateral at inflated rates, extracting approximately $310K worth of assets while bypassing proper accounting.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht6f9e0846c7","date":"2024-04-12","name":"Sumer Money","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Base"],"usd":310000.0,"lo":310000.0,"hi":310000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Sumer Money was exploited on the Base chain due to a smart contract vulnerability, which resulted in a loss of assets worth approximately $310,000.","theft":true,"onchain":true},{"id":"ht65742128a9","date":"2024-04-12","name":"FIL314","kind":"hack","fam":"market","tech":"Insufficient Validation And Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbab2de5561","date":"2024-04-12","name":"GROKD","kind":"hack","fam":"code","tech":"lack of access control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htf1a0db084a","date":"2024-04-11","name":"Fake Monad","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":266000.0,"lo":266000.0,"hi":266000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Monad on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht1afca21a5d","date":"2024-04-11","name":"Empower AI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":237500.0,"lo":237500.0,"hi":237500.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The price of Empower AI (EMPAI) on Ethereum has dropped by 100%. A whale 0xE4808...f3bA has dumped 1,000,000,000,000 EMPAI for about 66.44 WETH (valued at around $23,750).","theft":true},{"id":"htb3464c1f95","date":"2024-04-10","name":"Fake Oasis AI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":301600.0,"lo":301600.0,"hi":301600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Oasis AI on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht3aeac014fe","date":"2024-04-10","name":"Fake Truflation","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":256600.0,"lo":256600.0,"hi":256600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Truflation on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"review":["possible duplicate within one source"]},{"id":"htd16db71dba","date":"2024-04-10","name":"Jupiter","kind":"hack","fam":"other","tech":"DDoS Attack","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/JupiterExchange/status/1777947113361695053"}],"desc":"Jupiter, a trading aggregator in the Solana ecosystem, tweeted that they noticed a large number of spam bots hitting our RPCs and limited them. Users are advised to try their operations again. The team is working super hard on helping users in this new congested environment and dealing with extraordinary volume.","theft":true},{"id":"ht729ed2776d","date":"2024-04-10","name":"BigBangSwap","kind":"hack","fam":"other","tech":"precission loss","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"hta0a6ff85ff","date":"2024-04-09","name":"$23 million goes missing amid STFIL claims that they're being investigated","kind":"fraud","fam":"insider","usd":23000000.0,"lo":23000000.0,"hi":23000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stfil-investigation"}],"headline":true},{"id":"ht54b33e5602","date":"2024-04-09","name":"xBlast","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Token","chains":["Ethereum"],"usd":84500.0,"lo":84500.0,"hi":84500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/xblast_app/status/1777522669073944929"}],"desc":"On April 9, 2024, the xBlast protocol's main wallet was compromised and the attacker transferred XBL tokens worth approximately 22 ETH (~$84.5K) to an alternate address and sold them. xBlast responded with plans to deploy new XB tokens and provide fair compensation to affected users.","theft":true},{"id":"ht3df57cd774","date":"2024-04-08","name":"MuskSwap and related projects exit scam for over $5 million","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":5100000.0,"lo":5100000.0,"hi":5100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/muskswap-exit-scam"}],"theft":true,"headline":true},{"id":"ht0cab2f5f68","date":"2024-04-08","name":"SQUID","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":87000.0,"lo":87000.0,"hi":87000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On April 8, 2024, the SQUID Game Coin on BSC was exploited via swap logic vulnerability in the SquidTokenSwap contract. An attacker used a flashloan to acquire 163M SQUID tokens, then exploited the V2 PancakeSwap interaction to drain approximately $87K through unintended arbitrage opportunities.","theft":true,"onchain":true},{"id":"ht6f46943f03","date":"2024-04-08","name":"UPS","kind":"hack","fam":"code","tech":"Unknown","chains":["BNB Chain"],"usd":30000.0,"lo":28000.0,"hi":30000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"UPS on BNBChain was attacked and lost ~$30K.","theft":true,"onchain":true},{"id":"ht16029a2cb7","date":"2024-04-04","name":"CondomSOL","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":922000.0,"lo":922000.0,"hi":922000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/NippleBNB/status/1775653467828171204"}],"desc":"CondomSOL on Solana has exited, and its Twitter account is no longer accessible. The wallet associated with CondomSOL raised 4,965 SOL, equivalent to approximately $922,000.","theft":true},{"id":"ht7e91fb34ae","date":"2024-04-04","name":"Wall Street Memes","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Wall Street Memes (WSM)’s pre-sale contract was attacked, resulting in a loss of ～2.5M WSM, worth of ~$18,000.","theft":true,"onchain":true},{"id":"ht7ff2cf35e3","date":"2024-04-04","name":"wsm","kind":"hack","fam":"other","tech":"manipulating price","chains":["BNB Chain"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4399e5bbcd","date":"2024-04-04","name":"Robinson Burkey","kind":"hack","fam":"bridge","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/362540"}],"desc":"The Twitter account of Wormhole co-founder Robinson Burkey was hacked, and a suspicious link was posted.","theft":true},{"id":"htb23b68c75a","date":"2024-04-03","name":"Avolend Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":253000.0,"lo":253000.0,"hi":253000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/mouisaac/status/1775192739275244024?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"In the Blast ecosystem, the project Avolend Finance is suspected to be a rug pull. Currently, its official website and Twitter account cannot be accessed.","theft":true},{"id":"ht7387ce6093","date":"2024-04-03","name":"Project promising to rug pull raises almost $29,000","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":28878.0,"lo":28878.0,"hi":28878.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rug-pull-token"}],"theft":true,"headline":true},{"id":"hte51ba52b24","date":"2024-04-02","name":"HoppyFrogERC","kind":"hack","fam":"code","tech":"business logic flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"hta598406aaa","date":"2024-04-01","name":"OpenLeverage","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":236000.0,"lo":236000.0,"hi":260000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/OpenLeverage/status/1774734793990971462"}],"desc":"On April 1, 2024, OpenLeverage on BSC suffered a business logic vulnerability exploited via flashloan attack. An attacker manipulated protocol accounting to extract funds from the leveraged trading protocol. OpenLeverage's insurance and buyback funds were mobilized to compensate affected users.","theft":true},{"id":"ht945eb71fdd","date":"2024-04-01","name":"ATM","kind":"hack","fam":"code","tech":"business logic flaw","usd":182000.0,"lo":182000.0,"hi":182000.0,"conf":"C","n":1,"theft":true},{"id":"htff17703cba","date":"2024-03-31","name":"FixedFloat","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://ff.io/en/blog/news/reasons-for-hacking"}],"desc":"On March 31, 2024, FixedFloat exchange suffered a hosting control breach through Time4VPS vulnerability. An attacker exploited residual access after an earlier February incident. FixedFloat suspended operations for two months to rebuild security infrastructure and relocate servers away from the compromised hosting provider.","theft":true},{"id":"ht74b83e76cb","date":"2024-03-30","name":"Pendle Finance","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/tn_pendle/status/1773885858367811605"}],"desc":"The founder of yield-trading protocol Pendle Finance tweeted that the team has confirmed being unable to access the official Pendle Twitter account and is currently investigating to resolve the issue. During this period, hackers used the Pendle official Twitter account to post phishing links. On the same day, the Pendle founder tweeted that the team had regained control of the official Pendle Twitter account.","theft":true},{"id":"hta957713edd","date":"2024-03-29","name":"Solareum","kind":"hack","fam":"social","tech":"Social Account Takeover","target":"DeFi Protocol","chains":["Solana"],"usd":1000000.0,"lo":500000.0,"hi":1400000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=solana-drain-attacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/solana-drain-attacks"}],"desc":"On March 29, 2024 Solareum (Solana-based Telegram trading bot) suffered a major security breach when a North Korean developer hired by Solareum compromised users' private keys imported into the bot through insecure storage, likely via third-party service vulnerability. Over 6,045 SOL (valued at $1.4M) from approximately 300+ users were stolen.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht6a885930c4","date":"2024-03-29","name":"ETHFIN","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1200.0,"lo":1200.0,"hi":1240.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"ETHFIN smart contract exploited via an access control vulnerability allowing unauthorized calls to privileged functions.","theft":true,"onchain":true},{"id":"htf192b17870","date":"2024-03-28","name":"PrismaLST","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":11600000.0,"lo":11600000.0,"hi":12000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/prismafi-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/PrismaFi/status/1773316945430852058"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/prisma-finance-hack"}],"desc":"Prisma Finance was exploited on March 28, 2024 via a flash loan attack on MigrateTroveZap. The onFlashLoan callback lacked origin validation, allowing the attacker to spoof migration logic and hijack troves, extracting 3,257.69 ETH (~$11.6M) in collateral.","theft":true,"onchain":true},{"id":"ht366a79ec3b","date":"2024-03-28","name":"Lava","kind":"hack","fam":"code","tech":"Liquidation Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":340000.0,"lo":340000.0,"hi":340000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/LavaLending/status/1773571491587637329"}],"desc":"On March 28-29, 2024, Lava Lending on Arbitrum was exploited for $340K via calculation error in liquidation engine. Flashloan enabled improper collateral/debt evaluation; markets paused within 15 minutes of detection.","theft":true},{"id":"htcf054b8f02","date":"2024-03-27","name":"Decrypt","kind":"hack","fam":"keys","tech":"Account Compromised","usd":3000.0,"lo":3000.0,"hi":3000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/decryptmedia/status/1772844972817146066"}],"desc":"The email newsletter account of Web3 media company Decrypt has been compromised, and a phishing scam email has been sent to all of our subscribers. Please do not click on any links. Currently, the attacker has profited $3,000 through phishing.","theft":true},{"id":"ht4bdcf96725","date":"2024-03-26","name":"Munchables","kind":"hack","fam":"code","tech":"Proxy Upgrade Hijack","target":"Gaming","chains":["Blast","Ethereum"],"usd":62500000.0,"lo":62500000.0,"hi":62500000.0,"ret":62500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/munchables-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/flash/241090"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/munchables-hack"}],"desc":"On March 26, 2024 Munchables (gaming NFT project on Blast layer-2) suffered a $62.5 million exploit by a rogue developer (pseudonym 'Werewolves0943') hired to write the smart contracts who deliberately built in vulnerabilities, using control of the upgradeable proxy to assign themselves 1 million ETH and drain the protocol.","theft":true},{"id":"hte4763734ce","date":"2024-03-26","name":"LENX co-founder accused of $10 million rug pull","kind":"other","fam":"other","chains":["Bitcoin","Ethereum"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lenx-rug-pull"}],"headline":true},{"id":"htb95847a28c","date":"2024-03-25","name":"ZongZiFa","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":229000.0,"lo":229000.0,"hi":229000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1772184743053762886"}],"desc":"ZongZiFa token exploit where the attacker artificially inflated token price to profit from the protocol's invitation-reward mechanism, netting approximately 391 WBNB.","theft":true},{"id":"ht8d6bcbbc7f","date":"2024-03-24","name":"Curio","kind":"hack","fam":"code","tech":"Delegatecall Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/curio-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/flash/240546"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/curio-hack"}],"desc":"Curio exploited March 23-25, 2024 via access control flaw in voting power. Attacker with small CGT stake escalated voting power to execute delegatecall to malicious contract, minting ~1B CGT worth $16M.","theft":true},{"id":"htf5c59ce118","date":"2024-03-24","name":"ARK","kind":"hack","fam":"code","tech":"business logic flaw","conf":"C","n":1,"theft":true},{"id":"ht7fed76cf8b","date":"2024-03-23","name":"CGT","kind":"hack","fam":"code","tech":"Incorrect Access Control","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht5576d05a32","date":"2024-03-22","name":"Super Sushi Samurai","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Gaming","chains":["Blast","Ethereum"],"usd":4600000.0,"lo":4600000.0,"hi":4800000.0,"ret":4255000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sss-rekt"},{"s":"SlowMist Hacked","u":"https://s.foresightnews.xyz/news/detail/41275"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/super-sushi-samurai-exploit"}],"desc":"On March 21-22, 2024, the Super Sushi Samurai gaming token on Blast was exploited via a double-token transfer vulnerability in the mint function, allowing an attacker to drain approximately 1,310 ETH (~$4.6-4.8M). The attacker claimed to be a whitehat rescuer and offered reimbursement minus a 5% bounty.","theft":true},{"id":"hte7647eaf2c","date":"2024-03-22","name":"Lucky Star Currency","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":300000.0,"lo":297000.0,"hi":300000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=lucky-star-currency-rug-pull-2"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lucky-star-currency-rug-pull-2"}],"desc":"The astrology-based project Lucky Star Currency rug-pulled in October 2023, resulting in a loss of $1.1 million. On March 22, 2024, ownership of the project was transferred to a malicious smart contract, which then drained tokens valued at almost $300,000 from those who still held them.","theft":true},{"id":"hte65bb6ae16","date":"2024-03-21","name":"AirDAO","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Ethereum"],"usd":1050000.0,"lo":551540.0,"hi":1050000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/airdao_io/status/1770855600756281390"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/airdao-exploit"}],"desc":"AirDAO partner compromised via malicious email attachment carrying malware. Attackers gained access to liquidity pool keys and drained AMB tokens and ETH from Uniswap LP, netting approximately 125.51 ETH at realized prices.","theft":true,"review":["sources disagree on the loss"]},{"id":"htf6a86bb316","date":"2024-03-21","name":"TICKER","kind":"hack","fam":"insider","tech":"Insider Manipulation","chains":["Base","Ethereum"],"usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=ticker-rug-pull"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ticker-rug-pull"}],"desc":"TICKER project developer steals $900,000. A developer brought on to run a presale for the TICKER token stole $900,000 from the project. 15% of the token supply was sent to the developer to distribute via an airdrop, but instead of doing so, the developer sold the majority of the tokens for around $900,000.","theft":true},{"id":"ht5df5d99dd7","date":"2024-03-21","name":"SSS","kind":"hack","fam":"other","tech":"Token Balance Doubles on Transfer to self","chains":["Blast"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6b7cb636d4","date":"2024-03-20","name":"Dolomite","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Dolomite_io/status/1770499040741859645"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dolomite-exchange-hack"}],"desc":"An old Dolomite DEX contract on Ethereum (deployed 2019) was exploited via a reentrancy vulnerability. The attacker bypassed the noEntry reentrancy guard by calling the callFunction through the TradeManager contract, which lacked proper reentrancy protection, allowing recursive fund drainage from users who had approved the contract.","theft":true},{"id":"ht5f672785c1","date":"2024-03-20","name":"ParaSwap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":300000.0,"lo":24000.0,"hi":300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/bgv603ia.html"}],"desc":"Augustus V6 contract vulnerability allowed attackers to drain approved user wallets. 386 wallets were exposed; approximately $300K was stolen, with 90% returned after the main attacker's wallet was identified and frozen.","theft":true,"review":["sources disagree on the loss"]},{"id":"htb9f694d7fe","date":"2024-03-20","name":"LayerSwap","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/layerswap/status/1770679223876780091"}],"desc":"Attackers compromised LayerSwap's GoDaddy registrar account and redirected DNS to a phishing site, draining 50 users of $100K before the company regained access and began refunding users.","theft":true},{"id":"htc73e0efeba","date":"2024-03-20","name":"Trezor","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/zachxbt/status/1770225097552363795?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1770225097552363795%7Ctwgr%5E0ba4bb6530b9180869e"}],"desc":"On the X platform, on-chain investigator ZachXBT reported that the X account of hardware wallet provider Trezor was hacked.","theft":true},{"id":"ht50a68e39e6","date":"2024-03-19","name":"TON","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://t.me/investigations/106"}],"desc":"According to on-chain investigator ZachXBT, the X account of TON Blockchain has been compromised.","theft":true},{"id":"ht4627155a79","date":"2024-03-18","name":"Slerf memecoin meltdown only adds to mania","kind":"other","fam":"other","chains":["Solana"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/slerf-memecoin-meltdown-only-adds-to-mania"}],"headline":true},{"id":"ht6b2a726c7d","date":"2024-03-17","name":"Remilia","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"NFTfi","chains":["Ethereum"],"usd":6000000.0,"lo":5999945.0,"hi":6000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/_Enoch/status/1769228547619446975"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/remilia-collective-reports-multi-million-dollar-hack"}],"desc":"Remilia Collective's multisig was breached, likely via malware intercepting Bitwarden password manager credentials. Attackers stole ~490 ETH, USDC, and 130+ Milady NFTs, with floor-price valuation exceeding $6M.","theft":true},{"id":"ht7e7fc4fac1","date":"2024-03-17","name":"Fake Ansem","kind":"hack","fam":"keys","tech":"Social Engineering","chains":["Solana"],"usd":2600000.0,"lo":2600000.0,"hi":2600000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1769150002490638597"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ansem-twitter-impersonator"}],"desc":"According to blockchain investigator ZachXBT, an account impersonating Solana ecosystem KOL Ansem (@blknoiz06) capitalized on the recent meme coin craze to profit over $2.6 million through phishing.","theft":true},{"id":"ht2b022e934f","date":"2024-03-16","name":"Wilder World","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Ethereum"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=wilder-world-theft"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wilder-world-theft"}],"desc":"The deployer wallet of the NFT marketplace Wilder World was attacked, and ownership was transferred to the attacker. Following a malicious upgrade, the attacker withdrew WILD and MEOW tokens and converted them into approximately $1.8 million.","theft":true},{"id":"ht98c16ad162","date":"2024-03-15","name":"NFPrompt","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"NFTfi","chains":["Ethereum","BNB Chain"],"usd":3000000.0,"lo":3000000.0,"hi":10400000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/nfprompt/status/1768558658697433464"}],"desc":"NFPrompt's treasury and contract administrator wallets compromised, draining treasury and ecosystem fund. ~$3M net realized loss after token price impact; FBI involved; NFP price dropped 13.8% post-breach.","theft":true,"review":["sources disagree on the loss"]},{"id":"htb851b25f8c","date":"2024-03-15","name":"Mozaic","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"ret":1800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Mozaic_Fi/status/1768754080271196178"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mozaic-exploit"}],"desc":"Rogue developer stole a core team member's private key, gaining access to the bridgeViaLifi function. Attackers drained $2.4M, with 90% recovered after funds were frozen on MEXC exchange.","theft":true,"review":["possible duplicate within one source"]},{"id":"htfc73b59b82","date":"2024-03-14","name":"MOBOX","kind":"hack","fam":"code","tech":"Borrow Logic Flaw","target":"DeFi Protocol","chains":["Optimism"],"usd":750000.0,"lo":750000.0,"hi":750000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mobox-exploit"}],"desc":"MOBOX borrow function exploited by cyclically borrowing and redeeming funds while incrementally increasing loan amounts. Referral rewards were transferred back to the contract to inflate the next borrow, netting ~$750K USDT.","theft":true,"onchain":true},{"id":"htd7551ff047","date":"2024-03-14","name":"MO","kind":"hack","fam":"code","tech":"business logic flaw","usd":413000.0,"lo":413000.0,"hi":413000.0,"conf":"C","n":1,"theft":true},{"id":"ht139a7c175d","date":"2024-03-14","name":"Introspection Token","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":15200.0,"lo":15200.0,"hi":15200.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1768104947541840111"}],"desc":"On March 14, 2024, according to intelligence from the SlowMist security team, the IT token on the BSC was attacked, with the attacker profiting approximately $15,200. The attacker exploited the transfer function in the IT token, which allowed additional tokens to be minted to the pool based on the amount of tokens being exchanged, gradually increasing the reserve of IT tokens in the pool, manipulating the price, and continuously exchanging BSC-USD tokens from the pool for profit.","theft":true},{"id":"htccbeecb108","date":"2024-03-13","name":"Massachusetts prosecutors seek to seize $2.3 million from crypto romance scam","kind":"scam","fam":"social","usd":2300000.0,"lo":2300000.0,"hi":2300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/massachusetts-crypto-romance-scam"}],"theft":true,"headline":true},{"id":"ht93021800b9","date":"2024-03-13","name":"Phishing attack drains $2 million from one victim","kind":"scam","fam":"social","chains":["Ethereum"],"usd":2025000.0,"lo":2025000.0,"hi":2025000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/etherfi-phishing"}],"theft":true,"headline":true},{"id":"htc57bfef611","date":"2024-03-13","name":"Cloud AI","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"usd":360000.0,"lo":360000.0,"hi":360000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TheCloudAI/status/1767832941344800871"}],"desc":"The AI service provider Cloud AI reported that both their deployer and treasury account have been compromised by hackers. The attackers acquired 58,900 CloudAI tokens and some ETH. All CloudAI tokens have been exchanged for ETH. The total loss is approximately $360,000.","theft":true},{"id":"ht90e00a6e7d","date":"2024-03-13","name":"IT","kind":"hack","fam":"code","tech":"business logic flaw","usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"C","n":1,"theft":true},{"id":"htd277b6e604","date":"2024-03-12","name":"Polyhedra Network","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain"],"usd":760000.0,"lo":760000.0,"hi":760000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/40607"}],"desc":"Polyhedra Network's private key leaked, allowing attackers to drain 1.4M THENA tokens from BNB Chain. Team attributed the breach to human theft rather than smart contract vulnerability; zkBridge security unaffected.","theft":true},{"id":"ht28e1bce991","date":"2024-03-12","name":"BBT","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BBT smart contract exploited via business logic flaw in protocol's core functions. Specific mechanism and loss amount not disclosed but documented in DeFiHackLabs vulnerability database.","theft":true},{"id":"ht2cd5b7ca65","date":"2024-03-12","name":"beoble","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/a9qmb0zs.html"}],"desc":"The Twitter account of Web3 chat solution beoble has been compromised, with phishing links being posted. Please refrain from clicking on any links until further notice is provided by the official team.","theft":true},{"id":"ht0e52dfb735","date":"2024-03-11","name":"Incognito Market drug marketplace pulls multi-million dollar double scam","kind":"scam","fam":"social","chains":["Bitcoin","monero"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/incognito-market-exit-scam"}],"theft":true,"headline":true},{"id":"ht49bb53b29f","date":"2024-03-11","name":"Blastoff","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Blast"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/blastozone/status/1767104856609673667"}],"desc":"BlastOff yield vault exploited for approximately 150 ETH (~$600K). Protocol team closed the vulnerable pool after 6 hours and offered 20% bounty for recovery. Cause under investigation and protocol being reaudited.","theft":true},{"id":"ht1de0bc7991","date":"2024-03-11","name":"Binemon","kind":"hack","fam":"other","tech":"precission-loss","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht84a56862c0","date":"2024-03-10","name":"Twitter phishers steal over $46 million from 57,000 victims in February","kind":"scam","fam":"social","usd":42363781.0,"lo":42363781.0,"hi":42363781.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/february-2024-twitter-phishing"}],"theft":true,"headline":true},{"id":"htc5174a14db","date":"2024-03-09","name":"Unizen","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":2100000.0,"lo":2100000.0,"hi":2100000.0,"ret":2100000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/unizen-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1766311510362734824"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unizen-hack"}],"desc":"On March 8, 2024, the Unizen DeFi aggregator on Ethereum was exploited for $2.1M (primarily USDT and DAI) via an external call vulnerability introduced in a contract upgrade. The CEO reimbursed affected users starting March 11.","theft":true},{"id":"htc6e04602a2","date":"2024-03-09","name":"Juice Finance","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":54000.0,"lo":54000.0,"hi":54000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Juice staking contract drained of 1.3M tokens via exploit of reward distribution logic. Attacker swiftly sold tokens on Uniswap, netting ~54 ETH. Team recovered by airdropping stakers their stake plus 10% bonus.","theft":true,"onchain":true},{"id":"htabd75f1ddb","date":"2024-03-08","name":"HumanizedAi (HMZ)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":665000.0,"lo":665000.0,"hi":665000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xReaperMadness/status/1765543977208713615"}],"desc":"HumanizedAi (HMZ) is suspected to have exited scam, with the project team profiting 173 ETH (approximately $665,000). The project's Twitter account and website have been shut down.","theft":true},{"id":"htd46e88e32a","date":"2024-03-08","name":"FLOKIAI (FLOKIAI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":148000.0,"lo":148000.0,"hi":148000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"FLOKIAI (FLOKIAI) on the BNB Chain appears to have exit scammed. The address starting with 0xFe54 has exchanged 268,561,795,727,990.23 FLOKIAI tokens for approximately 316.4 BNB, valued at around $148,000.","theft":true,"onchain":true},{"id":"ht97485bc64a","date":"2024-03-07","name":"ClosedAI (ClosedAI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":131000.0,"lo":131000.0,"hi":131000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"ClosedAI (ClosedAI) appears to have exit scammed on the BNB Chain. The address starting with 0xFe54 has exchanged 277,635,327,881,198.25 ClosedAI tokens for approximately 307.3 BNB, valued at around $13,100.","theft":true,"onchain":true},{"id":"htfd04abf106","date":"2024-03-07","name":"GHT","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"GHT smart contract exploited via business logic flaw. Proof-of-concept documented in DeFiHackLabs but specific vulnerability mechanism and loss amount not publicly detailed.","theft":true},{"id":"ht0b48e93984","date":"2024-03-06","name":"TGBS (TGBS)","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":151000.0,"lo":151000.0,"hi":151000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On March 6, TGBS (TGBS) was exploited through a flash loan attack, resulting in a loss of approximately $151k.","theft":true,"onchain":true},{"id":"ht8c8c78274b","date":"2024-03-06","name":"ALP","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"ALP contract vulnerability where a function intended to be internal was left public, allowing unauthorized calls. Documented in DeFiHackLabs vulnerability database; amount not disclosed.","theft":true},{"id":"ht8420dacdc6","date":"2024-03-05","name":"WOOFi Swap","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":8750000.0,"lo":8750000.0,"hi":8750000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/woo-rekt"},{"s":"SlowMist Hacked","u":"https://woo.org/blog/en/woofi-spmm-exploit-post-mortem"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/woofi-hack"}],"desc":"WOOFi Swap on Arbitrum was exploited on March 5, 2024 via a flash loan attack on its synthetic proactive market making algorithm. An attacker borrowed 7.7M WOO tokens, exploiting the missing Chainlink price fallback to crash the price and profit ~$8.75M across three swaps in 13 minutes.","theft":true},{"id":"ht563ad7792e","date":"2024-03-05","name":"OrdiZK","kind":"rugpull","fam":"insider","tech":"Rug Pull","target":"Bridge","usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CoinDesk/status/1765034858177253545"}],"desc":"OrdiZK advertized themselves as a privacy bridge between the Ethereum network and Bitcoin, has exited, resulting in approximately $1.4 million in losses.","theft":true},{"id":"ht5f6b307ef2","date":"2024-03-05","name":"Sherlock","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/sherlockdefi/status/1764879891072200880"}],"desc":"The Twitter account of the security company @sherlockdefi was hacked, with the attackers using the account to post a tweet containing phishing links.","theft":true},{"id":"htdec538a325","date":"2024-03-05","name":"Woofi","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Arbitrum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1d07d9e9ab","date":"2024-03-01","name":"\"The AI Protocol\" burns tokens after holder suffers $4.3 million theft","kind":"hack","fam":"other","chains":["Ethereum"],"usd":4300000.0,"lo":4300000.0,"hi":4300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ai-protocol-theft-and-burn"}],"theft":true,"headline":true},{"id":"ht9364527fff","date":"2024-02-29","name":"Shido","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Other","chains":["Ethereum"],"usd":3300000.0,"lo":2100000.0,"hi":3300000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/356637"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/shido-contract-exploit"}],"desc":"On February 29, 2024, the Shido staking contract was compromised via a private key compromise. The attacker transferred ownership, upgraded the contract with a hidden withdrawToken() function, and drained 4.3 billion SHIDO tokens ($3.3M realized in ETH). Token price collapsed 94% within minutes.","theft":true,"review":["sources disagree on the loss"]},{"id":"htf920bde59a","date":"2024-02-29","name":"Grayscale Capital","kind":"hack","fam":"other","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/356777"}],"desc":"Capital Killer, an anti-capitalist hacker group, revealed on twitter that they have attacked the Grayscale official website, claiming it as a gift to the AVAV community in support of fairness and anti-capitalism. Currently, the Grayscale official website is inaccessible, but the page for Grayscale's Bitcoin ETF GBTC remains accessible.","theft":true},{"id":"htd27cfd9f2f","date":"2024-02-28","name":"Seneca","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":6400000.0,"lo":6400000.0,"hi":6500000.0,"ret":5200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/seneca-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1762865505042645010"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/seneca-protocol-bug"}],"desc":"Seneca Protocol's Chamber contract was exploited on February 28, 2024 via improper token approval handling that allowed unauthorized transfers of ~1,900 ETH and 50,000 senUSD. The attacker later returned 80% of funds after being offered a 20% bounty.","theft":true},{"id":"ht8cdff10c34","date":"2024-02-28","name":"Serenity Shield","kind":"hack","fam":"social","tech":"Phishing","target":"Token","chains":["Ethereum","BNB Chain"],"usd":586000.0,"lo":586000.0,"hi":5600000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SerenityShield_/status/1762560942821261325"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/serenity-shield-hack"}],"desc":"The Serenity Shield deployer wallet was compromised via spear-phishing attack, allowing attackers to access private keys. The attacker then transferred 6.9M SERSH tokens valued at $5.6M at the time, but only realized $586K after selling on available liquidity.","theft":true,"review":["sources disagree on the loss"]},{"id":"htbca7a4273a","date":"2024-02-28","name":"Smoofs","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Polygon"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A reentrancy vulnerability in the Smoofs staking contract allowed attackers to drain funds through unsafe external calls that enabled state to be manipulated during transaction execution.","theft":true},{"id":"hta76c9ac427","date":"2024-02-26","name":"MicroStrategy","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":440000.0,"lo":440000.0,"hi":440000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/355957"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/microstrategy-twitter-hack"}],"desc":"The Twitter account of MicroStrategy, the largest public holder of  BTC, appears to have been compromised, with phishing airdrop links being posted. According to on-chain detective ZachXBT, the incident has resulted in the theft of assets worth $440,000.","theft":true,"review":["possible duplicate within one source"]},{"id":"htb6ef114bad","date":"2024-02-26","name":"Aleo","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AleoHQ/status/1761970260360479214"}],"desc":"Aleo, a blockchain project that advertises it's a place for \"fully private applications\" with \"built-in privacy\" has just emailed private identification documents — including selfies and photographs of government identification cards — to the wrong users. Aleo acknowledged their screw-up on social media, claiming that only ten individuals were impacted, and that it had happened thanks to a \"copy/paste error in email metadata\".","theft":true},{"id":"ht0badb08a45","date":"2024-02-25","name":"Myanmar-based romance scam operation pulls in $100 million in less than two years","kind":"scam","fam":"social","chains":["Tron"],"usd":100000000.0,"lo":100000000.0,"hi":100000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/myanmar-based-pig-butchering-scam"}],"theft":true,"headline":true},{"id":"htab3bd8d65a","date":"2024-02-25","name":"RiskOnBlast gambling platform rug pulls for $1.3 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":13250000.0,"lo":13250000.0,"hi":13250000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/riskonblast-gambling-platform-rug-pulls-for-1-3-million"}],"theft":true,"headline":true},{"id":"ht6c330a51c7","date":"2024-02-25","name":"RiskOnBlast","kind":"rugpull","fam":"insider","tech":"Exit Scam","target":"DeFi Protocol","chains":["Blast","Ethereum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=riskonblast-gambling-platform-rug-pulls-for-1-3-million"}],"desc":"On February 25, 2024, RiskOnBlast (GambleFi) presale (420 ETH/$1.29M raised Feb 22-23) became Blast's first rugpull when anonymous team drained balances through MEXC, Bybit, ChangeNOW.","theft":true},{"id":"ht6fb2669988","date":"2024-02-25","name":"Tornado Cash","kind":"hack","fam":"keys","tech":"Governance Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://gas404.medium.com/tornado-cash-notes-exploit-from-jan-1st-and-the-actions-you-must-take-6076748bc886"}],"desc":"SlowMist founder Cos tweeted that there is a backdoor code in the Tornado Cash IPFS version frontend that hijacks deposit certificates. A governance attack led to malicious proposals being passed, and the malicious code has been present for about two months.","theft":true},{"id":"ht3d8abaa230","date":"2024-02-24","name":"Australian disappears with more than US$585,000 erroneously transferred to his cryptocurrency account by OTCPro","kind":"other","fam":"other","usd":650000.0,"lo":650000.0,"hi":650000.0,"ret":330000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kow-seng-chai-disappearance"}],"headline":true},{"id":"htc205d1ae77","date":"2024-02-23","name":"BitForex","kind":"rugpull","fam":"insider","tech":"Unknown","target":"CEX","usd":56500000.0,"lo":56500000.0,"hi":57000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/bitforexcom/status/1814314174782255524"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitforex-withdrawals"}],"desc":"On February 23, 2024, Hong Kong-based cryptocurrency exchange BitForex was suspected of an exit scam after approximately $56.5 million in suspicious fund outflows were detected across multiple blockchains. The platform subsequently restricted access. On-chain investigator ZachXBT was the first to notice irregularities in withdrawals, highlighting that the exchange had ceased processing withdrawals and failed to respond to customers. In mid-2023, the company faced regulatory scrutiny in Japan for operating without a license and was accused of inflating trading volumes. Its CEO resigned in January, promising a new team would take over. On July 19, BitForex updated the situation on X, stating that platform access was disrupted due to unforeseen events and that it would reopen soon.","theft":true},{"id":"htbf21670c33","date":"2024-02-23","name":"Jihoz","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Ethereum"],"usd":10000000.0,"lo":9500000.0,"hi":10000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Jihoz_Axie/status/1760845078757511562"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/jihoz-zirlin-wallet-hack"}],"desc":"Axie Infinity co-founder Jihoz tweeted that his personal two addresses have been compromised. The attack is limited to his personal accounts and is unrelated to the validation or operation of the Ronin chain. Additionally, the leaked keys are unrelated to the operations of Sky Mavis. He reassured everyone that strict security measures have been taken for all related activities.","theft":true},{"id":"ht4259873b1b","date":"2024-02-23","name":"BlueBerry","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":1347500.0,"lo":1340000.0,"hi":1400000.0,"ret":1080000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/web3isgreat/status/1761101904795271657"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blueberry-protocol-narrowly-avoids-1-3-million-hack"}],"desc":"On February 22-23, 2024, BlueBerry's lending market was exploited when borrowing was accidentally enabled early. A user obtained a 1 WETH flashloan from Balancer, deposited it into the lending contract to manipulate oracle prices, and overborrowed 457 ETH (~$1.34M). Whitehat c0ffeebabe.eth front-ran the exploit and recovered ~366 ETH (~$1.07M).","theft":true,"onchain":true},{"id":"ht7b429e8f86","date":"2024-02-23","name":"Compound","kind":"hack","fam":"market","tech":"Security Vulnerability","chains":["Ethereum"],"usd":660000.0,"lo":439537.0,"hi":660000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://x.com/0xLEVI104/status/1762092203894276481"}],"desc":"On the evening of February 23rd, UNI experienced a sudden price surge, causing Compound to fail in promptly updating UNI's price. As a result, the protocol used an incorrect price provided by Uniswap's TWAP (Time-Weighted Average Price). This allowed users to borrow UNI using collateral with a lower value than UNI's actual price, leading to $660,000 in bad debt.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht6b0488a29b","date":"2024-02-23","name":"ZoomerCoin","kind":"hack","fam":"market","tech":"Flashloan Governance Attack","target":"Token","chains":["Ethereum"],"usd":41000.0,"lo":41000.0,"hi":41000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1761067998633136243"}],"desc":"A flash loan attack on ZoomerCoin exploited constructed calldata parameters to call transferFrom, transferring tokens previously authorized to the project contract. Attackers then exchanged stolen tokens for ETH.","theft":true},{"id":"htae79bf9364","date":"2024-02-23","name":"Avalanche","kind":"hack","fam":"code","tech":"Security Vulnerability","chains":["Avalanche"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/_patrickogrady/status/1761057598143643696"}],"desc":"On February 23rd, the Avalanche mainnet experienced block production interruptions. Addressing this issue, Ava Labs co-founder Kevin Sekniqi stated on Twitter that the problem appears to be a gossip-related mempool management error, which is purely a code-related issue, not a performance handling problem. It seems that inscriptions have reached an edge case, but they did not affect performance. The mainnet downtime issue appears to be related to an edge-case bug in mempool processing, and bug fix testing is currently underway on the Avalanche testnet. On February 24th, Ava Labs engineering lead Patrick O'Grady tweeted that nodes need to be upgraded to AvalancheGo version 1.11.1, which disables the logic added in v1.10.18 that caused validators to send excessive amounts of gossip to each other. Avalanche Validators provision a stake-weighted bandwidth allocation for each peer, and this flawed logic led each node to saturate their allocation with useless transaction gossip. This dynamic prevented pull queries issued by validators from being processed in a timely manner and resulted in consensus stalling.","theft":true},{"id":"htcc83738b67","date":"2024-02-22","name":"Swarm Markets","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":472892.0,"lo":472892.0,"hi":472892.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A vulnerability in Swarm Markets' xTokenWrapper contract allowed unauthorized access to withdraw assets. While a MEV bot intercepted most of the attacker's attempts, the first hacker secured 472.8K SMT plus DAI and USDC.","theft":true},{"id":"htf67937c14f","date":"2024-02-22","name":"Tectonic","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Cronos"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On February 22, 2024 Tectonic (lending protocol on Cronos) lost $250,000 to a flashloan exploit targeting newly added market functionality that lacked protection against flashloan-based manipulation in the deposit logic.","theft":true},{"id":"hta5791aa697","date":"2024-02-21","name":"Gain","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Token","chains":["Ethereum"],"usd":3010000.0,"lo":3010000.0,"hi":3010000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An unauthorized mint function allowed attackers to create 5 billion GAIN tokens without proper access control. The tokens were immediately sold, crashing the token price 95%.","theft":true,"onchain":true},{"id":"ht81ba77772f","date":"2024-02-21","name":"DeezNutz 404","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Token","chains":["Ethereum"],"usd":170000.0,"lo":170000.0,"hi":170000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/deeznutz404-hack"}],"desc":"A calculation flaw in the DeezNutz 404 ERC-404 token contract enabled infinite minting through self-transfer exploits. Attackers minted unlimited tokens and sold them for ~$170K.","theft":true,"onchain":true},{"id":"htb3358f38e0","date":"2024-02-20","name":"Over $55 million taken from defunct AAX crypto exchange","kind":"fraud","fam":"insider","usd":55600000.0,"lo":55600000.0,"hi":55600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aax-money-movement"}],"headline":true},{"id":"ht3db709b1d4","date":"2024-02-20","name":"ARPA","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/arpaofficial/status/1760151923150467211?s=20"}],"desc":"The official Twitter account of ARPA, a permissionless threshold network based on the BLS signature scheme, has been compromised, and false token claiming links have been posted.","theft":true},{"id":"hteac1028354","date":"2024-02-20","name":"EGGX","kind":"hack","fam":"code","tech":"reentrancy","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"htc011377e09","date":"2024-02-19","name":"RuggedArt","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":32395.0,"lo":32395.0,"hi":32395.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A reentrancy vulnerability in the RuggedArt contract allowed attackers to manipulate contract state during transaction execution and drain funds through unsafe external calls.","theft":true,"onchain":true},{"id":"htd8253f4da0","date":"2024-02-18","name":"FixedFloat","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Ethereum","Bitcoin"],"usd":26100000.0,"lo":26100000.0,"hi":26100000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/y2rm7l22.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fixedfloat-hack"}],"desc":"On February 16-18, 2024, FixedFloat (non-KYC exchange) was compromised and ~$26.1M in Bitcoin and Ether were stolen: 409.304 BTC and 1,728.48 ETH. Private keys controlling hot wallets on both networks were compromised. Initially suspected as insider attack or rug pull, the team claimed external attackers exploited infrastructure vulnerabilities. Ethereum funds moved through eXch exchange; Bitcoin funds dispersed across addresses.","theft":true},{"id":"ht02bc94f2a0","date":"2024-02-18","name":"Starcoin","kind":"hack","fam":"other","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/StarcoinSTC/status/1759044409746727316"}],"desc":"On February 18th, Starcoin, a project within the Move ecosystem, tweeted that they detected abnormal activities on their network that required immediate attention to safeguard the integrity and security of the system. As a precautionary measure, Starcoin has temporarily suspended our network to conduct a thorough investigation together with SlowMist.","theft":true},{"id":"ht90b0cb01a9","date":"2024-02-16","name":"Trader loses $4.5 million in phishing attack","kind":"scam","fam":"social","usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kirilmeth-phishing"}],"theft":true,"headline":true},{"id":"htebb280de8f","date":"2024-02-16","name":"xPET","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Arbitrum"],"usd":254000.0,"lo":254000.0,"hi":254000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Michaeltalkhere/status/1758558740461306362"}],"desc":"The CEO of SocialFi xPET tweeted that SocialFi was attacked due to vulnerabilities related to the newly launched PvP feature, resulting in hackers stealing 91.5 ETH (approximately $25,400).","theft":true},{"id":"ht1c1c7a39af","date":"2024-02-15","name":"YouTuber KSI accused of pump-and-dump","kind":"fraud","fam":"insider","usd":850000.0,"lo":850000.0,"hi":850000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/youtuber-ksi-accused-of-pump-and-dump"}],"headline":true},{"id":"hte0bfd54d05","date":"2024-02-15","name":"ParticleTrade","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"ParticleTrade suffered an exploit due to unverified user input validation, allowing attackers to manipulate contract state and steal funds.","theft":true,"onchain":true},{"id":"ht622686eb29","date":"2024-02-15","name":"DualPools","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":41000.0,"lo":41000.0,"hi":41000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A precision truncation vulnerability in DualPools' share calculation allowed attackers to exchange 1.9999... dLINK for massive amounts of LINK by exploiting data truncation to 1 unit. Attackers then drained pools of WBNB, BTC, ETH, ADA, and BUSD.","theft":true,"onchain":true},{"id":"htb191ec1944","date":"2024-02-15","name":"Babyloogn","kind":"hack","fam":"code","tech":"lack of validation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htf68c217c46","date":"2024-02-14","name":"Miner","kind":"hack","fam":"code","tech":"lack of validation dst address","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htaa0bc1745f","date":"2024-02-13","name":"DuelBits","kind":"hack","fam":"social","tech":"Malware","target":"CEX","chains":["Ethereum","BNB Chain"],"usd":4600000.0,"lo":4600000.0,"hi":4600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Duelbits/status/1758159495807541459"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/duelbits-hack"}],"desc":"On February 13, 2024, DuelBits lost $4.6M when private keys to its hot wallets on Ethereum and BNB Chain were compromised. The attacker stole USDT, APE, and SHIB tokens, converted them to ETH, and laundered the funds through Tornado Cash.","theft":true},{"id":"hta03f0412b8","date":"2024-02-13","name":"Miner","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"Token","chains":["Ethereum","BNB Chain"],"usd":466000.0,"lo":466000.0,"hi":466000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/shoucccc/status/1757777764646859121"}],"desc":"A double-transfer vulnerability in the Miner ERC-X token allowed attackers to bypass validation on destination addresses. The lack of input validation enabled transfers of 168.8 ETH from the project.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htd247561173","date":"2024-02-11","name":"Game","kind":"hack","fam":"code","tech":"Reentrancy && Business Logic Flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"htc67a80c807","date":"2024-02-10","name":"FILX DN404","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0a139ba24d","date":"2024-02-09","name":"PlayDapp","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":290000000.0,"lo":290000000.0,"hi":290000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://playdapp.medium.com/important-notice-pla-mitigation-plan-a52f15ad0d42"}],"desc":"The PlayDapp deployer key was compromised via spear-phishing attack. The attacker added themselves as a minter for the PLA token contract and minted 1.79 billion tokens across two transactions (Feb 9 and Feb 12), valued at $290M.","theft":true},{"id":"ht5f48a5fe55","date":"2024-02-09","name":"PlayDapp crypto gaming platform exploited, spurring misleading headlines","kind":"hack","fam":"other","chains":["Ethereum"],"usd":36500000.0,"lo":36500000.0,"hi":36500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/playdapp-crypto-gaming-platform-exploited-spurring-misleading-headlines"}],"theft":true,"headline":true},{"id":"htb0f2fdcc1a","date":"2024-02-09","name":"Not Found (404)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":156000.0,"lo":156000.0,"hi":156000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Not Found (404) project on ETH is suspected to have exited with losses of approximately $156,000, as the deployer withdrew a large amount of liquidity.","theft":true},{"id":"ht22206fa71f","date":"2024-02-09","name":"Keith Grossman","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/354028"}],"desc":"Keith Grossman, the president of MoonPay, currently has a compromised X account distributing wallet drainer links.","theft":true},{"id":"ht99f8ee884e","date":"2024-02-08","name":"Starlay Finance","kind":"hack","fam":"code","tech":"Redeem Logic Flaw","target":"DeFi Protocol","chains":["Acala","Polkadot"],"usd":2100000.0,"lo":2100000.0,"hi":2100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/starlay_fi/status/1755920814497742957"}],"desc":"An improper liquidity index computation in the Starlay USDC lending pool on Acala EVM allowed attackers to withdraw far more than their deposits. The rounding issue in the index calculation enabled the exploit.","theft":true},{"id":"htc57cfee613","date":"2024-02-08","name":"Pandora","kind":"hack","fam":"other","tech":"Integer Underflow","usd":17000.0,"lo":17000.0,"hi":17000.0,"conf":"C","n":1,"theft":true},{"id":"ht21b93650d3","date":"2024-02-05","name":"BurnsDefi","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht872c3c811b","date":"2024-02-02","name":"Detto Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Base"],"usd":94147.0,"lo":94147.0,"hi":94147.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DackieSwap/status/1753229580465484085"}],"desc":"The project Detto Finance in the Base ecosystem is suspected of a rug pull, with its social media accounts currently inaccessible, resulting in approximately $95,000 in losses.","theft":true},{"id":"htceb13ecdb7","date":"2024-02-02","name":"Phantom","kind":"hack","fam":"other","tech":"DDoS Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/phantom/status/1753100432145318116"}],"desc":"The user-friendly crypto wallet designed for DeFi and NFTs, Phantom, reported a DDoS attack on its platform. Someone attempted to overload its systems, causing potential temporary interruptions in some services. User assets are secure.","theft":true},{"id":"htb22369835e","date":"2024-02-02","name":"ADC","kind":"hack","fam":"other","tech":"incorrect-access-control","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"hta2b9e5c5df","date":"2024-02-01","name":"Affine Protocol","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":88000.0,"lo":88000.0,"hi":88000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The Affine Protocol's flashloan callback failed to validate userData parameters from untrusted sources. Attackers exploited this to trigger the upgrade path and steal collateral assets.","theft":true},{"id":"htfd46ba2118","date":"2024-01-31","name":"Chris Larsen","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["ripple"],"usd":112500000.0,"lo":112500000.0,"hi":112500000.0,"ret":4200000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/352697"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/chris-larsen-xrp-theft"}],"desc":"On January 31st, according to blockchain investigator ZachXBT, Ripple fell victim to a hacking attack resulting in the theft of 213 million XRP, valued at approximately $112.5 million. Ripple's co-founder, Chris Larsen, tweeted, \"Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) – we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved.\"","theft":true},{"id":"ht935be2a73c","date":"2024-01-31","name":"More than $58 million stolen in Twitter phishing schemes in January","kind":"scam","fam":"social","usd":58324698.0,"lo":58324698.0,"hi":58324698.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/january-2024-twitter-phishing"}],"theft":true,"headline":true},{"id":"ht3e0e8e6341","date":"2024-01-31","name":"Klaytn","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/klaytn_official/status/1752352457634799982"}],"desc":"Klaytn, the South Korean public blockchain, tweeted a reminder to users that its official Discord server has been attacked. Until further notice, please refrain from clicking on any links or interacting with any posts. The team is currently working to remove malicious bots and regain control.","theft":true},{"id":"ht8b8663e39d","date":"2024-01-31","name":"ZeroLend","kind":"hack","fam":"other","tech":"DDoS Attack","chains":["zkSync Era"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zerolendxyz/status/1752589716837306878"}],"desc":"The lending market ZeroLend has experienced a DDoS attack.","theft":true},{"id":"ht04b4d2e3dc","date":"2024-01-30","name":"Abracadabra Spell","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":6500000.0,"lo":6490000.0,"hi":6500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/abra-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/MIM_Spell/status/1752368458715607261"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/abracadabra-exploit"}],"desc":"Abracadabra's MIM stablecoin exploited for $6.5M via precision loss in collateral calculations. An attacker used rounding errors to bypass collateral validation, inflating borrow amounts. Funded with 1 ETH from Tornado Cash, the attack caused MIM to depeg to $0.76.","theft":true},{"id":"hte90c919b1e","date":"2024-01-30","name":"XSIJ","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":51000.0,"lo":51000.0,"hi":51000.0,"conf":"C","n":1,"theft":true},{"id":"htf0ae90cc1c","date":"2024-01-30","name":"Masa","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/getmasafi/status/1751995669915529587"}],"desc":"The official Twitter account of zk-data marketplace Masa is suspected to be compromised, and fake airdrop links have been posted.","theft":true},{"id":"ht6b688d9ec1","date":"2024-01-30","name":"MIMSpell","kind":"hack","fam":"other","tech":"Precission Loss","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht557c9f96b5","date":"2024-01-29","name":"Andrei Grachev","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DWFLabs/status/1751691212229062958"}],"desc":"DWF Labs tweeted that the Twitter account of their managing partner, Andrei Grachev, has been compromised.","theft":true},{"id":"ht593ddfcacb","date":"2024-01-29","name":"PeapodsFinance","kind":"hack","fam":"code","tech":"Reentrancy","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht8f6312e8f1","date":"2024-01-28","name":"Wall Street Memes","kind":"hack","fam":"code","tech":"Third-party Vulnerability","chains":["BNB Chain"],"usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://wallstreetmemes.medium.com/important-security-update-fa4dedbc8f25"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wallstreetmemes-token-price-plummets-after-staking-contract-exploited"}],"desc":"The Wall Street Memes token was subject to a coordinated attack. The hackers exploited a vulnerability with their staking provider and accessed the $WSM staking contract.","theft":true},{"id":"ht07e8baad61","date":"2024-01-28","name":"Goledo","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Conflux","Ethereum"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GoledoFinance/status/1751442740200517984"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/goledo-finance-hack"}],"desc":"Goledo Finance, a lending protocol on Conflux eSpace, was exploited when an attacker borrowed 11M CFX via flash loan and purchased 24.6M PPI tokens to artificially inflate the price. The attacker then used the inflated PPI price as collateral to borrow 7.9M CFX from Goledo's lending pool. The attacker later contacted Goledo to negotiate.","theft":true},{"id":"ht6d6ce18315","date":"2024-01-28","name":"Barley Finance","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Barley_Finance/status/1751693455179522139"}],"desc":"Barley Finance, a volatility farming protocol, was exploited on its wBARL pod contract that had been deployed just two days prior. The attacker minted over 10% of the total BARL supply in a single transaction, extracting approximately $130K in value. The vulnerability was in the newly deployed pod contract.","theft":true},{"id":"htb9a246ef95","date":"2024-01-27","name":"Somesing","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":11580000.0,"lo":11580000.0,"hi":11580000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/274766/south-koreas-crypto-karaoke-platform-hacked-for-over-11-5-million?utm_source=browser&utm_medium=chrome&utm_campaig"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/somesing-hack"}],"desc":"Somesing, a South Korean Web3 social music service, suffered a vulnerability attack that resulted in the theft of 730 million SSX tokens. Of these, 504 million were undistributed tokens and 226 million were foundation-held tokens. The foundation reported the incident to the National Police Agency Cyber Investigation Unit.","theft":true},{"id":"htc4ca36cfaf","date":"2024-01-27","name":"Citadel.one","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Arbitrum"],"usd":93000.0,"lo":93000.0,"hi":93000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://neptunemutual.com/blog/how-was-citadel-finance-exploited/"}],"desc":"Citadel.one, a portfolio management dApp on Arbitrum, suffered an access control vulnerability that allowed unauthorized extraction of wrapped Ethereum (WETH) and USD Coin (USDC). The attackers exploited improper access controls in the smart contract to drain approximately $93,000 in user funds.","theft":true,"review":["possible duplicate within one source"]},{"id":"hta2b49d4ba0","date":"2024-01-27","name":"Citadel.one","kind":"hack","fam":"other","tech":"Unknown","chains":["Arbitrum"],"usd":93000.0,"lo":93000.0,"hi":93000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/352032"}],"desc":"Portfolio management tool Citadel.one has been attacked, resulting in a loss of approximately $93K.","theft":true},{"id":"ht043e758fa7","date":"2024-01-26","name":"AltLayer","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Optimism"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/351794"}],"desc":"AltLayer, a temporary extension layer built on Optimistic Rollups, tweeted that early this morning, its Twitter profile was not displaying past tweets on the timeline. After approximately 3 hours of handling, the account has now been restored to normal. The entire incident may have been an organized attack. AltLayer advises users to stay safe and cross-check any information and links across multiple channels.","theft":true},{"id":"ht0b8bdac620","date":"2024-01-26","name":"Staci Warden","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AlgoFoundation/status/1750721213469794648"}],"desc":"The Algorand Foundation tweeted that the Twitter account of Staci Warden (@StaciW_DC), the CEO of the Foundation, has been compromised.","theft":true},{"id":"htea18046bdd","date":"2024-01-25","name":"Nebula Revelation","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Optimism"],"usd":180264.0,"lo":180000.0,"hi":180264.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/NBLGAME/status/1750503951294976436"}],"desc":"Nebula Revelation's staking contract on Optimism was exploited via a reentrancy vulnerability. The attacker used a self-destructing contract to complete all malicious operations within a single transaction, enabling unauthorized token withdrawals totaling approximately $180,264.","theft":true},{"id":"hte746cad677","date":"2024-01-25","name":"Saga","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Solana"],"usd":65800.0,"lo":65761.0,"hi":65800.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2024/01/24/fan-club-for-solanas-saga-phone-loses-750-sol-to-hack/"}],"desc":"Saga DAO, a community-run fan club for Solana's mobile phone, lost ~$60,000 (750 SOL) when zkRedDevil's personal wallet was compromised, allowing unauthorized drainage of both personal and DAO treasury funds. The multisig wallet had never been properly activated, requiring only 1 of 12 confirmations for fund transfers.","theft":true},{"id":"htdff7ac3d84","date":"2024-01-25","name":"NBLGAME","kind":"hack","fam":"code","tech":"Reentrancy","chains":["Optimism"],"conf":"C","n":1,"theft":true},{"id":"ht19adadfa02","date":"2024-01-24","name":"JohnLennonC0IN (BEATLES)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":54900.0,"lo":54900.0,"hi":54900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"JohnLennonC0IN (BEATLES) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht8839ed45f3","date":"2024-01-23","name":"Gamee","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Polygon"],"usd":7000000.0,"lo":6000000.0,"hi":7000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GAMEEToken/status/1749652962849464727"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/animoca-brands-owned-gamee-tokens-stolen"}],"desc":"Gamee's deployer private key was compromised via an unsecured GitLab environment, enabling an attacker to gain control of the project's deployer address on Polygon. The attacker exploited recoverERC721s() function bypass protections and stole approximately 600 million GMEE tokens worth ~$7M at the time.","theft":true},{"id":"hte7cf6b9bb7","date":"2024-01-23","name":"MailerLite hack enables over $700,000 in crypto phishing thefts","kind":"scam","fam":"social","usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mailerlite-hack"}],"theft":true,"headline":true},{"id":"htc1faaf7c55","date":"2024-01-22","name":"Concentric","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":1720000.0,"lo":1700000.0,"hi":1800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ConcentricFi/status/1749418658818830622"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/concentric-finance-exploit"}],"desc":"On January 22, 2024, Concentric Finance on Arbitrum suffered a $1.72 million exploit. Attackers used social engineering to compromise the deployer private key, then upgraded vault contracts, minted unauthorized LP tokens, and drained assets. Lacked multi-sig or time-lock protections.","theft":true},{"id":"ht762ef1f84e","date":"2024-01-22","name":"Bullran Index","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":310000.0,"lo":310000.0,"hi":310000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/tonyke_bot/status/1749489858807230734"}],"desc":"Bullran Index was attacked due to a lack of permission control. An MEV bot was able to burn the BUI tokens that a user deposited into a custom safe contract and exploit the lack of permission control to extract 136 ETH.","theft":true},{"id":"ht0c2b8d0480","date":"2024-01-22","name":"DAO_SoulMate","kind":"hack","fam":"code","tech":"Incorrect Access Control","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"htf5593eb196","date":"2024-01-19","name":"CFTC files complaint against Debiex platform for using \"romance scam tactics\" to steal $2.3 million","kind":"scam","fam":"social","usd":2300000.0,"lo":2300000.0,"hi":2300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/debiex-cftc-complaint"}],"theft":true,"headline":true},{"id":"htx-2024-01-19","date":"2024-01-19","name":"HTX","kind":"hack","fam":"other","tech":"DDoS Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/justinsuntron/status/1748319971837710471"}],"desc":"Tron founder Justin Sun tweeted that Htx.com and HTX_DAO have been attacked by DDoS attack. The official HTX Twitter account also mentioned that the HTX application is currently experiencing interruptions, and the technical team is actively working to resolve the issues.","theft":true},{"id":"ht48a29ffc4c","date":"2024-01-18","name":"Colorado pastor charged for cryptocurrency scam he says he perpetrated at God's command","kind":"scam","fam":"social","usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/indxcoin"}],"theft":true,"headline":true},{"id":"htbefa4113b6","date":"2024-01-18","name":"CRONUS (CRONUS)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":316355.0,"lo":316355.0,"hi":316355.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"CRONUS (CRONUS) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htcb6ac4ae23","date":"2024-01-18","name":"Poldo (POLDO)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":311607.0,"lo":311607.0,"hi":311607.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BSC 上的 Poldo (POLDO) 疑跑路，部署者撤走了大量流动性，导致价格下跌 100%。","theft":true,"onchain":true},{"id":"ht6a6562cb41","date":"2024-01-18","name":"LongNoseDog (LONG)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":309749.0,"lo":309749.0,"hi":309749.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"LongNoseDog (LONG) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht5a7ff1e6e1","date":"2024-01-18","name":"Rosa Finance","kind":"hack","fam":"other","tech":"Unknown","chains":["Arbitrum"],"usd":44800.0,"lo":44800.0,"hi":44800.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/rosa_finance/status/1747917232644948236"}],"desc":"The decentralized, non-custodial liquidity market protocol Rosa Finance on Arbitrum was exploited, resulting in a loss of approximately $45,000.","theft":true},{"id":"ht5aa1122662","date":"2024-01-18","name":"Manta Pacific","kind":"hack","fam":"other","tech":"DDoS Attack","chains":["Optimism"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/superanonymousk/status/1747968680686993800"}],"desc":"According to a tweet from Manta Network, the Manta Pacific chain encountered an RPC attack at approximately 9 AM UTC. Kenny Li, co-founder of Manta Network (@superanonymousk), provided updates on Twitter regarding the DDoS attack on Manta Network. He mentioned that Manta Network experienced a calculated DDoS attack at 9:30 AM UTC, coinciding with the start of their TGE activity. Since then, the RPC nodes have faced over 135 million requests, indicating that this was a very aggressive and timed attack.","theft":true},{"id":"ht72ebed4ede","date":"2024-01-18","name":"Miguel Morel","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ArkhamIntel/status/1747770519816995281"}],"desc":"Arkham official announced on Twitter that its CEO, Miguel Morel, fell victim to a SIM card swap attack. Miguel Morel's Twitter account was compromised.","theft":true},{"id":"ht6a2f96ae4d","date":"2024-01-17","name":"BasketDAO","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":107000.0,"hi":1200000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/37065"}],"desc":"BasketDAO was exploited via a flaw in its smart contract that allowed arbitrary low-level external calls in the approval process. The vulnerability enabled attackers to drain approved funds from users, resulting in over $1.2M stolen. The protocol subsequently shut down and was acquired by PieDAO.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht111730dcb1","date":"2024-01-17","name":"Trezor","kind":"hack","fam":"code","tech":"Third-party Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8"}],"desc":"Trezor, the manufacturer of encrypted hardware wallets, has announced that it is currently investigating a security incident that occurred on January 17, 2024. Unauthorized access was detected to the third-party support portal used by Trezor. No damage has been inflicted on customers' digital assets. Internal audits indicate that the exposure might be limited to information of customers who have interacted with Trezor Support since December 2021, encompassing only email and names/nicknames.","theft":true},{"id":"htaba4d65e26","date":"2024-01-17","name":"BmiZapper","kind":"hack","fam":"code","tech":"Arbitrary external call vulnerability","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"htbf22e8e8fc","date":"2024-01-16","name":"Bungee","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/socket-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/socketdottech/status/1747349422730813525?s=46&t=VOX9GON9LkityHRA95UVTQ"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/socket-service-and-its-bungee-bridge-suffer-3-3-million-theft"}],"desc":"Socket's Bungee bridge aggregator was exploited on January 16, 2024 when missing validation of the swapExtraData parameter allowed over 700 users to lose $3.3M via injected unauthorized transferFrom calls.","theft":true,"onchain":true},{"id":"ht84f190916a","date":"2024-01-16","name":"Hector Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Fantom"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?id=hector-network-compensation-fund-theft"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hector-network-compensation-fund-theft"}],"desc":"Hector Network's compensation contract for token holders was exploited when a malicious account deposited only 0.0001 HEC and then transferred $2.7M worth of assets to itself. The vulnerable AddEligibleWallet function allowed the attacker to designate arbitrary addresses as eligible and drain the treasury via mintWithdraw and transferRedemption functions.","theft":true},{"id":"ht296c46f47d","date":"2024-01-16","name":"MOE (MOE)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":318021.0,"lo":318021.0,"hi":318021.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"MOE (MOE) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht43466556da","date":"2024-01-15","name":"Harmony blockchain encounters \"infinite mint\" bug; accusations of wrongdoing fly","kind":"hack","fam":"other","chains":["Ethereum"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/harmony-infinite-mint-bug"}],"theft":true,"headline":true},{"id":"hta42dcffd29","date":"2024-01-15","name":"FoxFunnies (FXN)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":303972.0,"lo":303972.0,"hi":303972.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"FoxFunnies (FXN) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht2e49cca746","date":"2024-01-15","name":"BorzoiCoin (BORZOI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BorzoiCoin (BORZOI) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htcb7f606733","date":"2024-01-15","name":"PulseXIncentiveToken (INC)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":272207.0,"lo":272207.0,"hi":272207.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"PulseXIncentiveToken (INC) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht02251cc946","date":"2024-01-15","name":"Shell_MEV_0xa898","kind":"hack","fam":"code","tech":"lack of access control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6341bd45c4","date":"2024-01-14","name":"SolDragon (DRAGON)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":304600.0,"lo":304600.0,"hi":304600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"SolDragon (DRAGON) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht7bd6016b69","date":"2024-01-14","name":"BoxyDude (BOX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":303435.0,"lo":303435.0,"hi":303435.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BoxyDude (BOX) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htec478993ad","date":"2024-01-14","name":"Speero (SPEERO)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Speero (SPEERO) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht0dedda0c89","date":"2024-01-14","name":"MAR3AI (MAR3)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":297917.0,"lo":297917.0,"hi":297917.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"MAR3AI (MAR3) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht527338b83c","date":"2024-01-14","name":"Audify (AUDI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":290000.0,"lo":290000.0,"hi":290000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Audify (AUDI) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht6e20e54c31","date":"2024-01-14","name":"StarkPepe (SPEPE)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":268000.0,"lo":268000.0,"hi":268000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"StarkPepe (SPEPE) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht51a4dfeb4a","date":"2024-01-12","name":"Wise Lending V1","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":464000.0,"lo":464000.0,"hi":464000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1745907642118123774?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"On January 12, 2024, Wise Lending was drained of $464K via a flashloan that exploited precision loss in _calculateShares() (division before multiplication), allowing accumulation of excess shares to withdraw more than deposited.","theft":true,"onchain":true},{"id":"htd3dd2bb0bb","date":"2024-01-12","name":"ZKFair","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ZKFCommunity/status/1745485069203157129"}],"desc":"The community-driven ZK L2 network ZKFair's official Discord has been hacked.Do not click any links until the team regain control of the server.","theft":true},{"id":"htab5a676f8e","date":"2024-01-11","name":"CoinGecko","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/coingecko/status/1745158344191717746"}],"desc":"Independent crypto data aggregator CoinGecko's Twitter accounts @CoinGecko and @GeckoTerminal was compromised. One of their team members clicked on a fraudulent Calendly link by accident, granting unauthorized app access to a hacker who then posted on their behalf."},{"id":"htaa9416144e","date":"2024-01-10","name":"Trader loses $5.7 million to slippage in memecoin trade","kind":"other","fam":"other","chains":["Solana"],"usd":5700000.0,"lo":5700000.0,"hi":5700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dogwifhat-slippage"}],"headline":true},{"id":"hta2bbdd231a","date":"2024-01-10","name":"Euler Finance cofounder loses private key and, with it, $3.8 million","kind":"other","fam":"other","usd":3800000.0,"lo":3800000.0,"hi":3800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/euler-finance-private-key-loss"}],"headline":true},{"id":"htffe47e95fc","date":"2024-01-10","name":"XAI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":220000.0,"lo":220000.0,"hi":220000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/36540"}],"desc":"A Rug Pull occurred with the XAI token on the BNB Chain, where the deployer dumped 20,779 billion XAI tokens, making a profit of approximately $220,000.","theft":true},{"id":"ht75cf783e6a","date":"2024-01-10","name":"Freedom","kind":"hack","fam":"code","tech":"lack of access control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht84da559463","date":"2024-01-10","name":"LQDX","kind":"hack","fam":"other","tech":"Unauthorized TransferFrom","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht96ed19ce30","date":"2024-01-09","name":"ElonTroll (ElonTroll)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":92000.0,"lo":92000.0,"hi":92000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake ElonTroll on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htdbff15c4f7","date":"2024-01-09","name":"SEC","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/273847/sec-says-multi-factor-authentication-had-been-turned-off-in-run-up-to-false-x-post-about-bitcoin-etf-approval"}],"desc":"The U.S. Securities and Exchange Commission (SEC) stated on Monday in a release that its Twitter account was compromised on January 9th due to an unauthorized party gaining control of the associated phone number through a \"SIM card swap\" attack. After gaining control of the phone number, the unauthorized party reset the password for the SEC's Twitter account. Access to the phone number was obtained through the telecommunications provider, not through the SEC's systems.","theft":true},{"id":"ht8919c0fc09","date":"2024-01-08","name":"\"Undead Apes Society\" creator charged over rug pull","kind":"followup","fam":"other","chains":["Solana"],"usd":128000.0,"lo":128000.0,"hi":128000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/undead-apes-rug-pull"}],"headline":true},{"id":"ht2cf8931f2e","date":"2024-01-07","name":"MangoFarmSol","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Solana"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/tayvano_/status/1743789297877262642"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mangofarmsol-rug-pull"}],"desc":"On January 6-7, 2024, MangoFarmSOL on Solana was revealed as an intentional rugpull. The frontend and smart contract were malicious drainers that extracted all wallet tokens from users who approved transfers. The team deleted all social media and vanished.","theft":true},{"id":"hte78159e0ee","date":"2024-01-06","name":"CoinsPaid","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","BNB Chain"],"usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/ctczfh18.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinspaid-hack-2"}],"desc":"CoinsPaid, a crypto payment gateway, was exploited for the second time in six months. An attacker with compromised wallet access stole $7.5M in digital assets from ETH and BNB chains, including USDT, USDC, CPD, BNB, and BSC-USD. The attacker swapped stolen assets into ETH and distributed them across multiple EOAs and exchanges including WhiteBit, MEXC, and ChangeNow.","theft":true},{"id":"ht6538e02ad5","date":"2024-01-06","name":"XKingdom Tech","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum","Ethereum"],"usd":1200000.0,"lo":1200000.0,"hi":1250000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/huobantianxia/status/1743816916857479634"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/xkingdom-rug-pull"}],"desc":"The SocialFi and GameFi platform XKingdom Tech, built on Arbitrum, has exit-scammed, resulting in approximately $1.2 million in losses. The stolen funds were bridged to Ethereum and transferred to Tornado Cash.","theft":true},{"id":"htf7bc287858","date":"2024-01-06","name":"Aragon Network DAO","kind":"scam","fam":"social","tech":"Scam","chains":["Ethereum"],"usd":800000.0,"lo":800000.0,"hi":800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://x.com/h3idilao/status/1743803201751777344"}],"desc":"Aragon Network DAO recently found itself targeted in a cryptocurrency scam, resulting in a substantial loss of approximately 800,000 USDC. The attack employed a multi-faceted approach, combining counterfeit ERC-20 tokens that imitated legitimate assets, the creation of deceptive vanity addresses, and the strategic use of automated monitoring bots.","theft":true},{"id":"htc54c087d6b","date":"2024-01-06","name":"Olaf","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/polychain/status/1743019573295894937?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1743019573295894937%7Ctwgr%5Ec6ddb49376b"}],"desc":"According to a report by Cointelegraph, the cryptocurrency venture capital firm Polychain Capital has confirmed that its founder and CEO, Olaf Carlson-Wee, has had his Twitter account compromised. Hackers have posted phishing links containing false airdrops. Polychain has urged Twitter users to avoid interacting with Carlson-Wee's account until further notice.","theft":true},{"id":"ht79d110aa1b","date":"2024-01-05","name":"Narwhal","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Narwhal_fyi/status/1744042646954488145"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/narwhal-exit-scam"}],"desc":"The liquidity mining project Narwhal’s token experienced two considerable drops within a two day period leading to an overall slippage of approximately 99%. The project’s official X account @Narwhal_fyi, announced that they had experienced an exploit, but did not give any specific details. On-chain links suggest this incident was an exit scam. Approximately $1 million worth of funds were deposited into Tornado Cash with a further $410,000 sitting in two wallets.","theft":true},{"id":"htf1e3f19ead","date":"2024-01-05","name":"CertiK","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiK/status/1743252309662912937"}],"desc":"The Twitter account of the security firm CertiK was compromised. The attackers posted false information claiming that the Uniswap router contract is vulnerable to a reentrancy attack, along with phishing links. Subsequently, CertiK tweeted that \"A verified account, associated with a well-known media, contacted one of our employees. Unfortunately, it appears that this account was compromised, leading to a phishing attack on our employee. \"","theft":true},{"id":"ht7e3dbcf0a6","date":"2024-01-04","name":"Gamma","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":6177474.0,"lo":4500000.0,"hi":6180000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gamma-strategies-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/gamma-strategies/post-mortem-remediation-plan-9a62f10d90f3"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gamma-strategies-exploit"}],"desc":"On January 4, 2024, Gamma Strategies' hypervisors on Arbitrum were exploited for ~$4.5M via flashloan-induced price manipulation. The vault deposit thresholds were set too high (-50% to +100% price swings), allowing attackers to manipulate underlying asset prices and drain vault positions.","theft":true,"onchain":true},{"id":"ht7a47dd9578","date":"2024-01-04","name":"Chronos","kind":"hack","fam":"market","tech":"Flash Loan Attack","target":"CEX","usd":148000.0,"lo":148000.0,"hi":148000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ChronosFi_/status/1742902758850584635"}],"desc":"Liquidity layer & AMM Chronos tweeted that its concentrated liquidity pools managed by @dyson_money have been exploited in a manner similar to the gamma exploit. Users are advised to revoke contracts associated with these pools. This vulnerability is specific to concentrated liquidity pools, and all other V2 pools remain safe and unaffected. The rest of the funds are secure.","theft":true},{"id":"ht69fc427981","date":"2024-01-02","name":"Radiant V2","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/radiant-capital-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/RDNTCapital/status/1742338729925112272"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/radiant-capital-hack"}],"desc":"On January 2, 2024, Radiant Protocol on Arbitrum suffered a flashloan attack exploiting rounding issues in the burn function on a newly activated USDC market. Attacker extracted 1,900 ETH (~$4.5 million) beyond legitimate deposits through three attacks within 6 seconds of market activation.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht687f476dba","date":"2024-01-02","name":"Wallet security startup founder scammed out of $125,000","kind":"scam","fam":"social","chains":["Ethereum"],"usd":125000.0,"lo":125000.0,"hi":125000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bill-lou-scammed"}],"theft":true,"headline":true},{"id":"htee5a21e865","date":"2024-01-02","name":"Atomicals Market","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/atomicalsmarket/status/1742073283665944922"}],"desc":"Atomicals Market (Marketplace and Explorer for Atomicals and ARC-20) tweeted that they're currently under ddos attacks.","theft":true},{"id":"htae7f979ec4","date":"2024-01-02","name":"Wizz Wallet","kind":"hack","fam":"other","tech":"DDoS Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wizzwallet/status/1742020813673714138"}],"desc":"Wizz Wallet, the wallet of the Atomicals protocol, posted on Twitter that builders within the Atomicals ecosystem, including the Wizz team, have experienced DDoS attacks.","theft":true},{"id":"htb591137d15","date":"2024-01-02","name":"MIC","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht4c607804cc","date":"2024-01-01","name":"Orbit Bridge","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":81600000.0,"lo":81000000.0,"hi":81700000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/orbit-bridge-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Orbit_Chain/status/1741725778956730778"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/orbit-bridge-hack"}],"desc":"Orbit Bridge was drained for ~$81.5M across its Ethereum vault when 7 of 10 multisig signer private keys were compromised, enabling fraudulent withdrawal signatures.","theft":true},{"id":"ht7c214e2885","date":"2024-01-01","name":"NFPrompt","kind":"hack","fam":"other","tech":"Unknown","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/nfprompt/status/1741769218704716082?s=20"}],"desc":"NFPrompt announced on its social media platform that the team detected issues with Web2 wallet service. They assured users about the security of their funds and recommended using self-custodied Web3 wallets. For users facing issues, they were advised to open a ticket in the project's Discord channel to mitigate the problem.","theft":true},{"id":"ht139a232022","date":"2024-01-01","name":"Wabalaba Land","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wabalabaland/status/1741550353051717907"}],"desc":"A global IP of FREE Digital Collectibles, Art and community Wabalaba Land's Discord has been compromised. Do not click any links until the team regain control of the server.","theft":true},{"id":"ht4f2b583e08","date":"2023-12-31","name":"Channels","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":4400.0,"lo":4400.0,"hi":4400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta38e7dd08a","date":"2023-12-30","name":"Locus Finance","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":321000.0,"lo":321000.0,"hi":321000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 30, 2023, Locus Finance vaults were exploited when an attacker compromised a developer's private key during a CTO transition. Without multisig security, the attacker used administrative access to drain $320,964 from vaults.","theft":true},{"id":"hte5c43c29d8","date":"2023-12-30","name":"Channels Finance","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["BNB Chain"],"usd":320000.0,"lo":320000.0,"hi":320000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Channels Finance, a Compound V2 fork on BSC, suffered an inflation attack exploiting improper token accounting. The attacker manipulated the protocol's supply mechanics to mint unbacked tokens, draining approximately $320K.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htbe73d62ed7","date":"2023-12-30","name":"Compound Labs","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/compoundfinance/status/1741012550958080239"}],"desc":"DeFi lending protocol Compound Labs tweeted that their account was compromised yesterday for ~4 hours until they regained control of the account and removed the spam messages.","theft":true},{"id":"ht01a8583439","date":"2023-12-30","name":"OKX","kind":"hack","fam":"code","tech":"Security Vulnerability","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/okxchinese/status/1741041915011960882"}],"desc":"OKX Wallet BRC20 marketplace has experienced a vulnerability where a large number of fake sats are displayed in the order book. Users are advised to immediately cease trading sats to avoid purchasing false assets and potential asset loss. On December 30th, OKX announced on Twitter that the Ordinals market has been restored, and trading for the affected currencies has resumed as usual. For genuine users who mistakenly purchased tokens due to this issue, the platform will compensate them after completing the assessment.","theft":true},{"id":"ht1a0b37d9f6","date":"2023-12-29","name":"INSC NFT","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wublockchain12/status/1740636382874488904"}],"desc":"There is a vulnerability in the INSC NFT contract, and multiple hackers have exploited it to steal NFTs and transfer them to Blur and OpenSea for sale. According to Blur market data, the floor price of INSC (ins-20) has dropped to 0.0048 ETH, with a decrease of 96.76% in the last 24 hours.","theft":true},{"id":"hte4d4065ddb","date":"2023-12-28","name":"Wallet gets phished for $4.4 million","kind":"scam","fam":"social","usd":4400000.0,"lo":4400000.0,"hi":4400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wallet-gets-phished-for-4-4-million"}],"theft":true,"headline":true},{"id":"ht2aefb46105","date":"2023-12-28","name":"Libra Protocol","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum"],"usd":550107.0,"lo":550107.0,"hi":550107.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/evilcos/status/1740224294494580910"}],"desc":"The inscription project Libra Protocol on Arbitrum is suspected to have exit scammed. Currently, the project team has transferred the received mint fees to the address [address].","theft":true},{"id":"ht5d81b55f8a","date":"2023-12-28","name":"NebulaNode (NNNN)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":335900.0,"lo":335900.0,"hi":335900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"NebulaNode (NNNN) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht83a4a48cbf","date":"2023-12-28","name":"Fake FomoFi (FOMO) Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":189600.0,"lo":189600.0,"hi":189600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ChainAegis/status/1740250397699367318"}],"desc":"Fake FomoFi (FOMO) on BNB Chain is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"review":["possible duplicate within one source"]},{"id":"htec8fff06da","date":"2023-12-28","name":"Fake NFPrompt (NFP)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":173193.0,"lo":173193.0,"hi":173193.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake NFPrompt (NFP) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htab3bbcd179","date":"2023-12-28","name":"Sleepless AI (AI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":91000.0,"lo":91000.0,"hi":91000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Sleepless AI (AI) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht34ae4a80d3","date":"2023-12-28","name":"CCV","kind":"hack","fam":"code","tech":"Precision loss","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht540aea55b6","date":"2023-12-28","name":"DominoTT","kind":"hack","fam":"code","tech":"Precision loss","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htdabe0a5d45","date":"2023-12-27","name":"Levana Perps","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Osmosis","Cosmos"],"usd":1100000.0,"lo":1100000.0,"hi":1146000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/levana-protocol-exploit"}],"desc":"Over December 13-26, 2023, Levana Protocol on Osmosis was exploited for $1.1M (10% TVL) via Pyth oracle staleness combined with Osmosis fee market bugs. Attacker executed profitable trades during volatile windows with stale price data; elevated gas costs amplified profitability.","theft":true},{"id":"htd9482d0501","date":"2023-12-27","name":"Thunder Terminal","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Solana"],"usd":240000.0,"lo":192000.0,"hi":240000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ThunderTerminal/status/1739813779976982946"}],"desc":"Thunder Terminal's MongoDB connection URL was compromised, allowing attackers to retrieve session tokens and execute unauthorized withdrawals from 114 user wallets. The attacker drained 86.5 ETH and 439 SOL in less than 9 minutes.","theft":true},{"id":"ht85c74126f9","date":"2023-12-26","name":"Money for nothing?","kind":"other","fam":"other","usd":1300000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/moneyfornothing"}]},{"id":"ht8dcedcbc3e","date":"2023-12-26","name":"MegabotETH","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":742000.0,"lo":742000.0,"hi":742000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/OrbitalFlux/status/1739341914866925606"}],"desc":"MegabotETH is suspected of a rug pull. Approximately 742k has been stolen.","theft":true},{"id":"ht7d2bbeea72","date":"2023-12-26","name":"Pike Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Base"],"usd":52600.0,"lo":52600.0,"hi":52600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CryptoMonkeyAi/status/1739203055978160553"}],"desc":"Pike Finance, a cross-chain lending protocol on Base, is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht587052fce5","date":"2023-12-25","name":"Telcoin","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"Payments","chains":["Polygon"],"usd":1250000.0,"lo":1240000.0,"hi":1250000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/telcoin/status/1739394228361310678"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/telcoin-exploit"}],"desc":"Telcoin's Polygon wallet proxy contracts were uninitialized, allowing an attacker to initialize dormant wallets with malicious versions and drain user funds that had never executed transactions.","theft":true},{"id":"hta131dfe181","date":"2023-12-25","name":"Ordinal Dex (ORDEX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":70600.0,"lo":70600.0,"hi":70600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Ordinal Dex (ORDEX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht86599421d8","date":"2023-12-22","name":"Pine Protocol","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":95000.0,"lo":90000.0,"hi":95000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1738131780459430338"}],"desc":"Pine Protocol was exploited via a flaw where old and new contract versions shared the same liquidity pools. An attacker used this to borrow NFT collateral from the new pool while recording repayment as a flash loan, allowing them to drain vault assets repeatedly across multiple transactions.","theft":true},{"id":"ht7f90ba8416","date":"2023-12-22","name":"UniSat Wallet","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/flash/208203"}],"desc":"UniSat Wallet's official tweet is suspected to have been hacked.It posted a promotional tweet for a program with closed comments and a suspected malicious link.","theft":true},{"id":"ht1e9bcbb750","date":"2023-12-21","name":"New wallet drainer steals almost $60 million in 9 months","kind":"hack","fam":"other","usd":58980000.0,"lo":58980000.0,"hi":58980000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ms-drainer"}],"theft":true,"headline":true},{"id":"htd85cad49f0","date":"2023-12-20","name":"INX Digital Company","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.prnewswire.com/news-releases/inx-customer-data-and-funds-are-secure-after-recent-attack-on-third-party-service-provider-302023932.html"}],"desc":"INX's third-party vendor serving one of the company's subsidiaries was compromised, allowing a malicious actor to execute unauthorized trades on the vendor's servers. The attacker drained approximately $1.6M from the subsidiary before being discovered.","theft":true},{"id":"ht8781630127","date":"2023-12-20","name":"Transit Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Transit Finance's router contract failed to validate swap pool paths provided by users. An attacker supplied a forged pool address in the path parameter, causing the router to transfer more tokens than intended during swaps.","theft":true},{"id":"hta3de40e610","date":"2023-12-18","name":"0xKofi","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DeDotFiSecurity/status/1736567490396688499"}],"desc":"@0xKofi's Twitter account has been hacked; please do not click on the scam link.","theft":true},{"id":"ht88edcc5f8d","date":"2023-12-18","name":"Metakey","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Plumferno/status/1736562536575574281"}],"desc":"Metakey's Discord has been compromised. Do not click the link in announcements.","theft":true},{"id":"ht5241ec9699","date":"2023-12-17","name":"FloorProtocol","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"C","n":1,"theft":true},{"id":"ht8363f9504e","date":"2023-12-17","name":"Flooring Protocol","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/0xfoobar/status/1736190355257627064"}],"desc":"Flooring Protocol's contract upgrade introduced a vulnerability in its multicall mechanism that lacked proper context isolation. Attackers exploited this to call transferFrom on user NFT approvals without consent, stealing 36 Pudgy Penguins and 14 Bored Apes.","theft":true},{"id":"htce192e8d10","date":"2023-12-17","name":"Aurory bridge hacked for over $1 million","kind":"hack","fam":"other","chains":["Solana","Ethereum"],"usd":1188000.0,"lo":1188000.0,"hi":1188000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/aurory-bridge-hack"}],"theft":true,"headline":true},{"id":"htd574b22178","date":"2023-12-17","name":"Bob","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd031fd8a39","date":"2023-12-16","name":"NFT Trader","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1736005523550646535"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-trader-hack"}],"desc":"NFT Trader's old smart contracts contained reentrancy vulnerabilities that allowed attackers to drain NFT collateral. Multiple actors exploited the flaw to steal 13 Mutant Apes, 37 Bored Apes, and other high-value NFTs worth ~$3M total.","theft":true},{"id":"hte05512f480","date":"2023-12-16","name":"GoodDollar","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"GoodDollar's reserve contract contained a reentrancy vulnerability that allowed an attacker to repeatedly call withdraw functions before state updates completed. The Protocol Guardians paused contracts and applied a 100% transaction fee to hacker-held tokens to discourage transfers.","theft":true},{"id":"ht338bf19925","date":"2023-12-16","name":"KEST","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":2300.0,"lo":2300.0,"hi":2300.0,"conf":"C","n":1,"theft":true},{"id":"ht04bb081449","date":"2023-12-14","name":"Ledger Connect Kit","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","chains":["Ethereum"],"usd":600000.0,"lo":484000.0,"hi":610000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1735299228866613465"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ledger-supply-chain-attack"}],"desc":"Attackers compromised a former Ledger employee's NPMJS account via phishing and published malicious versions of Ledger Connect Kit (1.1.5, 1.1.6, 1.1.7) containing Angel Drainer malware. The code rerouted user transaction approvals through rogue WalletConnect instances for less than two hours before detection.","theft":true},{"id":"htbdf7ba9437","date":"2023-12-14","name":"PHIL","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":2.0,"lo":2.0,"hi":2.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0d070801a6","date":"2023-12-13","name":"Australian victims lose estimated $1.3 billion to prolific scammers' HyperVerse project","kind":"scam","fam":"social","usd":1300000000.0,"lo":1300000000.0,"hi":1300000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hyperverse-scam"}],"theft":true,"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht28147658e3","date":"2023-12-13","name":"Money launderers charged over $80 million crypto romance scam ","kind":"scam","fam":"social","usd":80000000.0,"lo":80000000.0,"hi":80000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/80-million-romance-scam"}],"theft":true,"headline":true},{"id":"ht4cabe184a0","date":"2023-12-13","name":"Crypto scammer suddenly pleads guilty in trial surrounding EXW fraud","kind":"followup","fam":"other","usd":19300000.0,"lo":19300000.0,"hi":19300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/exw-fraud"}],"headline":true},{"id":"ht3e6962f619","date":"2023-12-13","name":"OKX DEX","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/okx-dex-rekt"},{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=okx-dex-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/okx-dex-hack"}],"desc":"OKX DEX's proxy admin private key was leaked on December 12-13, 2023. Attacker upgraded the proxy contract to a malicious implementation and stole ~$2.7M in ETH, USDT and USDC from wallets with standing approvals to the old contract.","theft":true},{"id":"ht741447688b","date":"2023-12-13","name":"Levana","kind":"hack","fam":"market","tech":"Oracle Attack","usd":1140000.0,"lo":1140000.0,"hi":1140000.0,"conf":"A","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/levana-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/269455/levana-protocol-exploited-osmosis"}],"desc":"The perpetual contract on Osmosis, Levana, has been subjected to an attack resulting in a loss exceeding $1.14 million. A post-incident report provided by its team indicates that between December 13th and December 26th, attackers successfully drained 10% of Levana's liquidity pool. Levana states that efforts are underway to rectify the issue, assuring that existing trading positions and profits remain unaffected. Future plans involve compensating affected liquidity providers through airdrops and the distribution of protocol fees collected during the attack period.","theft":true},{"id":"ht75294258cd","date":"2023-12-13","name":"Peapods Finance","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":231192.0,"lo":230000.0,"hi":231192.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1735025990819049968"}],"desc":"Peapods Finance's WeightedIndex contract suffered a reentrancy attack exploited via flashloan mechanisms. The attacker extracted PEAS tokens from the protocol; the hacker (white-hat) returned approximately 90% of funds on Dec 14.","theft":true},{"id":"ht5a44a0b394","date":"2023-12-13","name":"HYPR","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/hypr-network-rekt"}],"theft":true},{"id":"htdb4812749a","date":"2023-12-12","name":"Fraudsters steal more than $25 million in \"AI-powered\" crypto ponzi","kind":"fraud","fam":"insider","usd":25000000.0,"lo":25000000.0,"hi":25000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ai-powered-crypto-ponzi"}],"headline":true},{"id":"ht7eafa4d3ba","date":"2023-12-11","name":"Yearn Finance accidentally swaps its entire Ip-yCRVv2 treasury, asks nicely for the money back","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"ret":4400.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yearn-treasury-swap"}],"theft":true,"headline":true},{"id":"htc442c23427","date":"2023-12-11","name":"Venus Protocol","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["BNB Chain"],"usd":274000.0,"lo":270000.0,"hi":274000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/VenusProtocol/status/1733934890658263517"}],"desc":"Venus's snBNB oracle experienced a malfunction where Binance Oracle fed an incorrect price (snBNB spiked to $77B), allowing an attacker to buy snBNB at thin liquidity and trigger unintended liquidations. The protocol incurred a shortfall of ~$274K.","theft":true},{"id":"htfd2c0b4275","date":"2023-12-11","name":"stoic_DAO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":198033.0,"lo":198033.0,"hi":198033.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a price slippage on project stoic_DAO. 10% of the total Zeta token supply was swapped for ~91 ETH.","theft":true,"onchain":true},{"id":"htde5492558e","date":"2023-12-11","name":"GoodCompound","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3e147ac403","date":"2023-12-09","name":"BCT","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2b5086d91a","date":"2023-12-07","name":"Xai","kind":"scam","fam":"social","tech":"Impersonation Scam","target":"Token","chains":["Ethereum","Arbitrum"],"usd":845800.0,"lo":845800.0,"hi":845800.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1732652912688406759"}],"desc":"Malicious actors impersonated the legitimate Xai gaming blockchain project to deceive unsuspecting ETH holders. Victims transferred 374 ETH to the fraudulent scheme believing they were interacting with the Xai Launchpool or legitimate project channels.","theft":true},{"id":"ht8a5fffe460","date":"2023-12-07","name":"HNet","kind":"hack","fam":"code","tech":"Business logic flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht051a364448","date":"2023-12-06","name":"Abattoir of Zir (DIABLO)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":235705.0,"lo":235705.0,"hi":235705.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Abattoir of Zir (DIABLO) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht1fbcbbc985","date":"2023-12-06","name":"TIME","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"Token","chains":["Ethereum"],"usd":190000.0,"lo":190000.0,"hi":190000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/4hkd7dcm.html"}],"desc":"TIME token's integration of ERC-2771 with an unprotected multicall mechanism allowed arbitrary address spoofing. An attacker executed a delegatecall with malicious data, burned massive amounts of tokens from the LP, inflating the token price to extract ~$190K.","theft":true},{"id":"ht98664b34e1","date":"2023-12-06","name":"ElephantStatus","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":165000.0,"lo":165000.0,"hi":165000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"ElephantStatus was exploited via a flashloan-funded price manipulation attack. The attacker borrowed BUSD, swapped for WBNB, and manipulated the liquidity pool to artificially inflate WBNB price, enabling unintended extraction of value.","theft":true},{"id":"ht7ca344c74b","date":"2023-12-06","name":"Strong Finance (STRONG)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":60919.0,"lo":60919.0,"hi":60919.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Strong Finance (STRONG) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht78256d811a","date":"2023-12-05","name":"BEARNDAO","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":769000.0,"lo":769000.0,"hi":769000.0,"conf":"C","n":1,"theft":true},{"id":"htc76ff918c7","date":"2023-12-05","name":"CKD Token (CKD)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":539000.0,"lo":539000.0,"hi":539000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"CKD Token (CKD) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht928e07c657","date":"2023-12-05","name":"MAMO","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":3300.0,"lo":3300.0,"hi":3300.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht637b0f0855","date":"2023-12-05","name":"thirdweb","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/thirdweb/status/1731841493407576247"}],"desc":"On December 5, 2023, thirdweb, the Web3 base development platform, indicated that a security vulnerability was discovered in pre-built smart contracts. The impacted pre-built contracts include but are not limited to DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20. Please see a full list of impacted smart contracts and mitigation steps at this link (https://blog.thirdweb.com/security-vulnerability/).","theft":true},{"id":"ht8690419ecb","date":"2023-12-04","name":"Rob Robb robs victims of $1.2 million","kind":"hack","fam":"other","usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rob-robb-scam"}],"theft":true,"headline":true},{"id":"ht54aeffc1eb","date":"2023-12-04","name":"Stargate Finance","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Ethereum"],"usd":43000.0,"lo":43000.0,"hi":43000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/i825jmhr.html"}],"desc":"An attacker acquired 50,000 STG tokens to create a malicious voting proposal on Stargate Snapshot, posing as a gSTG token launch. The phishing link in the proposal directed over 1,000 users to a fake eligibility-check website, stealing credentials and private keys. PeckShieldAlert confirmed $43K in losses tracked to the attacker's wallet.","theft":true},{"id":"htf3b869ce6a","date":"2023-12-03","name":"Users of the Safe Wallet lose cumulative $2 million to address poisoning","kind":"hack","fam":"other","usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/safe-wallet-thefts"}],"theft":true,"headline":true},{"id":"htf76cfb1815","date":"2023-12-02","name":"bZxProtocol","kind":"hack","fam":"other","tech":"Inflation Attack","chains":["Ethereum"],"usd":208000.0,"lo":208000.0,"hi":208000.0,"conf":"C","n":1,"theft":true},{"id":"ht320672e454","date":"2023-12-01","name":"FCN-TRUST (FCN)","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":504000.0,"lo":504000.0,"hi":504000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The FCN-TRUST (FCN) token On BSC was exploited for over $504k in a flash loan attack. The attack caused the token price to crash by 99%.","theft":true,"onchain":true},{"id":"ht2c3c258c74","date":"2023-12-01","name":"UnverifiedContr_0x431abb","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"theft":true},{"id":"htd29dd4904b","date":"2023-12-01","name":"MYX Finance (QMYX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":128727.0,"lo":128727.0,"hi":128727.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"MYX Finance (QMYX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht93849eb543","date":"2023-11-30","name":"Florence Finance","kind":"hack","fam":"social","tech":"Address Poisoning","target":"DeFi Protocol","chains":["Ethereum"],"usd":1450000.0,"lo":1450000.0,"hi":1450000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/florence-finance-theft"}],"desc":"On November 30, 2023, user sent 1,456,162 USDC to poisoned address 0xB087... instead of Florence Finance's legitimate address. Attackers had seeded the user's address book with lookalike addresses; victim relied on autofill. Funds were bridged to Ethereum and swapped for ETH.","theft":true},{"id":"ht8615415f15","date":"2023-11-30","name":"CAROLProtocol","kind":"hack","fam":"market","tech":"Price Manipulation Via Reentrancy","chains":["Base"],"usd":53000.0,"lo":53000.0,"hi":53000.0,"conf":"C","n":1,"theft":true},{"id":"ht0a06bfc818","date":"2023-11-30","name":"EEE","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":22800.0,"lo":22800.0,"hi":22800.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2af1692068","date":"2023-11-29","name":"HOUNAX","kind":"fraud","fam":"insider","tech":"Scam","target":"CEX","usd":19830000.0,"lo":19000000.0,"hi":19830000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/qv9fuyz9.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hounax-scam"}],"desc":"Virtual Asset Platform HOUNAX Investigated for Fraud. On November 1, HOUNAX was placed by the Hong Kong Securities and Futures Commission (SFC) on a warning list of \"Suspicious Virtual Asset Trading Platforms,\" which is designed to alert investors to risks. On November 29, Hong Kong police reported that 158 Hong Kong investors had been lured by the unlicensed platform HOUNAX and lost approximately HK$155 million ($19.83 million)."},{"id":"ht49f81db931","date":"2023-11-29","name":"Velodrome","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Optimism"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/VelodromeFi/status/1729771762752135463"}],"desc":"An attacker used social engineering to compromise the domain registrar account for both Velodrome and Aerodrome, bypassing 2FA protections. Nameserver records were altered to redirect legitimate traffic to malicious protocol clones. Users were tricked into approving transactions on fake contracts, losing funds to attacker wallets. ChainSec and ZachXBT estimated losses at over $100K-$250K across both protocols.","theft":true},{"id":"ht63c68722a6","date":"2023-11-29","name":"AIS","kind":"hack","fam":"code","tech":"Insufficient validation","chains":["BNB Chain"],"usd":61000.0,"lo":61000.0,"hi":61000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2a838c6499","date":"2023-11-29","name":"Burntbubba","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":3000.0,"lo":3000.0,"hi":3000.0,"conf":"C","n":1,"theft":true},{"id":"htf4365b5ef6","date":"2023-11-29","name":"Aerodrome","kind":"hack","fam":"keys","tech":"DNS Hijacking Attack","chains":["Base"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/aerodromefi/status/1729771968717541711"}],"desc":"Aerodrome tweeted that the frontend is currently compromised, please do not interact with Aerodrome for the time being, the team is investigating.","theft":true},{"id":"htd3ff7ae9d3","date":"2023-11-28","name":"AssetClub (ACC)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":84423.0,"lo":84423.0,"hi":84423.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"AssetClub (ACC) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht44d723b283","date":"2023-11-28","name":"Symbiogenesis (SYSIS)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":54086.0,"lo":54086.0,"hi":54086.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Symbiogenesis (SYSIS) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht1975854976","date":"2023-11-28","name":"FiberRouter","kind":"hack","fam":"code","tech":"input validation","conf":"C","n":1,"theft":true},{"id":"ht08eb6498a4","date":"2023-11-27","name":"Expanso (EXPSO)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":87317.0,"lo":87317.0,"hi":87317.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Expanso (EXPSO) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htaa869730e6","date":"2023-11-25","name":"TheNFTV2","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":19000.0,"lo":19000.0,"hi":19000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"TheNFTV2 contained a business logic flaw in its withdrawal mechanism that incorrectly calculated user shares and balances. An attacker exploited the logic error to withdraw more assets than their proportional stake, extracting funds from the protocol.","theft":true,"onchain":true},{"id":"htc31ad305cb","date":"2023-11-25","name":"MetaLend","kind":"hack","fam":"other","tech":"CompoundV2 Inflation Attack","chains":["Ethereum"],"usd":4000.0,"lo":4000.0,"hi":4000.0,"conf":"C","n":1,"theft":true},{"id":"ht87d462aefc","date":"2023-11-24","name":"Changpeng Zhao (CZ)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":302028.0,"lo":302028.0,"hi":302028.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Changpeng Zhao (CZ) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht65dac6511e","date":"2023-11-24","name":"Jewels (JWL)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":65784.0,"lo":65784.0,"hi":65784.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"CJewels (JWL) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htd1581bb657","date":"2023-11-23","name":"Bitcoiner spends $3 million on transaction fee","kind":"other","fam":"other","chains":["Bitcoin"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoiner-spends-3-million-on-transaction-fee"}],"headline":true},{"id":"ht47014b1786","date":"2023-11-23","name":"GigaDAO (GIGS)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":240270.0,"lo":240270.0,"hi":240270.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Dor (DOR) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht35c322e3bb","date":"2023-11-23","name":"Fake TrustPad (TPAD)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":240006.0,"lo":240006.0,"hi":300000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/twitter-security-account-impersonator-scam"}],"desc":"Fake TrustPad (TPAD) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true,"review":["sources disagree on the date"]},{"id":"ht15c5958c26","date":"2023-11-23","name":"DigiFund (DFUND)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":237894.0,"lo":237894.0,"hi":237894.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"DigiFund (DFUND) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"hta1368ecbd0","date":"2023-11-23","name":"AISurf (AISC)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":237074.0,"lo":237074.0,"hi":237074.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"AISurf (AISC) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht3db3ce6003","date":"2023-11-23","name":"RepubliK (RPK)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":235995.0,"lo":235995.0,"hi":235995.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"RepubliK (RPK) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht95fa89b7df","date":"2023-11-23","name":"PAPABEAR (PAPA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":235249.0,"lo":235249.0,"hi":235249.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"PAPABEAR (PAPA) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht4a3f3deb29","date":"2023-11-23","name":"Creso (CRE)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":233693.0,"lo":233693.0,"hi":233693.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Creso (CRE) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht2fdce34375","date":"2023-11-23","name":"IPMB (IPMB)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":232074.0,"lo":232074.0,"hi":232074.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"IPMB (IPMB) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht0281c524b3","date":"2023-11-23","name":"DarkProtocol (DARK)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":230833.0,"lo":230833.0,"hi":230833.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"DarkProtocol (DARK) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht99598d002a","date":"2023-11-23","name":"Web (WEB)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":217791.0,"lo":217791.0,"hi":217791.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Web (WEB) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"hta429139797","date":"2023-11-23","name":"InfStones","kind":"hack","fam":"keys","tech":"Third-party Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/LidoFinance/status/1727317509169463343"}],"desc":"Lido officials say that over the course of the last 24 hours, Lido DAO contributors were made aware of a platform vulnerability that affected an active Node Operator using the Lido on Ethereum protocol (InfStones) sometime over the course of the previous few months. The vulnerability was disclosed to InfStones in July 2023 by security researchers dWallet Labs. The Node Operator has announced that the vulnerability has been 184 addressed. The vulnerability is related to the possible exposure of root-level access to 25 validator servers that may not be related to the Lido protocol, including possibly key material, to external attackers. It is not clear to contributors at this time if servers and/or keys related to Lido validators were included in the scope of affected systems or not.","theft":true},{"id":"htx-heco-2023-11-22","date":"2023-11-22","name":"HTX & Heco","kind":"hack","fam":"bridge","tech":"Unknown","target":"CEX","usd":113300000.0,"lo":113300000.0,"hi":113300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/justinsuntron/status/1727304656622326180"}],"desc":"HTX (formerly Huobi) and its related Heco Bridge were hacked for a combined $113.3 million.","theft":true},{"id":"hta7dd690132","date":"2023-11-22","name":"Heco Bridge","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":86600000.0,"lo":86600000.0,"hi":115000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/heco-htx-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/htx-and-heco-chain-hack"}],"desc":"On November 22, 2023, the HECO Chain bridge to Ethereum was drained of $86.6M when the operator's account was compromised, enabling unauthorized asset withdrawals.","theft":true},{"id":"ht171a94ddc6","date":"2023-11-22","name":"KyberSwap Elastic","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum","Base","Polygon","Optimism","Arbitrum"],"usd":51350000.0,"lo":48000000.0,"hi":54700000.0,"ret":4700000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kyberswap-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/KyberNetwork/status/1727475235342217682"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kyberswap-hack-2"}],"desc":"On November 22, 2023, KyberSwap Elastic was exploited via a double rounding error in computeSwapStep() that allowed the final swap price to exceed the target threshold without updating liquidity state. The attacker used strategic swaps to corrupt baseL and drain $48M across multiple networks.","theft":true},{"id":"ht739e2e5788","date":"2023-11-22","name":"Huobi","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":13600000.0,"lo":13600000.0,"hi":13600000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 22, 2023, Huobi HTX suffered a breach of three hot wallets when an attacker gained access to private keys stored on exchange servers. User assets and reserves were converted to Ether and transferred out, with initial hot wallet losses of $13.6M and additional impact from related HECO Chain bridge losses.","theft":true},{"id":"ht59bb9fd55d","date":"2023-11-21","name":"Dor (DOR)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":258467.0,"lo":258467.0,"hi":258467.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Dor (DOR) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htfeaaf82830","date":"2023-11-21","name":"CredixFinance (CREDIX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":82906.0,"lo":82906.0,"hi":82906.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"CredixFinance (CREDIX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htf41954041a","date":"2023-11-20","name":"DOJ cracks down on $225 million crypto romance scam","kind":"fraud","fam":"insider","usd":225000000.0,"lo":225000000.0,"hi":225000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/doj-cracks-down-on-225-million-crypto-romance-scam"}],"headline":true},{"id":"htbd083dfd12","date":"2023-11-20","name":"Loopring","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1726612551205814458"}],"desc":"Loopring's Twitter account has been hacked; please do not click on the phishing link.","theft":true},{"id":"ht863f185978","date":"2023-11-18","name":"Kronos Research","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"Other","chains":["Ethereum"],"usd":26000000.0,"lo":26000000.0,"hi":26000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kronos-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/ResearchKronos/status/1726013733888041376"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kronos-trading-firm-suffers-key-breach"}],"desc":"Kronos Research's API keys were compromised, allowing attackers to drain 26M USD from trading wallets via unauthorized transactions.","theft":true},{"id":"ht01faafee29","date":"2023-11-18","name":"Dydx","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":9000000.0,"lo":9000000.0,"hi":9000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dydx-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/dYdX/status/1725921897848914353"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dydx-insurance-fund-attack"}],"desc":"On November 17-18, 2023, dYdX V3's insurance fund lost $9M via coordinated market manipulation in less-liquid SUSHI and YFI markets. The attacker built leveraged positions on dYdX, orchestrated spot market price surges, and triggered a liquidation cascade worth $38M notional to drain the insurance fund.","theft":true},{"id":"htbfa6f456c1","date":"2023-11-18","name":"SpookySwap","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Fantom"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SpookySwap/status/1725677274718994543"}],"desc":"SpookySwap's frontend domain was compromised on November 18, 2023, with malicious phishing code injected to impersonate legitimate contract interactions. Users accessing the compromised domain were tricked into signing transactions draining their wallets. The attack resulted in $5K in realized losses before the team identified and removed the malicious code.","theft":true},{"id":"htf48e8ec7f0","date":"2023-11-18","name":"Trader Joe","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TraderJoe_xyz/status/1725628622524883448"}],"desc":"Trader Joe, the largest native DEX on Avalanche, tweeted that the team's preliminary analysis identified a potential exploit in a 3rd party analytics plugin hacked JavaScript code used by the frontend.","theft":true},{"id":"ht1a73f36c20","date":"2023-11-17","name":"Token8633_9419","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":52000.0,"lo":52000.0,"hi":52000.0,"conf":"C","n":1,"theft":true},{"id":"hte08488fbeb","date":"2023-11-17","name":"ShibaToken","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":31000.0,"lo":31000.0,"hi":31000.0,"conf":"C","n":1,"theft":true},{"id":"ht653337b4c4","date":"2023-11-16","name":"WECO","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"C","n":1,"theft":true},{"id":"ht27116947e3","date":"2023-11-15","name":"PIPI (PIPI)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":121373.0,"lo":121373.0,"hi":121373.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"PIPI (PIPI) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 99.92% price decline.","theft":true,"onchain":true},{"id":"ht6564ed4753","date":"2023-11-15","name":"LinkDAO","kind":"hack","fam":"other","tech":"Bad `K` Value Verification","chains":["BNB Chain"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"theft":true},{"id":"hte6e252aed2","date":"2023-11-15","name":"Lendora Protocol","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1724518553976488238"}],"desc":"Lendora Protocol on Scroll is suspected of an exit scam. The website is now offline and the contracts were paused.","theft":true},{"id":"ht3b2dc17f4d","date":"2023-11-15","name":"EHX","kind":"hack","fam":"other","tech":"Lack of Slippage Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htcc6456de86","date":"2023-11-15","name":"XAI","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht27c1c5511f","date":"2023-11-14","name":"Exzo Network","kind":"hack","fam":"code","tech":"Wallet Stolen","chains":["Ethereum"],"usd":470498.0,"lo":470498.0,"hi":470498.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Exzo_Network/status/1726680105915765211"}],"desc":"Exzo Network tweeted that a recent security breach targeted Exzo ($XZO), resulting from a compromised owner/admin account. The malicious group utilized the compromised admin wallet to transfer the 'ownership' role of Exzo ($XZO) to their wallet, enabling them to mint a substantial amount of $XZO and drain 169 ETH from the XZO/ETH liquidity pool on Uniswap. The attackers also transferred a total of 69 ETH and the remaining XZO in the admin wallet to their own wallet(s).","theft":true},{"id":"ht728e92de23","date":"2023-11-14","name":"Builders NFT (BuiLDerS)","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":89296.0,"lo":89296.0,"hi":89296.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Builders NFT (BuiLDerS) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"htf1b1406234","date":"2023-11-14","name":"BABYFIDO (BABYFIDO)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":81400.0,"lo":81400.0,"hi":81400.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BABYFIDO (BABYFIDO) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht20b47c5f77","date":"2023-11-14","name":"OKC Project","kind":"hack","fam":"code","tech":"Instant Rewards, Unlocked","usd":6268.0,"lo":6268.0,"hi":6268.0,"conf":"C","n":1,"theft":true},{"id":"htedd779719a","date":"2023-11-12","name":"Wallet drainer steals more than $60 million in six months","kind":"hack","fam":"other","chains":["Ethereum"],"usd":60000000.0,"lo":60000000.0,"hi":60000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/create2-wallet-drainer"}],"theft":true,"headline":true},{"id":"ht224f727bc0","date":"2023-11-12","name":"Wallet linked to Binance deployer loses $27 million in apparent hack","kind":"hack","fam":"other","usd":27000000.0,"lo":27000000.0,"hi":27000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/binance-linked-wallet-hacked"}],"theft":true,"headline":true},{"id":"ht95a5bf54ef","date":"2023-11-12","name":"MEVBot_0x8c2d","kind":"hack","fam":"code","tech":"Lack of Access Control","chains":["BNB Chain"],"usd":365000.0,"lo":365000.0,"hi":365000.0,"conf":"C","n":1,"theft":true},{"id":"ht0f7ffd9666","date":"2023-11-12","name":"MEVBot_0xa247","kind":"hack","fam":"code","tech":"Incorrect Access Control","chains":["Ethereum"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"C","n":1,"theft":true},{"id":"ht89ff7bab9c","date":"2023-11-11","name":"Samudai","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":1250000.0,"lo":1250000.0,"hi":1250000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.web3isgoinggreat.com/?tech=dao&id=samudai-treasury-drained"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/samudai-treasury-drained"}],"desc":"Samudai's multisignature wallets and founder's personal wallet were compromised, draining 1.25M USD in ETH. The attacker moved funds through Tornado Cash mixer to obfuscate the theft.","theft":true},{"id":"ht249c61a492","date":"2023-11-10","name":"Poloniex","kind":"hack","fam":"social","tech":"Malware","target":"CEX","chains":["Tron","Ethereum","Bitcoin"],"usd":126000000.0,"lo":126000000.0,"hi":130000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/poloniex-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1722965423803580735"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/poloniex-hack"}],"desc":"Poloniex hot wallet private keys compromised on November 10, 2023, draining $126M across Ethereum, Tron, and Bitcoin. Compromise likely via malware or social engineering. Justin Sun committed to full reimbursement.","theft":true},{"id":"ht0524451a54","date":"2023-11-10","name":"Raft","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":3300000.0,"lo":3200000.0,"hi":3300000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/raft-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/raft_fi/status/1723057566664548623"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/raft-hack"}],"desc":"On November 10, 2023, an attacker exploited a precision error in Raft's divUp function during share token minting to mint ~$6.7M unbacked R tokens via a 6000 cbETH flash loan from Aave, causing a ~$3.3M net loss.","theft":true,"onchain":true},{"id":"ht5617504ab5","date":"2023-11-10","name":"MahaLend","kind":"hack","fam":"code","tech":"Donate Inflation ExchangeRate & Rounding Error","chains":["Ethereum"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht87da4b7331","date":"2023-11-10","name":"grok","kind":"hack","fam":"other","tech":"Lack of slippage protection","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht9c91169104","date":"2023-11-09","name":"CoinSpot","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":2400000.0,"lo":2400000.0,"hi":2472000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/neptune-mutual/taking-a-closer-look-at-coinspot-exploit-ac8c08ed18ee"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinspot-hack"}],"desc":"CoinSpot lost ~1,283 ETH (~$2.4M) on Nov 8-9, 2023 from a compromised hot wallet private key. Attacker converted to BTC and dispersed across multiple wallets.","theft":true},{"id":"ht70e8e58fe5","date":"2023-11-09","name":"God Of Wealth (GOW39)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":206251.0,"lo":206251.0,"hi":206251.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"God Of Wealth (GOW39) is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"onchain":true},{"id":"ht6f51f42639","date":"2023-11-08","name":"Mirage Finance","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"usd":12000.0,"lo":12000.0,"hi":12000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Mirage Finance has been exploited for ~$12K, $MRG has dropped 54%.","theft":true,"onchain":true},{"id":"htfb47e8ffd5","date":"2023-11-07","name":"Curve Finance MEV Bot","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Bitcoin"],"usd":2000000.0,"lo":1975448.0,"hi":2152392.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ripmevbot2"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1722081647028478029"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mev-bot-0x05f01-exploit"}],"desc":"An MEV arbitrage bot on Ethereum was exploited when an attacker discovered a vulnerability allowing unauthorized calls to a function that traded wBTC for wETH. Using a flash loan to manipulate Curve pool prices, the attacker forced the bot to purchase wBTC at inflated prices.","theft":true,"review":["possible duplicate within one source"]},{"id":"htda5c17acfa","date":"2023-11-07","name":"RBalancer","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht40e1a2aafa","date":"2023-11-06","name":"Arrests made in $300 million Indian crypto scam","kind":"scam","fam":"social","usd":300000000.0,"lo":300000000.0,"hi":300000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/himachal-pradesh-scam"}],"theft":true,"headline":true},{"id":"hte3cf3c9833","date":"2023-11-06","name":"TheStandard.io","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":290000.0,"lo":290000.0,"hi":290000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/thestandard_io/status/1721823727925829842"}],"desc":"TheStandard.io was exploited when an attacker initiated a CDP with 10 WBTC collateral to mint 290K EUROs, then forced a manipulated swap in the WBTC/PAXG pool. Lack of slippage protection (amountOutMinimum = 0) combined with low liquidity enabled the attack.","theft":true},{"id":"ht4c464935e7","date":"2023-11-06","name":"TrustPad","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":155000.0,"lo":155000.0,"hi":155000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1721788176191332518"}],"desc":"TrustPad's receiveUpPool() function on BNB Chain failed to verify msg.sender, allowing an attacker to repeatedly call the function and harvest pending rewards by manipulating lock periods through untrusted external calls.","theft":true},{"id":"htea0f0bda8d","date":"2023-11-06","name":"KR","kind":"hack","fam":"code","tech":"Precision loss","chains":["BNB Chain"],"usd":15000.0,"lo":15000.0,"hi":15000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdd47e2c948","date":"2023-11-05","name":"Fake Ledger Live Web3","kind":"hack","fam":"other","tech":"Fake Application","usd":588000.0,"lo":588000.0,"hi":588000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1720961400313373127"}],"desc":"A fake Ledger Live app on the official Microsoft App Store which was resulted in 16.8+ BTC ($588K) stolen.","theft":true},{"id":"hte705831707","date":"2023-11-03","name":"Tellor","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1720326926466957344"}],"desc":"Tellor's Twitter account was compromised, and the hacker posted a phishing link related to the $TRB airdrop.","theft":true},{"id":"ht2007520e81","date":"2023-11-02","name":"3913Token","kind":"hack","fam":"other","tech":"Deflationary Token Attack","chains":["BNB Chain"],"usd":31354.0,"lo":31354.0,"hi":31354.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht63bee36718","date":"2023-11-02","name":"BRAND","kind":"hack","fam":"code","tech":"Lack of access control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht5d7cb3d58d","date":"2023-11-01","name":"Onyx Protocol","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":2100000.0,"lo":2000000.0,"hi":2100000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/onyx-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1719667931926413679"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/onyx-hack-1"}],"desc":"On November 1, 2023, Onyx Protocol (Compound V2 fork) was exploited for $2.1M. An attacker used a 4,000 ETH flashloan, swapped to PEPE, and donated to inflate the new oPEPE market's exchange rate, exploiting rounding errors in redemption logic.","theft":true},{"id":"hta41d56b6d5","date":"2023-11-01","name":"Monero","kind":"hack","fam":"keys","tech":"Unknown","chains":["monero"],"usd":460000.0,"lo":460000.0,"hi":460895.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=monero-community-wallet-hack"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monero-community-wallet-hack"}],"desc":"Monero discloses that its community crowdfunding wallet was drained of 2,675.73 XMR (the entire balance). The hot wallet, used for payments to contributors, is untouched; its balance is ~244 XMR.","theft":true},{"id":"htdf1c944fb2","date":"2023-11-01","name":"Fake Celestia (TIA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":208394.0,"lo":208394.0,"hi":208394.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Celestia (TIA) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 99.5% price decline.","theft":true},{"id":"hteeaa72445f","date":"2023-11-01","name":"Fake Memecoin (MEME)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":117930.0,"lo":117930.0,"hi":117930.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Memecoin (MEME) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht1986d1aba9","date":"2023-11-01","name":"Frax Finance","kind":"hack","fam":"keys","tech":"DNS Hijacking Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/fraxfinance/status/1719497560543658073"}],"desc":"According to @fraxfinance, Frax Finance's DNS has been attacked. Please don’t use http://frax[.]finance and http://frax[.]com domains until further notice.","theft":true},{"id":"ht98cd943971","date":"2023-11-01","name":"SwampFinance","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht1526925e03","date":"2023-10-31","name":"Unibot","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":640000.0,"lo":560000.0,"hi":640000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/unibot-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1719242913769803788"}],"desc":"On October 31, 2023, Unibot's newly-deployed unverified router contract contained a call injection vulnerability allowing attackers to insert arbitrary transferFrom() calls and drain $640,000 in approved tokens from user wallets. The stolen funds were moved to Uniswap then Tornado Cash.","theft":true},{"id":"ht987c4ce472","date":"2023-10-31","name":"UniBotRouter","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["Ethereum"],"usd":83944.0,"lo":83944.0,"hi":83944.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdcb2de7c18","date":"2023-10-31","name":"Dracula (DRAC)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":38349.0,"lo":38349.0,"hi":38349.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Dracula (DRAC) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"htb8d18fff22","date":"2023-10-30","name":"Fake TITANX (TITANX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":82385.0,"lo":82385.0,"hi":82385.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake TITANX (TITANX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"htbf09e58700","date":"2023-10-30","name":"Fake MEMEPAD (MEMEPAD)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":80134.0,"lo":80134.0,"hi":80134.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake MEMEPAD (MEMEPAD) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"ht0a4686e71e","date":"2023-10-30","name":"Fake Memecoin (MEME)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":78947.0,"lo":78947.0,"hi":78947.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Memecoin (MEME) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"review":["possible duplicate within one source"]},{"id":"hta58b9b3e6c","date":"2023-10-30","name":"LaEeb","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"hte0ad16f0fa","date":"2023-10-28","name":"Astrid Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":228000.0,"lo":228000.0,"hi":228000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/AstridFinance/status/1718254655288066501"}],"desc":"On October 28-29, 2023, Astrid Finance on Ethereum was exploited for $228K via missing input validation on withdraw() parameters. Attacker manipulated _restakedTokenAddress to create counterfeit tokens and convert to ETH; returned ~$182K after legal threat.","theft":true,"onchain":true},{"id":"ht57ea6c321c","date":"2023-10-27","name":"STIMMY","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":78800.0,"lo":78800.0,"hi":78800.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"STIMMY on Ethereum pulled liquidity to the tune of 43.8 ETH (~$78.8K) and deleted its social platforms.","theft":true},{"id":"ht53ad25cb89","date":"2023-10-26","name":"Fake Linea token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A fake Linea token is suspected of a rug pull for ~$1.3m. ~$743k has been deposited into Tornado Cash.\r\nContract Address: [address].","theft":true},{"id":"ht00e05a66ee","date":"2023-10-25","name":"LastPass","kind":"hack","fam":"other","tech":"Information Leakage","usd":4400000.0,"lo":4400000.0,"hi":4400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1717901088521687330"}],"desc":"On October 25, 2023 alone another ~$4.4M was drained from 25+ victims as a result of the LastPass hack.","theft":true},{"id":"htf0b1842a66","date":"2023-10-25","name":"Mina Protocol","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":106730.0,"lo":106730.0,"hi":106730.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Mina Protocol on BNB Chain has dropped 100%. 0x0920…a44A has swapped 1,000,000,000,000,000 $MINA for ~474.26 $BNB (worth ~$106.7K).","theft":true},{"id":"ht715e5eec8a","date":"2023-10-24","name":"Safereum (SAFEREUM)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Safereum has conducted an exit scam for ~$1.3m. Contract Address: [address].","theft":true},{"id":"ht7f21dc31e0","date":"2023-10-24","name":"Maestro","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":510000.0,"ret":465000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MaestroBots/status/1716969767804747820"}],"desc":"A vulnerability in the Maestro Router 2 contract behind a Telegram trading bot allowed attackers to execute arbitrary external calls, pulling tokens from user wallets that had granted the router approvals. Maestro identified and fixed the exploit within about 30 minutes and paused trading.","theft":true,"onchain":true},{"id":"ht917746b434","date":"2023-10-23","name":"Julia (JULIA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":73000.0,"lo":73000.0,"hi":73000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Julia (JULIA) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"htda1b06fb40","date":"2023-10-22","name":"OpenLeverage","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":8000.0,"lo":8000.0,"hi":8000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbdab1ef00f","date":"2023-10-20","name":"Coins.ph","kind":"hack","fam":"keys","tech":"Private Key Leakage","target":"CEX","usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/258701/philippines-based-exchange-coins-ph-appears-to-have-lost-12-2-million-xrp-in-possible-exploit"}],"desc":"Philippine exchange Coins.ph lost 12 million $XRP ($6 million) in a hack.","theft":true},{"id":"htb87bf0f1fb","date":"2023-10-20","name":"SOMESING (SSX)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":169000.0,"lo":169000.0,"hi":169000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Token SOMESING (SSX) on BNB Chain is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true},{"id":"htd7b3eeb732","date":"2023-10-20","name":"Fake Celestia (TIA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":162837.0,"lo":162837.0,"hi":162837.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Fake Celestia (TIA) on BNB Chain is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht94cfbda5dc","date":"2023-10-19","name":"Synthetify","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Solana"],"usd":230000.0,"lo":230000.0,"hi":230000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/synthetify/status/1714933001027477909?s=20"}],"desc":"Synthetify was compromised through a governance attack targeting an inactive DAO with pure token-based voting. The protocol was frozen and no funds were recovered as stolen assets were mixed through Tornado Cash.","theft":true},{"id":"ht8210939fa8","date":"2023-10-19","name":"The Honest Venture","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":58000.0,"lo":58000.0,"hi":58000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A project named The Honest Venture is a confirmed investment scam with losses of approximately ~$58k.","theft":true},{"id":"ht29ff2532ed","date":"2023-10-19","name":"kTAF","kind":"hack","fam":"other","tech":"CompoundV2 Inflation Attack","chains":["Ethereum"],"usd":8000.0,"lo":8000.0,"hi":8000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht07bd04ff97","date":"2023-10-18","name":"HOPE Lend","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":825000.0,"lo":818747.0,"hi":825000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1714655324395704423"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hope-lend-hack"}],"desc":"HopeLend was exploited via a precision loss vulnerability in hToken's share calculation during the _handleFlashLoanRepayment function. The attacker minted tiny PEPE shares, donated large volumes to distort the exchange rate, then borrowed ETH using rounding errors in the redeemUnderlying function.","theft":true,"onchain":true},{"id":"ht78f9f1d049","date":"2023-10-18","name":"MicDao","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":13000.0,"lo":12263.0,"hi":13000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"MicDao was exploited when an attacker manipulated token supply by burning tokens to artificially reduce total supply and inflate the token price, then sold MicDao tokens for profit and converted the funds to BSC.","theft":true,"onchain":true},{"id":"htd9da5e03cf","date":"2023-10-17","name":"Nightmare on FTM Street","kind":"other","fam":"other","usd":7500000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/nightmare-ftm"}]},{"id":"ht9644941e04","date":"2023-10-17","name":"Fantom Foundation and employees lose collective $7 million in mass hack","kind":"hack","fam":"other","chains":["Ethereum","Fantom"],"usd":7000000.0,"lo":7000000.0,"hi":7000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fantom-wallet-hacks"}],"theft":true,"headline":true},{"id":"ht0029360099","date":"2023-10-17","name":"Fantom Foundation","kind":"hack","fam":"keys","tech":"Private Key Leakage","usd":657000.0,"lo":657000.0,"hi":657000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/IM_23pds/status/1714430289206977005"}],"desc":"On October 17, Fantom Foundation Telegram Community Administrator Jane stated that some of Fantom Foundation's hot wallet assets were drained due to a zero-day vulnerability on Google Chrome. According to SlowMist's analysis of on-chain transmission methods and previous emergency response experience, this should be a case of private key theft, which may be the result of the Foundation or its employees being attacked by phishing, social engineering, and running malicious Trojan files, leading to the theft of some wallet private keys.","theft":true},{"id":"htdb90be67ee","date":"2023-10-17","name":"Everscale","kind":"hack","fam":"bridge","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Everscale_net/status/1714227498702323912"}],"desc":"Blockchain network Everscale said that a large number of EVER tokens have been stolen and they are working closely with exchanges where EVER is listed in order to stop any further outflow of tokens. To halt the actions of those responsible, they have temporarily disconnected Octus Bridge.","theft":true},{"id":"ht2f0559cfe7","date":"2023-10-16","name":"Ivy","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1580000.0,"lo":1580000.0,"hi":1580000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Project Ivy on BSC Suspected of Exit Scam. Contract Address: [address] which dropped >94%. EOA 0x5c30 removed $1.58m liquidity which caused the drop.","theft":true},{"id":"ht0367ea0738","date":"2023-10-13","name":"WiseLending","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":260000.0,"lo":260000.0,"hi":260000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"WiseLending was exploited through a flash loan attack that leveraged rounding errors in the _calculateShares function. The attacker used strategic deposits and withdrawals to artificially inflate share prices, with a white-hat MEV bot front-running the exploit to recover funds.","theft":true,"onchain":true},{"id":"htd60b7f81f8","date":"2023-10-13","name":"Beluga","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":175000.0,"lo":175000.0,"hi":175000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/CryptoGiants_/status/1712709341709476015"}],"desc":"Beluga Protocol's multichain AMM on Arbitrum was exploited through pool balance manipulation, resulting in approximately 175K USD in losses. Beluga is a Layer 3 infrastructure aggregating liquidity across multiple chains.","theft":true,"onchain":true},{"id":"ht6b538998f7","date":"2023-10-12","name":"Platypus Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Avalanche"],"usd":2100000.0,"lo":1655000.0,"hi":2200000.0,"ret":1487600.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/platypus-rekt2"},{"s":"SlowMist Hacked","u":"https://twitter.com/Platypusdefi/status/1712365385100689584"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/platypus-finance-hack-3"}],"desc":"On October 12, 2023, Platypus Finance on Avalanche was exploited via three flashloan transactions totaling ~$2.2-2.23M. Attackers manipulated swap prices by altering slippage calculations across multiple liquidity pools, then draining value from the protocol.","theft":true,"onchain":true},{"id":"htbd5d460240","date":"2023-10-12","name":"CRYPTO_STREET (CST)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The CST deployer sold tokens, resulting in a roughly 99% drop in the token price. Contract address: [address]. Deployer address: [address].","theft":true},{"id":"ht4553662732","date":"2023-10-12","name":"LastPass","kind":"hack","fam":"keys","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/flippen6485/status/1712158624985002176"}],"desc":"LastPass, a password management platform, is suspected to have suffered a data breach. On October 12, Twitter user flippen.eth tweeted that he had lost more than 20 ETH from his hot wallet overnight after storing his mnemonic on LastPass, an online password management platform, stating, \"This problem seems to be widespread, so if you've ever used LastPass, it's time to update your password and abandon your wallet and the mnemonics stored there.”","theft":true},{"id":"htaa9e91f07f","date":"2023-10-12","name":"Loozr","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/officialloozr/status/1712076664916652381"}],"desc":"There is a fake collab land verification in the Loozr Discord. The verification will take you to a phishing site that connects to a wallet drainer","theft":true},{"id":"htb897843af7","date":"2023-10-12","name":"NOWAI","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/nowaiAI/status/1712467212228051324"}],"desc":"The @nowaiAI announced their Discord server has been compromised. Do not connect your wallet. It connects to phishing site: hxxps://nowaiguard.github.io/discord/.","theft":true},{"id":"ht0c297edcac","date":"2023-10-12","name":"Wall Street Meme","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wallstmemes/status/1712389771522175250"}],"desc":"Attacker posted a phishing link in the announcements channel of Wall Street Meme's Discord server.","theft":true},{"id":"htecd9c44cf7","date":"2023-10-11","name":"FSL","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1680000.0,"lo":1680000.0,"hi":1680000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/2g0fii72.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fsl-rug-pull"}],"desc":"FSL project is suspected of being a Rug Pull, with a loss of approximately $1.68 million. FSL token plummeted 99.8%.","theft":true},{"id":"ht824b57b19a","date":"2023-10-11","name":"BlackHole Token","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":1272500.0,"lo":1200000.0,"hi":1280000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/black-hole-token-hack"}],"desc":"BlackHole Token on BSC was exploited when an attacker used a flash loan to manipulate liquidity pool prices. The attacker swapped 22 million USDT through the trading pair to artificially inflate the token price before draining funds from the protocol.","theft":true,"onchain":true},{"id":"hta860fcbcf7","date":"2023-10-10","name":"Fintoch scammers strike again with $1.6 million FinSoul scam","kind":"scam","fam":"social","usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/finsoul-exit-scam"}],"theft":true,"headline":true},{"id":"ht37e3a996c3","date":"2023-10-10","name":"Fake Bitcoin BSC Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":48700.0,"lo":48700.0,"hi":48700.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On Oct 10, a fake Bitcoin BSC Token (BTCBSC) on BSC was rugged for ~$48.7K. The deployer removed 235.871 WBNB and 4,271,589.56  BTCBSC token from the LP. Contract Address: [address]. Deployer Address: [address].","theft":true},{"id":"htdfbde83d95","date":"2023-10-10","name":"Cryptopreneurs","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/KonstVlad2/status/1711811593413984361"}],"desc":"Cryptopreneurs' Discord server was hacked and the attacker posted a phishing link.","theft":true},{"id":"htdfd3941bc1","date":"2023-10-10","name":"Ordswap","kind":"hack","fam":"keys","tech":"DNS Hijacking Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ordswap/status/1711444650823713181"}],"desc":"On October 10th, the BRC20 exchange platform Ordswap issued a tweet, stating that they had lost control of their website domain, and the issue appeared to be related to the website development and hosting company Netlify. They advised users not to access their website until they regained control of the domain. Ordswap users reported that the compromised website was redirecting users to phishing links.","theft":true},{"id":"htc14035bcd9","date":"2023-10-10","name":"Starksport","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/starkfinance/status/1711483205684281402"}],"desc":"Starksport announced that a community team member's Discord was  compromised.","theft":true},{"id":"htc17ac27676","date":"2023-10-09","name":"Lucky star Currency Token","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1110000.0,"lo":1100000.0,"hi":1110000.0,"conf":"A","n":3,"src":[{"s":"rekt.news","u":"https://rekt.news/LSC-FSL-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/WhaleChart/status/1711309225148690584"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lucky-star-currency-rug-pull"}],"desc":"Lucky star Currency Token on Binance Smart Chain has rugged for ~$1.11 million, down 98%.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht5bc3bd75d4","date":"2023-10-09","name":"Ethereum Foundation","kind":"hack","fam":"other","tech":"Sandwich Attack","usd":9101.0,"lo":9101.0,"hi":9101.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Ethereum Foundation fell victim to a sandwich attack by an MEV Bot when selling 1700 ETH through Uniswap V3, resulting in a loss of $9,101. The MEV Bot profited $4,060 from the attack.","theft":true},{"id":"ht456d108668","date":"2023-10-08","name":"zkFlex Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":56000.0,"lo":56000.0,"hi":56000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On Oct 8, zkFlex Finance on ETH was rugged for ~$56K when an address \r\n[address] dumped over 281,164,943.53 zkFlex Finance Tokens for 34.26 WETH. Contract Address: [address].","theft":true},{"id":"ht6f6ea7d1c2","date":"2023-10-08","name":"ZS","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"C","n":1,"theft":true},{"id":"ht976790a87c","date":"2023-10-08","name":"pSeudoEth","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":2300.0,"lo":2300.0,"hi":2300.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On Oct 8, the pSeudoEth token on ETH was exploited for ~$2.3K in a flash loan attack. Contract: [address]. Attacker: [address].","theft":true,"onchain":true},{"id":"ht87319e90ef","date":"2023-10-08","name":"MetaMundo","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Futuremoney247/status/1710891870111371360"}],"desc":"A phishing link has been posted in the announcements channel of MetaMundo Discord server. Do not interact with hxxps://mint-metamundo.co/.","theft":true},{"id":"ht673cb0c824","date":"2023-10-08","name":"OmniBTC","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/_erkan_aslan/status/1711053201179390423"}],"desc":"OmniBTC's Discord was hacked and the attackers posted a phishing link in the announcement channel.","theft":true},{"id":"ht61640a6a59","date":"2023-10-07","name":"Arena SocialFi","kind":"hack","fam":"code","tech":"Reentrancy","target":"Other","chains":["Avalanche"],"usd":2987265.0,"lo":2900000.0,"hi":3000000.0,"ret":2700000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/stars-arena-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1710548085343207599"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stars-arena-exploit"}],"desc":"On October 7, 2023, Stars Arena (an Avalanche friend.tech clone) was exploited via reentrancy when the share issuance function lacked reentrancy guards. The attacker called the function multiple times in one transaction to manipulate weight calculations, buying 1 share and selling it at ~274k AVAX to drain $2.97M.","theft":true,"onchain":true},{"id":"ht649b79a831","date":"2023-10-06","name":"Gitcoin loses $500,000 in transfer SNAFU","kind":"other","fam":"other","usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gitcoin-transfer-mistake"}],"headline":true},{"id":"ht5f44ca63f1","date":"2023-10-06","name":"Galxe","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"Other","chains":["Ethereum"],"usd":270000.0,"lo":270000.0,"hi":270000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Galxe/status/1710561491433197673"}],"desc":"An attacker impersonated a Galxe team member and contacted Dynadot, the domain registrar, with forged documentation to gain access to the Galxe.com domain account. The attacker redirected the domain to a phishing site and induced approximately 1,120 users to sign transactions to malicious contracts, resulting in $270K in losses before the domain was recovered.","theft":true},{"id":"ht6ad3d2fa78","date":"2023-10-06","name":"Fake CommEx Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":154000.0,"lo":154000.0,"hi":154000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a large liquidity removal on a fake CommEx token. Deployer removed ~$154k from the LP. BSC: [address].","theft":true},{"id":"htfe9511be9b","date":"2023-10-06","name":"MCT","kind":"fraud","fam":"insider","tech":"Domain Hijacking","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/mctxyz/status/1710270416391139735?s=20"}],"desc":"On October 6th, MCT issued an announcement stating that in the past two days, some users had reported cases of their MCT wallets being compromised. After investigation today, it was discovered that due to the DNS domain hijacking, under certain specific conditions, private keys could potentially be uploaded to a fraudulent domain. MCT advises users who have entered their private keys into MCT since September 15, 2023, to transfer their wallet balances as a precautionary measure as soon as possible."},{"id":"ht1a0970c9bf","date":"2023-10-05","name":"friend.tech","kind":"hack","fam":"other","tech":"SIM Card Attack","chains":["Base"],"usd":385000.0,"lo":385000.0,"hi":385000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1709697295464141208"}],"desc":"On October 5th, blockchain detective ZachXBT posted on social media, stating that a hacker had made a profit of 234 ETH (~$385,000) in the past 24 hours by conducting SIM card swap attacks on four different friend.tech users.","theft":true},{"id":"htc0700f9d0c","date":"2023-10-05","name":"DePayRouter","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":827.0,"lo":827.0,"hi":827.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a flashloan attack on the DePay platform that resulted in the theft of 827 USDC. The exploiter used a security issue with DePay router to steal the USDC.","theft":true,"onchain":true},{"id":"ht20313334af","date":"2023-10-05","name":"Metropolis World","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/metropolisworld/status/1709920393765507195"}],"desc":"Metropolis World announced that their Discord server was compromised.","theft":true},{"id":"ht7334dd0a63","date":"2023-10-03","name":"BigWhale loses $1.5 million in private key leak","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bigwhale-hack"}],"theft":true,"headline":true},{"id":"ht1d02a8de41","date":"2023-10-02","name":"GEMIE","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Gemie_Official/status/1708741008975098300"}],"desc":"The GEMIE Discord server was hacked and the attackers posted phishing links in the announcement channel. Please do not interact with hxxps://gemie.site/.","theft":true},{"id":"ht687126e44a","date":"2023-10-02","name":"VendX","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/VendXNFT/status/1709276102768669108"}],"desc":"VendX Discord server was compromised.","theft":true},{"id":"ht83f500a56b","date":"2023-10-01","name":"Fake EigenLayer Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is an exit scam on a fake EigenLayer token. The deployer profited ~$300k. BSC: [address].","theft":true},{"id":"hteeb0ba02e9","date":"2023-09-30","name":"FireBirdPair","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["Polygon"],"usd":3200.0,"lo":3200.0,"hi":3200.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht879a509868","date":"2023-09-29","name":"DKP","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":204000.0,"lo":204000.0,"hi":204000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There was a large liquidity removal on DKP resulting in losses of approximately $204,000 USDT. The token contract is [address].","theft":true},{"id":"ht507f007bc9","date":"2023-09-29","name":"DEXRouter","kind":"hack","fam":"code","tech":"Arbitrary External Call","chains":["BNB Chain"],"usd":4000.0,"lo":4000.0,"hi":4000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0c53c96f0c","date":"2023-09-28","name":"LuckyFactoryNFT","kind":"phishing","fam":"social","tech":"Phishing Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/phoenixb1ue/status/1707480908553716137"}],"desc":"A phishing link has been posted in the factory-updates channel of LuckyFactoryNFT. Do not interact with the malicious link.","theft":true},{"id":"ht83c4eca859","date":"2023-09-28","name":"Mode","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/modenetwork/status/1707266458852405364"}],"desc":"Mode Discord was hacked. A phishing link was posted in the announcements channel of the Mode Network Discord server.","theft":true},{"id":"ht9ab5ab3ff0","date":"2023-09-27","name":"SpaceChain","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Checkmateinvest/status/1706907640507600905"}],"desc":"SpaceChain Discord was hacked. A phishing link was posted in the announcements channel of SpaceChain Discord server.","theft":true},{"id":"ht9f74d297b2","date":"2023-09-27","name":"Venom Bears","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/VenomBears/status/1706780486343999820"}],"desc":"On September 27th, Venom Bears‘ Discord server was compromised.","theft":true},{"id":"ht924e539efa","date":"2023-09-26","name":"XSDWETHpool","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":12100.0,"lo":56.0,"hi":12100.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On September 26th, XSDWETHpool On BSC was exploited for ~$12.1k in a flash loan attack. The attacker created a malicious contract to interact with the pool contract and gained 56.96 WBNB. Pool Contract: [address].","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htx-2023-09-25","date":"2023-09-25","name":"Htx Huobi","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":8000000.0,"lo":8000000.0,"hi":8200000.0,"ret":8000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/htx-huobi-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/justinsuntron/status/1706311251024822748"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/huobi-exchange-hacked"}],"desc":"On September 25, 2023, HTX's hot wallet was drained of 5,000 ETH (~$8 million). The attacker gained unauthorized access to internal wallet infrastructure via private key compromise; the attacker returned all funds on October 7, 2023, claiming a 250 ETH white-hat bounty.","theft":true},{"id":"ht0b07f1864e","date":"2023-09-25","name":"Fake Justus Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":59000.0,"lo":59000.0,"hi":59000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is an exit scam on a fake Justus Token associated with fake Twitter Justusztoken. Deployer dumped 302 WBNB for a profit of ~$59k. BSC: [address].","theft":true},{"id":"ht6f58a68f5d","date":"2023-09-24","name":"KUB-Split (Split)","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":78400.0,"lo":78000.0,"hi":78400.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There was a flash loan exploit on Kub/Kub-split. The attacker gained ~$78.4k via pool manipulation. Contract: [address].","theft":true,"onchain":true},{"id":"ht1d977e9299","date":"2023-09-24","name":"Upbit","kind":"hack","fam":"other","tech":"False top-up","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/definalist/status/1705900412208029894"}],"desc":"On September 24th, according to Definalist on Twitter, scammers had deposited fake APT tokens into South Korea's largest exchange, Upbit. After these fake tokens were deposited into numerous user accounts, many users proceeded to directly sell them. The only explanation for this situation is that Upbit's wallet system only checked the type and data and processed deposits and withdrawals.","theft":true},{"id":"hteb1ac246f7","date":"2023-09-23","name":"Mixin Network","kind":"hack","fam":"keys","tech":"Database Breach","target":"Other","chains":["Mixin"],"usd":200000000.0,"lo":200000000.0,"hi":200000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mixin-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1706133260869468503"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mixin-network-hack"}],"desc":"On September 23, 2023, Mixin Network suffered a $200M hack when a cloud service provider's database containing hot wallet credentials was breached, allowing attackers to drain wallets of ETH, BTC, and USDT.","theft":true},{"id":"ht790c81dd72","date":"2023-09-23","name":"DUO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":352698.0,"lo":352698.0,"hi":352698.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There was a large liquidity removal on DUO. The Deployer removed $352.6K WBNB of LP in 3 transactions over a 4 day period. BSC: [address] .","theft":true},{"id":"ht8490e1008a","date":"2023-09-23","name":"Cat Nation","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":29700.0,"lo":29700.0,"hi":29700.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The token Cat Nation is suspected to be a rug pull. Transaction pool address (ETH): [address].","theft":true},{"id":"ht927dd95c4c","date":"2023-09-23","name":"BEDU","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/bedu_io/status/1705491570550591765"}],"desc":"BEDU announced that a team member in their Discord server has been compromised.","theft":true},{"id":"ht3c1db08ae0","date":"2023-09-23","name":"Synthtopia","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/D3STAB1LIZED/status/1705437709781598701"}],"desc":"Synthtopia Discord server was compromised.","theft":true},{"id":"ht292ec96a83","date":"2023-09-22","name":"BEAST","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":55300.0,"lo":55300.0,"hi":55300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There was a large liquidity removal on Unleashed Beast (BEAST). Deployer removed ~$55.3k from the LP. BSC:[address].","theft":true},{"id":"ht3969eb1dea","date":"2023-09-21","name":"BNBpay","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":114000.0,"lo":114000.0,"hi":114000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There was a large liquidity removal on BNBpay. Deployer profited ~$114k from this liquidity removal. BSC: [address].","theft":true},{"id":"htf9db59dd2a","date":"2023-09-21","name":"PEPEP","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a 70% slippage on PEPEP. ETH: [address]. Drop caused by EOA 0x4af2 who dumped tokens for ~$45k.","theft":true},{"id":"ht2845c40de0","date":"2023-09-21","name":"CEXISWAP","kind":"hack","fam":"code","tech":"Incorrect Access Control","chains":["Ethereum"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht82c8b0045e","date":"2023-09-21","name":"YZER","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":28600.0,"lo":28600.0,"hi":28600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On September 21st, a large liquidity of YZER was removed. Deployer profited ~$28.6k from this liquidity removal.","theft":true},{"id":"hte2edf37e96","date":"2023-09-21","name":"Linear Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/LinearFinance/status/1704818417880936535"}],"desc":"On September 21st, the Linear stable coin $LUSD appears to be under an exploit attack. While the team investigates, do not buy LUSD, do not trade $LUSD. Liquidations are paused and users accounts are not at risk.","theft":true},{"id":"ht53adb516eb","date":"2023-09-21","name":"TimeSoul","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/timesoulcom/status/1704845188424696117"}],"desc":"A phishing link has been posted in the announcements channel of timesoul Discord server.","theft":true},{"id":"ht73488c73a6","date":"2023-09-20","name":"Wallet phished for $4.46 million in fake mining scam","kind":"scam","fam":"social","usd":4458326.0,"lo":4458326.0,"hi":4458326.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0x5e422-phishing-attack"}],"theft":true,"headline":true},{"id":"htf8e0e2e779","date":"2023-09-20","name":"Baka Casino (BAKAC)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":57000.0,"lo":57000.0,"hi":57000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a slippage on Baka Casino (BAKAC) caused by EOA 0x9e5C8 who dumped tokens for ~$57k. The price has dropped 80%. BSC:[address]","theft":true},{"id":"htbbd18d449f","date":"2023-09-20","name":"Coinbase Wallet","kind":"phishing","fam":"social","tech":"Phishing Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1704464871080001976"}],"desc":"On September 20th, SlowMist tweeted that Coinbase Wallet recently integrated the Web3 messaging network protocol (http://xmtp.org). As long as the user's wallet address opens the messaging network, it may receive any information sent by the messaging protocol. Many attackers used this feature to send messages with phishing links to wallet users. Relevant wallet users need to be vigilant and not click on unknown links.","theft":true},{"id":"ht0a96f5b57d","date":"2023-09-19","name":"Balancer V2","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Ethereum"],"usd":238000.0,"lo":237932.0,"hi":350000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Balancer/status/1704402769535438928"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/balancer-frontend-compromise"}],"desc":"Balancer's DNS was hijacked and redirected users to phishing frontend, stealing ~$238K from users. Smart contracts were unaffected; only DNS infrastructure was compromised.","theft":true},{"id":"ht94b7917188","date":"2023-09-17","name":"One Mint","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AnorakDAO/status/1703225909442932787"}],"desc":"On September 17th, the NFT solution -- One Mint's Discord account was compromised. The attacker posted malicious links and shut down channels like support.","theft":true},{"id":"htb2199e11f5","date":"2023-09-17","name":"ThalaLabs","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Aptos_Network/status/1703166158327705897?t=xwbO7vWqBUu04u4FiinDNg&s=19"}],"desc":"On September 17th, ThalaLabs' Twitter account was compromised, and a phishing website was posted, which is linked to a known wallet drainer.","theft":true},{"id":"ht0f3e98e244","date":"2023-09-16","name":"Mark Cuban","kind":"hack","fam":"other","tech":"Wallet Stolen","usd":870000.0,"lo":870000.0,"hi":870000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.dlnews.com/articles/people-culture/mark-cuban-loses-870k-to-a-crypto-scam/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mark-cuban-hack"}],"desc":"Mark Cuban, a billionaire entrepreneur and owner of the Dallas Mavericks, fell victim to a hack on September 16th. Altogether, he was set back by around $870,000 across 10 cryptocurrencies. He said he moved his remaining funds to Coinbase custody.","theft":true},{"id":"htf21c0ed1bf","date":"2023-09-16","name":"Fake BitGo Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":194300.0,"lo":194300.0,"hi":194300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A fake BitGo token on BSC rugged for ~$194.3k WBNB from the honeypot and has moved 909.2 BNB through TornadoCash. BSC: [address]. Deployer Address: [address]。","theft":true},{"id":"ht6cbbdbb4bf","date":"2023-09-16","name":"uniclyNFT","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":2000.0,"lo":2000.0,"hi":2000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A reentrancy vulnerability in uniclyNFT's PointFarm contract allowed an attacker to repeatedly call the deposit() function without proper state updates. The attacker minted rewards multiple times before the contract could update rewardDebt, draining uJENNY tokens through reentrancy into external calls.","theft":true,"onchain":true},{"id":"ht71c763dd90","date":"2023-09-15","name":"Remitano","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Tron","Bitcoin Cash"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"ret":1900000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/remitano-rekt"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/remitano-exchange-allegedly-hacked-september-14"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/remitano-hack"}],"desc":"On September 14-15, 2023, a third-party data breach exposed private keys to Remitano's exchange hot wallets. An attacker used these keys to drain approximately $2.7M in cryptocurrency across Ethereum, Tron, and Bitcoin Cash chains ($1.4M USDT, $208K USDC, and Ankr tokens).","theft":true},{"id":"ht9990e2b419","date":"2023-09-15","name":"FriendChipsTech","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":77500.0,"lo":77500.0,"hi":77500.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ASongofTokens/status/1702750744556814551"}],"desc":"The FriendChipsTech token on ETH was suspected to be a rug pull, resulting in a loss of ~$77.5K. The exploiter created a malicious contract ([address]) to mint tokens and dump them for ~$77.5K which has already been deposited to Tornado Cash.","theft":true},{"id":"hta02ce00636","date":"2023-09-13","name":"JPEX","kind":"hack","fam":"other","tech":"Scam","target":"CEX","usd":194337178.0,"lo":191000000.0,"hi":194337178.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/gk6kvz31.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/jpex-collapse"}],"desc":"On September 13th, the Hong Kong Securities and Futures Commission issued a statement titled \"Regarding Unregulated Virtual Asset Trading Platforms,\" stating that the virtual asset trading platform JPEX did not have a license from the Commission and had not applied for one. On September 14th, the JPEX community discovered that the withdrawal limit on the JPEX platform was only 1000 USDT, while the withdrawal fee was as high as 999 USDT, effectively preventing users from withdrawing their funds. As of October 3rd, the police have received reports from 2,467 victims, involving approximately HKD 1.522 billion in total.","theft":true,"review":["sources disagree on the date"]},{"id":"ht720c84a002","date":"2023-09-12","name":"Coinex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","BNB Chain","Bitcoin","Tron","Kadena","Solana","Dagger","XRP","Bitcoin Cash","Polygon","Stellar","Arbitrum"],"usd":70000000.0,"lo":55000000.0,"hi":70000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/coinex-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/coinexcom/status/1701662057496731975"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinex-hacked"}],"desc":"CoinEx exchange suffered multi-chain attack on September 12, 2023 when attackers accessed hot wallet private keys, draining $31-54M across Ethereum, Tron, Polygon, and other chains.","theft":true},{"id":"ht398ff5f6cc","date":"2023-09-12","name":"OxODexPool","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":61000.0,"lo":61000.0,"hi":61000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Cointime_CN/status/1701420147616145422"}],"desc":"OxODexPool suffered from a flash loan. ETH: [address]. Approximately 40 ETH (~$61k) was lost. The stolen funds currently reside in the attacker's wallet.","theft":true},{"id":"htbd8d9053a1","date":"2023-09-11","name":"Milady Maker","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/charlottefang77/status/1701245168039452947"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/remilia-theft"}],"desc":"A rogue developer with access to the Remilia Collective treasury (backing the Milady Maker NFT project) siphoned $1M in accumulated fees from the Bonkler reserve-backed NFT system. The developer also attempted to seize control of project codebases and social media accounts, though Remilia's core reserves and NFT holdings remained secure.","theft":true},{"id":"htb2a1954044","date":"2023-09-11","name":"Paxos","kind":"hack","fam":"code","tech":"Transfer Vulnerability","target":"CEX","chains":["Bitcoin"],"usd":500000.0,"lo":499171.0,"hi":500000.0,"ret":499171.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/paxos-confirms-responsible-for-500k-mistaken-bitcoin-transaction"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoin-wallet-pays-500000-fee"}],"desc":"Stablecoin issuer Paxos admitted in a statement that the account that paid out nearly 20 BTC in fees in a single transaction in the early hours of September 11 belonged to the company. Paxos claims that end users have not been affected and all user funds are safe. The announcement comes after users on twitter speculated that PayPal could be responsible for the transaction, as analytics platform OXT identified relevant wallet accounts belonging to PayPal. A Paxos spokesperson said: \"PayPal takes no responsibility for this as this error was caused by Paxos itself. This transaction affected Paxos company operations, Paxos customers and end users were not affected, and all customer funds are safe. This was caused by a vulnerability in a single transfer, which has now been fixed. Paxos is contacting miners to recover the funds.\"","theft":true},{"id":"htd435da95db","date":"2023-09-11","name":"Base (TBA)","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":71600.0,"lo":71600.0,"hi":71600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a large liquidity removal on the fake Base token. BSC: [address]. Deployer [address] has profited ~$71.6k.","theft":true},{"id":"ht920c4084ba","date":"2023-09-11","name":"0x0DEX","kind":"hack","fam":"other","tech":"Parameter manipulation","chains":["Ethereum"],"usd":61000.0,"lo":61000.0,"hi":61000.0,"conf":"C","n":1,"theft":true},{"id":"ht46403ec6f1","date":"2023-09-11","name":"Witnet","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/witnet_io/status/1701034041657426106"}],"desc":"On September 11, Witnet - the multichain decentralized oracle, tweeted that the Witnet Discord server has been compromised and deleted temporarily.","theft":true},{"id":"ht4faa3b5ae8","date":"2023-09-10","name":"Vitalik Buterin","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":700000.0,"lo":691000.0,"hi":700000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/335151?source=share"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vitalik-buterins-twitter-account-hacked"}],"desc":"Ether co-founder Vitalik Buterin's Twitter account is suspected to have been hacked and posted a link (actually a phishing link) to a free Proto Danksharding Memorial NFT pickup related to ConsenSys.\r\nZachXBT says the hackers have now stolen $700,000. Upon review, the tweet containing the phishing link has been removed.","theft":true},{"id":"ht214d79cec1","date":"2023-09-10","name":"LDO","kind":"fraud","fam":"insider","tech":"False top-up","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1700782725593268448"}],"desc":"On September 10, according to on-chain intelligence from the SlowMist security team, when the LDO token contract is processing a transfer operation, if the transfer amount exceeds the amount actually held by the user, the operation will not trigger the rollback of the transaction. Instead, it will directly return a `false` as the processing result. This approach is different from many common ERC20 standard token contracts. Due to the above characteristics, there is a potential risk of \"fake top-up\", and malicious attackers may try to use this feature to conduct fraud. On September 11, Lido stated that this behavior was expected and complies with ERC20 token standards. LDO and stETH are still safe. The Lido Token Integration Guide will be updated with LDO details to show this more obviously."},{"id":"ht6760c01f0d","date":"2023-09-09","name":"BFCToken","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":38000.0,"lo":38000.0,"hi":38000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"BFCToken suffered from a flash loan attack, resulting in losses of ~$38k. BSC: [address]. The attacker was able to burn BFCTokens from the pool at no expense by exploiting the \"_transfer\" function.","theft":true,"onchain":true},{"id":"ht2b19def1c9","date":"2023-09-09","name":"ACG WORLDS","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ACGWORLDS_META/status/1701846441499787702"}],"desc":"A phishing link was posted in the announcements channel of ACG WORLDS discord server. Do not interact with hxxps://asusworlds.com/tcom/.","theft":true},{"id":"htbeeca2c00d","date":"2023-09-09","name":"PEPE","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/pepecoineth/status/1700335056433393690"}],"desc":"On September 9, PEPE stated on Twitter that PEPE’s old Telegram account had been hacked and was no longer under official control. The Twitter account \"lordkeklol\" has been compromised and used to perpetrate scams and is in no way affiliated with PEPE or its team members. All official information from PEPE will be released via its Twitter account in the coming weeks.","theft":true},{"id":"ht8da1bb731b","date":"2023-09-08","name":"APIG","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":169000.0,"lo":169000.0,"hi":169000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3886f1ebf3","date":"2023-09-07","name":"Fortress Trust","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Bitcoin"],"usd":12000000.0,"lo":12000000.0,"hi":15000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://fortune.com/crypto/2023/09/12/fortress-trust-12-to-15-million-hack-bitcoin-usdc-usdt-ripple/"}],"desc":"Attackers executed a phishing campaign against ReTool, a third-party vendor providing portal access for Fortress Trust customers to manage cryptocurrency custody. The compromise leaked Fortress operator credentials, allowing attackers to initiate unauthorized fund transfers from customer accounts.","theft":true},{"id":"ht4ce7c23fdc","date":"2023-09-07","name":"Fake Patex","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":97500.0,"lo":97500.0,"hi":97500.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"We have seen a large liquidity removal on a fake Patex token. BSC: [address]. Deployer gained ~$97.5k from removing liquidity on a honeypot token.","theft":true},{"id":"hta4d8086508","date":"2023-09-07","name":"HCT Token","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":30.0,"lo":30.0,"hi":30.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/leo_web3sec/status/1699775506785198499"}],"desc":"We have detected a malicious flash loan on HCT token. BSC: [address]. Approximately 30.5 BNB was lost. 30 BNB has been deposited into Tornado Cash by EOA 0xC89.","theft":true,"onchain":true},{"id":"ht4c4edebf71","date":"2023-09-07","name":"Ordinals Wallet","kind":"hack","fam":"keys","tech":"Account Compromise","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1699611085572284829"}],"desc":"Ordinals Wallet suffered a SIM Swap attack. The Twitter account was hacked and phishing links were posted. The attacker is PinkDrainer.","theft":true},{"id":"htf4f6bdbbbd","date":"2023-09-07","name":"Victory Point","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Albeertsegura5/status/1699480711558762871"}],"desc":"A phishing link has been posted in the major announcements channel of \r\nVictory Point Discord server. Do not interact with hxxps://victorypoints.xyz/airdrop/","theft":true},{"id":"htf6a80cc8da","date":"2023-09-06","name":"Victim loses around $24 million in phishing scam","kind":"scam","fam":"social","chains":["Ethereum"],"usd":24000000.0,"lo":24000000.0,"hi":24000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0x13e38-phished"}],"theft":true,"headline":true},{"id":"ht96712458fa","date":"2023-09-06","name":"GMBL.COMPUTER","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":772000.0,"lo":770000.0,"hi":815000.0,"ret":2000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://gmblcomputer.medium.com/gmbl-computer-exploit-postmortem-a09aa3297405"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gmblcomputer-exploit"}],"desc":"On September 6, 2023, hours after launch, GMBL.COMPUTER on Arbitrum was exploited when the off-chain signature server issued valid signatures for spoofed referral claims without verifying deposits, draining ~471 ETH.","theft":true},{"id":"htac63d0aa6f","date":"2023-09-06","name":"Fake Helio Protocol","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":127000.0,"lo":127000.0,"hi":127000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a large liquidity removal on a fake Helio Protocol token. BSC:[address]. Deployer profited ~$127k WBNB from this liquidity removal.","theft":true},{"id":"ht0550659cc4","date":"2023-09-06","name":"Base","kind":"hack","fam":"other","tech":"Block Failure","chains":["Base"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://status.base.org/"}],"desc":"According to official sources, Base had previously experienced a block failure. The Base team immediately investigated, and a fix was subsequently deployed, and block production began to resume. At present, the team confirmed that the network operation and RPC API have returned to normal, and will continue to monitor. Base later tweeted that the glitch had been fixed and no funds were at risk.","theft":true},{"id":"ht2fb8d7337e","date":"2023-09-06","name":"Big.B","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BigB_NFTs/status/1699241721417039936"}],"desc":"Big.B Discord Server was hacked. The attacker posted a phishing link in Big.B Discord Server. Do not click on any links until the team has confirmed they’ve regained control of the server.","theft":true},{"id":"htd7e876ee39","date":"2023-09-06","name":"Gala Games","kind":"hack","fam":"bridge","tech":"False top-up","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/x_explore_eth/status/1701629659719623067"}],"desc":"The token GALA of the blockchain gaming platform Gala Games underwent a major upgrade on May 15, 2023, and the token contract address was updated. As a result, there are now two tokens in circulation, both called GALA. The price ratio of old GALA and normal GALA is 1:12. The attacker has been using old GALA tokens to deposit funds on various exchanges since July 27 this year to test fake deposits. At the same time, hackers were also involved in the LDO “fake top-up” incident and the Nomad Bridge attack last August. On September 6, hackers deposited old GALA tokens to CoinHub, successfully causing the exchange to treat the deposited old GALA tokens as normal GALA tokens. Then the hacker user withdrew the real GALA. Now there is only $168 worth of GALA left in the exchange hot wallet, and the hacker earned 2.7 ETH.","theft":true},{"id":"htecfdb05965","date":"2023-09-05","name":"Stolen LastPass vaults possibly cracked to enable crypto thefts","kind":"hack","fam":"other","usd":35000000.0,"lo":35000000.0,"hi":35000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stolen-lastpass-vaults-possibly-cracked"}],"theft":true,"headline":true},{"id":"hte239ca2cc4","date":"2023-09-05","name":"Floor Dao","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":64200.0,"lo":64200.0,"hi":64200.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"FloorDAO's staking contract for the rebasing sFLOOR token contained a logic flaw that could be exploited during rebasing operations. The vulnerability was discovered and exploited on September 5, 2023, with post-mortems published by the FloorDAO team.","theft":true},{"id":"ht0ea6e5acce","date":"2023-09-05","name":"Connext","kind":"hack","fam":"code","tech":"DoS Attack","target":"Bridge","usd":39000.0,"lo":39000.0,"hi":39000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/y42fzup8.html"}],"desc":"According to a number of community users, there seems to be a problem in the Layer2 interoperability protocol Connext airdrop claim process. The NEXT tokens of some accounts were claimed to unexpected addresses. The data on the chain shows that the address starting with 0x44Af received a large number of Connext token NEXT airdrops through 230 accounts in the past 1 hour, and sold them all for ETH, USDT and USDC, earning nearly 39,000 US dollars. According to SlowMist analysis, users can claim NEXT tokens through the claimBySignature function of the NEXT Distributor contract. There are recipient and beneficiary roles, the recipient role is used to receive the NEXT tokens of the claim, and the beneficiary role is the address that is eligible to receive NEXT tokens, which has been determined when the Connext protocol announces the air investment qualifications. When the user makes a NEXT token claim, the contract will perform two checks: one is to check the signature of the beneficiary role, and the other is to check whether the beneficiary role is eligible to receive the airdrop. During the first check, it will check whether the recipient passed in by the user is signed by the beneficiary role, so the random incoming recipient address cannot pass the check if it is not signed by the beneficiary. If you specify a beneficiary address to construct a signature, even if it can pass the signature check, it cannot pass the second check on the eligibility for airdrops. Airdrop claim eligibility checks are checked through Merkle proofs, which should be officially generated by the Connext protocol. Therefore, users who are not eligible to receive airdrops cannot bypass the check to receive other people's airdrops. On September 7, Connext released a post-mortem analysis, stating that the attacker performed DOS operations on Tokensoft’s API, causing the claim database and UI to crash. During this process, 274,956 NEXT from 253 wallets (not related to Connext) were claimed (0.26% of the total airdrop) and sold for approximately 40,000 USDT before ordinary users were able to claim it. But Connext was not compromised in any way. After the DOS attack ended, airdrop claims returned to normal.","theft":true},{"id":"ht582f296f05","date":"2023-09-05","name":"Fake Lybra Finance Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":37000.0,"lo":37000.0,"hi":37000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A fake Lybra Finance token executed a exit scam on September 5th. Deployer added 60 WETH to LP and removed 83 WETH, profiting 23 WETH (~$37k).","theft":true},{"id":"ht8fc58b1601","date":"2023-09-05","name":"Haribo","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":35400.0,"lo":35400.0,"hi":35400.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"There is a large liquidity removal on Haribo. Owner removed ~24 ETH ($35.4k) from the tokens LP. Token appears to be a honeypot. Token Contract: [address].","theft":true},{"id":"ht24e59976a8","date":"2023-09-05","name":"JumpFarm","kind":"hack","fam":"code","tech":"Rebasing logic issue","chains":["Ethereum"],"usd":2.0,"lo":2.0,"hi":2.0,"conf":"C","n":1,"theft":true},{"id":"htebd88e1c20","date":"2023-09-05","name":"QuantumWN","kind":"hack","fam":"code","tech":"Rebasing logic issue","chains":["Ethereum"],"usd":0.5,"lo":0.5,"hi":0.5,"conf":"C","n":1,"theft":true},{"id":"htc6d2f97420","date":"2023-09-05","name":"Cyberport Hong Kong","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/FalconFeedsio/status/1698999826308894873?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1698999826308894873%7Ctwgr%5E0c1967d"}],"desc":"According to reports, Cyberport Hong Kong was hacked and the information, company documents, identity documents and other information of start-up companies were obtained by hackers, totaling about 436 GB of company data. As can be seen in the post of X, an account that focuses on Internet security, the hacker's website asked for about US$300,000 (approximately HKD 2.35 million) for the stolen information. On September 6, Hong Kong Cyberport responded to a cyber security incident suspected of being hacked, saying that Cyberport had discovered a cyber security incident involving an unauthorized third party intruding into some of Cyberport's computer systems. Cyberport is very concerned about the incident and has immediately taken action to control it, including handling the alarm and shutting down the affected computer equipment. It has also quickly launched a detailed investigation with the assistance of independent cybersecurity experts. Cyberport has also notified the relevant authorities and the Office of the Privacy Commissioner for Personal Data in Hong Kong.","theft":true},{"id":"ht01b3dd674f","date":"2023-09-05","name":"HeavensGate","kind":"hack","fam":"code","tech":"Rebasing logic issue","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht527cf17e6e","date":"2023-09-04","name":"Stake.com","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Other","chains":["Ethereum","BNB Chain","Polygon"],"usd":41300000.0,"lo":41000000.0,"hi":41300000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/stake-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Stake/status/1698746766076588057"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stake-hack"}],"desc":"Stake.com's hot wallets were compromised on September 4, 2023, leading to $41.3M theft of USDT, ETH, and other assets across Ethereum, BSC, and Polygon.","theft":true,"actor":"North Korea (Lazarus Group, APT38)","attr":{"by":"FBI","date":"2023-09-06","title":"FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com","url":"https://www.fbi.gov/news/press-releases/fbi-identifies-lazarus-group-cyber-actors-as-responsible-for-theft-of-41-million-from-stakecom"},"official":"about $41M"},{"id":"htc5e070dca9","date":"2023-09-04","name":"Nima Capital accused of rug pull","kind":"rugpull","fam":"insider","usd":3700000.0,"lo":3700000.0,"hi":3700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nima-capital-rug-pull"}],"theft":true,"headline":true},{"id":"ht4fe649a80e","date":"2023-09-04","name":"Saber DAO","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/The_Saber_DAO/status/1698550070206251303"}],"desc":"Saber DAO, the automated market maker for stablecoins on Solana, tweeted that its Discord had been attacked and that it had blocked the attackers.","theft":true},{"id":"ht8f093c8a0a","date":"2023-09-03","name":"Paras","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ParasHQ/status/1698151376403222609"}],"desc":"NFT marketplace Paras tweeted that its discord was under attack. Please do not click on the link, mint, or approve any transactions.","theft":true},{"id":"hta362c24b22","date":"2023-09-02","name":"CoredeFinance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":43900.0,"lo":43900.0,"hi":43900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The CoredeFinance project performed an exit scam and EOA (0x18500) made a profit of 27 ETH (~$43,900).","theft":true},{"id":"htaadbc897a5","date":"2023-09-02","name":"DAppSocial","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DAppSocial's lockTokens() function lacked validation that tokens were actually transferred, allowing an attacker to call deposit and create_deposit_record without sending funds. The attacker deployed a helper contract, deposited 2 USDT, set lock duration to 0, and withdrew without depositing tokens, exploiting the broken balance check.","theft":true,"onchain":true},{"id":"ht34b71d1a3e","date":"2023-09-02","name":"Balthazar","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BalthazarDao/status/1697656320231637140"}],"desc":"Balthazar tweeted that his Discord was under attack and please do not click on the link, mint, or approve any transactions.","theft":true},{"id":"ht0e07940987","date":"2023-09-01","name":"SharedStake","kind":"hack","fam":"code","tech":"Ownership Takeover","target":"DeFi Protocol","chains":["Ethereum"],"usd":175000.0,"lo":175000.0,"hi":175000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On September 1, 2023, SharedStake was exploited when improper ownership checks allowed an attacker to gain admin access. The attacker created a minter address with unlimited permissions, minted sgETH tokens without collateral, and withdrew approximately 105 ETH from the protocol.","theft":true},{"id":"htc31c126dba","date":"2023-09-01","name":"Ivan Bianco","kind":"hack","fam":"keys","tech":"Mnemonic Leakage","usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/brazilian-crypto-streamer-loses-50k-by-exposing-private-key"}],"desc":"A Brazilian YouTuber, Ivan Bianco, accidentally leaked the mnemonic of his cryptocurrency wallet during a live stream on his Fraternidade Crypto channel, resulting in the theft of nearly $60,000 worth of cryptocurrency and a batch of NFTs. Fraternidade Crypto has around 34,000 subscribers on YouTube. During the live broadcast, Bianco opened a file recording the mnemonic phrase, which allowed an unknown person to take control of his wallet and steal its funds. Bianco reported the incident to police after missing the funds. He also claimed that an unidentified man contacted him on Discord after the funds were stolen. The anonymous person identified himself as the money thief and expressed regret for his actions before hanging up and leaving. After the call ended, the wallet that stole most of the funds returned a total of approximately $50,000 worth of crypto assets to Bianco.","theft":true},{"id":"ht57f3f6f756","date":"2023-09-01","name":"Gitcoin","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/gitcoin/status/1700322477111492997"}],"desc":"On September 1, community users discovered that Gitcoin’s official twitter account was suspected to have been stolen. The thief had used the account to post some phishing information. On September 9, Gitcoin tweeted that it had regained access to the official Twitter account. In the details of the incident later released by the official, Gitcoin stated that it still did not know how the thief bypassed the 2FA verification, but it would continue to investigate and implement stricter security measures in the future.","theft":true},{"id":"ht83f681442d","date":"2023-09-01","name":"Lamas Finance","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/lamasfinance/status/1697323988362699057"}],"desc":"Lamas Finance's Discord is under attack, phishing site is lamas[.]co/airdrop, please do not click on the link, mint or approve any transactions.","theft":true},{"id":"ht9eecb7a340","date":"2023-08-31","name":"BabyShia","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":226000.0,"lo":226000.0,"hi":226000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The BabyShia project implemented an exit scam. The deployer (0xCbcd8) has earned 133 ETH (about $226,000).","theft":true},{"id":"htf0f73eff07","date":"2023-08-30","name":"Starkware","kind":"hack","fam":"other","tech":"Wallet not upgraded","chains":["Ethereum"],"usd":550000.0,"lo":550000.0,"hi":550000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://fullycrypto.com/starkware-bows-to-pressure-over-lost-funds"}],"desc":"For months, Ethereum layer 2 solution Starkware has repeatedly warned users that their funds would be lost if they did not take action before upgrading, but some users apparently did not see these notifications, which resulted in many users being locked out. Locked out of StarkWare accounts, losing access to funds, totaling $550,000 in affected accounts. Due to community pressure, Starkware has re-enabled the ability to upgrade wallets.","theft":true},{"id":"ht3e23ed6c37","date":"2023-08-29","name":"Blockchain gaming streamer loses life savings after exposing private key on stream","kind":"hack","fam":"other","chains":["Polygon"],"usd":65000.0,"lo":65000.0,"hi":65000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fraternidade-crypto-theft"}],"theft":true,"headline":true},{"id":"ht5ec56eec8f","date":"2023-08-29","name":"EAC","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":6376.0,"lo":6376.0,"hi":6376.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"EAC token on BSC was exploited via a flash loan attack. The attacker used a DODO X flash loan to artificially inflate EAC price, executed large swaps on Pancakeswap to increase token price beyond fair value, then sold the inflated position for profit after repaying the loan.","theft":true,"onchain":true},{"id":"htac0ba978cb","date":"2023-08-27","name":"Balancer V2","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":2050000.0,"lo":800000.0,"hi":2100000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/balancer-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/balancer/status/1694014645378724280"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/balancer-exploit"}],"desc":"Balancer V2's boosted pools suffered a $893k-$979k exploit on August 27, 2023 via rate manipulation in linear pools (ERC4626). The attacker manipulated token conversion rates to drain liquidity.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht14ffcbba40","date":"2023-08-26","name":"PEPE","kind":"hack","fam":"insider","tech":"Admin Drain","target":"Token","chains":["Ethereum"],"usd":15080000.0,"lo":15080000.0,"hi":16900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/pepecoineth/status/1695267128428114005"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/suspicious-pepe-transfers"}],"desc":"PEPE team insiders including developer Zachary Testa gained control of the multisig by reducing its signature requirement from five-of-eight to two-of-eight, then transferred ~16 trillion PEPE tokens (~$16.9M gross, ~$15M net after slippage) to CEXs. Insiders subsequently deleted themselves as signers and removed social media accounts.","theft":true},{"id":"htee01d036bf","date":"2023-08-26","name":"SOL Big Brain","kind":"phishing","fam":"social","tech":"Phishing Attack","chains":["Ethereum"],"usd":1500000.0,"lo":1490000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xQuit/status/1695153575087727057"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sol-big-brain-phishing-attack"}],"desc":"NFT collector SOL Big Brain lost about $1.5 million. Attackers compromised the Telegram account of a portfolio company founder and used it to send messages to SOL Big Brain, which double-checked that the sender was indeed the company founder and followed instructions. However, the attackers have set up a contract that uses wallets that allow phishing to drain SOL Big Brain. He lost $740,000 in stablecoins, $550,000 in ETH, and $200,000 in GEAR tokens.","theft":true},{"id":"ht9ccaa31cb3","date":"2023-08-26","name":"BitBrowser","kind":"hack","fam":"keys","tech":"Private Key Leakage","usd":520000.0,"lo":520000.0,"hi":520000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/gsr95zut.html"}],"desc":"The private key of the BitBrowser browser user was suspected to be leaked, and many members of the encryption community reported that the private key was stolen. BitBrowser issued a notice, admitting that the cached data of the server may have been invaded, and the case has been reported. Users whose wallets have enabled extended data synchronization are at risk of being stolen. It is recommended to take immediate measures to transfer wallet assets. Cos, the founder of SlowMist, said on Twitter that the leakage of the private key of BitBrowser users has caused at least $520,000 in losses.","theft":true},{"id":"htb14e16e840","date":"2023-08-26","name":"SVT","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Solana","BNB Chain"],"usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/99qr51p5.html"}],"desc":"SVT tokens were attacked by flash loans, and the economic model loopholes of SVT transaction contracts were exploited. The attackers made approximately $400,000 in profit from repeated buying and selling operations. According to MistTrack analysis, the attacker’s initial funds came from SwftSwap, and 1070 BNB has been transferred to Tornado Cash​.","theft":true,"onchain":true},{"id":"ht45cf271dea","date":"2023-08-25","name":"Magnate Finance","kind":"rugpull","fam":"insider","tech":"Treasury Misappropriation","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":6400000.0,"lo":5268000.0,"hi":6500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1694918938424234433"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/magnate-finance-rug-pull"}],"desc":"On August 25, 2023, Magnate Finance team rug-pulled Base depositors by deleting communication channels (Telegram/website), manipulating the price oracle, and draining all assets. The deployer had previously executed Solfire rug ($4.8M) in 2022.","theft":true},{"id":"ht5292494cce","date":"2023-08-25","name":"Kroll & BlockFi","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/FTX_Official/status/1694899217326608611"}],"desc":"Bankruptcy claims agency Kroll experienced a cybersecurity incident that resulted in the disclosure of non-sensitive customer data of certain claimants in pending bankruptcy cases, FTX said on Twitter. FTX's own system is not affected by this incident. BlockFi claimant data was also compromised in the incident. On August 26, FTX issued a document stating that in response to the Kroll cybersecurity incident, FTX has taken precautionary measures to temporarily freeze the affected user accounts in the customer claims portal.","theft":true},{"id":"ht3c5bf46e82","date":"2023-08-24","name":"U.S. Drug Enforcement Administration sends over $50,000 to a scammer","kind":"scam","fam":"social","chains":["Ethereum"],"usd":55000.0,"lo":55000.0,"hi":55000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/us-drug-enforcement-administration-scammed"}],"theft":true,"headline":true},{"id":"ht46d98c5873","date":"2023-08-23","name":"Former New Jersey prison guard charged by SEC over crypto pump-and-dump scheme targeted at cops","kind":"followup","fam":"other","usd":623888.0,"lo":623888.0,"hi":623888.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blazar-token-sec-lawsuit"}],"headline":true},{"id":"ht5c4015b2e6","date":"2023-08-23","name":"GSS","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"Token","chains":["BNB Chain"],"usd":25000.0,"lo":25000.0,"hi":25000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On August 24, 2023, GSS token on BSC was exploited via a vulnerability in its _transfer() function. An attacker flash-loaned 30,000 BUSDT from DODO and swapped to 725,246 GSS tokens. By transferring tokens to specific pair addresses and calling skim(), the attacker caused 707,162 tokens to be withdrawn twice from the liquidity pool, an arithmetic error in the custom transfer logic.","theft":true,"onchain":true},{"id":"htf082224699","date":"2023-08-21","name":"Fake \"LayerZero\" Token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A fake \"LayerZero\" token on the BSC chain has had a lot of liquidity removed. The deployer removed 4,827.99 WBNB worth about $1 million. The contract address of the fake token is [address].","theft":true},{"id":"ht07d8bce5d5","date":"2023-08-21","name":"Victim loses $900,000 to Google Ad phishing","kind":"scam","fam":"social","chains":["Ethereum"],"usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/celer-bridge-google-ad-phishing"}],"theft":true,"headline":true},{"id":"ht3c0b62d5b4","date":"2023-08-21","name":"EHIVE","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Ethereum"],"usd":15000.0,"lo":15000.0,"hi":15000.0,"conf":"C","n":1,"theft":true,"onchain":true,"review":["attack tx contradicts the date"]},{"id":"ht34f12d3796","date":"2023-08-20","name":"Thales","kind":"hack","fam":"keys","tech":"Information Leakage","chains":["BNB Chain"],"usd":35000.0,"lo":35000.0,"hi":35000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/thalesmarket/status/1692935883521953997?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"Derivatives marketplace Thales issued an announcement that a core contributor’s PC/Metamask had been hacked and that some hot wallets acting as casual deployers ($25k) or admin bots ($10k) had been compromised. Do not interact with any Thalesmarket contracts on the BNB Chain and revoke any contracts that are pending approval. All funds are safe on Optimism, Arbitrum, Polygon and Base. Thales said that due to the attack, support for the BSC will be officially dropped.","theft":true},{"id":"htf8bdf71fda","date":"2023-08-19","name":"Harbor Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Comdex"],"usd":250000.0,"lo":20000.0,"hi":250000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Harbor_Protocol/status/1692836252498723154"}],"desc":"On August 19, 2023, Harbor Protocol's oracle was manipulated via low-liquidity cSwap prices. An attacker borrowed CMST against inflated stOSMO, LUNA, and WMATIC collateral, draining ~$250K and dropping TVL from ~$370K to ~$81K.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht7173fa6241","date":"2023-08-19","name":"BTC20","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht03055e85a4","date":"2023-08-18","name":"Exactly","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":7450000.0,"lo":7000000.0,"hi":12000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/exactly-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://www.wu-talk.com/index.php?m=content&c=index&a=show&catid=46&id=17283"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/exactly-protocol-hack"}],"desc":"Exactly Protocol's DebtManager on Optimism was exploited on August 18, 2023 when unvalidated market address parameter allowed attacker to bypass permit checks and reenter crossDeleverage to steal users' deposited collateral. A copycat repeated the attack the same day.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht0258e9100e","date":"2023-08-18","name":"Crypto founder loses over $250,000 to crypto scam","kind":"scam","fam":"social","usd":273000.0,"lo":273000.0,"hi":273000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-founder-loses-over-250000-to-crypto-scam"}],"theft":true,"headline":true},{"id":"ht3fb56c7dbc","date":"2023-08-17","name":"Shibarium Bridge","kind":"other","fam":"other","usd":2600000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/shibarium-bridge-rekt"}]},{"id":"htf0efa637b5","date":"2023-08-16","name":"SwirlLend","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Base","Ethereum"],"usd":460000.0,"lo":460000.0,"hi":460000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/332931?source=share"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/swirllend-rug-pull"}],"desc":"The lending protocol SwirlLend team stole about $2.9 million in cryptocurrency from Base and $1.7 million worth of cryptocurrency from Linea, all of which were cross-chained to Ethereum. As of now, the deployer has transferred 254.2 ETH to Tornado Cash. SwirlLend's official Twitter and Telegram accounts have been logged out, and its official website is also inaccessible.","theft":true},{"id":"ht43715e5d0e","date":"2023-08-16","name":"Made by Apes","kind":"fraud","fam":"insider","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1691514780119343104"}],"desc":"On-chain analyst ZachXBT tweeted that there was an issue with Made by Apes’ SaaSy Labs APl, an on-chain licensing application platform launched by BAYC, allowing access to personal details for MBA applications. This issue was reported to Yuga Labs before disclosure and has since been fixed. Yuga Labs responded that it is currently uncertain whether there is a case of data misuse, is contacting anyone who may have exposed information, and will provide fraud and identity protection to any users who may need it."},{"id":"ht28cfc75cbd","date":"2023-08-15","name":"Shenzhen Shikongyun Technology accused of $83 million Filecoin pyramid scheme","kind":"fraud","fam":"insider","usd":83300000.0,"lo":83300000.0,"hi":83300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/shenzhen-shikongyun-technology-scheme"}],"headline":true},{"id":"htbdef671658","date":"2023-08-15","name":"RocketSwap Base","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":865000.0,"lo":857257.0,"hi":865000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/rocketswap-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/RocketSwap_Labs/status/1691229656593371136"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rocketswap-exploited-after-key-compromise"}],"desc":"RocketSwap's farm contract on Base was drained of 471 ETH ($865K) when attackers used brute force to compromise server-hosted private keys and gain control of the proxy contract with overly permissive transfer permissions.","theft":true},{"id":"ht3294794490","date":"2023-08-15","name":"MetisDAO","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wublockchain12/status/1691297467361550336?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"The official Twitter account of Ethereum expansion solution Metis was stolen. According to officials, team members fell victim to a Sim Swap attack, resulting in malicious actors being able to take over the account for approximately 30 hours.","theft":true},{"id":"ht339d66d2b9","date":"2023-08-15","name":"Sei Network","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/03xdxxa6.html"}],"desc":"The official Sei Network Discord server has been compromised, please do not click on any links until the team confirms that they have regained control of the server.","theft":true},{"id":"ht8dafafa253","date":"2023-08-13","name":"Zunami Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":2100000.0,"lo":2000000.0,"hi":2200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/zunami-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/332604?source=share"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zunami-protocol-exploit2-1-million"}],"desc":"On August 13, 2023, Zunami Protocol lost $2.1M to a flash loan attack that manipulated pricing via donation. The attacker exploited a flawed calcTokenPrice function (total_holdings / token_supply) to inflate pool value, increasing their UZD balance 3.5x before withdrawing through Tornado Cash.","theft":true,"onchain":true},{"id":"ht23565c47d2","date":"2023-08-13","name":"Fetch.ai","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/wublockchain12/status/1690679058147966977?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"An admin on the Fetch discord server showing the username \"Atari_buzz1kLL\" has had their @discord  account compromised. Please do not interact with any posts on our Discord until the issue has been resolved. There is no Fetch airdrop happening right now.","theft":true},{"id":"htbe5b8955a1","date":"2023-08-12","name":"Uniswap developer fired over FrensTech rug pull","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":25900.0,"lo":25900.0,"hi":25900.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/frenstech-rug-pull"}],"theft":true,"headline":true},{"id":"htb1d82b7fe7","date":"2023-08-10","name":"MPC Wallets","kind":"hack","fam":"keys","tech":"BitForge Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2023/08/09/fireblocks-discloses-zero-day-vulnerabilities-impacting-leading-mpc-wallets/"}],"desc":"Crypto infrastructure company Fireblocks has disclosed a series of vulnerabilities (collectively referred to as \"BitForge\") affecting various popular crypto wallets that use multi-party computation (MPC) technology, CoinDesk reported. The company classified BitForge as a \"zero-day\" vulnerability, and Coinbase, ZenGo, and Binance — the three companies most affected by BitForge — have already worked with Fireblocks to fix the underlying vulnerability. \"If not remediated, the vulnerabilities would allow attackers and malicious insiders to siphon funds from the wallets of millions of retail and institutional customers in seconds, without the knowledge of users or providers\", Fireblocks said.","theft":true},{"id":"ht6f6b1b70c5","date":"2023-08-09","name":"Blockchain Capital","kind":"hack","fam":"keys","tech":"Account Compromise","usd":6300000.0,"lo":6300000.0,"hi":6300000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/blockchain-capital-x-twitter-hacked-promoting-token-claim-scam"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bart-stephens-sim-swap-hack"}],"desc":"The Twitter account of Blockchain Capital, an encryption venture capital organization, was stolen this morning, and multiple tweets were posted to promote token claim scams. At present, the relevant fraudulent tweets have been deleted, and the Twitter account has now been restored.","theft":true},{"id":"htb5e9c2bac3","date":"2023-08-09","name":"Multiple wallets compromised due to irresponsible encryption in Libbitcoin project","kind":"hack","fam":"other","usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/libbitcoin-vulnerability"}],"theft":true,"headline":true},{"id":"htd740b018f7","date":"2023-08-09","name":"Earning.Farm","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":540000.0,"lo":530000.0,"hi":540000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On August 9, 2023 Earning.Farm (yield farming platform on Ethereum) was exploited for approximately $528,000-$540,000 via a reentrancy vulnerability in the withdraw() function where flawed share-burning logic allowed the attacker to reenter the contract and drain additional funds.","theft":true},{"id":"ht6d1ccdb67d","date":"2023-08-09","name":"EarningFram","kind":"hack","fam":"code","tech":"Reentrancy","chains":["Ethereum"],"usd":286000.0,"lo":286000.0,"hi":286000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3d1b11e643","date":"2023-08-08","name":"Solar Techno Alliance","kind":"fraud","fam":"insider","tech":"Scam","usd":120000000.0,"lo":120000000.0,"hi":120000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bitcoinist.com/120m-crypto-ponzi-scheme-in-india-unearthed/"}],"desc":"Legal authorities in the Indian state of Odisha have successfully busted a $120 million (Rs 1,000 crore) cryptocurrency Ponzi scheme. Two central figures in the fraudulent operation have been arrested. The project in question is called The Solar Techno Alliance (STA), using terms like green energy and solar technology. The investigation found that STA, with the assistance of online members, used various persuasive tactics and promises of profits in a short period of time to attract people to participate in the scheme, with more than 10,000 participants in Odisha alone. The investigation revealed that STA was not authorized by RBI, RBI or other regulators to accumulate deposits."},{"id":"ht08bc211d37","date":"2023-08-08","name":"Steadefi","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":1157000.0,"lo":1136848.0,"hi":1158000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/steadefi-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/steadefi/status/1688619454178144264"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/steadefi-exploit"}],"desc":"Attacker compromised deployer wallet private key to gain owner privileges over Steadefi pools, change pool ownership, and drain $1.148M in WBTC, WETH, and USDC via owner-only withdrawal functions.","theft":true},{"id":"ht9d1a05a28a","date":"2023-08-08","name":"Scammers target victims via web3 job search boards","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1172.0,"lo":1172.0,"hi":1172.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-target-victims-via-web3-job-search-boards"}],"theft":true,"headline":true},{"id":"ht23d254df67","date":"2023-08-07","name":"Bitsonic CEO arrested for allegedly stealing $7.5 million","kind":"fraud","fam":"insider","usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitsonic-ceo-arrested-for-allegedly-stealing-7-5-million"}],"headline":true},{"id":"htf873183900","date":"2023-08-07","name":"Cypher","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Solana"],"usd":1035000.0,"lo":1000000.0,"hi":1035203.0,"ret":600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/cypher_protocol/status/1688641036476731393"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cypher-protocol-exploit"}],"desc":"Cypher Protocol, a Solana-based futures exchange, was exploited for ~$1.035M via flashloan-enabled price manipulation. The attacker artificially inflated token prices through flashloans and exploited the protocol's economic model through repeated buying and selling at manipulated prices.","theft":true},{"id":"ht35092640cd","date":"2023-08-06","name":"Bitlord","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":567000.0,"lo":567000.0,"hi":567000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/9qw8r7dr.html"}],"desc":"Bitlord (BITLORD) A lot of liquidity has been removed. The deployer removed about 309 WETH from LP, worth about $567,000. The token project is suspected to be a honeypot scam.","theft":true},{"id":"htbed78eceb8","date":"2023-08-03","name":"Apache SalesRoom","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":680000.0,"lo":680000.0,"hi":680000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/6d8pcl4z.html"}],"desc":"A Rug Pull occurred on the Apache NFT SalesRoom (ASN) on the BNB Chain, and the deployer made a profit of about $680,000. The deployer transferred a large number of tokens to the address starting with 0xdc8, which has now dumped 1 million ASNs at a price of $680,000 in BSC-USD.","theft":true},{"id":"ht4fca35d006","date":"2023-08-03","name":"Tim Beiko","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/cfppi2h7.html"}],"desc":"The Twitter account of Tim Beiko, the core developer of Ethereum, was suspected of being stolen. He posted two tweets about \"ETH airdrop\" within half an hour with a phishing link(ether.fo). Users are asked not to click on suspicious links to prevent funds from being stolen. According to the analysis of SlowMist, the mastermind behind the scenes is PinkDrainer.","theft":true},{"id":"hte3e9c00fe5","date":"2023-08-02","name":"Uwerx","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Other","chains":["Ethereum"],"usd":324000.0,"lo":324000.0,"hi":327000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1686674169189249024"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uwerx-exploit"}],"desc":"Uwerx was exploited on August 2, 2023 for $327,000 (176 ETH). Attacker flash-loaned 20,000 ETH, swapped for WERX tokens, dumped them into Uniswap pool, then used the skim() function with a specific address. The 1% burn mechanism on transfers created a price imbalance the attacker arbitraged for profit.","theft":true,"onchain":true},{"id":"ht4f326e808e","date":"2023-08-02","name":"InsurAce","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/InsurAce_io/status/1686664525813358593"}],"desc":"InsurAce, a DeFi insurance protocol, tweeted: \"Our Discord server experienced a security breach. Our team discovered an unauthorized access to the server earlier today. We take this incident very seriously and are working hard to correct the situation. During this time, please do not interact with the server.\" According to the analysis of SlowMist, the phishing website is insurance.gift, and PinkDrainer is behind it.","theft":true},{"id":"htc1043908c5","date":"2023-08-01","name":"LeetSwap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":624000.0,"lo":620000.0,"hi":630000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/LeetSwap/status/1686190488506769408"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/leetswap-exploit"}],"desc":"LeetSwap on Base lost ~$624K (~342 ETH) on August 1, 2023 when an attacker exploited the _transferFeesSupportingTaxTokens function lacking access controls to move LP fees and manipulate pool prices.","theft":true,"onchain":true},{"id":"htcf58c85caa","date":"2023-08-01","name":"Neutra Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":36450.0,"lo":36450.0,"hi":36450.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Neutra Finance's convert() function used spot price to value LP tokens, but two LP tokens with the same name (CMLT-LP) from different pools could be swapped for each other. An attacker exploited this by converting from one LP token pool (CMLT-LP-65eb) to the other (CMLT-LP-2ea3), extracting value from the price differential.","theft":true},{"id":"ht1761bac84a","date":"2023-08-01","name":"CurveBurner","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["Ethereum"],"usd":36000.0,"lo":36000.0,"hi":36000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht466c171efa","date":"2023-07-31","name":"Bald","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["Base","Ethereum"],"usd":25600000.0,"lo":23000000.0,"hi":25600000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bald-rekt"},{"s":"SlowMist Hacked","u":"https://decrypt.co/150693/following-meme-coin-mania-on-coinbases-base-one-token-appears-to-be-a-rug"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bald-rug-pull"}],"desc":"On 31 July 2023 the anonymous deployer of the BALD memecoin on Base removed the two-sided liquidity provided two days after launch, crashing the token roughly 90%.","theft":true},{"id":"htcf0468f089","date":"2023-07-31","name":"GYM Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1193.0,"lo":1193.0,"hi":1193.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"GYM Network's _autoDeposit function had no transfer check, allowing users to call deposit() and create_deposit_record() without actually transferring tokens. An attacker repeatedly 'deposited' 8 million GYMNET tokens without sending any funds, then withdrew the fake deposit balance.","theft":true},{"id":"ht77b16835b9","date":"2023-07-31","name":"ZT Global","kind":"rugpull","fam":"insider","tech":"Rug Pull","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/g84sjbo2.html"}],"desc":"Some community users reported that the encrypted exchange named ZT Global was suspected of running away. Since the announcement of system upgrade and maintenance on July 28, transactions on the platform have been disabled. The TG channel has been banned and the founder cannot be contacted. At 21:00 on July 31, the exchange announced that it had completed maintenance and resumed trading functions, but the trading page showed that only 0.0006 BTC ($17) of buying orders pushed up the price of BTC on the platform and maintained it at 60,000 The price of USD and ETH also fluctuated violently in the case of tens of dollars of trading volume.","theft":true},{"id":"ht8405475045","date":"2023-07-31","name":"GYMNET","kind":"hack","fam":"code","tech":"Insufficient validation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht931f28443c","date":"2023-07-30","name":"Curve DEX","kind":"hack","fam":"code","tech":"Vyper Compiler Bug","target":"DeFi Protocol","chains":["Ethereum"],"usd":51350000.0,"lo":25123594.0,"hi":88000000.0,"ret":52300000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/curve-vyper-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/wu339f1f.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vyper-vulnerability"}],"desc":"On July 30, 2023, multiple Curve Finance pools were exploited via a Vyper 0.2.15/0.2.16/0.3.0 compiler bug in reentrancy guards. Attackers stole ~$61.7M across pETH-ETH, alETH-ETH, msETH-ETH, and others; ~68% was later recovered.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht06fce08f49","date":"2023-07-30","name":"Alchemix","kind":"hack","fam":"code","tech":"Affected by Vyper Vulnerability","chains":["Ethereum"],"usd":35315843.0,"lo":35315843.0,"hi":35315843.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AlchemixFi/status/1685737632133971968"}],"desc":"DeFi lending protocol Alchemix said on Twitter that after receiving notification from Curve Finance that the altH/ETH pool was attacked due to a Vyper bug, Alchemix quickly began removing AMO-controlled liquidity from the Curve pool through the AMO contract. The exploit was performed on the Curve pool contract. The Alchemix smart contract has not been compromised in any way and funds are safe. executed on the contract. Three transactions are required: unstake LP tokens from Convex, withdraw alETH from Curve pool, and withdraw ETH from Curve pool. The first transaction above has been executed, and after the second transaction is executed, 8000 ETH is removed from the Curve pool. This means that there is still about 5,000 ETH liquidity controlled by AMO in the Curve pool. In the process of removing the remaining liquidity, the alETH/ETH Curve pool was drained by the attacker. Currently, the alETH reserve has lost about 5,000 ETH. On September 4th, Alchemix issued a document stating that a white hat MEV robot operator has returned 43.3 ETH profits obtained through arbitrage from the Curve alETH/ETH pool attack incident, which will be added to the redistribution of funds.","theft":true},{"id":"htbf86c2e579","date":"2023-07-30","name":"JPEG'd","kind":"hack","fam":"code","tech":"Reentrancy Attack","usd":11363266.0,"lo":11363266.0,"hi":11363266.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/670e3s1g.html"}],"desc":"The NFT lending platform JPEG'd was hacked, and JPEG tokens fell by 40% in a short period of time, with a loss of at least about $10 million. The root cause is re-entry. When the attacker calls the remove_liquidity function to remove liquidity, he adds liquidity by re-entering the add liquidity function. Because the balance update is before re-entering the add_liquidity function, the price calculation is wrong. JPEG'd tweeted that the PETH-ETH curve pool was attacked. The vault contract that allows NFTs to be borrowed is safe and still functioning. NFT and treasury fund security. The JPEG'd contract has not been hacked and is safe. On August 5, JPEG'd tweeted that the DAO multi-signature address confirmed receipt of 5494.4 WETH, and the address owner who recovered funds from the pETH vulnerability received a 10% white hat bounty, which is 610.6 WETH.","theft":true},{"id":"htd6650d9973","date":"2023-07-30","name":"Kannagi","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["zkSync Era","Ethereum"],"usd":2130000.0,"lo":2130000.0,"hi":2130000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kannagi-finance-rekt"},{"s":"SlowMist Hacked","u":"https://www.fxstreet.com/cryptocurrencies/news/zksync-era-revenue-aggregator-protocol-kannagi-finance-has-reportedly-rug-pulled-over-2-million-2023072"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kannagi-finance-rug-pull"}],"desc":"Kannagi Finance, a yield aggregation protocol on zkSync Era, performed an exit scam on July 30, 2023, draining nearly all value from contracts (leaving $0.17 TVL). The launched contract code contained malicious functionality not present in the audited version. The team deleted all online presence.","theft":true},{"id":"htc2478f8fc8","date":"2023-07-30","name":"Vyper","kind":"hack","fam":"code","tech":"Compiler Bug","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hackmd.io/@vyperlang/HJUgNMhs2"}],"desc":"On August 6, the Ethereum compiler Vyper released an analysis report on last week's vulnerability incidents: Prior to July 30, due to potential vulnerabilities in the Vyper compiler, multiple Curve liquidity pools were exploited. While the bug was identified and patched, the impact on protocols using the vulnerable compiler was not recognized at the time, nor were they explicitly notified. The vulnerability itself is an improperly implemented reentrancy prevention, and the affected Vype versions are v0.2.15, v0.2.16, v0.3.0. Vulnerability fixed and tested in v0.3.1, v0.3.1 and later are safe.","theft":true},{"id":"ht24f7778a78","date":"2023-07-28","name":"Pond0x","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"Token","chains":["Ethereum"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/YazanXBT/status/1684971383590199325"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pond0x-bug"}],"desc":"Pond0x's directTransfer() function allowed any account to transfer tokens from any other address without authorization. The function exposed an internal _transfer function with no access controls, enabling attackers to drain funds by moving tokens from any address to their own.","theft":true},{"id":"ht104c32b84e","date":"2023-07-28","name":"Defilabs","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"A","n":3,"src":[{"s":"rekt.news","u":"https://rekt.news/defilabs-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1684736475815157760"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/defilabs-rug-pull"}],"desc":"DefiLabs on the BNB chain has run away, taking about $1.6 million. The privileged address 0xee08 drains user funds by exploiting the backdoor function withdrawFunds() in the vPoolv6 contract. DeFiLabs claimed on Twitter that the platform had “experienced unexpected issues” while it was “going through maintenance and updates.”","theft":true},{"id":"htf0e869ed2e","date":"2023-07-26","name":"IEGT","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1140000.0,"lo":1140000.0,"hi":1140000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://slowmist.medium.com/beware-of-covert-rug-pulls-exit-scams-driven-by-contract-storage-manipulation-3631c8cbe1a"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/iegt-token-rug-pull"}],"desc":"According to SlowMist, IEGT tokens were created on BSC on July 13. Its creators \"secretly minted a large number of tokens in preparation for pulling the rug\". Although the project’s token supply is only 5 million tokens, this enabled the team to sell 1 billion tokens, cashing out approximately $1.14 million in USDT stablecoins. According to SlowMist, the project party modified the balance of the specified address through inline assembly when the contract was initialized, and secretly issued a large number of tokens that were not known to other users, causing users to be Rug when participating in the project.","theft":true},{"id":"ht4a01d17097","date":"2023-07-26","name":"Carson DeFi","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":150000.0,"lo":145000.0,"hi":150000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1684393202252402688?s=20"}],"desc":"Carson DeFi token on BSC was exploited via a flash loan-based price manipulation attack. The attacker used borrowed assets to artificially move prices on connected pools, then captured value from the temporary price imbalance.","theft":true,"onchain":true},{"id":"htc2bcc2df1b","date":"2023-07-25","name":"EraLend","kind":"hack","fam":"code","tech":"Read-Only Reentrancy","target":"DeFi Protocol","chains":["zkSync Era","Ethereum"],"usd":3400000.0,"lo":2760000.0,"hi":3400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/eralend-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Era_Lend/status/1683897328938389505"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/eralend-exploit"}],"desc":"On July 25, 2023, EraLend on zkSync suffered a read-only reentrancy attack in code borrowed from SyncSwap, where an attacker repeatedly called a vulnerable function to manipulate asset prices via the internal oracle, draining $3.4M. Only USDC deposits were affected.","theft":true,"review":["possible duplicate within one source"]},{"id":"htc41ed56880","date":"2023-07-25","name":"MetaLabz","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Meta_labz/status/1683576178039308288"}],"desc":"MetaLabz token locker contract had an unprotected emergencyWithdraw() function that bypassed NFT stake records and reward calculations. Users could deposit both NFTs and ERC20 tokens, then execute emergencyWithdraw to extract tokens without processing proper stake accounting.","theft":true},{"id":"ht671dc03b67","date":"2023-07-24","name":"Palmswap","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/qoZaQbPZMx4nuP-I8EgCEA"}],"desc":"On July 24, 2023, Palmswap's PLP vault was exploited for $901,000. The attacker used flashloans to purchase USDP at 1:1, inflated the pool value, then redeemed at the manipulated 1:1.9 rate by exploiting incorrect exchange rate calculations in PlpManager.","theft":true,"onchain":true},{"id":"ht75b654b91a","date":"2023-07-23","name":"AlphaPo","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","Tron","Bitcoin"],"usd":60000000.0,"lo":60000000.0,"hi":60000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/alphapo-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1682941291825627137"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alphapo-hack"}],"desc":"AlphaPo's hot wallets were drained of ~$60M across Ethereum, Tron, and Bitcoin on July 23, 2023 after private key exposure.","theft":true},{"id":"htfabb8315e8","date":"2023-07-23","name":"MintoFinance","kind":"hack","fam":"code","tech":"Signature Replay","chains":["BNB Chain"],"usd":9000.0,"lo":9000.0,"hi":9000.0,"conf":"C","n":1,"theft":true},{"id":"ht96c5515ca2","date":"2023-07-23","name":"CoinList","kind":"hack","fam":"keys","tech":"Account Compromise","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Neon_EVM/status/1682846124242083840"}],"desc":"On July 23, the CoinList Twitter account was hacked. Previously, CoinList tweeted that it would launch native tokens, and then Neon EVM tweeted that the CoinList account was stolen and reminded users not to click on any links. On July 25, CoinList has shut down the malicious website for the scam token sale, and the security team is actively investigating and working with all relevant parties, including Twitter's support staff, to regain control of the CoinList Twitter account. CoinList will notify the community as soon as the fix process is complete, currently CoinList still controls all other official social media channels.","theft":true},{"id":"ht7271826554","date":"2023-07-22","name":"CoinsPaid","kind":"hack","fam":"social","tech":"Impersonation Scam","target":"Other","chains":["Bitcoin"],"usd":37300000.0,"lo":37300000.0,"hi":37300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://coinspaid.com/tpost/0zx28tmj51-coinspaid-is-back-to-processing-after-be"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinspaid-suspends-withdrawals"}],"desc":"Lazarus Group stole $37.3M from CoinsPaid via a 6-month social engineering campaign posing as recruiters. Attackers conducted fake job interviews and tricked an employee into installing JumpCloud Agent malware on their laptop, gaining access to operational systems and wallets.","theft":true},{"id":"ht5228643c3d","date":"2023-07-21","name":"Conic Finance","kind":"hack","fam":"code","tech":"Read-Only Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":3233500.0,"lo":3200000.0,"hi":3300000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/conic-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/ConicFinance/status/1682385596700844032"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/conic-finance-exploit"}],"desc":"Conic Finance exploited twice on July 21, 2023 for ~$4.2M ($3.3M ETH Omnipool, $934K crvUSD Omnipool) via read-only reentrancy in CurveLPOracleV2. Price manipulation extracted value from asset pools; audit findings hadn't covered this contract.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht443b73265f","date":"2023-07-21","name":"Conic Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":616980.5,"lo":300000.0,"hi":934000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ConicFinance/status/1682524319518269440"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/conic-finance-exploit-2"}],"desc":"On July 21-22, 2023, Conic Finance suffered two exploits via read-only reentrancy in CurveLPOracleV2. Attackers manipulated perceived prices to drain $3.26 million from the ETH omnipool; a second exploit of $300K occurred shortly after.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht35ae4d55fa","date":"2023-07-21","name":"SUT","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":8000.0,"lo":8000.0,"hi":8000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht929942cb13","date":"2023-07-21","name":"Hayden Adams","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Uniswap/status/1682130018225225728"}],"desc":"The Twitter account of Uniswap founder Hayden Adams was hacked, and the account sent multiple tweets containing links to scam websites. \"Hayden's account has been hacked,\" the Uniswap Foundation said in a tweet. \"Do not click on this link, or one that may appear in similar tweets.\"","theft":true},{"id":"ht5819c332b2","date":"2023-07-20","name":"Utopia","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":119300.0,"lo":119000.0,"hi":119300.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Utopia token on BSC was exploited via a business logic flaw in its swap or price calculation mechanism. The attacker exploited the broken logic to extract 492 BNB from the protocol.","theft":true,"onchain":true},{"id":"htc2dbdaaeb6","date":"2023-07-20","name":"FFIST","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"Token","chains":["BNB Chain"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"FFIST's _airdrop() function used predictable randomness via manipulable parameters (last airdrop address, block number). Fixed airdrop amounts (1 token) created pool imbalances, collapsing FFIST price to $1 and allowing attackers to swap small token amounts for disproportionate USD value.","theft":true,"onchain":true},{"id":"ht9155076846","date":"2023-07-19","name":"PleasrDAO","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ASvanevik/status/1681492638036537347"}],"desc":"Nansen CEO Alex Svanevik tweeted that the Twitter account of PleasrDAO, a decentralized autonomous organization composed of DeFi leaders, early NFT collectors, and digital artists, has been stolen, reminding users not to interact with it. PleasrDAO’s official Twitter account tweeted about the claim of the fake token PLEASR.","theft":true},{"id":"htde4909170e","date":"2023-07-19","name":"Shell Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Arbitrum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/0ctc3uc6.html"}],"desc":"The official Twitter account of the DeFi platform Shell Protocol on Arbitrum is suspected of being stolen. It posted false news about the application of SHELL tokens and closed the comment area. Please do not interact with it. According to news, this attack seems to be due to the hacking of its founder’s SIM card, resulting in both personal Twitter and Shell Protocol’s Twitter being hacked, and the attacker is the PinkDrainer phishing gang.","theft":true},{"id":"ht38323bb126","date":"2023-07-18","name":"GMETA","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":3600000.0,"lo":3600000.0,"hi":3600000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1681240663868973056"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gmeta-rug-pull"}],"desc":"GMETA on BSC has been Rug Pulled, with a price drop of 96%, taking about $3.6 million. The contract creator is [address].","theft":true},{"id":"ht8ca74dee23","date":"2023-07-18","name":"BNO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":500000.0,"lo":500000.0,"hi":505000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.solidityscan.com/bno-hack-analysis-15436d73e44e"}],"desc":"BNO's emergencyWithdraw function on BNB Chain lacked access controls and didn't check for NFT rights records. An attacker exploited this to deposit both NFT and ERC20 tokens, then withdraw only the ERC20 via emergencyWithdraw, bypassing reward calculations and earning undeserved mining rewards.","theft":true,"onchain":true},{"id":"htb3cf094b7b","date":"2023-07-18","name":"APEDAO","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1681316257034035201"}],"desc":"APEDAO on the BNB chain was attacked and the loss was approximately $7,000. The attacker transferred APEDAO to the pair contract. The APEDAO contract mistook the attacker's behavior as a selling operation and gradually accumulated a value named \"amountToDead\". The attacker repeatedly transferred APEDAO and then used the skim function to withdraw excess tokens. Eventually, the attacker calls the godead function to destroy APEDAO held in the pairing contract, causing the token price to rise.","theft":true,"onchain":true},{"id":"ht546fc48dce","date":"2023-07-17","name":"Scammer \"Soup\" makes more than $1 million through Discord hacks","kind":"scam","fam":"social","usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-soup-makes-more-than-1-million-through-discord-hacks"}],"theft":true,"headline":true},{"id":"ht45c0ec17be","date":"2023-07-17","name":"NewFi","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["BNB Chain"],"usd":31000.0,"lo":31000.0,"hi":31000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htffd64c60f5","date":"2023-07-15","name":"USDTStakingContract28","kind":"hack","fam":"code","tech":"Lack of access control","chains":["Ethereum"],"usd":20999.0,"lo":20999.0,"hi":20999.0,"conf":"C","n":1,"theft":true},{"id":"ht91ea278b92","date":"2023-07-13","name":"Ethscriptions","kind":"hack","fam":"code","tech":"Improper Access Control","target":"NFTfi","chains":["Ethereum"],"usd":2828.0,"lo":2828.0,"hi":2828.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/dumbnamenumbers/status/1679259067833786374"}],"desc":"A vulnerability in the Ethscriptions.com marketplace smart contract allowed unauthorized withdrawals. The contract contained code that permitted users to withdraw Ethscriptions they didn't own, resulting in ~202 inscriptions stolen across ~123 addresses.","theft":true},{"id":"ht30cff8c4b9","date":"2023-07-12","name":"WGPT Token","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":82500.0,"lo":80000.0,"hi":82500.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On July 12th, WGPT Token suffered from a flash loan attack, resulting in losses of ~$82.5k. Address (BSC): [address].","theft":true,"onchain":true},{"id":"ht56ea525633","date":"2023-07-12","name":"Klever","kind":"hack","fam":"keys","tech":"Low Entropy Mnemonic Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://klever.org/en/blog/klever-alert-external-security-incident"}],"desc":"Klever published a report on an external security incident on July 12. All wallets affected by the suspicious activity on July 12 were reported to be affected by a known vulnerability caused by low-entropy mnemonics. It's important to underscore that this issue is not exclusive to Klever. Reports indicate that users of multiple wallet providers are affected. All the wallets involved were imported into Klever Wallet K5. These wallets had not been originally created using Klever Wallet K5, instead all the wallets were created using an old and weak pseudorandom number generator (PRNG) algorithm as their entropy source. This algorithm was commonly used in early versions of various cryptocurrency wallet providers, which relied on the Javascript platform. The use of such a weak PRNG algorithm can significantly compromise the security and unpredictability of the generated keys, potentially making them more vulnerable to attacks or unauthorized access. Klever strongly recommends immediately migrating old wallets to new wallets created on Klever Wallet K5 or Klever Safe.","theft":true},{"id":"ht58f64f14f3","date":"2023-07-11","name":"Rodeo Finance","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Arbitrum","Ethereum"],"usd":1700000.0,"lo":888000.0,"hi":1790000.0,"ret":816000.0,"conf":"B","n":3,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/new-rodeo-finance-project-exploited-for-the-second-time-in-one-week"}],"desc":"The Arbitrum ecological leverage income agreement Rodeo Finance caused hackers to steal about $1.7 million due to price oracle manipulation, and currently about $816,000 has been recovered in the form of unshETH.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht71e32c4fe7","date":"2023-07-11","name":"LibertiVault","kind":"hack","fam":"code","tech":"Reentrancy Attack","chains":["Polygon"],"usd":450000.0,"lo":450000.0,"hi":452000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/329192"}],"desc":"The LibertiVault contract was attacked, losing about 123 ETH and 56,234 USDT on Polygon, worth about $290,000; 35 ETH and 96,223 USDT on Ethereum, worth about $160,000. Total damages exceeded $450,000. Attackers exploited a reentrancy vulnerability in the LibertiVault contract to repeatedly call the deposit function, manipulate the contract balance, and mint tokens based on incorrect balance calculations.","theft":true,"onchain":true},{"id":"ht556eba254a","date":"2023-07-11","name":"Platypus Finance","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Avalanche","Polygon"],"usd":50500.0,"lo":50000.0,"hi":157000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/platypus-finance-hack-2"}],"desc":"Platypus's liquidity conversion logic for LP-USDC assumed a 1:1 ratio between USDC and USDC.e, ignoring market price discrepancies. When exchanging USDC for USDC.e, the calculation produced unreasonably large quantities, allowing arbitrageurs to extract value.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htf744e0986f","date":"2023-07-11","name":"Libertify","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum","Polygon"],"usd":230.0,"lo":230.0,"hi":230.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A reentrancy vulnerability in LibertiVault's deposit function allowed attackers to mint excess shares by re-entering before totalSupply was updated. The attacker used flash loans to deposit funds, called deposit() recursively, and claimed inflated rewards before the state was finalized.","theft":true},{"id":"htc6acbd6f52","date":"2023-07-10","name":"Multichain drained of another $107 million days after previous theft","kind":"hack","fam":"other","usd":107000000.0,"lo":107000000.0,"hi":107000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/multichain-theft-3"}],"theft":true,"headline":true},{"id":"htb86d5a8307","date":"2023-07-10","name":"Arcadia V1","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Optimism"],"usd":455000.0,"lo":400000.0,"hi":460000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Phalcon_xyz/status/1678270672911605760"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/arcadia-finance-exploited"}],"desc":"On July 10, 2023, Arcadia Finance V1 vault was exploited via reentrancy in liquidation. Attacker registered a malicious contract as both router and whitelisted account, spoofing context to execute unauthorized withdrawals, draining ~$455-460K in LP tokens across Ethereum and Optimism.","theft":true,"onchain":true},{"id":"ht928f1144a6","date":"2023-07-10","name":"NFT phisher charged over OpenSea lookalike scam","kind":"scam","fam":"social","chains":["Ethereum"],"usd":448923.0,"lo":448923.0,"hi":448923.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-phisher-charged-over-opensea-lookalike-scam"}],"theft":true,"headline":true},{"id":"ht4ce94ddde0","date":"2023-07-09","name":"CivFund","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":180000.0,"lo":180000.0,"hi":180000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/revokecash/status/1677729762653995011?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"}],"desc":"CivFund had unrestricted token approvals that allowed an attacker to drain users' approved funds. The exploit abused callback functions to execute unauthorized fund transfers to Uniswap for liquidation.","theft":true},{"id":"htde05568df1","date":"2023-07-08","name":"CIVNFT","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":180000.0,"lo":180000.0,"hi":180000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"CIVNFT smart contract shipped fund-transfer functions with zero access control. An attacker exploited this to initiate callback functions that transferred CIV and USDT funds to Uniswap for liquidation.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht2cbb93e533","date":"2023-07-08","name":"Civfund","kind":"hack","fam":"code","tech":"Lack of access control","chains":["Ethereum"],"usd":165000.0,"lo":165000.0,"hi":165000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7ed6645bf4","date":"2023-07-07","name":"Multichain","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Moonriver","BNB Chain","Fantom"],"usd":126000000.0,"lo":126000000.0,"hi":130000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/multichain-rekt2"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/238206/tens-of-millions-of-dollars-withdrawn-from-multichain-on-fantom-in-possible-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/multichain-suspected-hack"}],"desc":"Multichain lost ~$126M on July 6-7, 2023 from bridge reserves on Fantom, Moonriver and Dogechain (WBTC, WETH, USDC, USDT, DAI, LINK and more). CEO Zhaojun, who held the MPC signing keys, had been detained since May 2023; project shut down days later.","theft":true,"review":["possible duplicate within one source"]},{"id":"htc61b96cc81","date":"2023-07-07","name":"Gutter Cat Gang","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":800000.0,"lo":750000.0,"hi":800000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/147913/gutter-cat-gang-twitter-hacked-at-least-750k-worth-nfts-swiped"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gutter-cat-gang-twitter-compromise"}],"desc":"An attacker has successfully compromised the Twitter accounts of popular NFT project Gutter Cat Gang and its co-founders, and used them to post phishing website airdrops claiming to be new NFTs. Instead of receiving the promised tokens, those who authorized contracted their wallets to be emptied. One victim lost 36 NFTs, including a Bored Ape NFT they bought for about $130,000. In total, the attackers managed to steal between $750,000 and $900,000 worth of NFTs, depending on how the resale value was estimated. The next day, the Gutter Cat Gang announced that they had regained control of the Twitter account and deleted the malicious tweet. They said they were cooperating with law enforcement investigating the theft but, to the dismay of some victims, did not describe any plans to compensate those whose assets were lost.","theft":true},{"id":"htfe262ecb0b","date":"2023-07-07","name":"Aptos Foundation","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AptosLabs/status/1677044666452299776"}],"desc":"The Aptos Foundation Twitter account (@Aptos_Network) has been hacked, with hackers directing people to a fraudulent website claiming to participate in a bogus airdrop. Aptos Labs also posted a warning on Twitter, reminding users not to interact with links to fake websites."},{"id":"ht01dc5c1166","date":"2023-07-07","name":"LUSD","kind":"hack","fam":"market","tech":"Price manipulation attack","conf":"C","n":1,"theft":true},{"id":"htcfe6d62e02","date":"2023-07-05","name":"Bryan Pellegrino","kind":"hack","fam":"bridge","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/LayerZero_Labs/status/1676327546202517504"}],"desc":"The cross-chain interoperability protocol LayerZero officially tweeted that its CEO Bryan Pellegrino's Twitter account (@PrimordialAA) was stolen, reminding users not to click on any suspicious links or participate in suspicious activities.","theft":true},{"id":"htf52fb01c62","date":"2023-07-04","name":"MIKE & SID","kind":"hack","fam":"insider","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":171000.0,"lo":171000.0,"hi":171000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/25656"}],"desc":"Mike Wazowski Monsters Inc  $MIKE and Sid Ice Age $SID on the Ethereum chain have been rugged via a backdoor function that allows unlimited minting of tokens. The scammer has profited 87.9 $ETH, equivalent to about $171,000.","theft":true},{"id":"ht882f0a85b5","date":"2023-07-04","name":"Rodeo","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Arbitrum"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Rodeo Finance suffered first exploit on July 5, 2023 via a logic flaw in the mintProtocolReserves function, losing ~$89K. A second exploit on July 11 via TWAP oracle manipulation resulted in an additional $1.53M loss (810+ ETH). Stolen funds bridged to Ethereum then partially mixed via Tornado Cash.","theft":true},{"id":"htbfbcdbfe1d","date":"2023-07-04","name":"BaoCommunity","kind":"hack","fam":"code","tech":"Donate Inflation ExchangeRate && Rounding Error","chains":["Ethereum"],"usd":46000.0,"lo":46000.0,"hi":46000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht83a8810949","date":"2023-07-04","name":"BambooIA","kind":"hack","fam":"market","tech":"Price manipulation attack","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht9ddf6ab534","date":"2023-07-03","name":"Encryption AI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain","Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://beincrypto.com/encryption-ai-rug-pulls-2m/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/encryption-ai-rug-pull"}],"desc":"Encryption project Encryption AI (0XENCRYPT) crashed 99% as the developers behind it performed a retreat. Losing a total of $2 million, the developer released a message citing his online gambling addiction.","theft":true},{"id":"ht4ff0806463","date":"2023-07-03","name":"Trader loses $213,000 to phishing scam, blames Twitter","kind":"scam","fam":"social","chains":["Ethereum"],"usd":213000.0,"lo":213000.0,"hi":213000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lovemakeeth-wallet-drain"}],"theft":true,"headline":true},{"id":"htc658d8131c","date":"2023-07-03","name":"NFT Trader","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/NftTrader/status/1675749755052523520"}],"desc":"NFT Trader, a P2P digital asset trading protocol, said on Twitter that the website has been attacked, and users are asked to monitor their accounts and beware of phishing attacks. The NFT Trader website will be closed until further notice. Currently, the team is still investigating and the platform has been taken offline to avoid any further issues. NFT Trader stated that this is not a problem with the protocol. It is suspected that someone outside the team inserted a malicious code at the front end. The team will continue to investigate.","theft":true},{"id":"htd8417f0046","date":"2023-07-02","name":"Poly Network","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Polygon"],"usd":10000000.0,"lo":5000000.0,"hi":10100000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/poly-network-rekt2"},{"s":"SlowMist Hacked","u":"https://polynetwork.medium.com/the-poly-network-exploit-analysis-b0a77aff6078"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polynetwork-exploited-again"}],"desc":"On July 2, 2023, Poly Network was exploited across 11 blockchains via insufficient validation of block headers and validator signatures in bridging logic. Attackers minted ~$43B in tokens; limited liquidity and swift exchange intervention (Tether freeze of $33M USDT) contained cashed-out losses to $5-10M.","theft":true,"review":["sources disagree on the loss"]},{"id":"htb5c07d9ab7","date":"2023-07-02","name":"Aave fork","kind":"hack","fam":"bridge","tech":"Governance Attack","usd":930000.0,"lo":930000.0,"hi":930000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/kaucoe3r.html"}],"desc":"The Aave fork project on the Pulse chain suffered a governance attack. The hacker first purchased a large number of Aave tokens to obtain the governance authority of the Aave fork project, and then created multiple contracts. The hacker seemed to want to use the governance authority to modify the implementation of the proxy contract Address, using the user's authorization to the contract that has not been canceled, to transfer the user's funds away. Such as WBTC, YFI, BAL, AAVE, UNI and other tokens. Finally, the hacker converted the stolen funds into ETH through the cross-chain bridge protocol, and sent it to the [address] address of Ethereum. The attacker made a profit of 483 ETH (approximately $930,000).","theft":true},{"id":"hted6938965c","date":"2023-06-30","name":"Smurfs Coin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":423000.0,"lo":423000.0,"hi":423000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Smurfs Coin project is an exit scam, and the contract deployer sold the tokens on June 13 and removed a total of 227 ETH (approximately $423,000) of liquidity. The contract address is ETH: [address], not to be confused with a project with a similar name.","theft":true},{"id":"htb43abfb744","date":"2023-06-30","name":"Biswap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":72000.0,"lo":72000.0,"hi":710000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Biswap_Dex/status/1674871633461272578"}],"desc":"Biswap's V3 Migrator contract lacked proper access control and parameter validation when migrating liquidity from V2 to V3. An attacker exploited this to call the migrator contract and steal funds from liquidity providers who had authorized their LP tokens.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htf383a72561","date":"2023-06-30","name":"AzukiDAO","kind":"hack","fam":"code","tech":"Signature Replay","target":"DeFi Protocol","chains":["Ethereum"],"usd":69000.0,"lo":68000.0,"hi":69000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/wublockchain12/status/1675804855414452225"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/azukidao-exploit"}],"desc":"On July 3-4, 2023, AzukiDAO's governance token claim contract was exploited via signature replay when the signatureClaimed mapping was never verified. The attacker replayed one valid signature across multiple transactions to steal approximately 1.79M BEAN tokens (~$68,000).","theft":true,"onchain":true},{"id":"ht4807e2500e","date":"2023-06-30","name":"MyAi","kind":"hack","fam":"code","tech":"Business Logic","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht561e670d10","date":"2023-06-28","name":"Manta Network","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Polkadot"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/f2lzk34v.html"}],"desc":"The Twitter account of Manta Network, a Poca eco-privacy project, which was previously stolen and posted false airdrops, has been restored.","theft":true},{"id":"htd1340f6143","date":"2023-06-27","name":"Chibi Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum","Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/25306"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/chibi-finance-rug-pulls-for-1-million"}],"desc":"A suspected Rug Pull occurred on the Chibi Finance project on Arbitrum, and $1 million worth of cryptocurrency was drained. The stolen funds have been converted into approximately 555 ETH and transferred to Tornado Cash after bridging from Arbitrum to Ethereum.","theft":true},{"id":"htdab7249c33","date":"2023-06-27","name":"Themis Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":370000.0,"lo":368000.0,"hi":370000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ThemisProtocol/status/1673806486299099137"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/themis-protocol-hacked-shortly-after-going-live"}],"desc":"Themis Protocol relied on DEX spot prices without flashloan protection. Attackers used flashloans to manipulate BLP prices via large wstETH swaps, borrowing assets at inflated collateral values.","theft":true,"onchain":true},{"id":"ht5e83b669ef","date":"2023-06-27","name":"UnverifiedContr_9ad32","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":5955.0,"lo":5955.0,"hi":5955.0,"conf":"C","n":1,"theft":true},{"id":"ht906436b405","date":"2023-06-27","name":"Entangle Protocol","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zackozacko/status/1673528986734047234"}],"desc":"On June 27th, Entangle Protocol's Discord was hacked.","theft":true},{"id":"ht2f44c49fef","date":"2023-06-27","name":"ZigZag","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["zkSync Era"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ZigZagExchange/status/1673363843299287040"}],"desc":"ZK Rollup Order Book DEX Protocol ZigZag tweeted, \"Our Discord has been hacked, please note that there is no airdrop activity at ZigZag at this time, please do not click on phishing links. We are working to resolve this issue and will provide an update when control is regained.\"","theft":true},{"id":"ht6417fd19ad","date":"2023-06-27","name":"STRAC","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4942168ca1","date":"2023-06-26","name":"Prime Trust placed into receivership","kind":"collapse","fam":"insider","usd":83660000.0,"lo":83660000.0,"hi":83660000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/prime-trust-placed-into-receivership"}],"headline":true},{"id":"ht1b55f483c5","date":"2023-06-26","name":"Eco-travel company We Are Bamboo loses millions of customer funds gambling on crypto","kind":"fraud","fam":"insider","chains":["Ethereum","Bitcoin"],"usd":2800000.0,"lo":2800000.0,"hi":2800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/eco-travel-company-we-are-bamboo-loses-millions-of-customer-funds-gambling-on-crypto"}],"headline":true},{"id":"ht4e19bb7e32","date":"2023-06-26","name":"Former NRL star and convict Jarryd Hayne reportedly loses more than $500,000 to a Bitcoin scam run by fellow inmate","kind":"scam","fam":"social","chains":["Bitcoin"],"usd":1335000.0,"lo":1335000.0,"hi":1335000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/jarryd-hayne-bitcoin-scam"}],"theft":true,"headline":true},{"id":"htac5e813469","date":"2023-06-25","name":"Blockchain for dog nose wrinkles","kind":"fraud","fam":"insider","tech":"Scam","usd":127000000.0,"lo":127000000.0,"hi":127000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.dlnews.com/articles/people-culture/korean-blockchain-for-dog-nose-wrinkles-crypto-scam-127m/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dog-noseprint-ponzi-scheme"}],"desc":"‘Blockchain for dog nose wrinkles’ Ponzi makes off with $127m. A South Korean company lured investors with its new technology: a blockchain app that can identify dogs by their nose wrinkles.The investigation found that what the company promoted to be its dog nose wrinkle reader was fake.The South Korean police say investors have lost more than $100 million in what it describes as a “typical Ponzi.”"},{"id":"ht4ca64ca72a","date":"2023-06-25","name":"Alleged SpireBit crypto scam loses one senior his life savings","kind":"scam","fam":"social","usd":340000.0,"lo":340000.0,"hi":340000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/alleged-spirebit-crypto-scam-loses-one-senior-his-life-savings"}],"theft":true,"headline":true},{"id":"ht278dff6e54","date":"2023-06-24","name":"Ichioka Ventures","kind":"fraud","fam":"insider","tech":"Scam","usd":21000000.0,"lo":21000000.0,"hi":21000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptopotato.com/cftc-charges-man-for-defrauding-investors-of-21m-in-crypto-ponzi-scheme/"}],"desc":"The U.S. Commodity Futures Trading Commission (CFTC) recently filed a lawsuit in the U.S. District Court for the Northern District of California against William Koo Ichioka, an alleged digital asset and foreign exchange Ponzi scheme, alleging that he mishandled more than $21 million in investor assets and used new customer funds to create the illusion of profits in his Ponzi scheme.William Koo Ichioka raised money from William Koo Ichioka raised funds from more than 100 individuals and entities, promising to trade forex through the operation of a commodity interest pool called Ichioka Ventures. He advertised the service on his website claiming that the promised returns matched the performance of his investments, as he himself was a white knuckle investor who had made millions of dollars. According to his trading strategy, Ichioka promised a 10% return every 30 business days to those who participated in his program. However, his trades suffered huge losses. To hide the losses, he provided false documents to inflate the amount of money in his commodity interest pool accounts and provided participants with false account statements. Ichioka also used other participants' funds to pay for the alleged gains. Although Ichioka claimed that he was investing for his clients, he actually used client funds for personal expenses. He commingled participants' assets with his own and used them to purchase luxury items such as jewelry, cars, and watches."},{"id":"htbbbeda0654","date":"2023-06-23","name":"$1.25 million stolen in 2 months in Polygon NFT phishing scheme","kind":"scam","fam":"social","chains":["Polygon"],"usd":1250000.0,"lo":1250000.0,"hi":1250000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/1-25-million-stolen-in-2-months-in-polygon-nft-phishing-scheme"}],"theft":true,"headline":true},{"id":"ht75ca5d27c8","date":"2023-06-23","name":"Shido","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["BNB Chain"],"usd":238500.0,"lo":238500.0,"hi":238500.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://panewslab.com/zh/sqarticledetails/5y6bi4cv.html"}],"desc":"Shido on BNB Chain suffered an exploit on June 23, 2023 due to a configuration error. The attack resulted in the loss of approximately 976 BNB worth ~$238.5K at the time of exploit.","theft":true,"onchain":true},{"id":"ht428f290572","date":"2023-06-22","name":"Former Home Improvement child star Zachery Ty Bryan accused of crypto scamming","kind":"fraud","fam":"insider","usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/former-home-improvement-child-star-zachery-ty-bryan-accused-of-crypto-scamming"}],"headline":true},{"id":"ht13bc6180b8","date":"2023-06-21","name":"BUNN","kind":"hack","fam":"other","tech":"Reflection tokens","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb310f313a3","date":"2023-06-21","name":"BabyDogeCoin02","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0449fc407d","date":"2023-06-20","name":"IPO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":102000.0,"lo":102000.0,"hi":102000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The project named \"IPO\" (Twitter handle @IPO_web3) is suspected to have suffered a Rug Pull, losing around 102,000 BSC-USD, the project's tokens are down 32%, and the stolen funds are now located in addresses beginning with 0x35fe.","theft":true},{"id":"htc1284acb55","date":"2023-06-20","name":"MIMSpell","kind":"hack","fam":"code","tech":"Arbitrary External Call Vulnerability","chains":["Ethereum"],"usd":17000.0,"lo":17000.0,"hi":17000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht348f5c13a3","date":"2023-06-20","name":"Astaria","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AstariaXYZ/status/1671215491069927429"}],"desc":"Astaria, the NFT lending platform, tweeted: \"At 12:42 BST on June 20, Astaria became aware of an issue with the basic execution of BeaconProxy.sol that allowed an attacker to manipulate the beacon to load a malicious execution that would allow the attacker to invoke the self-destruct feature. All funds and NFTs are secure and no action is required at this point, Astaria is in a suspended state and cannot initiate new loans. The suspended state is to protect all assets in the protocol and we can confirm that no funds are missing. Just now Astaria successfully executed a white hat recovery script that saved all ERC20 and ERC721 assets of all LPs and borrowers. Astaria has been in public beta since May 25. The recovery script extracted all funds and NFTs to Astaria multi-signature addresses using the updated contract implementation and recovery code. We are drafting a plan for the next steps and will follow up as soon as possible.\"","theft":true},{"id":"ht2f45383a32","date":"2023-06-20","name":"Slingshot","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/realScamSniffer/status/1670959880604389376"}],"desc":"The Twitter account of decentralized exchange Slingshot has been compromised by scammer Pink Drainer, who posted links to fake websites and claimed that users could claim airdrop tokens. Users are advised to be aware of the risks and not to click on the links.","theft":true},{"id":"htb9de69a4a8","date":"2023-06-19","name":"VPANDA DAO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":265000.0,"lo":265000.0,"hi":265000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/24933"}],"desc":"Seems like @VPandaCommunity rugged for ~265K $BSC-USD $VPC has dropped -97.4%, the stolen funds has already been transferred to 0x33d2a4...af65","theft":true},{"id":"ht32cd6a0a4b","date":"2023-06-19","name":"Contract_0x7657","kind":"hack","fam":"code","tech":"Business Logic","chains":["Ethereum"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb66a91fcc5","date":"2023-06-18","name":"Ara Finance","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["BNB Chain"],"usd":125000.0,"lo":124000.0,"hi":125000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On June 18-19, 2023, an attacker exploited Ara Finance's unrestricted swap contract by flash-loaning 1.202 million USDT on BNB Chain. The contract lacked access control and held unbounded ARA and USDT approvals, allowing the attacker to steal ~$124,915.","theft":true,"onchain":true},{"id":"htc5af1f266b","date":"2023-06-17","name":"Pawnfi","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Ethereum"],"usd":820000.0,"lo":820000.0,"hi":820000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Pawnfi's ApeStaking contract allowed attackers to use the same NFT as collateral multiple times for borrowing APE tokens. The vulnerability stemmed from missing NFT transfer verification in the depositAndBorrowApeAndStake() function, enabling an attacker to borrow without securing proper collateral by leveraging an already-staked NFT.","theft":true,"onchain":true},{"id":"ht8af08fe470","date":"2023-06-17","name":"Midas Capital","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":600000.0,"lo":340000.0,"hi":600000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/midas-rekt2"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/7xmbgnkh.html"}],"desc":"On June 17, 2023, Midas Capital's HAY/BUSD pool on BSC was exploited for $340K-$600K via a rounding error in cToken redemption logic. The attacker crafted positions that rounded down to 1 wei, repeatedly exploited the error with minimal deposits and flash-loaned ANKR collateral to withdraw disproportionately large sums.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht283f0128b2","date":"2023-06-15","name":"Hashflow","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Avalanche","BNB Chain","Polygon"],"usd":605000.0,"lo":600000.0,"hi":605000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/hashflow/status/1669031128307572766"}],"desc":"A vulnerable function in Hashflow's contract allowed attackers to trigger transferFrom() on approved user tokens. The attacker exploited an approve-related issue across five chains, draining approximately $605K. The white-hat nature of the attack was later confirmed, and a recovery function was provided by the attacker, with Hashflow committing to compensating all affected users.","theft":true},{"id":"ht4e2aca4166","date":"2023-06-15","name":"DEP/USDT,  LEV/USDC","kind":"hack","fam":"code","tech":"Unknown","chains":["Ethereum"],"usd":105800.0,"lo":105000.0,"hi":105800.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/xbxdm9ar.html"}],"desc":"DEP/USDT and LEV/USDC pools were stolen with 105,800 stablecoins worth (36,000 USDC and 69,960,000 USDT), and the attackers initially received 1 ETH of initial funding from Tornado Cash.","theft":true,"onchain":true},{"id":"ht87b3589f9b","date":"2023-06-15","name":"Hyperliquid","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["Arbitrum"],"usd":37000.0,"lo":37000.0,"hi":37000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"In June 2023, an attacker manipulated SNX prices on centralized exchanges to exploit Hyperliquid's vault system through its reliance on easily-manipulated CEX spot prices, leveraging the discrepancy between real and inflated prices.","theft":true},{"id":"ht87d678ecd1","date":"2023-06-15","name":"CFC","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["BNB Chain"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited CFC's custom transfer logic on a Uniswap V2-style pool by repeatedly transferring tokens to the pair and invoking skim(), triggering the _transfer() function to burn tokens. This reduced the LP pair's actual token balance, allowing the attacker to extract value through the token supply manipulation.","theft":true},{"id":"ht4b79a0660a","date":"2023-06-15","name":"Move VM","kind":"hack","fam":"code","tech":"Overflow Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/b678w3tm.html"}],"desc":"Recently, a security firm discovered a stack overflow vulnerability in the Move VM that does not limit the depth of recursive calls, which can cause a total network shutdown, prevent new validator nodes from joining the network, and potentially even cause a hard fork. mainnet_v1.2.1, Aptos mainnet_v1.4.3 and earlier are all affected by this vulnerability. Suimainnet_v1.2.1, Aptosmainnet_v1.4.3, and Move-language versions after June 10, 2023 fix this vulnerability.","theft":true},{"id":"ht8f85abe2c4","date":"2023-06-14","name":"Tropykus RSK","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["Rootstock"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On June 14, 2023, Tropykus RSK was exploited via a rounding error vulnerability in the redeem counter affecting interest rate calculations, resulting in $150,000 in losses.","theft":true},{"id":"ht860118051a","date":"2023-06-12","name":"Sturdy V1","kind":"hack","fam":"code","tech":"Read-Only Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":787500.0,"lo":770000.0,"hi":884000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sturdy-rekt"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sturdy-finance-exploited-for-775000"}],"desc":"On June 12, 2023, Sturdy Finance was drained of ~$800K via a flashloan-funded read-only reentrancy attack on Balancer pools during oracle checks, inflating B-stETH-STABLE prices.","theft":true,"onchain":true},{"id":"ht2d5dc99dd7","date":"2023-06-12","name":"Keep3r Network","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"DeFi Protocol","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On June 12, 2023, an attacker compromised Keep3r Network's governor private key (an insecure vanity address). Attacker reset pool governors and launched a reentrancy attack, harvesting ~4,084 KP3R (~$200K); attacker was funded via Tornado Cash.","theft":true},{"id":"ht7db3cb7ce6","date":"2023-06-11","name":"FPG","kind":"hack","fam":"code","tech":"Security Vulnerability","target":"CEX","usd":20000000.0,"lo":15000000.0,"hi":20000000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2023/06/14/crypto-prime-broker-fpg-loses-up-to-20m-in-cyber-attack/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fpg-halts-withdrawals-after-1520-million-hack"}],"desc":"A spokesperson for Floating Point Group (FPG), a trading platform for crypto institutions, said it was hit by a cyber attack on June 11 and has lost between $15 million and $20 million in cryptocurrency. fpg has taken security measures and successfully obtained SOC 2 certification after hiring external auditors to conduct a series of cybersecurity audits and penetration tests last December. After the security breach was discovered, FPG froze all third-party accounts and implemented protective measures for all wallets. The company's account isolation measures limited the overall impact of the attack.","theft":true},{"id":"ht5a0bcd96a2","date":"2023-06-11","name":"Floating Point Group","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","usd":15000000.0,"lo":15000000.0,"hi":15000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Floating Point Group, an institutional crypto prime brokerage, suffered a cybersecurity breach resulting in a loss of $15-20M from custody accounts. The attackers gained unauthorized access to the company's systems, leading FPG to freeze third-party accounts and migrate funds to secure wallets while working with law enforcement.","theft":true},{"id":"hta91810491b","date":"2023-06-11","name":"Atlantis Loans","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1100000.0,"lo":1000000.0,"hi":2500000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/atlantis-loans-rekt"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/abandoned-atlantis-loans-project-exploited-for-1-1-million"}],"desc":"On June 7, attacker exploited weak governance controls to pass malicious proposal ID 52, gaining admin access to token proxy. Attacker modified ABep20Delegate with backdoor to extract funds from users with active token approvals.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht6f893c9f45","date":"2023-06-11","name":"SellToken04","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":109000.0,"lo":109000.0,"hi":109000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd9e33e8a0e","date":"2023-06-11","name":"TrustTheTrident","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":95000.0,"lo":95000.0,"hi":95000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"TrustTheTrident ($SELLC) suffered an attack that resulted in approximately $95,000 in losses.","theft":true},{"id":"ht32454e8024","date":"2023-06-11","name":"Ben Armstrong","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/OurielOhayon/status/1667743998583209985"}],"desc":"ZenGo CEO Ouriel Ohayon tweeted that BitBoy Crypto founder Ben Armstrong's Twitter account was hacked and used to promote a crypto scam to steal users' NFT assets, the same scam that hit garry tan, peter schiff and others, asking users to be aware of the risks involved.","theft":true},{"id":"ht7a9d7d1c7e","date":"2023-06-09","name":"Franklin","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ElectionDayMad1/status/1666930033372413954"}],"desc":"NFT giant whale Franklin is suspected to have posted a warning on his Twitter handle @ElectionDayMad1 with text and video that his Twitter account @franklinisbored was stolen, please do not send any cryptocurrency or click on any links, and that none of the tweets from the early morning of June 9 were posted by him.","theft":true},{"id":"ht628c9977f0","date":"2023-06-08","name":"Arbitrum","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ArbitrumDevs/status/1666549893001887744"}],"desc":"According to official sources, a bug in Arbitrum's sequencer code previously caused a brief outage in the network's batch transaction submission feature, which prevented transactions from being confirmed on the main chain. The bug has since been fixed and the bulk transaction submission feature has been restored.","theft":true},{"id":"ht8754b3dd44","date":"2023-06-07","name":"USEA","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1100000.0,"lo":1100000.0,"hi":1100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"A Rug Pull occurred on the USEA token on BNB Chain with a loss of about $1.1 million, and the deployer minted a total of 700 million USEAs via the mint function, then transferred them to EOA addresses and sold 1114468 BUSD via PancakeSwap V3.","theft":true},{"id":"htc6d387c1ee","date":"2023-06-07","name":"CompounderFinance","kind":"hack","fam":"other","tech":"Manipulation of funds through fluctuations in the amount of exchangeable assets","chains":["Ethereum"],"usd":27174.0,"lo":27174.0,"hi":27174.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd441583657","date":"2023-06-07","name":"Xverse","kind":"hack","fam":"keys","tech":"Mnemonic leaked","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://protos.com/terra-founder-do-kwon-claims-to-have-funded-top-montenegro-political-party/"}],"desc":"Ordinals eco-wallet Xverse tweeted: Xverse has fixed a bug that caused wallet helpers to be stored unencrypted on local devices, and all users should update the Chrome extension to the latest version. The risk of this bug is minimal if it is confirmed that no helper words leave the user's local device. However, if users are concerned about the threat, they can migrate their assets to a newly generated wallet. This error does not affect Xverse iOS and Android apps.","theft":true},{"id":"ht7e05150b3e","date":"2023-06-06","name":"NFDAO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":88300.0,"lo":88300.0,"hi":88300.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"NFDAO (NFD) bulk liquidity has been removed. The deployer's associated wallet removed the liquidity and made a profit of about $88,300. bsc address: [address].","theft":true},{"id":"htafb0e4bd9f","date":"2023-06-06","name":"UN","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":26000.0,"lo":26000.0,"hi":26000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3244d6cccc","date":"2023-06-06","name":"VINU","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":6000.0,"lo":6000.0,"hi":6000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7aeb6beaf8","date":"2023-06-06","name":"Cole","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1665929832855916544"}],"desc":"According to a tweet from MistTrack, the Twitter account of Cole, co-founder of the NFT project Pudgy Penguins, appears to have been attacked, seemingly by the PinkDrainer hacker group. Please do not click on suspicious links.","theft":true},{"id":"ht58326b1a14","date":"2023-06-03","name":"Atomic Wallet","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"Wallet","chains":["Ethereum","Tron","BNB Chain","Bitcoin","Polkadot","Avalanche"],"usd":100000000.0,"lo":100000000.0,"hi":100000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/atomic-wallet-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/AtomicWallet/status/1664946301815910400"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/atomic-wallet-hacks-total-over-35-million"}],"desc":"On June 3, 2023, Atomic Wallet users lost over $100 million when attackers compromised the wallet application through a supply chain attack that injected malicious code to exfiltrate private keys. Approximately 5,500 wallets were affected across multiple chains.","theft":true},{"id":"htec0a4c2dac","date":"2023-06-02","name":"Hector Lending","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Fantom"],"usd":653000.0,"lo":653000.0,"hi":653000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Hector Lending's cross-chain bridge on Fantom was exploited on June 2, 2023. An unlimited USDC approval on a beta bridge contract was exploited to drain ~650,000 USDC, after which the network voted to liquidate $16M in treasury.","theft":true},{"id":"ht13eda63e54","date":"2023-06-02","name":"NST Simple Swap","kind":"hack","fam":"code","tech":"Unverified contract, wrong approval","chains":["Polygon"],"usd":40000.0,"lo":40000.0,"hi":40000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte26c37a860","date":"2023-06-02","name":"CosmWasm","kind":"hack","fam":"code","tech":"Overflow Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://jumpcrypto.com/writing/stop-the-chain-cosmwasm-stack-overflow/"}],"desc":"Jump Crypto, the digital asset trading arm of Jump Trading, said on Twitter that its security team discovered a stack overflow vulnerability in CosmWasm, a smart contract platform designed by the Cosmos ecosystem. The bug would stop users uploading new smart contracts on Cosmos-based blockchains from functioning on those chains entirely.","theft":true},{"id":"htfd19fbd55b","date":"2023-06-01","name":"DD Coin","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":126000.0,"lo":126000.0,"hi":300000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"DD Coin was attacked and lost about 126,000 USDT. The attacker initially received 1 BNB of funds from Tornado Cash about 17 days ago. DD Coin has lost 21%.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht67b966c1e1","date":"2023-06-01","name":"Cellframe","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":76000.0,"lo":74000.0,"hi":76112.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1664182095730872320"}],"desc":"Cellframe suffered a flash loan attack exploiting calculation errors during liquidity migration. The attacker took flash loans to manipulate LP pools by injecting and withdrawing liquidity strategically across different pools, converting the resulting tokens through a new CELL-BUSD pool to extract value.","theft":true,"onchain":true},{"id":"ht1d30487f40","date":"2023-05-31","name":"unshETH","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"DeFi Protocol","chains":["Ethereum"],"usd":375000.0,"lo":375000.0,"hi":375000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/unsheth_xyz/status/1664534089704275968"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unsheth-compromised-after-private-key-leaked-to-github"}],"desc":"A developer leaked private deployment keys to GitHub, which an attacker exploited to drain $375K from the unshETH staking protocol. The attacker transferred ownership of smart contracts to themselves before the protocol emergency-paused withdrawals and the keys were secured.","theft":true},{"id":"ht5fbdf9e180","date":"2023-05-31","name":"Pixel Penguin","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":117000.0,"lo":117000.0,"hi":117000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1663708430274551808"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/charity-nft-project-by-supposed-cancer-patient-raises-117000-with-stolen-art-before-being-exposed-as-a-fraud"}],"desc":"On-chain detective ZachXBT tweeted that a Rug Pull occurred on Pixel Penguin, a charity project created by Hopeexist1, which claimed to raise funds to help him fight cancer. At present, the social accounts of Hopeexist1 and Pixel Penguin have been deleted, and the Pixel Penguin contract is worth only $117,000 (61.686 ETH).","theft":true},{"id":"htb974b3e9d7","date":"2023-05-31","name":"ERC20TokenBank","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":111000.0,"lo":111000.0,"hi":111000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht26908a605f","date":"2023-05-31","name":"Sashimi Swap","kind":"hack","fam":"insider","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":3500.0,"lo":3500.0,"hi":3500.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ArkhamIntel/status/1664210608865042435"}],"desc":"A MEV bot (0xb2…2B96 is the MEV bot call contract, 0xb4…0343 is the single-use MEV bot) borrowed 95,000 WETH (worth nearly $180 million) via flash loan to attack Sashimi Swap. The bot swept away the last remaining money in Sashimi’s investment contract and slETH contract, but only about $3,500. It is reported that Sashimi Swap was attacked in December 2021 and lost $210,000, and the project was subsequently abandoned.","theft":true},{"id":"ht4cdc1edbba","date":"2023-05-31","name":"Waifu AI World","kind":"scam","fam":"social","tech":"Scam","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/ChrisONCT/status/1663261546070278144"}],"desc":"Twitter user @ChrisONCT cited on-chain data to expose a suspected scam Meme coin project Waifu AI World (WFAI). The token economics announced by the project stated that 95% of the supply was allocated to LPs. However, shortly after WFAI went online, 4 new wallets spent a total of 14.4 ETH in four transactions to purchase 647 trillion WFAI, accounting for approximately 83.2% of supply (777 trillion). At present, the project party has blacklisted the wallets that purchased 457 trillion WFAI, and now the total supply of WFAI is 320 trillion, which means that 190 trillion tokens are held by insiders, accounting for 60% of the total token supply. And DWF Labs spent about 20 ETH to purchase 624.9 billion WFAI yesterday afternoon; DEXTools trust score changed from extremely low to extremely high within a few hours.","theft":true},{"id":"ht2cf414e683","date":"2023-05-30","name":"EDE","kind":"hack","fam":"insider","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":580000.0,"lo":580000.0,"hi":580000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/resdegen/status/1663322636594675713"}],"desc":"The perpetual DEX El Dorado Exchange (EDE) is suspected to have been attacked with losses of about $580,000, and an address has been sending small amounts of money to Arbitrum's ELP-1 pool and withdrawing large amounts immediately afterwards. The attacker claimed that the protocol backdoor allowed the developer to force the liquidation of any positions and would return the funds if the developer admitted to price manipulation. 334,000 USDC were returned by the attacker on May 30. By May 31, the attackers had returned more than $400,000 in stolen funds. Dorado revealed that the attackers charged 10% of the stolen funds as a fee when returning them.","theft":true},{"id":"htd953ddab71","date":"2023-05-30","name":"BlockGPT","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":256000.0,"lo":256000.0,"hi":256000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Rug Pull of the BSC project BlockGPT occurred, involving assets of over 816 BNB (about 256,000 US dollars), and 800 BNB have been transferred to Tornado Cash so far.","theft":true,"onchain":true},{"id":"ht4dfe0a5ea7","date":"2023-05-30","name":"El Dorado Exchange","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Arbitrum"],"usd":120000.0,"lo":120000.0,"hi":120000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker exploited a closed-source Oracle contract in El Dorado Exchange to manipulate prices and liquidate positions. The attacker extracted approximately $520K but was identified as a white-hat security researcher exposing a price manipulation fraud scheme. After the team admitted code vulnerabilities, the attacker returned over $400K.","theft":true},{"id":"ht222e038c55","date":"2023-05-30","name":"TRON","kind":"hack","fam":"keys","tech":"Multisig Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://0d.dwalletlabs.com/game-of-tron-critical-0-day-in-tron-multi-signature-wallets-2c3e90668dc0"}],"desc":"DWallet Labs discovered a zero-day vulnerability in TRON multi-signature accounts that put more than $500 million in digital assets at risk. What about the threshold and number of signers defined in the account. The bug has now been disclosed and fixed, so no user assets are now at risk.","theft":true},{"id":"htdc21afa62b","date":"2023-05-29","name":"NOON (NO)","kind":"hack","fam":"other","tech":"Wrong visibility in function","chains":["Ethereum"],"usd":2000.0,"lo":2000.0,"hi":2000.0,"conf":"C","n":1,"theft":true},{"id":"ht76e03cd6fe","date":"2023-05-29","name":"FAPEN","kind":"hack","fam":"other","tech":"Wrong balance check","chains":["BNB Chain"],"usd":600.0,"lo":600.0,"hi":600.0,"conf":"C","n":1,"theft":true},{"id":"htd2c8593b85","date":"2023-05-29","name":"Aleo","kind":"hack","fam":"code","tech":"Inflation Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/fede_intern/status/1662622123397992450"}],"desc":"Fede's Intern, a contributor to the venture capital studio LambdaClass, said on Twitter that it found that Aleo, a programmable privacy network, had an inflation loophole and used the first loophole to stop block production, and contacted the Aleo team by email. Following an open discussion on the Zero Knowledge Podcast, Aleo CEO and Zero Knowledge Podcast contributor Alex Pruden stepped in and the bug is now fixed.","theft":true},{"id":"ht6e5bf997b6","date":"2023-05-29","name":"Polygon zkEVM","kind":"hack","fam":"bridge","tech":"Logic Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xiczc/status/1662090451493740545"}],"desc":"Blockchain security researcher iczc tweeted that a vulnerability was found in Polygon zkEVM and received a bug bounty from Immunefi L2. The vulnerability prevents asset migration from L1 to L2 by preventing assets bridged from L1 to Polygon zkEVM (L2) from being properly claimed in L2. iczc found in the code logic of processing claim tx pre-execution results that malicious attackers can bypass the \"isReverted\" pre-execution check on claim transactions by setting the gas fee to non-zero, allowing them to send a large number of Low-cost claims DoS attacks on sequencers and validators, increasing computational overhead. Also, transactions are not immediately removed from the pool after execution. The status is updated from Pending to Selected and continues to exist in the PostgreSQL database. Currently, there is only one trusted sequencer capable of fetching transactions from the transaction pool and executing them. Therefore, another vulnerability is to maliciously mark any deposit amount by sending a failed transaction. This will cause claim transactions that correctly use credits to be rejected because the credits are already used. This makes the L2 network unusable for new users. The Polygon zkEVM team fixed this vulnerability by removing the specific gas logic for claiming transactions, with no funds at risk.","theft":true},{"id":"htd510057891","date":"2023-05-28","name":"Jimbos Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":7500000.0,"lo":7500000.0,"hi":8000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/jimbo-rekt"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/324820?source=share"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/jimbos-protocol-exploited"}],"desc":"On May 28, 2023, Jimbos Protocol on Arbitrum (launched <20 days prior) was exploited for 4,090 ETH via flashloan-enabled oracle manipulation. Attacker took $5.9M flashloan and manipulated JIMBO price to exploit shift/conversion logic lacking slippage protection.","theft":true,"onchain":true},{"id":"ht033f023721","date":"2023-05-28","name":"BabyDogeCoin","kind":"hack","fam":"other","tech":"Lack Slippage Protection","chains":["BNB Chain"],"usd":135000.0,"lo":135000.0,"hi":135000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2d4fb3844c","date":"2023-05-27","name":"Malfunctioning bot costs Poo Finance token hunters $440,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":440000.0,"lo":440000.0,"hi":440000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/malfunctioning-bot-costs-poo-finance-token-hunters-440000"}],"theft":true,"headline":true},{"id":"ht0f8fc18144","date":"2023-05-26","name":"Patricia","kind":"hack","fam":"keys","tech":"Database Breach","target":"CEX","usd":2000000.0,"lo":2000000.0,"hi":4800000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/hackers-breach-nigerian-crypto-trading-platform-btc-and-naira-assets-compromised/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/patricia-technologies-theft"}],"desc":"Nigerian crypto exchange Patricia suffered a security breach compromising Bitcoin and Naira assets, resulting in $2M in losses. Although the breach occurred in January 2022, it was only disclosed in May 2023. Patricia committed to a 2-5 year repayment plan for affected users starting December 2024.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht903ef716c2","date":"2023-05-26","name":"Arthur Madrid","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TheSandboxGame/status/1662106263294185472"}],"desc":"The Sandbox tweeted that the Twitter account of its CEO and co-founder Arthur Madrid was hacked, and the hackers posted a scam/phishing link for a fake SAND token airdrop. The Sandbox reminds users not to click on the link, but to report the post so it can be blocked.","theft":true},{"id":"hte2d4881a6e","date":"2023-05-25","name":"Hackers steal around $170,000 after compromising Steve Aoki's Twitter account","kind":"hack","fam":"other","chains":["Ethereum"],"usd":170000.0,"lo":170000.0,"hi":170000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/steve-aoki-twitter-compromise"}],"theft":true,"headline":true},{"id":"htf1e2b54959","date":"2023-05-25","name":"GPT Token","kind":"hack","fam":"other","tech":"Fee Machenism Exploitation","usd":42000.0,"lo":42000.0,"hi":42000.0,"conf":"C","n":1,"theft":true},{"id":"ht5b1661aa31","date":"2023-05-25","name":"Multichain","kind":"hack","fam":"bridge","tech":"Unknown","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MultichainOrg/status/1661443109019062272"}],"desc":"Multichain tweeted that although most of the cross-chain routes of the Multichain protocol are operating normally, due to force majeure, some cross-chain routes cannot be used, and the time to restore services is unknown. After service is restored, pending transactions will be credited automatically. Multichain will compensate users affected during this process, and the compensation plan will be announced later. According to previous reports from multiple community users, there is an abnormal delay in the arrival of Multichain cross-chain funds. Markets show that the Multichain token MULTI has fallen 24.1% in the past 24 hours and is currently trading at $5.36.","theft":true},{"id":"hteeb35c0822","date":"2023-05-25","name":"Trezor","kind":"hack","fam":"keys","tech":"RDP downgrade attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/232085/cybersecurity-firm-claims-it-hacked-private-key-from-a-trezor-t-hardware-wallet"}],"desc":"According to The Block, cybersecurity firm Unciphered claims it was able to hack into hardware-encrypted wallets powered by Trezor T models. In a YouTube demo, Unciphered showed exploiting the wallet vulnerability to extract the mnemonic private key from the wallet, saying the attack is only feasible if the attacker has physical access to the hardware wallet. Trezor CTO Tomáš Sušánka responded: \"This appears to be a vulnerability called an RDP downgrade attack, which requires extremely sophisticated technical knowledge and advanced equipment. Even with the above conditions, Trezor can pass a powerful passphrase, making RDP downgrade attacks ineffective.” Trezor added that they have taken the important step of developing a new secure element for hardware wallets with their sister company Tropic Square to solve future problems.","theft":true},{"id":"ht9bd1ab9d89","date":"2023-05-24","name":"Fintoch","kind":"fraud","fam":"insider","tech":"Scam","usd":31600000.0,"lo":31600000.0,"hi":31600000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1661129110062788608"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/morgan-df-fintoch-likely-exit-scams-for-around-31-million"}],"desc":"The team behind Fintoch, a blockchain financial platform, is suspected of being a Ponzi scheme. It defrauded users of 31.6 million USDT on BNB Chain, and the funds were bridged to multiple addresses on Tron and Ethereum. Users reported that they could not withdraw funds. Fintoch advertises that it is a blockchain financial platform built by Morgan Stanley, and users can get 1% return on investment every day. The team page on the Fintoch website refers to \"Bobby Lambert\" as its CEO, when in fact he doesn't exist and is a paid actor. Earlier, the Singapore government and Morgan Stanley both issued warnings about the investment plan."},{"id":"htb29b47e653","date":"2023-05-24","name":"Local Traders","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":118000.0,"lo":118000.0,"hi":118000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On May 23, 2023, Local Traders protocol on BSC was exploited when an attacker called an unprotected function (0xb5863c10) to become the contract owner, then manipulated token pricing to purchase LCT tokens at artificially low prices and resell them.","theft":true},{"id":"htd1496eecc1","date":"2023-05-24","name":"Celer Network","kind":"fraud","fam":"insider","tech":"Contract Vulnerability","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/232025/celer-network-patches-code-vulnerability-discovered-by-jump-crypto"}],"desc":"Cross-chain interoperability protocol Celer Network reported Wednesday that it has patched a code vulnerability first discovered by Jump Crypto, The Block reported. In a blog post published by Celer and Jump Crypto, a vulnerability in the State Guardian Network (SGN), Celer's proof-of-stake (PoS) blockchain, was disclosed. If implemented, the vulnerability could allow a malicious validator to submit a large number of fraudulent \"votes\", resulting in a change in the state of the network. Celer emphasized that the breach did not result in any financial loss. The vulnerability was not publicly accessible and no funds were directly at risk when it was discovered. Celer said it would propose a bug bounty for Jump Crypto as a result of the discovery."},{"id":"htd329f0e4e9","date":"2023-05-23","name":"CS Token","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain","Ethereum"],"usd":714000.0,"lo":689400.0,"hi":714000.0,"conf":"A","n":3,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/brand-new-cs-token-exploited"}],"desc":"CS Token was hacked and a total of 714,000 USDT was stolen. The hacker initially transferred 1 BNB from Tornado Cash, and then transferred 383 ETH to Tornado Cash.","theft":true,"onchain":true},{"id":"ht2ed6e489ee","date":"2023-05-23","name":"LunaFi","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Polygon"],"usd":35000.0,"lo":35000.0,"hi":35000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"LunaFi's reward claiming mechanism lacked a time lock in the claimRewards() function, allowing an attacker to repeatedly claim rewards using a malicious contract. The vulnerability enabled depositing, claiming, and withdrawing within a single transaction, generating profits while depleting the reward pool.","theft":true},{"id":"ht4fed69bdb5","date":"2023-05-23","name":"Local Trade LCT","kind":"hack","fam":"code","tech":"Improper Access Control of Close-source contract","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5e42ac13a7","date":"2023-05-22","name":"LFI Token","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["Polygon"],"usd":36000.0,"lo":36000.0,"hi":36000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2899fbdf75","date":"2023-05-20","name":"Croatian cryptocurrency investment company BitLucky reportedly collapses; more than $75 million allegedly missing","kind":"collapse","fam":"insider","usd":75700000.0,"lo":75700000.0,"hi":75700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitlucky-reportedly-collapses"}],"headline":true},{"id":"htca5ad3863e","date":"2023-05-20","name":"CoinDeal","kind":"fraud","fam":"insider","tech":"Scam","usd":45000000.0,"lo":45000000.0,"hi":45000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.justice.gov/opa/pr/man-charged-alleged-participation-45m-coindeal-investment-fraud-scheme-involving-over-10000"}],"desc":"A Nevada man has been charged in connection with his alleged involvement in CoinDeal, an investment fraud scheme that defrauded more than 10,000 victims of more than $45 million, the U.S. Department of Justice announced. According to court documents, Lee allegedly conspired with Neil Chandran and others to defraud investors of companies controlled by Chandran. Operating under the name \"ViRSE,\" these companies include Free Vi Lab, Studio Vi Inc., ViDelivery Inc., ViMarket Inc., and Skalex USA Inc., among others. Presumably, these companies are developing virtual world technology, including their own cryptocurrency, for use in virtual worlds. Chandran allegedly misled investors by falsely promising extremely high returns on the premise that his company was about to be acquired by a syndicate of wealthy buyers. As further alleged, Lee was the nominal owner and director of ViMarket and was instructed by Chandran on how to transfer received investor funds into ViMarket's bank accounts."},{"id":"htd7cac5c4a7","date":"2023-05-20","name":"Tornado Cash","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DAO","chains":["Ethereum"],"usd":2173500.0,"lo":1100000.0,"hi":2173500.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/tornado-gov-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1660252800406659073"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tornado-cash-governance-attack"}],"desc":"An attacker exploited Tornado Cash governance by proposing a malicious proposal that appeared identical to a previously approved one, gaining voter trust. The malicious code granted 1.2M governance votes to the attacker, exceeding legitimate votes and gaining full governance control. The attacker drained 483,000 TORN tokens ($2.17M) from governance vaults before later proposing its reversal.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht296f00b178","date":"2023-05-20","name":"Swap-LP","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1100000.0,"lo":1100000.0,"hi":1100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Swap-LP's factory contract contained a low-level function vulnerability that an attacker exploited to manipulate liquidity pools. The attacker extracted approximately $1.1M (609 ETH) by calling restricted factory functions to drain value from the protocol's liquidity.","theft":true},{"id":"ht2548a049bb","date":"2023-05-20","name":"Aave","kind":"hack","fam":"code","tech":"Compatibility issues","chains":["Polygon"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://beincrypto.com/aave-users-unable-to-access-over-100m/"}],"desc":"About 110 million USD in WETH, USDT, WBTC, WMATIC in Aave V2 on Polygon cannot be withdrawn, nor can it be borrowed and repaid. This is because the interest rate strategy contract is only compatible with Ethereum, not Polygon. At present, Aave has submitted a patch to fix this problem, which will be deployed after voting. Funds are not at risk, but it takes at least a week for funds to be unfrozen.","theft":true},{"id":"ht306fb80484","date":"2023-05-19","name":"Phishing-as-a-service company \"Inferno Drainer\" steals assets nominally worth $5.9 million in three months","kind":"scam","fam":"social","chains":["Ethereum","BNB Chain","Polygon"],"usd":5923380.0,"lo":5923380.0,"hi":5923380.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phishing-as-a-service-company-inferno-drainer-steals-assets-nominally-worth-5-9-million-in-three-months"}],"theft":true,"headline":true},{"id":"htc13a27cce0","date":"2023-05-19","name":"Swaprum","kind":"rugpull","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":3000000.0,"lo":2962797.0,"hi":3000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/swaprum-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/hackenclub/status/1659499442041417729?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/swaprum-decentralized-exchange-rug-pulls-for-almost-3-million"}],"desc":"Swaprum founders exploited a backdoor add() function in their smart contract to steal approximately $3 million in deposited liquidity pool tokens from users. The stolen funds were laundered through Tornado Cash.","theft":true},{"id":"ht4ce0b4cbfe","date":"2023-05-19","name":"WDZD Swap","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1100000.0,"lo":1000000.0,"hi":1100000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=wdzd-swap-exploited-for-1-1-million"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wdzd-swap-exploited-for-1-1-million"}],"desc":"The attacker exploited a low-level access control flaw in the Swap-LP factory contract, transferring WDZD tokens from trading pairs to the factory address. This artificial manipulation inflated WDZD's value, allowing the attacker to trade WDZD for LP tokens at highly favorable rates and extract approximately 609 ETH (~$1M) by burning the LP tokens.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht030dfa58a5","date":"2023-05-19","name":"Stacks","kind":"hack","fam":"other","tech":"Block Reorganization","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/blockworksres/status/1659228801384194049"}],"desc":"On May 19, Blockworks Research stated on Twitter that the Bitcoin Layer 2 network Stacks has experienced several obstacles in the past few months: 1. There is a serious loophole in the STX \"stacking\" mechanism; 2. Confused review It becomes common during Stacks mining; 3. Stacks chain block reorganization is more common.","theft":true},{"id":"ht6b9e07d852","date":"2023-05-17","name":"Former Fabric CFO accused of siphoning $35 million into his crypto startup and losing it all","kind":"fraud","fam":"insider","chains":["Terra"],"usd":35000000.0,"lo":35000000.0,"hi":35000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/former-fabric-cfo-accused-of-siphoning-35-million-into-his-crypto-startup-and-losing-it-all"}],"headline":true},{"id":"hte7ea9d988a","date":"2023-05-16","name":"EOS EVM","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/EOSnFoundation/status/1658278077024161792"}],"desc":"The EOS Network Foundation tweeted that the EOS EVM has released version v0.4.2, which fixes a serious security vulnerability found in the EOS EVM. The EOS EVM contracts, EOS EVM nodes, and EOS EVM RPC components implemented by the EOS mainnet all need to be upgraded.","theft":true},{"id":"ht6620cd0165","date":"2023-05-16","name":"Mirror","kind":"hack","fam":"other","tech":"Load","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/viamirror/status/1658484282149711876"}],"desc":"The Web3 content publishing platform Mirror application is currently experiencing an outage under load.","theft":true},{"id":"ht5b461ee3e5","date":"2023-05-16","name":"OpenSea","kind":"hack","fam":"code","tech":"Royalty Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/alex_pengfei/status/1658274622457126913"}],"desc":"Alexpf.eth, co-founder and CEO of NFT exchange EZswap, tweeted: \"OpenSea is suspected of having a royalty loophole. Recently, OpenSea seems to have changed the owner's identification standard, which means that NFT projects cannot set or change royalties. This error is very serious. Seriously, it's been around for 2 days.\"","theft":true},{"id":"htc7e7384e19","date":"2023-05-15","name":"Traders lose more than $15 million to phishing website impersonating crypto exchange HitBTC","kind":"scam","fam":"social","chains":["Ethereum","Bitcoin"],"usd":15000000.0,"lo":15000000.0,"hi":15000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/traders-lose-more-than-15-million-to-phishing-website-impersonating-crypto-exchange-hitbtc"}],"theft":true,"headline":true},{"id":"htfec2ef6d5d","date":"2023-05-14","name":"land","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The DeFi protocol land was suspected of being attacked and lost about 150,000 US dollars. The reason for the attack was the lack of mint permission control.","theft":true,"onchain":true},{"id":"hte7f5298a78","date":"2023-05-13","name":"SellToken02","kind":"hack","fam":"market","tech":"Price Manipulation","usd":197000.0,"lo":197000.0,"hi":197000.0,"conf":"C","n":1,"theft":true,"review":["possible duplicate within one source"]},{"id":"ht401dfe15e8","date":"2023-05-13","name":"Bitpaidio","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht083c57ce50","date":"2023-05-13","name":"SellToken03","kind":"hack","fam":"other","tech":"Unchecked User Input","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3b77f15709","date":"2023-05-12","name":"LW Token","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":50000.0,"lo":48415.0,"hi":50000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/4jq3adah.html"}],"desc":"An attacker exploited the LW token on BSC using a flashloan-based price manipulation attack. The marketAddr account held 173,272 USDT which was used to artificially manipulate the LW price on the PancakeSwap LW-BUSD pair, enabling the attacker to extract approximately 48,415 USDT through price distortion. The LW token price collapsed 69% following the exploit.","theft":true,"onchain":true},{"id":"htb10311783f","date":"2023-05-10","name":"SNK (Snooker)","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":197000.0,"lo":190000.0,"hi":197725.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/iizfq6j2.html"}],"desc":"The SNK token on BSC suffered an exploit of its referral reward mechanism. The attacker exploited the bindParent function of the SNKMiner contract to establish relationships between attack contracts, amplifying staking rewards based on child account SNK balances. By creating multiple attack contracts and establishing referral chains, the attacker was able to claim inflated rewards totaling approximately $197,725.","theft":true},{"id":"ht9daa3e9718","date":"2023-05-10","name":"SellToken01","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":95000.0,"lo":95000.0,"hi":95000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht4989dcf975","date":"2023-05-10","name":"WEEB","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/iizfq6j2.html"}],"desc":"The WEEB project was attacked by price manipulation. The hacker used the performUpkeep function in the WEEB token to burn the balance of a large number of WEEB tokens in the pair, thereby increasing the price of WEEB and making a profit of 16 ETH.","theft":true},{"id":"htd03266f35f","date":"2023-05-09","name":"DMAN","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":89611.09,"lo":89611.09,"hi":89611.09,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Derpman ($DMAN) Rugged. The scammer initially obtained 4 ETH from Binance, added 3 ETH to liquidity, then exchanged 1,200T DMAN for 48.55 ETH ($89,611.09), and transferred these ETHs to 0x4d1f…915.","theft":true},{"id":"ht6042fc5fad","date":"2023-05-09","name":"GNS","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":62180.81,"lo":62180.81,"hi":62180.81,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"GeniusMeme ($GNS) has Rugged 33.6 ETH($62,180.81). The scammer initially received 4 ETH from Binance and added 3 ETH to liquidity.","theft":true},{"id":"ht9329c05318","date":"2023-05-09","name":"PEPG","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":55609.2,"lo":55609.2,"hi":55609.2,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Pepega ($PEPG) has Rugged 30 ETH ($55,609.2). The scammer initially received 3.58 ETH from Binance and added 2.8 ETH to liquidity.","theft":true},{"id":"ht7346951764","date":"2023-05-09","name":"FLOKI","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The ethereum-based meme cryptocurrency FLOKI has suffered a lightning loan attack with a loss of over $50,000. Stolen TX:\r\n[explorer link]","theft":true,"onchain":true},{"id":"ht100df17c64","date":"2023-05-09","name":"MChainCapital","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":18871.0,"lo":18871.0,"hi":18871.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/NumenAlert/status/1655851512445403138"}],"desc":"MChainCapital suffered a flash loan attack and lost about $18,871. TX: [explorer link]","theft":true},{"id":"ht066eac7a24","date":"2023-05-09","name":"MCC","kind":"hack","fam":"other","tech":"Reflection token","chains":["Ethereum"],"usd":10.0,"lo":10.0,"hi":10.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht74ec5bb6be","date":"2023-05-09","name":"HODL","kind":"hack","fam":"other","tech":"Reflection token","chains":["Ethereum"],"usd":2.3,"lo":2.3,"hi":2.3,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2c276b9053","date":"2023-05-08","name":"HAKUNA","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":31683.11,"lo":31683.11,"hi":31683.11,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Hakuna Matata ($HAKUNA) Rugged. The scammer initially obtained 2.76 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T HAKUNA for 17 ETH ($31,683.11), and mortgaged 13.5 ETH to Lido.","theft":true,"onchain":true},{"id":"htb1c8d734bb","date":"2023-05-08","name":"HIS","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":24568.11,"lo":24568.11,"hi":24568.11,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"FTX ($HIS) Rugged. The scammer initially obtained 2.76 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T HIS for 13 ETH ($24,568.11), and mortgaged 11.5 ETH to Lido.","theft":true,"onchain":true},{"id":"ht4001756aa2","date":"2023-05-07","name":"Art Coin","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":331000.0,"lo":331000.0,"hi":331000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://bitcoinist.com/project-losses-over-331000-setup-flaw-on-uniswap-v3/"}],"desc":"An exploiter identified and leveraged a flaw in the Art Coin presale and Uniswap V3 LP configuration on May 7. By investing just 0.1 ETH in the presale, the attacker could withdraw at a highly favorable exchange rate due to misconfigured LP parameters. The attacker extracted 181 ETH (worth $331,000) by selling their presale allocation immediately after launch, exploiting the LP setup vulnerability.","theft":true},{"id":"ht9b95b29368","date":"2023-05-06","name":"Melo","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The Melo protocol on BSC was exploited via an access control vulnerability. An attacker gained unauthorized access to critical protocol functions, draining approximately $90,000 from user accounts. The incident highlighted insufficient access control checks on sensitive contract functions.","theft":true,"onchain":true},{"id":"htd09d895f5a","date":"2023-05-06","name":"FREDDIE","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":52344.4,"lo":52344.4,"hi":52344.4,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Freddie ($FREDDIE) has Rugged. The scammer initially obtained 2.96 ETH from Orbiter Finance Bridge and added 2 ETH liquidity, then exchanged 4,999T FREDDIE for 28 ETH ($52,344.4), and mortgaged 22.5 ETH to Lido.","theft":true,"onchain":true},{"id":"ht0f5169d347","date":"2023-05-06","name":"REI Network","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/yewcrxmq.html"}],"desc":"The public chain REI Network stated in a telegram announcement that its official Twitter account was hacked, do not believe the airdrop information, and wait for further notice. After checking, the Twitter account has deleted the airdrop-related information, but released a new tweet 2 hours ago, and the relevant official personnel in the Telegram group have not yet confirmed whether the latest tweet is a phishing link.","theft":true},{"id":"ht82ae13b988","date":"2023-05-05","name":"DEUS Finance","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Arbitrum","BNB Chain","Ethereum"],"usd":6500000.0,"lo":6500000.0,"hi":7000000.0,"ret":5500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deus-dao-r3kt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/deus-finance-suffers-third-hack"}],"desc":"DEUS Finance lost $6.5M across Arbitrum, BSC, and Ethereum when an attacker exploited a parameter ordering error in the DEI stablecoin's burnFrom function, reversing approval relationships in the allowances mapping.","theft":true},{"id":"ht5f2ca727f5","date":"2023-05-05","name":"DEI","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Arbitrum"],"usd":6300000.0,"lo":6300000.0,"hi":6300000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DeusDao/status/1654614967084101633"}],"desc":"The stablecoin DEI launched by the DeFi protocol DEUS has been hacked, and the loss has exceeded $6.3 million. Over $5 million was lost on Arbitrum and $1.3 million on the BSC chain. This appears to be a public destroy bug. On May 7, one of the DEI hacker addresses (starting with 0xdf610228) returned about 1.07 million DAIs. on May 8, DEUS tweeted to confirm that the DEI attackers had returned 2,023 ETH.","theft":true,"onchain":true},{"id":"ht0a03e7b6e4","date":"2023-05-04","name":"WSB Coin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":635000.0,"lo":635000.0,"hi":635000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1653937194388664322"}],"desc":"A Rug Pull on the meme coin project WSB Coin, again involving an address on-chain marked “ZJZ.eth,” dumped most of the WSB team’s supply for $635,000 (334 ETH).","theft":true},{"id":"ht3cc8a406df","date":"2023-05-04","name":"YODA","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"YODA coin project happened Rug Pull, YODA token price fell 100%, @yodacoineth_ has deleted his social account/group. Scammers have transferred 68 ETH (~$130,000) to FixedFloat.","theft":true,"onchain":true},{"id":"htb6325d20d7","date":"2023-05-03","name":"XIRTAM","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum","Ethereum"],"usd":3200000.0,"lo":3200000.0,"hi":3200000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://tokeninsight.com/zh/news/an-unusual-rug-pull-xirtam-transfers-the-rugged-1909-eth-to-binance-and-soon-gets-frozen"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/xirtam-rug-pull"}],"desc":"XIRTAM, a project built on the Arbitrum ecology, is a reputation building platform that does not require KYC. It advocates building digital reputation step by step through the XIRTAM system in an anonymous and decentralized manner. At the same time, users can get rewards for participating in activities on XIRTAM. The project party is on the 3rd Rug Pull. However, unlike the usual practice of the Rug Pull project, the runaway XIRTAM project party did not transfer the raised 1909 ETH to the currency mixing service to hide the identity and the direction of the funds, but deposited all the funds in Binance. In this regard, Binance stated that the funds involved in the XIRTAM project have been frozen and will cooperate with law enforcement agencies to investigate.","theft":true},{"id":"ht7f1e50cee5","date":"2023-05-03","name":"WallStreetBets coin tanks 90% after insider dumps holding","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":635000.0,"lo":635000.0,"hi":635000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wallstreetbets-coin-tanks-after-insider-dumps-holding"}],"theft":true,"headline":true},{"id":"hta22e3d3a5f","date":"2023-05-03","name":"Daniel Alegre","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/yugalabs/status/1653524254598545411"}],"desc":"Yuga Labs tweeted that the Twitter account of the company's new CEO, Daniel Alegre, was hacked and is now under hacker control. Yuga Labs reminds users not to click on any minting links, nor to interact with any twitter accounts named Daniel Alegre until the official update notice is released, the Yuga Labs team is working with twitter to regain control of the account .","theft":true},{"id":"ht3bcdf00e4d","date":"2023-05-02","name":"Neverfall protocol","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":75000.0,"lo":75000.0,"hi":75000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/hexagate_/status/1653663881191993344"}],"desc":"Neverfall protocol Hacked, $75,000 Lost. The attackers have deposited funds into TornadoCash.","theft":true,"onchain":true},{"id":"ht1ebd493998","date":"2023-05-01","name":"pcash","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The pcash DeFi protocol on EOS was attacked on May 1, resulting in the draining of the main swap contract's liquidity. The attacker stole approximately 2 million EOS tokens and attempted to evade governance by moving funds to EOS EVM accounts. The Pcash team covered user losses and worked with the EOS ecosystem to recover stolen assets, with significant funds recovered through EOS EVM administrative actions.","theft":true},{"id":"hta62163692f","date":"2023-05-01","name":"Level Perps","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1050000.0,"lo":1000000.0,"hi":1100000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/level-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/level__finance/status/1653140756540825638?s=46&t=DLwbX9Nw4QECiyZQ0av-fg"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/level-finance-exploited-for-1-1-million"}],"desc":"Level Finance on BSC lost $1.1M in May 2023 when attackers exploited missing epoch reuse prevention in the referral claims contract. Flashloans inflated reward tiers, allowing multiple claims per epoch via the unprotected claimMultiple() function.","theft":true,"onchain":true},{"id":"ht3b77e7f7ee","date":"2023-04-30","name":"Individuals lose millions in \"permit phishing\" scams","kind":"scam","fam":"social","chains":["Ethereum"],"usd":7769000.0,"lo":7769000.0,"hi":7769000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/individuals-lose-millions-in-permit-phishing-scams"}],"theft":true,"headline":true},{"id":"ht100e23d353","date":"2023-04-28","name":"0vix","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Polygon"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2023/04/28/defi-protocol-0vix-loses-nearly-2m-in-flash-loan-exploit/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0vix-protocol-exploited-for-2-million"}],"desc":"On April 28, 2023, 0VIX on Polygon was exploited for $2M via flashloan-enabled oracle manipulation. Attacker obtained $6.12M flashloan, manipulated vGSHT/Curve pricing to inflate collateral value, triggered liquidation cascade ($4.33M net loss), and bridged 1,069 ETH to Tornado Cash.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htc08090173a","date":"2023-04-27","name":"Hacker steals Bitcoins from Russia, destroys them or donates them to Ukraine","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-bitcoins-from-russia-destroys-them-or-donates-them-to-ukraine"}],"theft":true,"headline":true},{"id":"ht4fff021ccc","date":"2023-04-27","name":"Silo finance","kind":"hack","fam":"code","tech":"Business Logic Flaw","conf":"C","n":1,"theft":true},{"id":"ht41a47362b3","date":"2023-04-26","name":"AT&T customers suffer crypto wallet compromises reportedly totaling $15–$20 million","kind":"hack","fam":"other","usd":15000000.0,"lo":15000000.0,"hi":15000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/att-customers-suffer-crypto-wallet-compromises"}],"theft":true,"headline":true},{"id":"htceac2c4563","date":"2023-04-25","name":"CoinLoan suspends withdrawals","kind":"collapse","fam":"insider","usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coinloan-suspends-withdrawals"}],"headline":true},{"id":"ht61d1fd6e52","date":"2023-04-25","name":"MERLIN DEX","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["zkSync Era","Ethereum"],"usd":1820000.0,"lo":1820000.0,"hi":1820000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/merlin-dex-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/0xBobie/status/1651051380155744256"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rogue-developers-make-off-with-1-82-million-from-merlin"}],"desc":"On April 25, 2023, zkSync DEX Merlin was exploited for $1.82 million. The attacker drained pools through the feeTo address in MerlinFactory which had unlimited asset transfer permissions and lacked multi-sig governance.","theft":true},{"id":"ht77e8391caf","date":"2023-04-25","name":"Ordinals Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum","Bitcoin"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1650871282353963014"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ordinals-finance-rug-pulls"}],"desc":"Ordinals Finance has been identified as an exit scam project that caused $1 million in losses. The deployer withdraws OFI tokens from the OEBStaking contract, exchanges them for ETH and transfers them to the EOA address (0x34e...25cCF), which in turn transfers 550 ETH (approximately $1 million) to Tornado Cash. All social media accounts and websites of the project have been deleted.","theft":true},{"id":"ht86c88410f7","date":"2023-04-24","name":"KuCoin","kind":"scam","fam":"social","tech":"Social Account Takeover","target":"CEX","usd":22628.0,"lo":22628.0,"hi":22628.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"KuCoin's official X (Twitter) account was hijacked for approximately 45 minutes on April 24. Scammers used the compromised account to promote a fraudulent giveaway, tricking users into sending BTC and ETH to a fake address. Users lost approximately $22,628 before KuCoin regained control and announced full reimbursement for verified losses.","theft":true},{"id":"ht35f6b27c18","date":"2023-04-24","name":"Kucoin","kind":"hack","fam":"keys","tech":"Account Compromise","target":"CEX","usd":22628.0,"lo":22628.0,"hi":22628.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/2yw1l2q1.html"}],"desc":"The crypto exchange Kucoin stated that its official Twitter account was stolen for about 45 minutes from 00:00 on April 24 (UTC+2) on the 24th, and the attacker posted false activities, causing multiple users to lose assets. As of 02:00 (UTC+2) on April 24, 22 transactions have been identified, including ETH/BTC related to fake activity, with a total value of 22,628 USDT. Kucoin will fully compensate all verified asset losses caused by social media leaks and fake activities.","theft":true},{"id":"ht64c54167e2","date":"2023-04-24","name":"UniSat Marketplace","kind":"hack","fam":"code","tech":"Double Spend Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/unisat_wallet/status/1650349654800994306"}],"desc":"UniSat Wallet tweeted: “Due to a vulnerability in our code base, the UniSat Marketplace that just launched has suffered a lot of double-spend attacks. In the test last week, we simulated different double-spend attack methods and improved the code. and enhancements. Unfortunately, certain issues were still exposed in the initial public release. Currently, we have preliminary findings, and out of a total of 383 transactions, 70 transactions have been identified as affected. We will report on In the next few days, we will further investigate and compensate the losses of users related to this incident.” It is reported that UniSat Marketplace is an inscription market based on PSBT and supporting BRC-20 assets on the Bitcoin chain.","theft":true},{"id":"ht6e5a7a8dd0","date":"2023-04-24","name":"Axioma","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1fc66e9a63","date":"2023-04-23","name":"€1.5 million stolen in celeb-backed French NFT rug pull that promised to make a movie called Plush","kind":"rugpull","fam":"insider","usd":1660000.0,"lo":1660000.0,"hi":1660000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/1-5-million-stolen-in-celeb-backed-french-nft-rug-pull-that-promised-to-make-a-movie-called-plush"}],"theft":true,"headline":true},{"id":"ht8bda0d8556","date":"2023-04-23","name":"FilDA","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Elastos","REI Network","HECO"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://fildafinance.medium.com/filda-exploit-statement-49ec69e34c53"}],"desc":"FilDA's lending protocol was exploited on the Elastos Smart Chain (ESC) and REI Network on April 23. Attackers exploited abandoned zero-balance asset pools and manipulated deposit/borrow operations to drain approximately $700K. The exploit leveraged the bridging mechanism and targeted deprecated markets that only existed on ESC and REI, which were subsequently halted pending security review.","theft":true},{"id":"ht29b8e5f5df","date":"2023-04-21","name":"Kyiv Post alleges misappropriation of funds by Ukraine DAO","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":483602.0,"lo":483602.0,"hi":483602.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kyiv-post-alleges-misappropriation-of-funds-by-ukraine-dao"}],"headline":true},{"id":"ht0e4af2e8b8","date":"2023-04-20","name":"MEV Bot","kind":"hack","fam":"other","tech":"Sandwich Attack","usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/subway-themed-trading-bot-makes-millions-using-sandwich-attacks"}],"desc":"Sealaunch, an NFT data and research platform, has monitored that the MEV Bot named jaredfromsubway.eth recently carried out \"sandwich attacks\" on buyers and sellers of Meme coins such as WOJAK and PEPE, earning more than $1.4 million in profits. Additionally, Sealaunch stated that MEV Bots spent 7% of Ethereum’s gas fees during the 24-hour period between April 18 and 19. A sandwich attack occurs when the attacker \"sandwiches\" the victim's transaction between two of his own to profit from the user by manipulating prices.","theft":true},{"id":"ht1f7e0fba0f","date":"2023-04-20","name":"Tales of Elleria","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Gaming","chains":["Arbitrum"],"usd":280000.0,"lo":280000.0,"hi":280000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/crwy__/status/1648776712157794312"}],"desc":"Tales of Elleria's bridge contract on Arbitrum was exploited on April 20. An attacker forged bridge signatures and minted 5 billion ELM tokens, then drained the associated liquidity pool. Approximately 140 ETH (~$280K) was extracted from the LP before the attack was detected. The project froze operations and announced plans to compensate affected users through an airdrop mechanism.","theft":true},{"id":"ht84cf7cb52b","date":"2023-04-19","name":"zkLink","kind":"hack","fam":"bridge","tech":"Account Compromise","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zkLinkorg/status/1648557699477434369"}],"desc":"The Discord server of the cross-chain trading platform zkLink has been hacked, and some hackers posted phishing links. Do not click on any links until the team confirms that they have regained control of the server.","theft":true},{"id":"ht7d42a4b170","date":"2023-04-19","name":"OLIFE","kind":"hack","fam":"other","tech":"Reflection token","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht06d9eddc53","date":"2023-04-18","name":"Crypto researcher identifies massive wallet draining operation","kind":"hack","fam":"other","usd":9877350.0,"lo":9877350.0,"hi":9877350.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-researcher-identifies-massive-wallet-draining-operation"}],"theft":true,"headline":true},{"id":"ht55787f1252","date":"2023-04-18","name":"Arbtomb","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The Arbitrum ecological Arbtomb project is suspected of Rug Pull. The scammer has bridged 54 ETH (approximately $110,000) to Ethereum, then transferred 52 ETH to Tornado Cash, and transferred 2.4 ETH to Binance.","theft":true,"onchain":true},{"id":"ht95e6528dda","date":"2023-04-17","name":"KyberSwap","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/KyberNetwork/status/1647920799557505028"}],"desc":"KyberSwap, a DEX aggregator and liquidity platform, tweeted that they discovered a potential loophole in KyberSwap Elastic, and hoped that liquidity providers could extract liquidity as soon as possible. No user assets have been lost so far.","theft":true},{"id":"ht31a90ba9fd","date":"2023-04-16","name":"Swapos V2","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":468000.0,"lo":468000.0,"hi":468000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Swapos V2 was exploited through a broken k-value invariant in the swap pool, allowing attackers to drain approximately $468K from the protocol by manipulating the automated market maker's core pricing mechanism.","theft":true},{"id":"ht181a4bb7d0","date":"2023-04-15","name":"Hundred Finance","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":7200000.0,"lo":7000000.0,"hi":7400000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hundred-rekt2"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1647307128267476992"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hundred-finance-exploited-for-7-4-million"}],"desc":"On April 15, 2023, Hundred Finance was drained of $7.4M on Optimism via a flashloan-funded donation to an empty WBTC pool, exploiting rounding errors in exchange rate calculation.","theft":true,"onchain":true},{"id":"ht1965b96da6","date":"2023-04-14","name":"Bitrue","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":23000000.0,"lo":23000000.0,"hi":23000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BitrueOfficial/status/1646811220543168512"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitrue-crypto-exchange-hacked-for-23-million"}],"desc":"On April 14, 2023 at 07:18 UTC, Bitrue's hot wallet was compromised; attackers withdrew ~$23M in ETH, QNT, GALA, SHIB, HOT, MATIC. Compromised wallet represented <5% of total exchange funds.","theft":true},{"id":"htcfb3d79489","date":"2023-04-13","name":"Yearn Finance","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":11569500.0,"lo":10000000.0,"hi":11600000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/yearn2-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/yearnfi/status/1646436798086672385"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yearn-finance-hack-2023"}],"desc":"On April 13, 2023, Yearn Finance's yUSDT vault was exploited through a misconfigured oracle reference pointing to Fulcrum's USDC contract instead of USDT. Attacker exploited the incorrect contract pointer to manipulate share prices, minting 1.2 quadrillion yUSDT by depositing only 10,000 USDT, then selling for $11.54 million.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htce5e9ceda2","date":"2023-04-13","name":"NFT collector Franklin claims to have been scammed for 2,000 ETH ($4.2 million)","kind":"scam","fam":"social","chains":["Ethereum"],"usd":4232000.0,"lo":4232000.0,"hi":4232000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/franklin-claims-to-have-been-scammed-for-2000-eth"}],"theft":true,"headline":true},{"id":"ht67aaf3c3a0","date":"2023-04-13","name":"SyncDex","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":370000.0,"lo":370000.0,"hi":370000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/319781?source=share"}],"desc":"Zksync era mainnet SyncDex project has exited with a rugpull, resulting in over $370,000 USD in losses.","theft":true},{"id":"ht9a333f5ee1","date":"2023-04-12","name":"Nicole Behnam pumps and dumps: \"There were mistakes made in a wallet that I controlled\"","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":38000.0,"lo":38000.0,"hi":38000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nicole-behnam-pumps-and-dumps"}],"headline":true},{"id":"ht470989fb8a","date":"2023-04-11","name":"MetaPoint","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["BNB Chain"],"usd":820000.0,"lo":820000.0,"hi":920000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1645976721378934785"}],"desc":"MetaPoint was exploited through a public approval function that allowed attackers to transfer all user assets. The attacker created bulk contracts to invoke the unrestricted approve function and drain maximum token amounts from user deposits.","theft":true,"onchain":true},{"id":"hted5b5d361d","date":"2023-04-11","name":"Paribus","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Arbitrum"],"usd":100000.0,"lo":67800.0,"hi":100000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1645742296904929280"}],"desc":"Paribus was exploited through a reentrancy vulnerability in a Compound V2 fork, where the transfer occurred before storage updates. An attacker used flash loans and the reentrant redeem function to borrow against collateral twice, draining USDT, WBTC, and ETH.","theft":true,"onchain":true},{"id":"ht7542fd2e1c","date":"2023-04-10","name":"Terraport","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Terra"],"usd":4000000.0,"lo":2000000.0,"hi":4000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/_Terraport_/status/1645330062378508289"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/terraport-finance-hacked-for-2-million-less-than-two-weeks-after-launch"}],"desc":"Terraport, a Terra Classic DeFi platform, was drained of liquidity barely 10 days after launch through an access control vulnerability. An attacker with excessive permissions manipulated the DND token price and systematically drained liquidity pools.","theft":true,"review":["sources disagree on the loss"]},{"id":"htedc5170608","date":"2023-04-09","name":"GDAC","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","usd":13000000.0,"lo":13000000.0,"hi":13900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://support.gdac.com/hc/ko/articles/17389345782041--%EA%B8%B4%EA%B8%89%EA%B3%B5%EC%A7%80-%EC%9E%85%EC%B6%9C%EA%B8%88-%EC%84%9C%EB%B9%84%EC%8A%A4-%"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gdac-exchange-hacked-for-assets-notionally-worth-more-than-14-million"}],"desc":"GDAC, a South Korean crypto exchange, was hacked on April 9, 2023 (detected at 07:00 KST), with $13.9M stolen. Attacker gained access to the hot wallet and transferred 61 BTC, 350.5 ETH, 10M WEMIX, and $220K USDT. Stolen ETH was laundered through Tornado Cash.","theft":true},{"id":"ht1564f8e897","date":"2023-04-09","name":"SushiSwap","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum","Arbitrum","Optimism","BNB Chain","Polygon","Avalanche"],"usd":3300000.0,"lo":2784000.0,"hi":3340000.0,"ret":3300000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sushi-yoink-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1644936375924584449"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0xsifu-loses-more-than-2-7-million-to-sushiswap-hack"}],"desc":"SushiSwap's RouteProcessor2 contract was exploited due to missing validation of route parameters across Ethereum, BSC, Arbitrum, and Optimism. Attacker created malicious routes directing users to attacker-controlled pools, stealing ~$3.3M.","theft":true},{"id":"ht98e2d51471","date":"2023-04-09","name":"CoreHunter","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["zkSync Era"],"usd":510000.0,"lo":510000.0,"hi":510000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/samurai_lit/status/1646140606333300736"}],"desc":"On April 9th, a rug pull occurred on the ZkSync ecological project CoreHunter, and the scammers made a profit of about 510,000 US dollars.","theft":true},{"id":"ht7aaf053dd7","date":"2023-04-09","name":"Trader loses 14,377 $APE (~$61,000) when they sell their Bored Ape","kind":"other","fam":"other","chains":["Ethereum"],"usd":61000.0,"lo":61000.0,"hi":61000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trader-loses-14377-ape-61000-when-they-sell-their-bored-ape"}],"headline":true},{"id":"ht9813ebbd59","date":"2023-04-07","name":"Bitcoin mining firm sues business partner after they allegedly lose $500,000 in Bitcoin to fraudster","kind":"other","fam":"other","chains":["Bitcoin"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoin-mining-firm-sues-business-partner-after-they-allegedly-lose-500000"}],"headline":true},{"id":"ht70fd8234f8","date":"2023-04-07","name":"Someone steals the Bored Ape belonging to former NFL star Dez Bryant","kind":"hack","fam":"other","chains":["Ethereum"],"usd":138800.0,"lo":138800.0,"hi":138800.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/someone-steals-the-bored-ape-belonging-to-former-football-star-dez-bryant"}],"theft":true,"headline":true},{"id":"htc82789db7d","date":"2023-04-05","name":"Someone accidentally spends 100 ETH (~$190,000) on a free NFT","kind":"other","fam":"other","chains":["Ethereum"],"usd":190000.0,"lo":190000.0,"hi":190000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/someone-accidentally-spends-100-eth-190000-on-a-free-nft"}],"headline":true},{"id":"ht3503871c6c","date":"2023-04-04","name":"Sentiment","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":1000000.0,"lo":966000.0,"hi":1000000.0,"ret":905000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/sentimentxyz/status/1643485652573405185"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sentiment-protocol-hacked"}],"desc":"On April 4, 2023, Sentiment on Arbitrum lost ~$1M due to reentrancy in integrated Balancer; attacker used flashloan price manipulation to drain funds. Sentiment recovered 90% ($900K+) within days through negotiation.","theft":true,"onchain":true},{"id":"ht58daca252e","date":"2023-04-03","name":"MEV Bots","kind":"hack","fam":"bridge","tech":"Sandwich Attack","chains":["Ethereum"],"usd":25000000.0,"lo":25000000.0,"hi":25389731.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/yov8heci.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/over-25-million-taken-from-an-mev-bot-by-malicious-validator"}],"desc":"On April 3, MEV bots suffered a malicious sandwich attack that cost them around $25 million. Data on the chain shows that the malicious verifier who attacked the MEV bots today has been punished by Slash and kicked out of the verifier queue. According to SlowMist analysis, the reason why the MEV bots was attacked was that even if the beacon block was incorrect, the relay still returned the payload to the proposer, which resulted in the proposer being able to access the content of the block before another block was finalized. The attacker takes advantage of this problem to maliciously construct an invalid block, so that the block cannot be verified, and the relay cannot broadcast (the status code is 202) to obtain the transaction content in advance. mev-boost-relay has urgently released a new version to alleviate this problem, and it is recommended that relay operators upgrade the relay in time.","theft":true},{"id":"htaf2aca121d","date":"2023-04-03","name":"MEV-Boost Relay","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"Other","chains":["Ethereum"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A malicious Ethereum validator exploited a flaw in the mev-boost-relay implementation by crafting an invalid block header with zero parent and state roots, bypassing validation and gaining visibility of block contents. The attacker front-ran and replaced MEV bot transactions to drain approximately $20M over 24 transactions.","theft":true},{"id":"htf294c5a5f6","date":"2023-04-02","name":"Degen Zoo","kind":"hack","fam":"market","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/920fl63f.html"}],"desc":"According to a Telegram announcement, the DAO Maker project Degen Zoo is suspected to have been hacked on Binance Oracle. At present, the project team has suspended the game and launched an investigation. No loopholes have been found yet, and better animals cannot be hatched through smart contract errors.","theft":true},{"id":"ht096e47dd52","date":"2023-04-02","name":"zkSync","kind":"hack","fam":"keys","tech":"Downtime","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zksync/status/1642277369632227334"}],"desc":"According to official news, the zkSync team announced the cause of the downtime on Twitter. Block generation stopped due to a block queue database failure. Despite this, the server API was not affected. Transactions continue to be added to the mempool, and queries are served normally. Although all components had comprehensive monitoring, logging, and alerting, no alerts were triggered because the API was functioning properly.","theft":true},{"id":"hte5b6c2e3b9","date":"2023-04-01","name":"Allbridge Core","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":571500.0,"lo":550000.0,"hi":573757.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Allbridge_io/status/1642507995610329088"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/allbridge-cross-chain-bridge-exploited-for-around-574000"}],"desc":"In April 2023, Allbridge Core on BNB Chain was drained when an attacker acting as both liquidity provider and swapper manipulated pool prices to drain BUSD and USDT.","theft":true,"onchain":true},{"id":"ht49d9eb61a3","date":"2023-03-31","name":"Arbitrum airdrop plagued by downtime, bugs, and scams","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1320000.0,"lo":1320000.0,"hi":1320000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/arbitrum-airdrop-plagued-by-downtime-bugs-and-scams"}],"theft":true,"headline":true},{"id":"ht73a706316d","date":"2023-03-30","name":"Rocket Pool","kind":"hack","fam":"social","tech":"Phishing","target":"Token","chains":["Ethereum"],"usd":3800000.0,"lo":3800000.0,"hi":3830000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/lookonchain/status/1641397055171211265"}],"desc":"Patricio Worthalter, a major RocketPool token holder and POAP founder, was phished and had 85,900 RPL tokens worth $3.8M stolen. The attacker subsequently exchanged the tokens for ETH and scattered the proceeds across multiple addresses.","theft":true},{"id":"htd482e68b40","date":"2023-03-28","name":"Safemoon","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":8900000.0,"lo":8900000.0,"hi":8900000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/safemoon-rekt"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/8-9-million-stolen-from-safemoon"}],"desc":"On March 28, 2023, SafeMoon suffered an $8.9 million exploit via a publicly-accessible burn function left unprotected after an upgrade. The attacker destroyed SFM tokens to inflate their value, deposited, and withdrew disproportionate BNB. The attacker returned 80% of the funds ($7.2M) on April 20, keeping 20% as a claimed bug bounty.","theft":true},{"id":"htf199da09b4","date":"2023-03-27","name":"Kokomo Finance","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/kokomo-finance-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/ym50p7sf.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kokomo-finance-rug-pull"}],"desc":"On March 26-27, 2023, Kokomo Finance developers initiated an exit scam, stealing ~$4M in user funds. The team manipulated the cBTC reward token contract, halted borrowing, converted the token implementation into a malicious contract, and removed all social media and website within days of launch.","theft":true},{"id":"ht3434714d3d","date":"2023-03-27","name":"Thena","kind":"hack","fam":"other","tech":"Yield Protocol Flaw","chains":["BNB Chain"],"usd":10000.0,"lo":10000.0,"hi":10000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta71616decc","date":"2023-03-26","name":"EC token","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":43800.0,"lo":43800.0,"hi":43800.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/unsnarl_secure/status/1639510645384290305"}],"desc":"EC token deployer addresses withdrew approximately $43,800 from the liquidity pool.","theft":true},{"id":"ht33f4cd04a8","date":"2023-03-25","name":"Swerve","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.chaincatcher.com/article/2089961"}],"desc":"Swerve Finance, a defunct Curve clone, was targeted in a governance attack where the attacker created proposals to transfer $1.3M in stablecoins to their contract. Though the attack ultimately failed due to insufficient voting power, it represented a live governance exploit attempt.","theft":true},{"id":"ht7e153189cd","date":"2023-03-24","name":"DBW","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":24000.0,"lo":24000.0,"hi":24000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbcd3afd0bb","date":"2023-03-24","name":"FASTSWAP","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/h5Detail/20030"}],"desc":"The FASTSWAP (FAST) project on BNB Chain was attacked by a flash loan and lost 26.77 BNB","theft":true},{"id":"ht24071e3fca","date":"2023-03-22","name":"BIGFI","kind":"hack","fam":"other","tech":"Reflection token","chains":["BNB Chain"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht9b05c3fe9c","date":"2023-03-22","name":"Archive of PEACEMINUSONE","kind":"hack","fam":"code","tech":"CVE-2022-38217 general vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Supremacy_CA/status/1638449628747284482"}],"desc":"According to news, the NFT series \"Archive of PEACEMINUSONE\" released by Korean singer Quan Zhilong has the previously disclosed CVE-2022-38217 general vulnerability, and the possibility of being used by hackers cannot be ruled out.","theft":true},{"id":"ht31a01a9e15","date":"2023-03-22","name":"Circle's Chief Strategy Officer","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/42k1frb3.html"}],"desc":"Circle tweeted that the Circle Chief Strategy Officer's Twitter account (@ddisparte) has been taken over by a scammer. Any link to an offer is a scam. We are investigating this situation and taking appropriate action. Earlier, Circle’s Chief Strategy Officer tweeted that a loyalty rewards distribution program would be launched for USDC holders. However, the tweet has now been deleted.","theft":true},{"id":"ht39ca1a917b","date":"2023-03-21","name":"Indexed Finance","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":9925.0,"lo":9925.0,"hi":9925.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/AnciliaInc/status/1637925297327865856"}],"desc":"The ORCL5 index token was exploited through a flaw in the tokenAmountOut output calculation, allowing a flashloan-enabled attack to drain approximately $9,925 from the protocol within 11 minutes of vulnerability discovery.","theft":true},{"id":"ht6e2f4f4af8","date":"2023-03-19","name":"Harvest Keeper","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":933000.0,"lo":933000.0,"hi":933000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/7urkn6lh.html"}],"desc":"Harvest Keeper, marketed as an AI-based DeFi platform, executed a coordinated rug pull barely one month after launch. The team drained the contract through a privileged getAmount function and conducted ice phishing attacks to steal additional user funds.","theft":true},{"id":"ht3467e53077","date":"2023-03-18","name":"Zircon Gamma","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain","Moonriver"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On March 18, 2023, Zircon was exploited on Moonriver and BSC via a donation attack on the burnOneSide function in modified Uniswap V2. Attacker donated to inflate pool reserves, then withdrew shares at favorable rates due to incorrect share calculation, draining ~$350K.","theft":true},{"id":"ht9365137235","date":"2023-03-17","name":"ParaSpace Lending V1","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"NFTfi","chains":["Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"ret":5000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ParaSpace_NFT/status/1636617953599946752"}],"desc":"On March 17, 2023 ParaSpace (NFT lending protocol on Ethereum) suffered a price manipulation exploit in the AutoCompoundApe contract allowing attackers to borrow assets with less NFT collateral than required. Security firm BlockSec intercepted the attack and recovered approximately 2,900 ETH ($5M) of BAYC NFTs before the full attack executed.","theft":true,"onchain":true},{"id":"htc1884e791d","date":"2023-03-17","name":"General Bytes","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"Other","chains":["Ethereum","Bitcoin"],"usd":1628000.0,"lo":1500000.0,"hi":1800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/general-bytes-crypto-atms-exploited-for-over-1-6-million"}],"desc":"General Bytes' Bitcoin ATM cloud service was compromised through a zero-day vulnerability in the master service interface. Attackers uploaded malicious Java applications to decrypt API keys, accessed hot wallet funds, and stole user credentials by scanning private keys entered at ATMs.","theft":true},{"id":"hte8ce89bf8a","date":"2023-03-17","name":"iEarn Bot","kind":"scam","fam":"social","tech":"Scam","usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.bbc.com/news/technology-64939146"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thousands-lose-money-to-iearn-bot-crypto-scam-"}],"desc":"According to the BBC, a scam called iEarn Bot has affected thousands of victims in several countries. In the scam, victims were persuaded to sign up for an \"AI intelligent quantitative trading robot\" called iEarn Bot, which appeared to successfully trade cryptocurrencies on their behalf. However, after some time, the victims realize that they are unable to withdraw their due earnings nor withdraw the funds they invested. iEarn Bot claims to be an American company, despite its website being riddled with misinformation. The man identified as the company's founder told the BBC he had nothing to do with the scheme, with companies and institutions listed as \"strategic partners\" saying they had no such partnerships. The BBC uncovered a cryptocurrency wallet that received payments from around 13,000 other people totaling close to $1.3 million.","theft":true},{"id":"ht3907316b0c","date":"2023-03-15","name":"Poolz Network","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":390000.0,"lo":390000.0,"hi":500000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Poolz__/status/1635899850918178817"}],"desc":"Poolz Finance was exploited through an integer overflow vulnerability in the unaudited LockedControl contract. The attacker manipulated the CreateMassPools function and GetArraySum method to trick the vesting contract into believing large amounts were deposited while actually depositing minimal tokens.","theft":true},{"id":"ht9b2374819d","date":"2023-03-14","name":"Idle Finance","kind":"hack","fam":"code","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":10990000.0,"lo":10990000.0,"hi":10990000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/idlefinance/status/1635356439849099264"}],"desc":"The DeFi protocol Idle Finance tweeted that after investigation, the estimated exposure of the Euler Finance vulnerability to the protocol Yield Tranches was $5.6628 million, and the estimated exposure of Best Yield vaults was about $5.3271 million, for a total of about $10.99 million.","theft":true},{"id":"ht88580ad013","date":"2023-03-14","name":"Sherlock","kind":"hack","fam":"code","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/sherlockdefi/status/1635366485123268610"}],"desc":"Sherlock is a DeFi security provider that provides smart contract auditing and insurance services. When Euler first launched, it entered into a $10 million partnership with Sherlock, who was responsible for auditing Euler's smart contracts and providing insurance for Euler. After Euler was attacked, Sherlock has passed a vote to pay Euler $4.5 million.","theft":true},{"id":"hta94484f3bc","date":"2023-03-14","name":"Yield Protocol","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/yield/status/1635339497067130881"}],"desc":"Yield Protocol, a fixed-rate lending agreement, posted an update on Twitter saying: \"All collateral deposited by borrowers on Yield Protocol appears to be safe. Collateral is not deposited into Euler, but is kept in Yield Protocol. Euler hack Affected our mainnet liquidity pool. The Yield liquidity pool holds two assets: Euler eTokens and Yield fyTokens. We do not yet have exact figures for the value of eTokens held prior to the attack, but believe the total value is less than $1.5 million. \" On April 25, Yield Protocol tweeted that \"we have successfully claimed the recovered funds from Euler. The funds are being held in the timelock. We are now taking the steps to restart Yield Protocol and to enable withdraws. We expect this complicated process to take several weeks to complete.\"","theft":true},{"id":"htaeec47b663","date":"2023-03-14","name":"Yearn Finance","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":1380000.0,"lo":1380000.0,"hi":1380000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/iearnfinance/status/1635312188712792065"}],"desc":"Yearn Finance tweeted: “While there is no direct exposure to Euler, some vaults are indirectly exposed to the hack. Vaults using the Idle and Angle strategies have a combined exposure of $1.38 million on yvUSDT and yvUSDC. The developers are currently actively working on the affected protocol, any remaining bad debt will be borne by the Yearn Treasury, and all vaults will remain open and fully operational for users as usual.\" On May 3, Yearn Finance tweeted that all funds impacted by the march Euler hack have now been recovered. The affected vaults were yvUSDC & yvUSDT, with these strategies having indirect exposure: Idle Finance v4 [Best yield] and Angle Standard LP.","theft":true},{"id":"ht85df40f064","date":"2023-03-14","name":"Phishers take advantage of fears surrounding the USDC de-peg","kind":"scam","fam":"social","usd":130500.0,"lo":130500.0,"hi":130500.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phishers-take-advantage-of-fears-surrounding-the-usdc-de-peg"}],"theft":true,"headline":true},{"id":"hta3f3cb2221","date":"2023-03-14","name":"Harvest","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/harvest_finance/status/1635326911428833280"}],"desc":"Harvest said that USDC, USDT, and WETH Vault were affected because of the use of Idle. Currently Harvest has not explained how to deal with it, and reminds users not to interact with these vaults until the problem is resolved.","theft":true},{"id":"htac35bcfa5e","date":"2023-03-14","name":"Sense Finance","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/v0dusvai.html"}],"desc":"Sense Finance is a fixed-rate lending protocol in which fixed-income assets such as Idle can be traded, which was indirectly affected by the Euler attack.","theft":true},{"id":"ht25a0842d84","date":"2023-03-13","name":"Euler V1","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":197000000.0,"lo":197000000.0,"hi":200000000.0,"ret":197000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/euler-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1635288963580825606"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/euler-finance-exploited-for-almost-200-million"}],"desc":"On March 13, 2023, Euler Finance was exploited via flash loan attack on the donateToReserves function. The attacker stole ~$197M in DAI, USDC, stETH, and WBTC via account balance inflation without actual collateral. The hacker returned funds within weeks; recovery completed by early April.","theft":true,"onchain":true},{"id":"htd5a2ef0cd6","date":"2023-03-13","name":"Over $35 million lost as contagion from Euler hack spreads throughout defi","kind":"hack","fam":"other","chains":["Ethereum"],"usd":37600000.0,"lo":37600000.0,"hi":37600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/over-35-million-lost-as-contagion-from-euler-hack-spreads-throughout-defi"}],"theft":true,"headline":true},{"id":"ht8c8563a6bd","date":"2023-03-13","name":"Angle Protocol","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":17600000.0,"lo":17600000.0,"hi":17600000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AngleProtocol/status/1635293731082612738"}],"desc":"Angle Protocol, a decentralized stablecoin protocol, tweeted: \"Angle Protocol was affected by the Euler exploit, which deposited 17.6 million USDC into Euler. The protocol has been suspended, the debt ceiling has been set to 0, and the Euler AMO has been closed .are monitoring the situation and will update as soon as they are received.” Angle Protocol stated that before the Euler hack, the total value locked (TVL) of the Angle Core module was about 36 million US dollars, and 17.2 million agEUR had passed through the core. Module casting. In addition, in the agreement are: about 11.6 million US dollars in deposits from standard liquidity providers, about 353,000 US dollars in deposits from hedging agents, and a surplus of about 5.58 million yuan.","theft":true},{"id":"ht3be570905e","date":"2023-03-13","name":"Balancer","kind":"hack","fam":"code","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":11900000.0,"lo":11900000.0,"hi":11900000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Balancer/status/1635296206221090817"}],"desc":"The decentralized exchange Balancer disclosed on Twitter that in the Euler Finance attack, about $11.9 million was sent to Euler from the bbeUSD liquidity pool, accounting for 65% of the liquidity pool TVL, and bbeUSD was also deposited The other 4 liquidity pools: wstETH/bbeUSD, rETH/bbeUSD, TEMPLE/bbeUSD, DOLA/bbeUSD, all other Balancer liquidity pools are safe.","theft":true},{"id":"ht5002a430d0","date":"2023-03-13","name":"SwissBorg","kind":"hack","fam":"code","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/swissborg/status/1635250132370477056"}],"desc":"SwissBorg is a crypto asset management platform that is regulated and licensed in Switzerland, France and Estonia. It has its own SwissBorg app and can earn money through this mobile wallet. SwissBorg stated that the ETH and USDT in the Earn strategy suffered partial losses, including 1617.23 ETH and about 1.69 million USDT, accounting for 2.27% and 29.52% of the subscription funds respectively. SwissBorg will bear all losses.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht8f46abc300","date":"2023-03-13","name":"Inverse Finance","kind":"hack","fam":"code","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"usd":860000.0,"lo":860000.0,"hi":860000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/InverseFinance/status/1635280206171885572"}],"desc":"Inverse Finance, a DeFi lending protocol, tweeted: “Euler attack impacted DOLA-bb-e-USD pool on Balancer. Despite quick action to mitigate 90% of the impact, DOLA Fed suffered up to 86% for this pool. million in losses, excluding rewards points. Will be working with Balancer to recover the remaining funds.”","theft":true},{"id":"ht1da2420964","date":"2023-03-13","name":"Opyn","kind":"hack","fam":"other","tech":"Affected by Euler Finance Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/opyn_/status/1635279477738737673"}],"desc":"Opyn built the first decentralized option protocol, developed the perpetual option Opyn Squeeth, and built a variety of income strategies on Suqeeth. This time Opyn is affected by the Zen Bull strategy, which combines the Crab strategy and ETH leveraged long positions, and is suitable for low-volatility markets where ETH prices are on an upward trend. Since this strategy requires mortgage assets to buy ETH through leverage, it may be a mortgage loan in Euler, resulting in losses. Opyn has not announced the amount of the loss and how it will be dealt with.","theft":true},{"id":"htd4c4a40521","date":"2023-03-10","name":"Someone attempting to swap ~$2 million in 3CRV token ends up with $0.05 due to apparent Kyber issue","kind":"other","fam":"other","chains":["Ethereum"],"usd":1970000.0,"lo":1970000.0,"hi":1970000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/someone-attempting-to-swap-2-million-in-3crv-token-ends-up-with-0-05-due-to-apparent-kyber-issue"}],"headline":true},{"id":"hte8f786e405","date":"2023-03-10","name":"Hedera","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Hedera"],"usd":600000.0,"lo":570000.0,"hi":600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hedera-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/hedera/status/1634055353435561986"}],"desc":"Hedera Token Service (HTS) precompile bug March 9-11, 2023 allowed attacker to impersonate DEX pool accounts via delegatecall, draining ~$600K from Saucerswap, Pangolin, and Heliswap before network halted.","theft":true},{"id":"ht7bea724f45","date":"2023-03-10","name":"SUCKR","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.chaincatcher.com/article/2089005"}],"desc":"The SUCKR project on the Aptos chain is suspected of being a rug pull. The hacker called the mint_SUCKR (admin privilege function) function to mint a large number of SUCKR tokens and exchange them for USDT. The price of SUCKR tokens plummeted by 9% 249h.","theft":true},{"id":"htb3f01736be","date":"2023-03-08","name":"PeopleDAO","kind":"hack","fam":"social","tech":"Signer Phishing","target":"DAO","chains":["Ethereum"],"usd":120000.0,"lo":120000.0,"hi":120000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/bv6m85qy.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/peopledao-loses-120000-after-payment-spreadsheet-is-shared-publicly"}],"desc":"On March 6, 2023, PeopleDAO lost 76.5 ETH (~$120K) when an accounting lead accidentally shared a public editable Google Sheets form in Discord. An attacker added a hidden fraudulent 76.5 ETH transaction row, which the multisig signers failed to catch during review and approved.","theft":true},{"id":"ht25fa4a3ddf","date":"2023-03-08","name":"DKP","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":80000.0,"lo":80000.0,"hi":80000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DKP token on BSC was exploited through flash loan price manipulation. The attacker leveraged the oracle's reliance on USDT-DKP pair ratios to manipulate token pricing, swapping small amounts to trigger massive price shifts and profiting from the arbitrage.","theft":true,"onchain":true},{"id":"ht2bbd924447","date":"2023-03-07","name":"Tender Finance","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Arbitrum"],"usd":1590000.0,"lo":1590000.0,"hi":1590000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/217823/tender-fi-hacker-returns-stolen-funds-gets-bounty-reward"}],"desc":"Tender Finance on Arbitrum exploited March 7, 2023 for $1.59M via misconfigured GMX oracle. Attacker borrowed using only 1 GMX token (~$70 collateral). White-hat negotiated return for $97K bounty.","theft":true},{"id":"htcff03cf5f4","date":"2023-03-07","name":"Phoenix","kind":"hack","fam":"code","tech":"Access Control & Arbitrary External Call","chains":["Polygon"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6e02890111","date":"2023-03-02","name":"ArbiSwap","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["Arbitrum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On March 2, 2023, ArbiSwap DEX on Arbitrum was rugged by the development team. Team promoted a fake staking scheme with 1330% APY less than 24 hours before draining 85 ETH and $112,000+ in tokens using admin functions.","theft":true,"onchain":true},{"id":"ht945439430c","date":"2023-03-01","name":"BitBNS discloses that they were hacked in February 2022, hid it as \"system maintenance\"","kind":"hack","fam":"other","usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitbns-discloses-that-they-were-hacked-in-february-2022-hid-it-as-system-maintenance"}],"theft":true,"headline":true},{"id":"ht8588972223","date":"2023-03-01","name":"iToken","kind":"hack","fam":"keys","tech":"Insider Manipulation","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.wublock123.com/index.php?m=content&c=index&a=show&catid=10&id=29686"}],"desc":"According to the official WeChat account of Ping An Xuhui, employees Zhang, Dong, and Liu from Company A decided in early March 2023 to insert a backdoor program into a certain cryptocurrency wallet software to obtain users' private keys. The three individuals illegally obtained over 27,000 mnemonic phrases and more than 10,000 private keys, successfully converting over 19,000 digital wallet addresses. In April 2024, the Xuhui District People's Court sentenced Liu, Zhang, and Dong to three years in prison for the crime of illegally obtaining data from a computer information system and fined each of them 30,000 RMB. It is worth noting that Company A is suspected to be the former Huobi company. In an exclusive report by WuShuo in 2023, it was revealed that due to the installation of trojans by former employees, some users' mnemonic phrases or private keys of iToken (formerly Huobi Wallet) were leaked. HTX responded that the trojan installation was the personal act of former Huobi employees before the acquisition, leading to the theft of others' mnemonic phrases and private keys.","theft":true},{"id":"htfb7de7f5ca","date":"2023-02-27","name":"MyAlgo","kind":"hack","fam":"keys","tech":"CDN Compromise","target":"Wallet","chains":["Algorand"],"usd":9200000.0,"lo":9200000.0,"hi":9200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/myalgo_/status/1630218075411828739"}],"desc":"Between February 19-21, 2023, MyAlgo wallet on Algorand suffered a breach where 19.5M ALGO and 3.5M USDC (~$9.6M) were stolen from high-value accounts. The root cause was unclear: either the website was compromised to exfiltrate private keys or users' seed phrases were compromised via phishing. ChangeNow froze an additional $1.5M.","theft":true},{"id":"ht7aabab3383","date":"2023-02-27","name":"Large Algorand holders have wallets drained","kind":"hack","fam":"other","usd":3292000.0,"lo":3292000.0,"hi":3292000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/large-algorand-holders-have-wallets-drained"}],"theft":true,"headline":true},{"id":"ht44b96d8ea0","date":"2023-02-27","name":"Two BNB-based projects attacked for around $700,000 each","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":1427900.0,"lo":1427900.0,"hi":1427900.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/two-bnb-based-projects-attacked"}],"theft":true,"headline":true},{"id":"ht65e7267eed","date":"2023-02-27","name":"swapX","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"swapX on BSC was exploited through a lack of access control in the 0x4f1f05bc function. The attacker repeatedly called this function to manipulate DND token prices and drain approximately $1M from user wallets that had approved the contract.","theft":true,"onchain":true},{"id":"ht5604195297","date":"2023-02-27","name":"DungeonSwap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":728000.0,"lo":728000.0,"hi":728000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MetaSleuth/status/1630210958084952065"}],"desc":"DungeonSwap and Launch Zone protocols were exploited through excessive user permissions in the implementation contract. An attacker abused insufficient access controls to manipulate DND token pricing and drain approximately $728K from liquidity pools.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht432b4f3684","date":"2023-02-27","name":"LaunchZone","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":700000.0,"lo":320000.0,"hi":700000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/launchzoneann/status/1630161294836768771"}],"desc":"On February 27, 2023, LaunchZone on BSC suffered a $700,000 exploit via missing access control on the transferFrom() function in the Bscex SwapX contract. The attacker manipulated LZ token prices and executed arbitrary token transfers from liquidity pools.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht9d8c8b1626","date":"2023-02-27","name":"HideYoApes","kind":"hack","fam":"keys","tech":"Phishing Attack","chains":["Ethereum"],"usd":208000.0,"lo":208000.0,"hi":208000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/HideYoApes/status/1629967639383793664"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hideyoapes-suffers-200000-wallet-drain"}],"desc":"@HideYoApes previously owned several expensive NFTs from Yuga Labs, including a Bored Ape, Mutant Ape, three Bored Ape Kennel Club NFTs, a SewerPass, and two Otherdeeds. The attacker sold all the NFTs for a profit of 127.3 wETH (~$208,000). HideYoApes explained on Twitter that he had downloaded and installed the MetaMask wallet extension from MetaMask’s official website.","theft":true},{"id":"ht1fb7cb9937","date":"2023-02-26","name":"The Sandbox","kind":"phishing","fam":"social","tech":"Phishing Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://sandboxgame.medium.com/notice-of-security-incident-february-2023-ea692ee8094b"}],"desc":"According to the official blog, The Sandbox issued a security incident notice on February 26 that an unauthorized third party gained access to the computer of an employee of the team and used its permissions to send a false email claiming to be from The Sandbox . Titled \"The Sandbox Game (PURELAND) Access,\" the email contained hyperlinks to malware that could remotely install malware on a user's computer, granting it control of the computer and access to the user's personal information right. The Sandbox said that after the unauthorized access was discovered, the recipient was notified and the employee's account and access to The Sandbox were disabled, and no further impact has been identified.","theft":true},{"id":"ht55e19c3ed3","date":"2023-02-25","name":"Solana","kind":"hack","fam":"other","tech":"Fork","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2023/02/25/solana-networks-transaction-processing-craters-after-forking-event/"}],"desc":"As Coindesk reported, the Solana network experienced a fork event that limited users’ ability to execute transactions. According to Solana Explorer, the network was processing about 93 transactions per second at around 2AM ET today, well below the previous network rate of nearly 5000 TPS about 15 minutes ago. Such low throughput has prohibited users from performing activities such as on-chain transactions and transfers on Solana.","theft":true},{"id":"ht1552664092","date":"2023-02-24","name":"Earning.farm","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":5150000.0,"lo":5100000.0,"hi":5150000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"On February 24, 2023, Earning.farm’s USDC vault was exploited and lost about 5.15 million USDC.","theft":true,"onchain":true},{"id":"htc41a8eabaa","date":"2023-02-21","name":"Friendsies NFT project rug pulls","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":5300000.0,"lo":5300000.0,"hi":5300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/friendsies-nft-project-rug-pulls"}],"theft":true,"headline":true},{"id":"hta636e430c4","date":"2023-02-20","name":"Hope Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Arbitrum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hope-finance-rekt"}],"desc":"On February 20, 2023, Hope Finance (Arbitrum stablecoin protocol) was exploited by an insider who modified the TradingHelper contract to redirect GenesisRewardPool funds to an attacker address. ~$2M was stolen; ~$1.86M was laundered through Tornado Cash.","theft":true},{"id":"ht6e59cb1364","date":"2023-02-19","name":"BABYDOLL","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":7900.0,"lo":7900.0,"hi":7900.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/o9vi6cpj.html"}],"desc":"The Baby Doll (BABYDOLL) project was hit by a flash loan attack, losing 25 BNB (~$7,900). BSC contract address is [address]","theft":true},{"id":"ht226529038e","date":"2023-02-18","name":"Block Tower Capital","kind":"hack","fam":"code","tech":"Affected by Dexible events","usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2023/02/17/blocktower-capital-loses-15m-in-defi-market-aggregator-dexible-exploit-blockchain-data"}],"desc":"Hackers exploited a vulnerability in the Dexible smart contract code to withdraw funds from crypto wallets using funds approved for spending. The team added that \"a small number of whales\" lost 85% of the funds stolen in the attack. Data on the chain shows that Block Tower Capital, a digital asset investment company, was one of the victims. The address labeled Block Tower Capital had $1.5 million worth of TRU tokens stolen in this incident. The attackers transferred TRU tokens to SushiSwap for ether (ETH) and then to TornadoCash.","theft":true},{"id":"ht20c939168e","date":"2023-02-18","name":"Revert Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":29000.0,"lo":29000.0,"hi":30000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/revertfinance/status/1627490043026890752"}],"desc":"Revert Finance's V3Utils contract was exploited through an access control vulnerability allowing arbitrary code execution. Attackers transferred approved user funds by executing unauthorized contract calls, stealing approximately $29K before the team deployed a refund bot to recover all victim funds.","theft":true,"onchain":true},{"id":"ht9c7f1a3250","date":"2023-02-17","name":"Dexible V2","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":1800000.0,"lo":1500000.0,"hi":2047635.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dexible-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/y4jol3pw.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dexible-hacked-for-around-1-6-million"}],"desc":"Dexible V2's selfSwap function lacked router validation, allowing attacker to call token contracts with transferFrom targeting accounts with Dexible approvals, draining $2.047M from 17 user wallets.","theft":true,"onchain":true},{"id":"ht28c783a85a","date":"2023-02-16","name":"Platypus Finance","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Avalanche"],"usd":8500000.0,"lo":6100000.0,"hi":9000000.0,"ret":222634.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/platypus-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Platypusdefi/status/1626396538611310592"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/platypus-finance-stablecoin-exploited"}],"desc":"Platypus Finance was exploited for $8.5M via flashloan. The attacker manipulated the solvency check's cash/liability ratio calculation by depositing to increase liability and performing swaps to reduce cash, artificially inflating slippage.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htf0e5c364cc","date":"2023-02-16","name":"Zachxbt reports phishing scammer \"Loyalist\" has stolen more than $4 million since early 2022","kind":"scam","fam":"social","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zachxbt-reports-phishing-scammer-loyalist-has-stolen-more-than-4-million-since-early-2022"}],"theft":true,"headline":true},{"id":"ht5a515a548c","date":"2023-02-16","name":"Starlink","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":12000.0,"lo":12000.0,"hi":12000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2b4660e0cc","date":"2023-02-15","name":"Multichain","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/543vc392.html"}],"desc":"On February 15, 2023, the AnyswapV4Router contract of Multichain was exploited via a front-running attack. The attacker exploited a lack of signature verification in the permit mechanism to front-run the anySwapOutUnderlyingWithPermit function and transfer WETH worth approximately 87 ETH ($130K) from the contract.","theft":true},{"id":"ht7028c8cf25","date":"2023-02-15","name":"DYNA","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":21000.0,"lo":21000.0,"hi":21000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5f0e4e03ce","date":"2023-02-12","name":"Namecheap","kind":"phishing","fam":"social","tech":"Phishing Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/namecheaps-email-hacked-to-send-metamask-dhl-phishing-emails/"}],"desc":"The email account of domain name registrar Namecheap has been hacked and hackers are using the account to send phishing emails. According to a report by BleepingComputer, the phishing campaign originated from SendGrid, an email platform used by Namecheap to send marketing emails and renewal notifications. The phishing emails pretended to be from logistics provider DHL and cryptocurrency wallet MetaMask. The email posing as MetaMask stated that the recipient's account had been suspended and would need to complete a KYC verification process before it could be reactivated. The email also contained a Namecheap marketing link that redirected users to a fake MetaMask page that asked users to enter their seed phrase or private key, seeking to steal the recipient's personal information and cryptocurrency wallet assets. The official MetaMask response stated that MetaMask will not collect KYC information, nor will it send emails to users about their accounts.","theft":true},{"id":"ht3ea18270d9","date":"2023-02-11","name":"fcdep","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["BNB Chain"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/HypernativeLabs/status/1624115631401336845"}],"desc":"On February 11, 2023, the fcdep (EPMAX) protocol on BSC was attacked using a flash loan exploit. The attacker manipulated token balances through improper balance accounting to extract approximately $350K from the protocol.","theft":true},{"id":"ht9a33c57b77","date":"2023-02-11","name":"OneKey","kind":"hack","fam":"keys","tech":"\"Man-in-the-middle\" attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/210665/security-firm-unciphered-hacked-into-popular-hardware-wallet-onekey"}],"desc":"Cybersecurity startup Unciphered has carried out an attack on encrypted hardware wallets made by OneKey. In a video on YouTube, Unciphered demonstrates a so-called \"man-in-the-middle\" wallet attack method that exploits a vulnerability to extract a mnemonic seed phrase, or private key, from a OneKey Mini hardware wallet. OneKey acknowledged the vulnerability in a statement and said that no one was affected as it had updated the security patch. OneKey said it has paid a bounty to Unciphered.","theft":true},{"id":"htb09e965c31","date":"2023-02-10","name":"SushiSwap","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":26000.0,"lo":26000.0,"hi":26000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/dw2h404u.html"}],"desc":"SushiSwap's BentoBoxv1 contract was attacked, and the hacker made a profit of about $26,000. According to analysis, the attack is due to the Kashi Medium Risk ChainLink price update later than the mortgage/loan. In the two attack transactions, the attacker flashloaned 574,275 and 785,560 xSUSHI respectively. After mortgage and loan, the price of kmxSUSHI/USDT in LINK Oracle dropped by 16.9%. By exploiting this price gap, the attacker can call the liquidate() function to liquidate and obtain 15,429 and 11,333 USDT.","theft":true},{"id":"htaefd76cdce","date":"2023-02-10","name":"Sheep","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":3000.0,"lo":3000.0,"hi":3000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On February 10, 2023, the SHEEP reflection token on BSC was exploited. The attacker repeatedly executed the burn function and synchronized the pair to manipulate the reflection mechanism, causing balances to drop due to improper rate calculations and extracting approximately $3K.","theft":true,"onchain":true},{"id":"ht60bc75fe03","date":"2023-02-09","name":"dForce Lending","kind":"hack","fam":"code","tech":"Read-Only Reentrancy","target":"DeFi Protocol","chains":["Arbitrum","Optimism","Ethereum"],"usd":3650000.0,"lo":3650000.0,"hi":3650000.0,"ret":3650000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dforce-network-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/dForcenet/status/1623904209161830401"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dforce-network-exploited-for-3-65-million-funds-returned"}],"desc":"An attacker exploited read-only reentrancy in dForce's Curve vault integration on Arbitrum and Optimism. During asset withdrawal, the attacker called back into the protocol to manipulate Curve's virtual price and liquidate wstETH/ETH positions.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htcc51ef57e2","date":"2023-02-09","name":"Umami Finance","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["Arbitrum","Ethereum"],"usd":380000.0,"lo":380000.0,"hi":380000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://protos.com/defi-protocol-umami-finance-sours-as-ceo-goes-rogue-and-core-team-quits/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/umami-finance-halts-yields-ceo-dumps-tokens-amidst-accusations-of-rugpull"}],"desc":"Umami Finance, a DeFi protocol on Arbitrum, offers yield products to institutional clients. On January 31, they announced they were suspending yields, saying they were concerned about regulatory tactics. Soon after, the project CEO started dumping tokens on the market, cashing out 44,000 UMAMI tokens. These were ostensibly priced at $800,000, and although the sell-off sent UMAMI prices crashing by more than 60%, the CEO still netted around $380,000 in USDC.","theft":true},{"id":"ht03ad3bc206","date":"2023-02-08","name":"Nostr","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/4ozpop6z.html"}],"desc":"A fake token project named \"Nostr\" on the Ethereum chain has run away, and its funds have been transferred to a new EOA address [address]. In the end, the fraudsters made a profit of 232.1 ETH, worth about $370,000. The token contract is [address].","theft":true},{"id":"ht0e55fd347f","date":"2023-02-07","name":"Coin Cloud crypto ATM operator files for bankruptcy","kind":"collapse","fam":"insider","usd":123600000.0,"lo":123600000.0,"hi":123600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/coin-cloud-crypto-atm-operator-files-for-bankruptcy"}],"headline":true},{"id":"ht97e913e18b","date":"2023-02-07","name":"LianGoPay","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/tycwc1sv.html"}],"desc":"On February 7, 2023, LianGoPay was exploited by attackers with access to private keys who deployed fake staking pool contracts with addresses similar to legitimate ones. Users were tricked into depositing into these malicious contracts, resulting in a loss of approximately $1.6M in tokens.","theft":true},{"id":"ht59c7793008","date":"2023-02-07","name":"CoWSwap","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":180000.0,"lo":180000.0,"hi":180000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On February 7, 2023, CoW Swap was exploited through a vulnerability in the SwapGuard contract which permitted arbitrary external calls. The attacker forced the GPv2Settlement contract to approve a malicious contract and transferred DAI tokens worth approximately $180K from the settlement contract.","theft":true},{"id":"ht87e3ca9a9f","date":"2023-02-07","name":"CowSwap","kind":"hack","fam":"code","tech":"Arbitrary External Call Vulnerability","chains":["Ethereum"],"usd":120000.0,"lo":120000.0,"hi":120000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb9e35480a6","date":"2023-02-06","name":"Webaverse discloses $4 million theft via a mysterious social engineering attack","kind":"hack","fam":"other","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/4-million-stolen-from-webaverse"}],"theft":true,"headline":true},{"id":"htd0ecb6758d","date":"2023-02-06","name":"FDP","kind":"hack","fam":"other","tech":"Reflection token","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7e43c3056f","date":"2023-02-04","name":"Sperax USD","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"Token","chains":["Arbitrum"],"usd":250000.0,"lo":250000.0,"hi":300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SperaxUSD/status/1622003045776195587"}],"desc":"On February 3, 2023, an attacker exploited a bug in the SperaxUSD token contract by pre-computing a Gnosis Safe address and sending 11 USDs to it. When the Safe was created, this triggered an overflow in the balance calculation, allowing the attacker to mint 9.7 billion unbacked USDs and exchange approximately $250K worth before the contract was paused.","theft":true},{"id":"htbfe4e3abbb","date":"2023-02-03","name":"Spherax USDs","kind":"hack","fam":"code","tech":"Balance Recalculation Bug","chains":["Arbitrum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1165960ad2","date":"2023-02-02","name":"Orion Pools","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":3000000.0,"lo":2900000.0,"hi":3000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/orion-protocol-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2023/02/02/orion-protocol-loses-3m-of-crypto-in-trading-pool-exploit/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/orion-protocol-suffers-2-9-million-hack"}],"desc":"On February 2, 2023, Orion Protocol on BSC and Ethereum was exploited via reentrancy in swapThroughOrionPool. Attacker created a fake token (ATK) and used reentrancy to hijack deposit logic, extracting $3M.","theft":true,"onchain":true},{"id":"hta111b20349","date":"2023-02-02","name":"BonqDAO","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Polygon","Ethereum"],"usd":1800000.0,"lo":1721905.0,"hi":120000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bonq-rekt"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/207799/bonqdao-exploited-for-88-million-allianceblock-tokens-stolen-during-the-exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bonq-defi-borrowing-project-exploited"}],"desc":"On February 1, 2023, BonqDAO's collateral pricing read directly from TellorFlex's last reported value with no TWAP, dispute delay, or bounds. An attacker staked 10 TRB to become a reporter, posted an arbitrary wALBT price, minted ~98.65M BEUR against near-worthless collateral, then reversed the price to liquidate other troves. Nominal damage was ~$120M but illiquidity capped realized gains to ~$1-2M.","theft":true,"review":["sources disagree on the loss"]},{"id":"htfc01a9ea1f","date":"2023-01-30","name":"BEVO","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1620030206571593731"}],"desc":"On January 30, 2023, the BEVO reflection token on BSC was exploited. The attacker took a flash loan of 192.5 WBNB, swapped for BEVO tokens, and invoked the deliver function which decreased the _rTotal value. This manipulation of the deflationary mechanism allowed the attacker to profit approximately $45K.","theft":true,"onchain":true},{"id":"ht0d52d8a097","date":"2023-01-28","name":"Azuki","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":1740000.0,"lo":1740000.0,"hi":1740000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AzukiOfficial/status/1619114813766139906"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacked-azuki-twitter-account-enables-theft-of-pricey-nfts-and-crypto"}],"desc":"According to official news, the NFT project Azuki confirmed that its Twitter account was hacked, and the team has regained control of the account. Hackers posted two tweets on Azuki's Twitter account, prompting users to claim the virtual land, one of which was pinned to the top. Azuki officials remind users to be alert to this scam and not to click on any links.","theft":true},{"id":"ht5a26e0af8c","date":"2023-01-26","name":"Kevin Rose","kind":"hack","fam":"keys","tech":"Phishing Attack","chains":["Ethereum"],"usd":1000000.0,"lo":831000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/205606/moonbirds-creator-kevin-rose-hacked-at-least-1-million-in-nfts-stolen"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kevin-rose-loses-pricey-nfts-to-wallet-hack"}],"desc":"Kevin Rose, the founder of the NFT project Moonbirds, tweeted that his personal wallet was hacked and 25 Chromie Squiggles and other NFTs were lost, with an estimated loss of more than $1 million. Arran Schlosberg, vice president of engineering at Proof Collective, said their NFTs are safe after Kevin Rose was hacked and lost $1 million. Schlosberg said the phishing attack tricked Rose into signing a malicious signature, and the hackers then transferred his valuable NFT.","theft":true},{"id":"htbd5f6b1a6d","date":"2023-01-26","name":"Robinhood","kind":"fraud","fam":"social","tech":"Social Account Takeover","target":"CEX","chains":["BNB Chain"],"usd":8200.0,"lo":8000.0,"hi":8200.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/205563/robinhoods-twitter-hacked-users-tricked-into-buying-fraudulent-crypto-project"}],"desc":"On January 25, 2023, Robinhood's social media accounts (Twitter, Instagram, Facebook) were compromised and used to promote a fake RBH token on the BNB Chain. Attackers made off with 26.95 BNB (~$8,200) from users who fell for the scam, with the account believed to have been compromised via a third-party vendor."},{"id":"hteb5bb65684","date":"2023-01-26","name":"TINU","kind":"hack","fam":"other","tech":"Reflection token","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2839908166","date":"2023-01-21","name":"Omm","kind":"hack","fam":"code","tech":"Redeem Logic Flaw","target":"DeFi Protocol","chains":["Icon"],"usd":1891000.0,"lo":1891000.0,"hi":1891000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On January 21, 2023, Omm protocol on Icon was exploited for $1.891M when the Redeem function accepted arbitrary collateral addresses without ownership validation. The attacker could withdraw collateral from any pool regardless of whether they owned positions in it.","theft":true},{"id":"ht08be4cc9b3","date":"2023-01-21","name":"Doglands","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":204000.0,"lo":204000.0,"hi":204000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1uvhqd0t.html"}],"desc":"Dogechain ecological multi-purpose GameFi and DeFi agreement Doglands may have exit scams. The contract addresses on the project chain are 0x106E6a2D5433247441c1Cdf4E3e24a0696a46d0, 0x12b17 and 0x0e815, which drain all the reserves in the LP tokens, with a value of about $204000. The funds have now been transferred to Ethereum through the cross-chain bridge and transferred to multiple addresses. Doglands has deleted the official Twitter and website.","theft":true},{"id":"ht698dc8b3cd","date":"2023-01-20","name":"FFF","kind":"hack","fam":"insider","tech":"Insider Manipulation","chains":["BNB Chain"],"usd":1030000.0,"lo":1030000.0,"hi":1030000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/11pl2td6.html"}],"desc":"It is reported that the FFF token deployed on the BSC has an abnormal additional issue event. This event is that the administrator of the original project party purchased the additional issue through the pre-set additional issue contract, and then sold the additional issued tokens and transferred the acquired assets in part. More than US $1.03 million of FFF tokens were sold in this issue.","theft":true},{"id":"htd363412ba7","date":"2023-01-19","name":"Genesis files for bankruptcy","kind":"collapse","fam":"insider","usd":5100000000.0,"lo":5100000000.0,"hi":5100000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/genesis-files-for-bankruptcy"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht363c9569df","date":"2023-01-19","name":"Thoreum Finance","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":65540.0,"lo":65540.0,"hi":580000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/chr92pfw.html"}],"desc":"On January 19, 2023, Thoreum Finance on BSC was exploited through a logic flaw in the transfer mechanism. An attacker deposited BNB to gain WBNB, then used the swapExactTokensForTokensSupportingFeeOnTransferTokens function to exchange for THOREUM tokens, exploiting a branch in the transfer logic to profit approximately 2,260 BNB (~$65.5K).","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht02346a3f73","date":"2023-01-19","name":"SHOCO","kind":"hack","fam":"other","tech":"Reflection token","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc18e620b0a","date":"2023-01-18","name":"QTNToken","kind":"hack","fam":"code","tech":"business logic flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht796a98c9d5","date":"2023-01-18","name":"UPSToken","kind":"hack","fam":"code","tech":"business logic flaw","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht97f3748b40","date":"2023-01-17","name":"OmniEstate","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":70705.0,"lo":70000.0,"hi":70705.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/t730u0t3.html"}],"desc":"On January 17, 2023, the OMNI Real Estate Token (ORT) staking pool on BSC was exploited due to insufficient parameter validation. The StakingPool contract's _Check_reward function returned an incorrect value when durations was 0. An attacker invested 1 Wei with durations set to 0, bypassing verification, and repeatedly called withdrawAndClaim to extract 236 BNB (~$70.7K).","theft":true,"onchain":true},{"id":"ht143c9ca550","date":"2023-01-15","name":"Midas Capital","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Polygon"],"usd":650000.0,"lo":650000.0,"hi":660000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/midas-capital-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/MidasCapitalxyz/status/1615407372402585601"}],"desc":"On January 15-17, 2023 Midas Capital's Jarvis Polygon pool was exploited via a flashloan-enabled reentrancy attack targeting a recently-added collateral token, draining $660,000 of MATIC. Midas reached out with a bug-bounty offer and contributed $1,000 USDC weekly for 52 weeks toward affected protocols and users.","theft":true,"onchain":true},{"id":"htece9b39a4b","date":"2023-01-14","name":"NFT God","kind":"fraud","fam":"insider","tech":"Malicious Software","chains":["Ethereum"],"usd":25800.0,"lo":25800.0,"hi":25800.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/NFT_GOD/status/1614442000958324739"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-gods-wallet-drained-accounts-used-to-phish-others-after-malware-infection"}],"desc":"Encrypted KOL NFT God tweeted that due to hackers hacking into its Twitter, Substack, Gmail, Discord and wallets, it lost all its encrypted assets and NFTs, and the hackers also posted fraudulent links through the stolen accounts. The reason for being hacked was that the Ledger was set as a hot wallet instead of a cold wallet on the new device, and the mnemonic was imported and used in the wallet on the networked computer. Then yesterday, after downloading the video streaming software OBS for the game live broadcast, I clicked on Google. The sponsored links of the website downloaded malware that gave hackers access to their funds. Yu Xian, the founder of SlowMist, said that the core reason is that the computer runs a game program with a Trojan horse, and then the mnemonic of encrypted assets is connected to the Internet on this computer, so it may be stolen by hackers."},{"id":"ht1495dfacc3","date":"2023-01-13","name":"LendHub","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Heco","HECO"],"usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/obl5l5ms.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lendhub-reports-6-million-hack"}],"desc":"LendHub on Huobi Eco Chain was exploited on January 12, 2023 for ~$6M. The deprecated token remained active and priced identically to its replacement, allowing the attacker to exploit accounting flaws in mint/redeem operations.","theft":true},{"id":"htd52094e632","date":"2023-01-11","name":"UFDao","kind":"hack","fam":"other","tech":"Incorrect Parameter Setting","chains":["BNB Chain"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3b48dddeab","date":"2023-01-11","name":"Roe Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum","Polygon","BNB Chain"],"usd":80000.0,"lo":80000.0,"hi":80000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1613267000913960976"}],"desc":"On January 11, 2023, Roe Finance was exploited for $80K via a flashloan-enabled Uniswap V2 oracle price manipulation attack. The attacker borrowed massive amounts of UNI-v2 tokens to create pool imbalance and manipulated the oracle price, then swapped at the false rate without Roe Finance validating freshness.","theft":true,"onchain":true},{"id":"htbccd634e38","date":"2023-01-11","name":"Google Chrome","kind":"hack","fam":"keys","tech":"Browser Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.imperva.com/blog/google-chrome-symstealer-vulnerability/"}],"desc":"A vulnerability known as CVE-2022-3656 affects more than 2.5 billion users of Google Chrome and Chromium-engine-based browsers. This vulnerability allows the theft of sensitive files such as encrypted wallets and cloud provider files. The vulnerability was discovered by examining how the browser interacts with the file system. Specifically, the browser did not properly check whether a symlink pointed to an inaccessible location, allowing sensitive files to be stolen. This problem is often referred to as symbolic link following. Attackers may use encrypted phishing sites to strategically gain access to users' sensitive files.","theft":true},{"id":"htbff3615220","date":"2023-01-10","name":"BRA","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"Token","chains":["BNB Chain"],"usd":225000.0,"lo":225000.0,"hi":225000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/ql0656re.html"}],"desc":"On January 10, 2023, the BRA token on BSC was exploited through a tax-sharing loophole in the transfer mechanism. The attacker exploited a logic flaw where if sender and recipient formed a pair, the transfer function would double rewards. This created 1.6 million additional BRA tokens that were sold for approximately 819 WBNB (~$225K).","theft":true},{"id":"htd790164768","date":"2023-01-10","name":"Chimpers","kind":"hack","fam":"other","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/t3twhooc.html"}],"desc":"The official Twitter account of Chimpers, the NFT project, was hacked and embezzled, and multiple links to fake websites were published to lure users to forge NFT through the links.","theft":true},{"id":"ht6fe319df22","date":"2023-01-10","name":"Sui Name Service","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.dcnews.vip/a/206433.html"}],"desc":"On January 10, Sui Name Service, an eco-domain name service provider, posted a message on social media that its Discord server was attacked by a former employee today, and the attacker posed as an administrator. At present, the Sui Name Service is restoring role labels for users.","theft":true},{"id":"htced86d5720","date":"2023-01-08","name":"Twity","kind":"hack","fam":"keys","tech":"Telegram was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/ql3phayl.html"}],"desc":"The Web3 Twitter marketing platform Twity tweeted that there was a security vulnerability in its system, the Telegram account of the technician was leaked, and the chat record contained project information and wallet private key, resulting in the disclosure of administrator account information. The team is currently holding an emergency meeting to study solutions. All user assets and NFT information will be snapped. The specific solution will be published separately after it is formulated.","theft":true},{"id":"htf0fe932afb","date":"2023-01-07","name":"Mycelium","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["BNB Chain"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://yjzljc.com/kuaixun/12696198.html"}],"desc":"Mycelium, a perpetual agreement, tweeted that due to the oracle feeding problem of the ETH-USD trading pair, MLP suffered a loss of 4~6% from robot arbitrage (the current pool size is about $6.6 million, and the estimated loss is about $300,000), but the team has fixed the loophole and resumed trading. The reason for this is that due to the fact that Binance began blocking US IPs in late December, one of Mycelium's three oracle data vendors went offline, and the other vendor also seemed to have gone wrong overnight, resulting in prices relying only on Coinbase and Bitfinex. Coinciding with about 4 pm yesterday, Bitfinex's ETH-USD feed price fluctuated significantly, and the spread was extremely large, perhaps the arbitrage robot detected the spread and began to arbitrage at a higher than usual amount, resulting in a loss of MLP.","theft":true},{"id":"htdf7a8857e4","date":"2023-01-07","name":"CyberKongz","kind":"hack","fam":"keys","tech":"Account Compromise","usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xGBM/status/1612162753250328576"}],"desc":"The official Twitter account of CyberKongz in the NFT project was attacked by hackers, who replaced the homepage links, etc. with phishing links and released false Mint information. At present, the account has been renamed and is under freezing protection.","theft":true},{"id":"ht45985d1870","date":"2023-01-06","name":"Mutant Ape Planet","kind":"fraud","fam":"insider","tech":"Scam","usd":2900000.0,"lo":2900000.0,"hi":2900000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bloomberg.com/news/articles/2023-03-01/-mutant-ape-planet-nft-seller-in-plea-talks-in-fraud-case"}],"desc":"Aurelien Michel, developer of MAYC's Mutant Ape Planet NFT series, has pleaded guilty after being arrested on charges of defrauding $2.9 million. Aurelien Michel and the other defendants marketed the Mutant Ape Planet NFT to potential buyers with promises including “rewards, sweepstakes, exclusive access to other crypto assets, and community-controlled wallets to fund the marketing of the NFT collection.” The project developer also implicitly promises that NFT holders can obtain \"metaverse land\". However, none of Michel's promises were kept. When all the NFTs were sold, Michel and the other defendants allegedly transferred the proceeds of $2.9 million to other wallets, including wallets under Michel’s control."},{"id":"ht55357b3161","date":"2023-01-05","name":"Developer of Mutant Ape Planet NFT project charged in $2.9 million rug pull","kind":"followup","fam":"other","chains":["Ethereum"],"usd":2900000.0,"lo":2900000.0,"hi":2900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/developer-of-mutant-ape-planet-nft-project-charged-in-2-9-million-rug-pull"}],"headline":true},{"id":"htcf0f2a0b1c","date":"2023-01-04","name":"NFTs reportedly stolen from influencer CryptoNovo, flipped for at least $525,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":524788.0,"lo":524788.0,"hi":524788.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nfts-reportedly-stolen-from-influencer-cryptonovo"}],"theft":true,"headline":true},{"id":"ht10ab7fbd79","date":"2023-01-04","name":"Fake NFTs listed under verified collections on Magic Eden marketplace","kind":"hack","fam":"other","chains":["Solana"],"usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-nfts-listed-under-verified-collections-on-magic-eden-marketplace"}],"theft":true,"headline":true},{"id":"ht8d68141603","date":"2023-01-03","name":"Hackers steal $3.2 million from GMX whale","kind":"hack","fam":"other","chains":["Ethereum"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hackers-steal-3-2-million-from-gmx-whale"}],"theft":true,"headline":true},{"id":"hte6d64f0dc6","date":"2023-01-03","name":"Nikhil Gopalani","kind":"hack","fam":"keys","tech":"Phishing attack","chains":["Ethereum"],"usd":173000.0,"lo":159300.0,"hi":173000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Nikgopalani/status/1610120899570663425"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-drains-the-wallet-of-the-rtfkt-crypto-projects-coo"}],"desc":"Nikhil Gopalani, chief operating officer of Nike's encrypted fashion brand RTFKT, tweeted that he was attacked by a phisher and lost more than $173,000, including 19 CloneX NFTs, 18 RTKFT Space Pods, 11 CryptoKicks, etc. Gopalani believes the phishing attack may have been the result of accidentally providing confidential information to hackers posing as Apple representatives.","theft":true},{"id":"ht7cf5022a49","date":"2023-01-02","name":"GDS","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":187000.0,"lo":180000.0,"hi":187000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On January 3, 2023, the GDS protocol on BSC was exploited using a flash loan attack. The attacker borrowed $2.38M USD via flash loan, manipulated the LP mining reward calculation by exploiting a flaw in the _lpRewardAmount calculation, and created multiple attack contracts to withdraw excessive rewards. The attacker profited approximately $187K before repaying the flash loan.","theft":true,"onchain":true},{"id":"ht4f3f8513a2","date":"2023-01-01","name":"Bitcoin core developer claims his wallets were compromised, more than 216 BTC (~$3.6 million) stolen","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":3600000.0,"lo":3600000.0,"hi":3600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitcoin-core-developer-claims-wallets-were-compromised"}],"theft":true,"headline":true},{"id":"ht340dcb06a5","date":"2022-12-31","name":"DictumExchange","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Arbitrum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/olimpiocrypto/status/1609183982821818369"}],"desc":"About a week ago, Arbitrum-based project DictumExchange announced an airdrop. It turned out to be a scam.","theft":true},{"id":"ht1dc166db4d","date":"2022-12-31","name":"Luke Dashjr","kind":"hack","fam":"keys","tech":"Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/198688/bitcoin-developer-pgp-exploit"}],"desc":"Luke Dashjr, one of the original Bitcoin Core developers, claimed on Twitter that attackers had managed to compromise multiple wallets, with more than 216 BTC (approximately $3.6 million) stolen. Dashjr initially blamed the attack on a leaked PGP key, but later said the PGP leak was just part of a broader hack in which the attacker also bypassed two-factor authentication and gained access to his wallet.","theft":true},{"id":"ht507d5d0604","date":"2022-12-30","name":"DFS","kind":"hack","fam":"market","tech":"Insufficient validation + flashloan","chains":["BNB Chain"],"usd":1450.0,"lo":1450.0,"hi":1450.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htef0152453c","date":"2022-12-29","name":"Jaypeggers","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":18500.0,"lo":18500.0,"hi":18500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 29, 2022, Jaypeggers (JAY token) on Ethereum was exploited through a reentrancy vulnerability. The buyJay function lacked proper validation and allowed the attacker to insert a malicious contract as an ERC-721 token. The attacker reentered through the sell function using a miscalculated price to profit approximately 15.32 ETH (~$18.5K).","theft":true},{"id":"ht30bdb32182","date":"2022-12-29","name":"Kevin O’Leary","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/kevin-olearys-twitter-account-hacked-to-promote-bitcoin-ethereum-giveaway-scam/"}],"desc":"The Twitter account of celebrity investor Kevin O’Leary was hacked on Thursday and used to promote a bitcoin and ethereum giveaway scam, Bitcoin.com reported. The hacker claims that Mr. Wonderful (Kevin O’Leary) is giving away 5,000 BTC and 15,000 ETH, and the tweet also provides a link so anyone can participate. The scam giveaway posts have now been removed by Twitter a few hours after they were posted.","theft":true},{"id":"hteea19fafcf","date":"2022-12-29","name":"JAY","kind":"hack","fam":"code","tech":"Insufficient validation + Reentrancy","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htbd605bffd7","date":"2022-12-28","name":"3Commas finally owns up to API key leak","kind":"hack","fam":"other","usd":14800000.0,"lo":14800000.0,"hi":14800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/3commas-finally-owns-up-to-api-key-leak"}],"theft":true,"headline":true},{"id":"hta6823e1da6","date":"2022-12-28","name":"Wallets linked to Sam Bankman-Fried's Alameda Research unexpectedly begin selling off $1.7 million in tokens","kind":"fraud","fam":"insider","usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wallets-linked-to-sam-bankman-frieds-alameda-research-unexpectedly-begin-selling-off-1-7-million-in-tokens"}],"headline":true},{"id":"ht7f533647fc","date":"2022-12-27","name":"Midas Investments platform closes after revealing they're $63.3 million in the hole","kind":"collapse","fam":"insider","usd":63300000.0,"lo":63300000.0,"hi":63300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/midas-investments-platform-closes"}],"headline":true},{"id":"ht570e159892","date":"2022-12-26","name":"BitKeep","kind":"hack","fam":"other","tech":"Unknown","target":"Wallet","chains":["BNB Chain"],"usd":9000000.0,"lo":8000000.0,"hi":9000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/73b6rcf2.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/millions-of-dollars-of-user-funds-stolen-in-bitkeep-wallet-hack"}],"desc":"Several users claimed that their funds were stolen in the official Telegarm group of BitKeep, a Web3 multi-chain wallet. BitKeep issued an announcement saying that after preliminary investigation by the team, it is suspected that some APK package downloads were hijacked by hackers, and the packages implanted by hackers were installed. At present, funds on multiple chains have been damaged, and only BNB Chain has lost more than 3 million US dollars.","theft":true},{"id":"ht93da21b332","date":"2022-12-26","name":"BTC.com suffers $3 million attack","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/btccom-suffers-3-million-attack"}],"theft":true,"headline":true},{"id":"htf9c90ffeee","date":"2022-12-26","name":"Amun","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Polygon"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker gained control of Amun's unprotected rebalance manager, rebalanced PECO and DFI indices into a worthless token it controlled, and minted roughly 80 billion tokens to dump on DEXs, causing about $300K in losses.","theft":true},{"id":"htc875da2447","date":"2022-12-25","name":"Rubic","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":1405000.0,"lo":1400000.0,"hi":1500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/h5Detail/15051"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rubic-cross-chain-exchange-hacked"}],"desc":"Rubic lost $1.4M on December 25, 2022 when USDC was mistakenly added to the router whitelist and routerCallNative lacked input validation. Attacker exploited user pre-approvals to RubicProxy by calling arbitrary contracts, draining USDC directly from user wallets.","theft":true,"onchain":true},{"id":"ht2206adc957","date":"2022-12-25","name":"LastPass","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/"}],"desc":"Password management platform LastPass said a hacker accessed a cloud-based storage environment using information previously obtained in an incident they disclosed in August 2022, and some source codes and technical information were stolen and used to attack another employee , to obtain credentials and keys for accessing and decrypting certain storage in cloud-based storage services.","theft":true},{"id":"ht179a17251b","date":"2022-12-23","name":"Defrost","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Avalanche"],"usd":12000000.0,"lo":170000.0,"hi":12173000.0,"ret":12000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://foresightnews.pro/article/detail/22019"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/defrost-finance-fails-to-rug-pull"}],"desc":"On December 24, 2022, Defrost Finance on Avalanche suffered two coordinated attacks: V2 flashloan drained $173K via LSWUSDC price manipulation; V1 admin key compromise allowed minting 100M H20 and draining ~$12M USDT via fake oracle. All funds were later returned.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht12c7091f06","date":"2022-12-19","name":"mgnr","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":52000000.0,"lo":52000000.0,"hi":52000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Quantitative trading company mgnr has deleted all tweets and quit some groups, leaving only 0.097 Ethereum in its wallet address. The address with the domain name mgnr.eth transferred 43.6 million USDC to Coinbase on November 14, and at the same time transferred 8 million USDC and 0.1 Ethereum to the Genesis Trading address.","theft":true},{"id":"ht796d3998cd","date":"2022-12-17","name":"Scammer steals fourteen Bored Apes from one victim, flips them for over $1 million ","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1075030.0,"lo":1075030.0,"hi":1075030.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-steals-fourteen-bored-apes-from-one-victim-flips-them-for-over-1-million-"}],"theft":true,"headline":true},{"id":"ht341547f4a5","date":"2022-12-16","name":"Raydium AMM","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Solana"],"usd":4400000.0,"lo":4395000.0,"hi":4400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/raydium-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/RaydiumProtocol/status/1603860540153028625"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/raydium-exploit"}],"desc":"On December 16, 2022, Raydium AMM private keys were compromised by trojan malware; attacker gained admin access and modified SyncNeedTake pool parameters to extract $4.4M without burning LP tokens. Raydium patched within 4 hours and recovered governance.","theft":true},{"id":"ht53d1608a84","date":"2022-12-16","name":"Over 100 Bitcoin moved from dormant QuadrigaCX wallets in \"unauthorized\" transfer","kind":"fraud","fam":"insider","chains":["Bitcoin"],"usd":1750000.0,"lo":1750000.0,"hi":1750000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/over-100-bitcoin-moved-from-dormant-quadrigacx-wallets-in-unauthorized-transfer"}],"headline":true},{"id":"ht60911dd4c2","date":"2022-12-14","name":"Lastpass Users","kind":"other","fam":"other","usd":37000000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/lastpass-users-rekt"}]},{"id":"ht9685a0ccbb","date":"2022-12-14","name":"Nimbus","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":76000.0,"lo":76000.0,"hi":76000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1602942551753101312"}],"desc":"Nimbus Platform's reward distribution mechanism was exploited via a flash loan attack. An attacker manipulated the token ratio in the NIMB/GNIMB pool using a 278 BNB flash loan to artificially inflate their staked ratio, dramatically increasing their rewards payout.","theft":true},{"id":"htd2cf2865a9","date":"2022-12-14","name":"FPR","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":29000.0,"lo":29000.0,"hi":29000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"FPR protocol on BSC suffered an access control vulnerability allowing unauthorized calls to privileged functions. The exploit drained $29K in protocol assets through improper permission checks.","theft":true,"onchain":true},{"id":"ht21c9c93841","date":"2022-12-13","name":"ElasticSwap","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Avalanche","Ethereum"],"usd":850000.0,"lo":845000.0,"hi":850000.0,"ret":520650.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 13, 2022, ElasticSwap was exploited on Avalanche and Ethereum via inconsistent accounting between addLiquidity (constant K) and removeLiquidity (pool balance), draining ~$854K.","theft":true,"onchain":true},{"id":"ht685d6de19c","date":"2022-12-12","name":"BGLD","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BGLD, a deflationary token on BSC, was exploited through a flash loan price manipulation attack. The attacker used a flash loan to artificially inflate the token price, enabling a profitable swap on PancakeSwap.","theft":true,"onchain":true},{"id":"ht181b8a211a","date":"2022-12-12","name":"Polynomial Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xPoor4ever/status/1602156729105788929"}],"desc":"Polynomial Protocol has a loophole in optimism's deposit contract. The problem stems from the swapAndDeposit() function, which has no restrictions on its input. Anyone can pass in an address and maliciously construct swapData to steal contract-approved tokens.","theft":true},{"id":"htba03d7729e","date":"2022-12-11","name":"3Commas","kind":"hack","fam":"keys","tech":"Database Breach","target":"CEX","chains":["Multiple"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://3commas.io/blog/december-10-update-on-investigation-api-key-exchange-attacks"}],"desc":"3Commas' API database containing ~100K API keys was breached and publicly leaked on December 28, 2022. Attackers used the stolen keys to access connected exchange accounts and drain cryptocurrency by performing unauthorized trades across Binance, KuCoin, and other platforms.","theft":true},{"id":"htcc1baa1fc9","date":"2022-12-11","name":"MEVbot_0x28d9","kind":"hack","fam":"code","tech":"Insufficient validation","chains":["Ethereum"],"usd":2000.0,"lo":2000.0,"hi":2000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht9bbf96750d","date":"2022-12-10","name":"Lodestar V0","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Arbitrum"],"usd":6900000.0,"lo":4000000.0,"hi":7000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/lodestar-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/LodestarFinance/status/1601686921566375936"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lodestar-finance-attacked"}],"desc":"On December 10, 2022 Lodestar Finance V0 on Arbitrum suffered a flashloan and oracle manipulation attack when an attacker manipulated the price of PlutusDAO's plvGLP token to 1.83 GLP per plvGLP, then used flashloans to borrow all available platform liquidity with the inflated collateral, resulting in $6.9M loss.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht4ae46b1d38","date":"2022-12-10","name":"MU&MUG","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["Avalanche"],"usd":57000.0,"lo":57000.0,"hi":57000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"MU&MUG tokens on Avalanche were exploited through a flash loan price manipulation attack. The attacker used a flash loan to artificially inflate the token price, enabling profitable swaps that drained $57K.","theft":true,"onchain":true},{"id":"ht178033a0d0","date":"2022-12-10","name":"TiFi","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":43500.0,"lo":43500.0,"hi":43500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"TIFIToken on BSC suffered a flash loan price manipulation attack. The attacker used a flash loan to artificially move the token price, enabling profitable transactions on decentralized exchanges.","theft":true},{"id":"ht54cf99d421","date":"2022-12-10","name":"TIFIToken","kind":"hack","fam":"market","tech":"FlashLoan price manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht56be47ea14","date":"2022-12-09","name":"NOVAToken","kind":"hack","fam":"insider","tech":"Admin Drain","target":"Token","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"NOVAToken on BSC was rugged through malicious unlimited minting. The admin used their privileged access to mint unlimited tokens and drain value from the protocol.","theft":true,"onchain":true},{"id":"htdb2b4dffcc","date":"2022-12-08","name":"Former Love Island Australia contestant Vanessa Sierra rug pulls her NFT project","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":316320.0,"lo":316320.0,"hi":316320.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/former-love-island-australia-contestant-vanessa-sierra-rug-pulls-her-nft-project"}],"theft":true,"headline":true},{"id":"ht9ea588460f","date":"2022-12-07","name":"AES (Deflationary token)","kind":"hack","fam":"code","tech":"Rounding Error","target":"Token","chains":["BNB Chain"],"usd":61608.0,"lo":60000.0,"hi":61608.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"AES, a deflationary token on BSC, was exploited through abuse of its skim function. The attacker repeatedly sent AES tokens to the AES-USDT pair to break the pool balance, then called skim to extract surplus tokens. Each cycle burned additional AES tokens, allowing profitable conversion of small token amounts into large USDT payouts.","theft":true,"onchain":true},{"id":"ht1b0899c2da","date":"2022-12-06","name":"PayPal","kind":"hack","fam":"code","tech":"Credential stuffing attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/ui5WQF7_KtGqa4qGd_FBfQ"}],"desc":"According to reports, PayPal notified the United States Attorney General's Office of Maine (Maine), saying that they discovered that they had been hacked on December 20, 2022, and after investigation believed that the incident occurred between December 6 and 8. Credential stuffing attack, the total number of affected users is 34,942. PayPal pointed out that the attack may lead to the disclosure of customer information, including: name, address, security code, personal tax information, phone number and birthday. However, PayPal emphasized that no user personal information has been stolen. PayPal also mentioned that it has provided 24 months of credit theft monitoring services for affected users. PayPal added that this incident is not a PayPal system vulnerability, but that users repeatedly use the same set of account numbers and password combinations on different services or websites, allowing hackers to steal, purchase, or obtain user account numbers, passwords, etc. from other places, and then use a large number of Account and password combination, crack PayPal account.","theft":true},{"id":"htde16432741","date":"2022-12-05","name":"Orthogonal Trading is insolvent, defaults on $36 million in loans","kind":"collapse","fam":"insider","usd":36000000.0,"lo":36000000.0,"hi":36000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/orthogonal-trading-is-insolvent-defaults-on-36-million-in-loans"}],"headline":true},{"id":"ht0792ae16f5","date":"2022-12-05","name":"BBOX","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BBOX token on BSC was exploited through a flash loan price manipulation attack. The attacker used a flash loan to artificially move the token price on DEX, enabling profitable transactions.","theft":true},{"id":"ht559a419c0d","date":"2022-12-05","name":"RFB","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"RFB protocol on BSC was exploited through predictable random number generation. The attacker predicted the random numbers used by the protocol's randomness mechanism, allowing them to manipulate outcomes.","theft":true,"onchain":true},{"id":"ht9dee44f867","date":"2022-12-05","name":"Nmbplatform","kind":"hack","fam":"market","tech":"FlashLoan price manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htc13739501b","date":"2022-12-03","name":"Genesis owes $900 million to customers of Gemini Earn","kind":"collapse","fam":"insider","usd":900000000.0,"lo":900000000.0,"hi":900000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/genesis-owes-900-million-to-customers-of-gemini-earn"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht4981286da9","date":"2022-12-03","name":"BTC.com","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"Wallet","chains":["Bitcoin","Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.prnewswire.com/news-releases/bit-mining-limited-subsidiary-experiences-cyberattack-301709947.html"}],"desc":"BTC.com's custodial systems were compromised on December 3, 2022, exposing private keys and enabling the theft of 32.5 BTC and 1964 ETH. Approximately $700K belonged to client assets while $2.3M was company-owned. Stolen funds were transferred to Tornado Cash and CEX exchanges.","theft":true},{"id":"ht3f800d3570","date":"2022-12-03","name":"Ratio Finance","kind":"hack","fam":"keys","tech":"Key Brute Forced","target":"DeFi Protocol","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On December 3, 2022, Ratio Finance on Solana experienced a developer private key compromise. Attacker accessed protocol accounts and drained user collateral; exact loss not specified. Incident disclosed January 17, 2023.","theft":true},{"id":"ht6559d1d410","date":"2022-12-02","name":"Helio","kind":"hack","fam":"code","tech":"The impact of the Ankr vulnerability","chains":["BNB Chain"],"usd":19000000.0,"lo":15000000.0,"hi":19000000.0,"conf":"B","n":3,"src":[{"s":"rekt.news","u":"https://rekt.news/ankr-helio-rekt"},{"s":"SlowMist Hacked","u":"https://rekt.news/ankr-helio-rekt/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/oracle-attack-on-helio-enabled-by-a-separate-hack-on-ankr-allows-attackers-to-steal-15-million"}],"desc":"After the attack on Ankr’s aBNBc token, an address exchanged 10 BNB for 15.5 million BUSD with the help of the Ankr vulnerability, resulting in the emptying of the Hay liquidity pool. Another user made a profit through the same method, with an income of about $3.5 million. Helio Protocol tweeted that the BNB pledged by users is safe, and the official is in close communication with the Ankr team to discuss the restart plan of aBNBc.","theft":true},{"id":"ht8207077a1b","date":"2022-12-02","name":"Ankr","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"ret":5000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ankr/status/1598624443642703872"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ankr-defi-project-exploited"}],"desc":"On December 2, 2022, a former Ankr employee exploited an access control flaw in the aBNBc staking token contract, minting 10 trillion tokens and converting ~$5M to USDC. Binance froze $3M; Ankr reimbursed affected users from company reserves.","theft":true},{"id":"htf821777fa5","date":"2022-12-02","name":"Overnight Finance","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Avalanche"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"OverNight protocol on Avalanche suffered a flash loan attack on December 2, 2022. The attacker exploited protocol logic to drain funds using a flash loan.","theft":true},{"id":"htf7a1f81db7","date":"2022-12-02","name":"OverNight","kind":"hack","fam":"market","tech":"FlashLoan Attack","chains":["Avalanche"],"conf":"C","n":1,"theft":true},{"id":"ht081bc9d0c8","date":"2022-12-01","name":"APC","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"Token","chains":["BNB Chain"],"usd":6000.0,"lo":6000.0,"hi":6000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"APC token on BSC was exploited through a combined flash loan and price manipulation attack. The attacker used a flash loan to artificially inflate the token price, enabling profitable swaps.","theft":true,"onchain":true},{"id":"ht975f9a1e21","date":"2022-11-29","name":"SEAMAN","kind":"hack","fam":"code","tech":"Unknown","target":"Token","chains":["BNB Chain"],"usd":7000.0,"lo":7000.0,"hi":7000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"SEAMAN token on BSC was exploited through a business logic flaw in its protocol mechanics. The vulnerability allowed attackers to manipulate token flows.","theft":true,"onchain":true},{"id":"ht14dce20cd2","date":"2022-11-29","name":"MBC & ZZSH","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":5900.0,"lo":5900.0,"hi":5900.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"MBC and ZZSH tokens on BSC suffered access control vulnerabilities combined with business logic flaws. Attackers exploited improper permission checks to drain protocol funds.","theft":true},{"id":"ht5ccc4c11ad","date":"2022-11-28","name":"BlockFi files for bankruptcy","kind":"collapse","fam":"insider","usd":1300000000.0,"lo":1300000000.0,"hi":1300000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blockfi-files-for-bankruptcy"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht5f0c2a1eec","date":"2022-11-26","name":"Webaverse","kind":"scam","fam":"social","tech":"Scam","usd":4000050.0,"lo":4000050.0,"hi":4000050.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xngmi/status/1622614930519212032"}],"desc":"For several weeks last year, Webaverse was targeted by a skilled scam gang posing as investors, Webaverse reported. The Webaverse team and the crooks met in Rome at the end of November 2022, and approximately $4 million was stolen. They reported the theft to the local Rome police station the same day, and then to the FBI a few days later on Form IC3.","theft":true},{"id":"hta3ec96dc9b","date":"2022-11-26","name":"Ahad Shams","kind":"scam","fam":"social","tech":"Social engineering scam","usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TrustWallet/status/1623355786557632512"}],"desc":"Trust Wallet, a multi-chain non-custodial wallet, tweeted that Ahad Shams, the co-founder of the Web3 metaverse game engine Webverse, said that he did not disclose the mnemonic and was only stolen $4 million worth of cryptocurrency because he was photographed. Trust Wallet believes this is a security incident triggered by a social engineering attack involving an organized crime group from Rome, Italy, with known locations in Milan and Barcelona. It is reported that the theft of Ahad Shams’ funds occurred in November 2022. At that time, it hoped to complete a round of financing for the project. A scammer pretending to be an investor shared an NDA PDF file and KYC information (suspected to contain malware) to prove identity, then had Shams transfer funds to a new non-multisig wallet, and view Ahad Shams trust wallet balance, taking pictures in the process. While no private key or seed phrase was revealed, $4 million in cryptocurrency from the Trust wallet subsequently disappeared, and the crook has never been seen again.","theft":true,"review":["possible duplicate within one source"]},{"id":"htf173f45fde","date":"2022-11-23","name":"Numbers Protocol","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":13836.0,"lo":13836.0,"hi":13836.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/n3dbo2gk.html"}],"desc":"Numbers Protocol's bridge integration with Multichain exposed a vulnerability in how excessive permissions were handled in the permit mechanism. An attacker exploited a user's unlimited permit grant to steal 557,754 NUM tokens, converting them to 13 ETH and draining multiple user accounts.","theft":true},{"id":"htf68d8f89ca","date":"2022-11-23","name":"NUM","kind":"hack","fam":"other","tech":"Protocol Token incompatible","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte193799868","date":"2022-11-22","name":"AUR Protocol","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"AUR token on BSC lacked proper permission checks in critical functions. The missing access control allowed attackers to call privileged functions and drain token assets.","theft":true},{"id":"htd163381381","date":"2022-11-21","name":"sDAO","kind":"hack","fam":"code","tech":"Unknown","target":"Token","chains":["BNB Chain"],"usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"sDAO token on BSC suffered a business logic flaw allowing attackers to manipulate protocol mechanics and extract funds.","theft":true},{"id":"htc89f38ee71","date":"2022-11-21","name":"sDAO","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"usd":13000.0,"lo":13000.0,"hi":13000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htb94995e1c7","date":"2022-11-18","name":"Polynomial","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Optimism"],"usd":7000.0,"lo":1400.0,"hi":7000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Polynomial Protocol on Optimism suffered a missing input validation vulnerability. The flaw affected a select number of users in a contract variant not used for all functionality. The protocol compensated affected users.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht7226eed09f","date":"2022-11-18","name":"AnnexFinance","kind":"hack","fam":"market","tech":"Verify flashLoan Callback","chains":["BNB Chain"],"usd":3000.0,"lo":3000.0,"hi":3000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta97ebc7fbc","date":"2022-11-17","name":"Trust Wallet","kind":"hack","fam":"keys","tech":"Wallet Vulnerability","target":"Wallet","usd":170000.0,"lo":170000.0,"hi":170000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://community.trustwallet.com/t/browser-extension-wasm-vulnerability-postmortem/750787"}],"desc":"Trust Wallet released an analysis report saying: \"In November 2022, a vulnerability was discovered in the back-end module WebAssembly (WASM) at the core of the open source repository wallet. The vulnerability affected new wallets generated by browser extension versions 0.0.172 and 0.0.182, and only the private keys of a limited number of new wallets created in these versions were affected. Despite our best efforts, two breaches occurred, resulting in a combined loss of approximately $170,000 at the time of the attack. \"","theft":true},{"id":"ht7166610693","date":"2022-11-17","name":"UEarnPool","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":16038.0,"lo":16038.0,"hi":24000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"UEarnPool on BSC was exploited using a flash loan to repeatedly manipulate the invitor reward distribution mechanism. The attacker inflated their staked ratio by calling the public bindInvitor() function multiple times, allowing the protocol to allocate portions of staked amounts to controlled invitor accounts. Each staking round distributed rewards while allocating the claimable reward back to the attacker.","theft":true,"onchain":true},{"id":"ht51d5d5d639","date":"2022-11-16","name":"BBOX","kind":"hack","fam":"market","tech":"FlashLoan price manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8e80f0ca1f","date":"2022-11-15","name":"Ranger","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":77000.0,"lo":77000.0,"hi":77000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/3b6ha25t.html"}],"desc":"The Ranger project on the BSC chain was an exit scam, and the Ranger token fell by 95%. The contract deployer sent the tokens to an external account, which was then sold for a profit of about $77,000. Do not confuse this project with similarly named tokens and symbols, refer to the contract address: bsc: [address].","theft":true},{"id":"ht01955eb41a","date":"2022-11-15","name":"SheepFarm","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":72000.0,"lo":72000.0,"hi":72000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/nmuct2g5.html"}],"desc":"On November 16, 2022, SheepFarm gaming token on BSC was exploited via a register function that failed to update user timestamps after registration, allowing an attacker to call it multiple times to increase gems yield and drain approximately 262 BNB (~$72K). The attacker then converted the accumulated yield to BNB and withdrew.","theft":true,"onchain":true},{"id":"ht2f3b455ab8","date":"2022-11-14","name":"DeFiAI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1592023899558285312"}],"desc":"Rug pull occurred in the DeFiAI project, and the contract deployer made a profit of about 40 million US dollars. According to SlowMist MistTrack analysis, funds have been transferred to Fixedfloat and MEXC.","theft":true},{"id":"ht3998b7f0bf","date":"2022-11-14","name":"Flare","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":18500000.0,"lo":17000000.0,"hi":18500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/flare-token-rug-pulls-or-is-exploited-for-17-million"}],"desc":"The price of the Flare project has dropped by more than 95%, which is suspected to be a Rug Pull scam project. Flare token deployers and associated addresses received approximately 4 billion Flare tokens. The scam has so far made around $18.5 million.","theft":true},{"id":"hte164e8d88f","date":"2022-11-12","name":"FTX","kind":"hack","fam":"social","tech":"Phishing","target":"CEX","chains":["Ethereum","Solana"],"usd":477000000.0,"lo":450000000.0,"hi":600000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2022/11/12/ftx-crypto-wallets-see-mysterious-late-night-outflows-totalling-more-than-380m/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ftx-claims-it-was-hacked"}],"desc":"On November 11-12, 2022, a SIM-swapping gang stole approximately $450M in crypto from FTX by walking into AT&T stores with fake IDs, hijacking employee phone accounts, intercepting 2FA codes sent to FTX users, and draining their wallets during the company's bankruptcy.","theft":true},{"id":"htf4135af7a2","date":"2022-11-12","name":"SBF - MASK OFF","kind":"other","fam":"other","usd":477000000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/sbf-mask-off"}]},{"id":"htb2d12c5584","date":"2022-11-12","name":"Over $4 million drained from DeFiAI","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":4173646.0,"lo":4173646.0,"hi":4173646.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/over-4-million-drained-from-defiai"}],"theft":true,"headline":true},{"id":"hte418caacd8","date":"2022-11-11","name":"FTX files for bankruptcy, Sam Bankman-Fried resigns","kind":"collapse","fam":"insider","usd":8700000000.0,"lo":8700000000.0,"hi":8700000000.0,"ret":7000000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ftx-files-for-bankruptcy-sam-bankman-fried-resigns"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"htb8ec121b30","date":"2022-11-10","name":"Early crypto investor loses $42 million in wallet compromise","kind":"hack","fam":"other","usd":42000000.0,"lo":42000000.0,"hi":42000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/early-crypto-investor-loses-42-million-in-wallet-compromise"}],"theft":true,"headline":true},{"id":"ht5e4643587c","date":"2022-11-10","name":"DFX V2","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":4000000.0,"lo":231138.0,"hi":5000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/304558"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dfx-finance-suffers-5-million-loss"}],"desc":"On November 10, 2022, DFX Finance V2 was exploited for $4.3 million (plus $3.2M via MEV) through a reentrancy vulnerability in the flash function introduced in V2. The contract failed to prevent reentrant deposits, allowing attacker to repay flashloans while recording deposits as debt.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht66cf50e87a","date":"2022-11-09","name":"brahTOPG","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":89879.0,"lo":89000.0,"hi":89879.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1590685173477101570"}],"desc":"According to the monitoring of the SlowMist security team, the brahTOPG project on the ETH chain was attacked, and the attacker made a profit of about $89,879. The main reason for this attack is that the Zapper contract strictly checks the data passed in by the user, which leads to the problem of arbitrary external calls. The attacker uses this arbitrary external call problem to steal the tokens of users who are still authorized to the contract.","theft":true,"onchain":true},{"id":"ht8daaeb1472","date":"2022-11-09","name":"Brahma Finance","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":89343.0,"lo":89343.0,"hi":89343.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 9, 2022, Brahma Finance's TopGear vault on Ethereum was exploited via an arbitrary external call vulnerability in the Zapper contract, where the swapTarget parameter was not validated, allowing an attacker to construct malicious call data and drain 89,343 USDC from three authorized user accounts.","theft":true},{"id":"htbac7f05a5a","date":"2022-11-08","name":"MEV_0ad8","kind":"hack","fam":"code","tech":"Arbitrary call","chains":["Ethereum"],"usd":282000.0,"lo":282000.0,"hi":282000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht64387621bc","date":"2022-11-08","name":"Kashi","kind":"hack","fam":"other","tech":"Price-caching Design Defect","chains":["Ethereum"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht08688a4347","date":"2022-11-07","name":"MooCakeCTX","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":143921.0,"lo":143921.0,"hi":143921.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/vb6aozpr.html"}],"desc":"The MooCakeCTX project suffered a flash loan attack, and the attackers made a profit of $143,921. According to Fairyproof’s analysis, the suspected reason is that the contract reinvested (the earn function was not called) before the user pledged (depositAll function) without settlement of the reward, that is, when the user pledged, the contract did not settle the previous reward and conduct new investment. This will cause users to get the previous pledge dividends immediately after the pledge. After the attacker borrows 50,000 cake tokens using a flash loan in the same block, he pledges it twice in a row, and then withdraws the pledged cake tokens and returns them to make a profit.","theft":true},{"id":"ht8e398b68da","date":"2022-11-06","name":"Pando exploited for $20 million","kind":"hack","fam":"other","usd":70000000.0,"lo":70000000.0,"hi":70000000.0,"ret":50000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pando-exploited-for-20-million"}],"theft":true,"headline":true},{"id":"ht19108c916a","date":"2022-11-06","name":"Pando Rings","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Mixin"],"usd":22000000.0,"lo":22000000.0,"hi":22000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 5-6, 2022, Pando Rings suffered an oracle manipulation attack when an attacker inflated sBTC-WBTC LP token values in the oracle, enabling borrowing against inflated collateral and stealing approximately $20-22M.","theft":true},{"id":"ht99f9968c2c","date":"2022-11-06","name":"MooCAKECTX","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 7, 2022, MooCAKECTX on BSC was exploited via a flashloan attack targeting the reward settlement logic, where the attacker borrowed 50,000 CAKE, pledged twice in the same transaction without reward settlement, and withdrew to profit approximately $143,921. The contract failed to settle previous rewards before reinvesting.","theft":true,"onchain":true},{"id":"htc39232f0f2","date":"2022-11-05","name":"Loopring","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/loopringorg/status/1589034582242099200"}],"desc":"Ethereum L2 protocol Loopring tweeted that it was hit by a large-scale DDoS attack. While the funds were not at risk, the service was down for 11 hours. Currently, domain access on the mobile app side has been reconfigured and the Loopring wallet service has been restored.","theft":true},{"id":"hta7903c10d1","date":"2022-11-04","name":"pNetwork","kind":"hack","fam":"bridge","tech":"Configuration Error","target":"Bridge","usd":10800000.0,"lo":10800000.0,"hi":10800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/pNetworkDeFi/status/1588266897061031936"}],"desc":"An address on the BNB Chain minted more than $1 billion of pGALA tokens out of thin air, and sold them through PancakeSwap to make a profit. The pGALA contract hacker has made a profit of $4.3 million. One Smart Money address arbitraged nearly $6.5 million in this attack, even more than the attacker's profit. Multi-link is tweeted by the protocol pNetwork, and the pGALA contract on the BNB Chain needs to be redeployed due to the misconfiguration of the cross-chain bridge. Huobi Global announced that it would re-list GALA after proposing that the GALA purchased after the abnormal event would be renamed pGALA, and the project party agreed to pay full compensation to the holders of the currency before the accident.","theft":true},{"id":"ht45bf9fb679","date":"2022-11-04","name":"Monkey Drainer steals dozens more NFTs, nets around $867,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":867042.0,"lo":867042.0,"hi":867042.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monkey-drainer-steals-dozens-more-nfts-nets-around-867000"}],"theft":true,"headline":true},{"id":"ht67e906e676","date":"2022-11-03","name":"pNetwork","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["BNB Chain"],"usd":4300000.0,"lo":4300000.0,"hi":4300000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A governance key leaked in pNetwork's pGALA bridge contract on BSC allowed 55.6B pGALA tokens to be minted and sold on PancakeSwap. The pNetwork team executed a white-hat intervention to drain $4.3M from PancakeSwap and limit losses.","theft":true},{"id":"ht9762d50a4b","date":"2022-11-02","name":"Skyward Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["NEAR"],"usd":3000000.0,"lo":3000000.0,"hi":3200000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/skyward-rekt"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/skyward-finance-exploit-allegedly-results-in-3-million-loss"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/skyward-finance-treasury-drained-of-3-2-million"}],"desc":"Skyward Finance was exploited on November 2, 2022 when missing input validation in treasury redemption logic allowed attacker to redeem 1.08M $NEAR (~$3M) in a single transaction. Attacker purchased SKYWARD on Ref.finance and redeemed at unfavorable rates.","theft":true},{"id":"ht383513e9f3","date":"2022-11-02","name":"Save","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Solana"],"usd":1260000.0,"lo":1260000.0,"hi":1260000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 2, 2022, an attacker manipulated USDH price on Saber DEX from $1 to ~$15 to inflate collateral value on Solend, borrowing across isolated pools. By locking the Saber account to prevent arbitrage, the attacker created approximately $1.26M in bad debt.","theft":true},{"id":"hta9666e586d","date":"2022-11-02","name":"Rubic","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":1200000.0,"lo":814000.0,"hi":1200000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/CryptoRubic/status/1587704890800889858"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rubic-exchange-private-key-compromised-token-plummets"}],"desc":"On November 2, 2022, an attacker compromised an administrator's private key for Rubic's bridge, which controlled the RBC/BRBC bridge and staking rewards. The attacker stole approximately 34M RBC tokens and sold them on Uniswap and PancakeSwap, with realized losses estimated at ~$1.2M. The token price collapsed 98% following the mass liquidation.","theft":true},{"id":"ht132ffb8de4","date":"2022-11-01","name":"Deribit","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","usd":28000000.0,"lo":28000000.0,"hi":28000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deribit-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/DeribitExchange/status/1587701883778523136"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-exchange-deribit-hacked-for-28-million"}],"desc":"On November 1-2, 2022, Deribit's BTC, ETH, and USDC hot wallets were compromised, draining ~$28M in crypto assets. Client assets in cold storage and Fireblocks vaults were unaffected. Deribit covered the loss with company reserves; the specific compromise method remains undisclosed.","theft":true},{"id":"htae7aa21310","date":"2022-11-01","name":"Solend","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["Solana"],"usd":1260000.0,"lo":1026000.0,"hi":1260000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/solendprotocol/status/1587671511137398784"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/oracle-attack-on-solend-costs-the-project-1-26-million"}],"desc":"Solend on Solana was manipulated when the protocol relied on a single oracle source from Saber pool vulnerable to price manipulation. The attacker inflated USDH price from ~$1 to $15 through transaction spam, creating $1.26 million in bad debt.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht81f1ae09a2","date":"2022-11-01","name":"FITE","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/omf9a0dp.html"}],"desc":"The FITE (FTE) project is suspected of Rug pull, its website fit[.]app has been shut down, and social media has been deleted. Scammers have transferred 1900 BNB to Tornado Cash.","theft":true},{"id":"ht6962d01d31","date":"2022-10-30","name":"BDEX","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht7fac5bbb61","date":"2022-10-29","name":"Eden Network","kind":"hack","fam":"keys","tech":"Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/rw58tidv.html"}],"desc":"The ownership of the MEV infrastructure Eden Network deployer address was hacked and took control of the EDEN token contract. The attacker claims that a new token contract will be deployed, and Eden Network can redeem ownership after purchasing 200 ETH of NEDEN.","theft":true},{"id":"ht2318c0665c","date":"2022-10-28","name":"FriesDAO","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"DeFi Protocol","chains":["Ethereum"],"usd":2300000.0,"lo":2300000.0,"hi":2328659.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/friesdao/status/1585712229067915264"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/french-fry-themed-dao-loses-2-3-million-due-to-profanity-exploit"}],"desc":"On October 28, 2022, FriesDAO's deployer wallet generated using the Profanity vanity-address tool was compromised, allowing an attacker to calculate the private key and steal approximately $2.3M in FRIES governance tokens and other assets from the staking pool. Profanity had a known critical flaw enabling private key derivation for vanity addresses.","theft":true},{"id":"ht77b3fba756","date":"2022-10-28","name":"Opensea","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PocketUniverseZ/status/1585793457385140225"}],"desc":"Browser security plug-in Pocket Universe tweeted that a new vulnerability was discovered in Opensea’s old contracts that could be used to steal users’ NFTs, potentially emptying wallets once the transaction was signed. It can steal any NFT users listed on Opensea before May 2022 (i.e. before Seaport upgrades), mainly involving the Wyvern protocol, which grants proxy contracts the right to withdraw user NFTs, and this new exploit will Trick the user into signing a transaction, giving the attacker ownership of the user's proxy contract. Cosine, the founder of SlowMist, tweeted that it is necessary to be vigilant about the new use of this old problem, which is related to the old OpenSea protocol, but many users of the old protocol have not cancelled the relevant authorization, and this use is invalid for the new OpenSea protocol (Seaport).","theft":true},{"id":"htca88d5733a","date":"2022-10-28","name":"THORChain","kind":"hack","fam":"bridge","tech":"Network interruption","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/THORChain/status/1585800482764730369"}],"desc":"The THORChain network of the cross-chain DeFi protocol was interrupted. The official said that the consensus problem has been identified and a patch will be released. The code pushes cosmos.Uint (instead of uint64) into the string, which causes the string to get an arbitrarily large integer instead of the actual value, causing the memo string to be on a different node. On October 28th, THORChain was back online and produced blocks. The network is signing block transactions, so pending transactions should start going through. Once the queue is cleared, the transaction will be re-enabled. Expect 2-3 hours. During the network outage, investors did not lose any funds. However, the exchange deposits and withdrawals of Thorchain's native currency RUNE have been suspended on centralized exchanges such as Kucoin.","theft":true},{"id":"hte69303f67d","date":"2022-10-27","name":"Team Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":15150000.0,"lo":14500000.0,"hi":15800000.0,"ret":13050000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/teamfinance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/TeamFinance_/status/1585562380591063043"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/14-5-million-stolen-from-team-finance"}],"desc":"Team Finance's migrate function, which moves locked LP positions from Uniswap v2 to v3, never validated that token and pair parameters matched the caller's lock. On 27 October 2022, an attacker locked a worthless token, then used another user's lock parameters to move that liquidity into an attacker-controlled v3 pair at a skewed price. Four locked projects lost ~$15.8M for $2,700 of attacker capital.","theft":true,"onchain":true},{"id":"ht1078d05748","date":"2022-10-27","name":"UvToken","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/303069"}],"desc":"On October 27, 2022, UvToken's mining pool contract on BSC was exploited via a logic error in the withdrawal mechanism where input validation failed to authenticate the caller, allowing an attacker to make malicious calls and seize approximately 1,078 BNB and 1,161,991 BUSD (~$1.5M) from the vault.","theft":true},{"id":"ht6f40829526","date":"2022-10-26","name":"N00dleSwap","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":29000.0,"lo":29000.0,"hi":29000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 26, 2022, N00dleSwap on Ethereum was exploited via a reentrancy vulnerability in the token's ERC777 callback mechanism, allowing an attacker to drain approximately $29K in tokens by reentering during token transfers.","theft":true},{"id":"ht316cf3a1cd","date":"2022-10-25","name":"Monkey Drainer steals ~$1 million in 24 hours","kind":"hack","fam":"other","chains":["Ethereum"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monkey-drainer-steals-1-million-in-24-hours"}],"theft":true,"headline":true},{"id":"ht5655163409","date":"2022-10-25","name":"ULME","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 25, 2022, ULME on BSC was exploited via a parameter validation flaw that lacked access control, allowing an attacker to use a flashloan, iterate through authorized spenders, drain their BUSD, manipulate ULME price, and extract approximately 50,646 BUSD (~$250K) before repaying the loan.","theft":true},{"id":"hte0b22d98ce","date":"2022-10-25","name":"VTF Token","kind":"hack","fam":"code","tech":"Incorrect Reward calculation","chains":["BNB Chain"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht0ff5381b19","date":"2022-10-25","name":"N00d Token","kind":"hack","fam":"code","tech":"Reentrancy","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht658a97498e","date":"2022-10-24","name":"MulticallWithoutCheck","kind":"hack","fam":"code","tech":"Arbitrary External Call Vulnerability","chains":["Polygon"],"conf":"C","n":1,"theft":true},{"id":"htc5609e0e9e","date":"2022-10-23","name":"Freeway halts withdrawals, accused of $160 million rug pull","kind":"rugpull","fam":"insider","usd":160000000.0,"lo":160000000.0,"hi":160000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/freeway-halts-withdrawals-accused-of-100-million-rug-pull"}],"theft":true,"headline":true},{"id":"htccd2a50d27","date":"2022-10-23","name":"FTX & 3Commas","kind":"hack","fam":"keys","tech":"Phishing attack","chains":["Bitcoin"],"usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://3commas.io/blog/3commas-security-update-october-20"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/several-users-report-losing-more-than-a-million-dollars-each-in-3commasftx-theft"}],"desc":"Several FTX users were hacked and stolen coins, which 3Commas said was due to phishing websites. In a collaborative investigation conducted by 3Commas and FTX, it was discovered that some API keys were associated with new 3Commas accounts, but the API keys were not obtained from 3Commas, but from outside the 3Commas platform. At the same time, FTX will provide a total of approximately $6 million in compensation to FTX accounts affected by the phishing incident.","theft":true},{"id":"ht1df45f8482","date":"2022-10-23","name":"QuickSwap Market","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Polygon"],"usd":220000.0,"lo":188260.0,"hi":220000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/oracle-manipulation-attack-on-a-quickswap-market-earns-exploiter-188000"}],"desc":"On October 24, 2022, QuickSwap's Market XYZ lending market on Polygon was exploited for $220K via a read-only reentrancy vulnerability in the Curve LP Oracle. An attacker used a flash loan to manipulate spot prices, inflating collateral values to drain assets from the market. The exploit affected LDO, MATIC, and staked MATIC tokens, leading QuickSwap to shut down its lending service.","theft":true,"onchain":true},{"id":"ht9f9d915d21","date":"2022-10-23","name":"Layer2DAO","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":190000.0,"lo":87000.0,"hi":190000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/TheLayer2DAO/status/1583994186982109185"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-drains-tokens-from-layer2dao-project-buys-some-of-them-back"}],"desc":"On October 23, 2022, a hacker gained access to Layer2DAO's multisig wallet on Optimism and drained 49,950,000 L2DAO tokens. Layer2DAO negotiated with the attacker and repurchased 31,239,677 tokens to stabilize the market. The token price dropped 36.48% following the incident.","theft":true,"review":["sources disagree on the loss"]},{"id":"htd4592079fb","date":"2022-10-22","name":"Blur","kind":"phishing","fam":"social","tech":"Phishing attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/pcgo7jg3.html"}],"desc":"NFT platform Blur tweeted that it noticed a phishing account with the ID @Blur_DAO and reminded users not to click on fake links. The fake account tweeted that the BLUR token query was now open, and posted a phishing URL.","theft":true},{"id":"htf1edcc949d","date":"2022-10-22","name":"Gate.io","kind":"hack","fam":"keys","tech":"Account Compromise","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/evilcos/status/1583640865418842113"}],"desc":"SlowMist founder Cosine tweeted that Gate.io’s official Twitter account may have been hacked. Hackers sent phishing messages to trick users into visiting gąte[.]com. Once you click \"Claim\", the eth_sign signature phishing will appear, which may lead to the theft of related assets such as Ethereum.","theft":true},{"id":"htc861c908e5","date":"2022-10-22","name":"Vivity","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1583617781370851328"}],"desc":"The Discord server of NFT project Vivity was attacked.","theft":true},{"id":"ht68a5b40cb4","date":"2022-10-21","name":"Bond Protocol","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":300000.0,"lo":292000.0,"hi":300000.0,"ret":300000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1i3txm4e.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/almost-300000-stolen-from-olympus-dao-later-returned"}],"desc":"On October 21, 2022, attacker deployed counterfeit bond tokens on Bond Protocol's OlympusDAO market and redeemed them for legitimate OHM collateral, draining $300K before returning funds hours later. Fixed-Expiry Teller lacked token validation.","theft":true,"onchain":true},{"id":"ht418e0c5cb4","date":"2022-10-20","name":"Ethereum Alarm Clock","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":260000.0,"lo":260000.0,"hi":260000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/ethereum-alarm-clock-exploit-leads-to-260k-in-stolen-gas-fees-so-far"}],"desc":"On October 20, 2022, Ethereum Alarm Clock's transaction scheduling protocol was exploited via a gas fee refund calculation vulnerability where the cancel() function calculated refunds too high when given inflated transaction fees, allowing attackers to call cancel with high gas prices and extract approximately 204 ETH (~$260K) in overpaid refunds.","theft":true},{"id":"ht01c23596d3","date":"2022-10-20","name":"Mango INU","kind":"fraud","fam":"insider","tech":"Scam","chains":["Ethereum"],"usd":48500.0,"lo":48500.0,"hi":48500.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1582976826653126656"}],"desc":"The Mango INU (MNGO) project has been confirmed to be an exit scam, and the currency price has dropped by more than 80%. This token project was deployed by attackers at Mango Market and has made a profit of about $48,500."},{"id":"ht65043b9faf","date":"2022-10-20","name":"Petra","kind":"hack","fam":"keys","tech":"Mnemonic Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PetraWallet/status/1583235962317852672"}],"desc":"Aptos ecological wallet Petra tweeted that the Aptos Labs team discovered a vulnerability on Petra on October 20. The mnemonic is related to account creation in existing wallets, and the mnemonic displayed on the page may be inaccurate. To access the exact 12 mnemonic phrases, set up, manage your account, enter your password, and click Show Key Recovery Phrase. Currently, Petra has fixed the vulnerability.","theft":true},{"id":"ht1e7d8f7152","date":"2022-10-20","name":"HEALTH","kind":"hack","fam":"code","tech":"Transfer Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htfc0c4f6ef0","date":"2022-10-19","name":"BitBTC","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Optimism"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/twitter-user-saves-cross-chain-bridge-from-potential-exploit"}],"desc":"As reported by Cointelegraph, the BitBTC team has now fixed the bug after Twitter user @PlasmaPower0 disclosed a “fake minting” bug that existed in the cross-chain bridge between BitBTC and Optimism. It is reported that the vulnerability allows an attacker to fake tokens on one side of the bridge and exchange them for real tokens on the other side. Attackers have tried to extract 200 billion BitBTC tokens from Optimism through this vulnerability, but it is only a test.","theft":true},{"id":"ht0d2c898bb2","date":"2022-10-19","name":"Dataverse","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/data_verse/status/1582820158699343873"}],"desc":"Metaverse data platform Dataverse tweeted that it has detected hackers attacking the GEO BSC contract, and reminded users not to buy GEO in BSC, any code purchased on BNB Chian from October 19th to 22nd UTC Coins are invalid. It may be caused by the \"allow unlimited minting\" vulnerability in the minting function of BGEO (Binance GeoDB Coin).","theft":true},{"id":"htb59dd7aa92","date":"2022-10-19","name":"BEGO","kind":"hack","fam":"code","tech":"Incorrect signature verification","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdad583c27d","date":"2022-10-18","name":"Moola Market","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Celo"],"usd":8400000.0,"lo":8400000.0,"hi":9000000.0,"ret":7812000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/moola-markets-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Moola_Market/status/1582588102790434816"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/moola-market-exploited-for-8-4-million"}],"desc":"On October 18, 2022, attacker exploited Moola Market on Celo by manipulating MOO token's low-liquidity price oracle to inflate collateral value, allowing unauthorized borrows and draining $8.4M in multiple tokens.","theft":true},{"id":"hte65ac7c443","date":"2022-10-18","name":"Bitkeep Swap","kind":"hack","fam":"code","tech":"Contract Vulnerability","target":"Wallet","usd":1180000.0,"lo":1180000.0,"hi":1180000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BitKeepOS/status/1582157619032395776"}],"desc":"According to the official news of the wallet BitKeep, BitKeep Swap was attacked by hackers, and the development team has carried out urgent processing. The hacker's attack has been stopped. The attack was concentrated on the BNB Chain, resulting in a loss of about 1 million US dollars. According to SlowMist MistTrack monitoring, Bitkeep Swap attackers have transferred 4,300 BNB (about $1.18 million) stolen funds to Tornado Cash in the form of 100 BNB each.","theft":true},{"id":"htc8c64e8fef","date":"2022-10-18","name":"HPAY","kind":"hack","fam":"code","tech":"Access Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht7349654631","date":"2022-10-17","name":"MTDAO","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":702000.0,"lo":702000.0,"hi":702000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/spqk6wao.html"}],"desc":"The MTDAO contract deployed on BSC was exploited on October 17, 2022 through a malicious function call that bypassed authorization checks. The attacker called transfer functions on both the MT and ULM tokens to extract 1,930 BNB and 487,042.615 BUSD, then routed funds through Tornado Cash.","theft":true},{"id":"ht7c2521e50d","date":"2022-10-17","name":"BitKeep Swap hacked for more than $1 million","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bitkeep-swap-hacked-for-more-than-1-million"}],"theft":true,"headline":true},{"id":"hta462757f34","date":"2022-10-17","name":"LiveArtX","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"NFTfi","chains":["Ethereum"],"usd":39000.0,"lo":39000.0,"hi":39000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MistTrack_io/status/1581916015553699840"}],"desc":"LiveArtX's treasury wallet was compromised on October 16-17, 2022, resulting in the theft of 197 NFTs from the Seven Treasures collection. The attacker exploited poor key management—the private key was shared among multiple team members with no multi-sig protection—to transfer the NFTs to their own address and sell them at depressed prices.","theft":true},{"id":"ht12747c7c99","date":"2022-10-17","name":"PLTD","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":24000.0,"lo":24000.0,"hi":24000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/p4ochu0v.html"}],"desc":"The PLTD project was attacked by hackers, all BUSD in its trading pool was sold out, and the attackers gained a total of 24,497 BUSD. This attack mainly exploits the code loopholes in the PLTD contract, reduces the PLTD token balance in Cake-LP (0x4397c7) to 1 through a flash loan attack, and then uses the PLTD in hand to exchange all BUSD into the attack contract .","theft":true,"onchain":true},{"id":"ht45054fd575","date":"2022-10-17","name":"Uerii Token","kind":"hack","fam":"code","tech":"Access Control","chains":["Ethereum"],"usd":2400.0,"lo":2400.0,"hi":2400.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht2c90290ec0","date":"2022-10-15","name":"Earning.Farm","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":971248.0,"hi":1200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SupremacyHQ/status/1581012823701786624"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/earningfarm-exploited-for-971000"}],"desc":"EFLeverVault, a key component of Earning.Farm, was targeted with flash loan attacks on October 15, 2022. The contract failed to verify the origin of flashloan callbacks, allowing attackers to impersonate legitimate protocol calls and execute unauthorized ETH withdrawals from the collateral pool.","theft":true},{"id":"ht91f28ce45a","date":"2022-10-15","name":"Tokens notionally worth $825,000 stolen from Syntropy in venture capital investment deal gone wrong","kind":"hack","fam":"other","chains":["Ethereum"],"usd":825000.0,"lo":825000.0,"hi":825000.0,"ret":825000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/syntropy-venture-capital-investment-deal-gone-wrong"}],"theft":true,"headline":true},{"id":"ht98eace0831","date":"2022-10-14","name":"INUKO","kind":"hack","fam":"market","tech":"FlashLoan price manipulation","usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"C","n":1,"theft":true},{"id":"ht6624a668e7","date":"2022-10-14","name":"EFLeverVault","kind":"hack","fam":"market","tech":"Verify flashLoan Callback","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte3c76e720c","date":"2022-10-13","name":"FTX","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"CEX","chains":["Ethereum"],"usd":70000.0,"lo":70000.0,"hi":70000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mirror.xyz/x-explore.eth/M2BJgQJaj2JK0mAO9OecByja3tU7mKXbHR_Agjs-MjA"}],"desc":"In October 2022, an attacker exploited FTX's withdrawal fee sponsorship mechanism by submitting 500,000 gas unit withdrawal requests—far exceeding normal 21,000 gas transfers. FTX subsidized the excess fees, unknowingly covering costs for smart contract calls that minted XEN tokens on the attacker's behalf.","theft":true},{"id":"ht989b55d226","date":"2022-10-13","name":"MEVBOTa47b","kind":"hack","fam":"market","tech":"Price Oracle Manipulation","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htff81948bf1","date":"2022-10-12","name":"UXD Protocol","kind":"hack","fam":"code","tech":"Affected by the Mango attack","chains":["Solana"],"usd":20000000.0,"lo":20000000.0,"hi":20000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/UXDProtocol/status/1579990264713994240"}],"desc":"The total amount of funds affected by the Solana ecological algorithm stablecoin protocol UXD Protocol in the Mango attack is $19,986,134.9037. UXD Protocol stated: “Our insurance fund is sufficient to cover losses. UXD is fully secured and will be redeemable by users once Mango Markets recovers from the exploit. The total insurance fund is $53,527,304.7757. UXD Protocol has suspended UXD minting for Risk minimization. Minting will be re-enabled once we confirm the issue with Mango Markets has been resolved.”","theft":true},{"id":"hte786a2cb32","date":"2022-10-12","name":"Tulip Protocol","kind":"hack","fam":"code","tech":"Affected by the Mango attack","chains":["Solana"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TulipProtocol/status/1580056583220113409"}],"desc":"Tulip Protocol, a Solana ecological income aggregator and leveraged income farming platform, stated that its exposure to the Mango attack was limited to a portion of the USDC/RAY strategic treasury, namely 2,465,841.497167 USDC and 66,721.925355 RAY, and the funds affected by the Mango attack were about $2.5 million.","theft":true},{"id":"ht3b643072b9","date":"2022-10-11","name":"Mango Markets V3","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Solana"],"usd":115000000.0,"lo":100000000.0,"hi":116777480.0,"ret":67000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mango-markets-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/mangomarkets/status/1580053208130801664"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mango-markets-suffers-hack"}],"desc":"Attacker used $5M initial capital to take a MANGO-PERP position and pumped spot price via large purchases on another account, creating artificial collateral worth $423M to borrow $110-116M. Protocol relied on liquidity-sensitive price feeds vulnerable to large single-account manipulation.","theft":true},{"id":"ht7d74b4af7e","date":"2022-10-11","name":"TempleDAO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":2320000.0,"lo":2300000.0,"hi":2360000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/templedao-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1579848760766926848"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stax-finance-exploited-for-2-3-million"}],"desc":"TempleDAO's staking contract lacked access control on the migrateStake function. An attacker exploited this vulnerability to withdraw 321,154 xLP tokens from the staking contract and swap them for 1,418,303 TEMPLE tokens and 1,262,438 FRAX tokens, totaling $2.3M.","theft":true,"onchain":true},{"id":"hta66a271b67","date":"2022-10-11","name":"QANplatform","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"DeFi Protocol","chains":["Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/qanplatform/qanx-bridge-wallet-disclosure-analysis-continuously-updated-724121bbbf9a"}],"desc":"QANplatform's bridge deployer wallet was compromised on October 11, 2022 due to the profanity vulnerability in the vanity address generator. The attacker recovered the private key and drained ~$2M from the Ethereum and BNB cross-chain bridges in multiple withdrawals.","theft":true},{"id":"ht364e767a9b","date":"2022-10-11","name":"QANX Bridge suffers $1.16 million loss caused by the Profanity vanity address vulnerability","kind":"hack","fam":"other","chains":["Ethereum","BNB Chain"],"usd":1163964.0,"lo":1163964.0,"hi":1163964.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/qanx-bridge-suffers-1-16-million-loss-caused-by-the-profanity-vanity-address-vulnerability"}],"theft":true,"headline":true},{"id":"htdfedc1fc27","date":"2022-10-11","name":"The Micro Elements","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":548600.0,"lo":548600.0,"hi":548600.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1579707616002908160"}],"desc":"The Micro Elements (TME) project is an exit scam, with a drop of more than 95%, and about $548,600 has been stolen. BSC address [address].","theft":true},{"id":"ht5c3c197bfe","date":"2022-10-11","name":"Rabby","kind":"hack","fam":"code","tech":"Contract Vulnerability","target":"Wallet","chains":["Ethereum"],"usd":190000.0,"lo":190000.0,"hi":194500.0,"conf":"A","n":3,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1579839744128978945"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rabby-swap-exploited-a-month-after-launch"}],"desc":"DeBank plug-in wallet Rabby tweeted that its Rabby Swap smart contract has a vulnerability, and users who have used it should revoke Rabby Swap approvals on all chains as soon as possible. According to the analysis of the SlowMist security team, the Rabby Swap contract was attacked, and the token exchange function in the contract was directly called externally through the functionCallWithValue function in the OpenZeppelin Address library. The parameters passed in by the user are not checked, resulting in any external call problems. Attackers exploit this issue to steal funds from users authorized by this contract.","theft":true},{"id":"ht5077d826ce","date":"2022-10-11","name":"ATK","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum","BNB Chain"],"usd":120000.0,"lo":120000.0,"hi":127000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/q1qgvsgc.html"}],"desc":"The Journey of Awakening (ATK) project suffered a flash loan attack. The attacker attacked the strategy contract of the ATK project ([address]) through a flash loan attack, and obtained a large amount of ATK tokens from the contract. The attackers have exchanged all of the obtained ATK tokens for approximately $120,000 in BSC-USD, and the stolen funds are currently being exchanged for BNB and all transferred to Tornado Cash.","theft":true,"onchain":true},{"id":"ht3398713ed9","date":"2022-10-11","name":"TokenPocket","kind":"hack","fam":"other","tech":"Abnormal traffic attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/TokenPocket_TP/status/1579787917656207361"}],"desc":"According to the official announcement of TokenPocket, the official website tokenpocket.pro is currently attacked by abnormal traffic, and the technical team is carrying out emergency maintenance. During the technical maintenance period, the TokenPocket website will not be accessible normally, and the security of user assets will not be affected.","theft":true},{"id":"ht84743ea275","date":"2022-10-10","name":"Carrot","kind":"hack","fam":"other","tech":"Public functionCall","chains":["BNB Chain"],"usd":31318.0,"lo":31318.0,"hi":31318.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht1299dbaeaa","date":"2022-10-09","name":"Jumpnfinance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1150000.0,"lo":1150000.0,"hi":1150000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Jumpnfinance project Rugpull, involving an amount of about 1.15 million US dollars. The attacker first calls the 0x6b1d9018() function of the 0xe156 contract to extract the user assets in the contract and store them at the attacker's address ([address]).","theft":true},{"id":"ht005e9abaf2","date":"2022-10-08","name":"NFT collector loses Bored Apes he bought for nearly $2 million in two consecutive scams","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1933403.0,"lo":1933403.0,"hi":1933403.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-collector-loses-bored-apes-he-bought-for-nearly-2-million-in-two-consecutive-scams"}],"theft":true,"headline":true},{"id":"hta07caa5b1a","date":"2022-10-08","name":"Xave Finance","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":635.0,"lo":635.0,"hi":635.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mobile.twitter.com/AnciliaInc/status/1578952542926491650"}],"desc":"An attacker submitted a fake verification message to Xave's oracle on October 8-9, 2022, enabling four malicious proposals to pass through the DaoModule. This resulted in the minting of an enormous amount of RNBW tokens sent to the attacker's address, which were then converted to xRNBW.","theft":true,"onchain":true},{"id":"htf7d4e42b77","date":"2022-10-06","name":"Bnb Bridge","kind":"fraud","fam":"insider","tech":"Pseudo-authentication","chains":["BNB Chain"],"usd":586000000.0,"conf":"A","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/bnb-bridge-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1578220472373649408"}],"desc":"BNBChain was attacked and lost more than 500 million US dollars. According to SlowMist, the hacker’s initial source of funds was ChangeNOW, and the hacker’s address has interacted with multiple DApps, including Multichain, Venus Protocol, Alpaca Finance, Stargate, Curve, Uniswap, Trader Joe, PancakeSwap, SushiSwap, etc. Analyst @samczsun posted a post explaining how hackers used Binance Bridge to steal BNB. The attackers stole 1 million BNB twice, but both used the height of 110217401, which is much lower than the normal height. Furthermore, the proof submitted by the attacker is shorter than the legitimate proof, showing that the attacker forged the proof for that particular block. The specific method is to add a new leaf node when the COMPUTEHASH function generates a hash, and then create a blank internal node to satisfy the prover, and exit early after finding a matching hash with the internal node. So far, only two fake verifications have been generated in this way."},{"id":"ht72cc8a00ff","date":"2022-10-06","name":"Binance Bridge","kind":"hack","fam":"bridge","tech":"Proof Verifier Bug","target":"DeFi Protocol","chains":["BNB Chain"],"usd":570000000.0,"lo":570000000.0,"hi":586000000.0,"ret":430000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/binance-smart-chain-halts-after-bridge-exploit"}],"desc":"On October 4-6, 2022 the BNB Chain's BSC Token Hub bridge (connecting BEP2 and BEP20) was exploited via incomplete Merkle proof verification in the bridge contract, allowing an attacker to forge proofs and mint 2 million BNB (~$570 million). Binance paused the chain on October 6; roughly $137M bridged out before containment; $433M remained frozen.","theft":true},{"id":"ht9a5927717d","date":"2022-10-06","name":"RES Token","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":290000.0,"lo":290000.0,"hi":290000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 6, 2022, RES Token was exploited via a flash loan attack that manipulated the pool price. The attacker used the thisAtoB function to swap tokens multiple times at artificially inflated prices, extracting ~$290K in repeated transactions.","theft":true,"onchain":true},{"id":"htcc98ff41f1","date":"2022-10-05","name":"Sex DAO","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh_hk/articledetails/6jry6n1d4iu7.html"}],"desc":"The Web3 social platform Sex DAO is suspected to have been Rug. The original white paper has been deleted. Over 220,000 USDT and 4.17 billion SED (SEXDAO Token) have been transferred on the chain. Currently, the Sex DAO official website and official Twitter account are inaccessible.","theft":true},{"id":"htfd6c081a28","date":"2022-10-04","name":"Sovryn","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["RSK","Ethereum","Bitcoin"],"usd":1100000.0,"lo":1100000.0,"hi":1125536.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/sovryn-rekt"},{"s":"SlowMist Hacked","u":"https://www.sovryn.app/blog/interim-exploit-update"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/more-than-1-1-million-stolen-from-sovryn-defi-protocol"}],"desc":"On October 4, 2022, Sovryn's legacy Lend/Borrow pool was exploited via cross-contract reentrancy in closeWithDeposit. Attacker manipulated iToken price through fallback functions triggered by RBTC/rUSDT transfers, draining 44.9368 RBTC and 282,351.9644 rUSDT (~$1.1M).","theft":true},{"id":"ht11b00d2ab7","date":"2022-10-01","name":"Transit Swap","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":24950000.0,"lo":21000000.0,"hi":28900000.0,"ret":15000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/transit-swap-rekt"},{"s":"SlowMist Hacked","u":"https://slowmist.medium.com/cross-chain-dex-aggregator-transit-swap-hacked-analysis-74ba39c22020"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/transit-swap-hacked-for-21-million-hacker-returns-large-portion"}],"desc":"On 2022-10-02 an attacker exploited a missing payer check in Transit Swap's claimTokens function, pulling tokens from any wallet with an approval to the contract across Ethereum and BSC. Transit Swap lost $28.9 million; the attacker was traced and returned funds the following day.","theft":true,"onchain":true},{"id":"ht97dbf942d0","date":"2022-10-01","name":"BabySwap","kind":"hack","fam":"code","tech":"Parameter Access Control","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht78789a439e","date":"2022-10-01","name":"RL Token","kind":"hack","fam":"code","tech":"Incorrect Reward calculation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht29a9f6808c","date":"2022-09-30","name":"Thunder Brawl","kind":"hack","fam":"code","tech":"Reentrancy","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htf05ab8db92","date":"2022-09-28","name":"BXH","kind":"hack","fam":"market","tech":"Flash Loan Attack","target":"CEX","chains":["BNB Chain"],"usd":40305.0,"lo":40305.0,"hi":40305.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/300625"}],"desc":"The TokenStakingPoolDelegate contract updated by BXH after the last attack suffered another flash loan attack. The contract lost 40,085 USDT, and the attacker made a profit of 31,794 USDT after paying off the flash loan fee. After analysis, this attack is caused by the use of getReserves() in the contract's getITokenBonusAmount function to obtain the instantaneous quotation, so that the attacker can make a profit by manipulating the quotation.","theft":true,"onchain":true},{"id":"htbbc691004b","date":"2022-09-27","name":"MEV Bots","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":1479777.0,"lo":1469700.0,"hi":1500000.0,"conf":"A","n":4,"src":[{"s":"rekt.news","u":"https://rekt.news/ripmevbot"},{"s":"SlowMist Hacked","u":"https://rekt.news/ripmevbot/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mev-bot-earns-over-1-million-in-profit-loses-almost-1-5-million-in-hack-an-hour-later"}],"desc":"A bot named 0xbadc0de made a windfall when traders tried to sell 1.8 million cUSDC (USDC on the Compound protocol) ($1.85 million in nominal value), but only got $500 of the asset due to low liquidity in return. However, the MEV bot made a profit of 800 ETH (~$1 million) from the sold carry trade. An hour later, a hacker exploited a bug in 0xbadc0de's badc code to withdraw all 1,101 ETH (~$1.5 million) in the contract.","theft":true,"onchain":true},{"id":"hte53bc1f339","date":"2022-09-25","name":"Four NFTs valued at at least $150,000 stolen from Jason Falovitch","kind":"hack","fam":"other","chains":["Ethereum"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/four-nfts-valued-at-at-least--stolen-from-jason-falovitch"}],"theft":true,"headline":true},{"id":"ht604faebd84","date":"2022-09-23","name":"RADT-DAO","kind":"hack","fam":"other","tech":"pair manipulate","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht957c29a899","date":"2022-09-21","name":"BXH","kind":"hack","fam":"keys","tech":"Private Key Leakage","target":"CEX","usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.cnyes.com/news/id/4962622"}],"desc":"According to the SlowMist security team, according to the BXH Stupid Kids team’s announcement on September 23, a total of $2.5 million worth of assets and 38 million BXH tokens were stolen the night before yesterday (September 21). According to the analysis and evaluation of SlowMist MistTrack, the private key of the original owner of the BXH VaultPool contract is suspected to be stolen, and the inCaseTokensGetStuck function is called to transfer the funds in the contract to the hacker's address. The hacker's address is 0x158f...e345. Up to now, the hacker has exchanged the stolen funds to the ETH chain across the chain, and further transferred all the stolen funds to Tornado Cash, with a total transfer amount of 1865 ETH.","theft":true},{"id":"htdad323da4c","date":"2022-09-20","name":"Wintermute","kind":"hack","fam":"social","tech":"Phishing","target":"Other","chains":["Ethereum"],"usd":160000000.0,"lo":160000000.0,"hi":160000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/wintermute-rekt-2"},{"s":"SlowMist Hacked","u":"https://twitter.com/EvgenyGaevoy/status/1572329148411936770"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wintermute-hacked-for-160-million"}],"desc":"On September 20, 2022, Wintermute's $160M DeFi hot wallet was compromised. Attacker brute-forced the private key using a weak 32-bit seed from the Profanity vanity address generator; only DeFi operations were affected.","theft":true},{"id":"htbc92de84de","date":"2022-09-20","name":"Investors seek to recoup around $30 million from Canadian \"Crypto King\" in his early 20s","kind":"fraud","fam":"insider","usd":29500000.0,"lo":29500000.0,"hi":29500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/investors-seek-to-recoup-around-35-million-from-canadian-crypto-king-in-his-20s"}],"headline":true},{"id":"ht1ea3ecd86c","date":"2022-09-19","name":"SEC files emergency action to stop CryptoFX scam","kind":"fraud","fam":"insider","usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sec-files-emergency-action-to-stop-cryptofx-scam"}],"headline":true},{"id":"htfee1747be6","date":"2022-09-18","name":"GMX V1 EVM","kind":"hack","fam":"market","tech":"Stale Price Arbitrage","target":"DeFi Protocol","chains":["Arbitrum","Avalanche"],"usd":565000.0,"lo":400000.0,"hi":565000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/whale-illustrates-price-manipulation-risk-in-gmx-exchange"}],"desc":"GMX V1's AVAX/USD perpetuals were drained via wash trades on CEXs that manipulated oracle-reported prices, allowing arbitrage at zero slippage.","theft":true},{"id":"ht03b04515ce","date":"2022-09-18","name":"Scammer earns 13 ETH ($17,500) from fake Mutant Ape scheme","kind":"scam","fam":"social","chains":["Ethereum"],"usd":17515.0,"lo":17515.0,"hi":17515.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-mutant-ape-results-in-13-ETH-17500-loss"}],"theft":true,"headline":true},{"id":"htea1c789f31","date":"2022-09-16","name":"Binance accounting bug involving Helium tokens results in $19 million of erroneous payouts","kind":"hack","fam":"other","chains":["Ethereum"],"usd":19000000.0,"lo":19000000.0,"hi":19000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/binance-accounting-bug-involving-helium-tokens-results-in-19-million-of-erroneous-payouts"}],"theft":true,"headline":true},{"id":"ht8c6881e914","date":"2022-09-15","name":"Vulnerability discovered in vanity wallet generator puts millions of dollars at risk","kind":"hack","fam":"other","chains":["Ethereum"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vulnerability-discovered-in-vanity-wallet-generator-puts-millions-at-risk"}],"theft":true,"headline":true},{"id":"ht8e052757e4","date":"2022-09-14","name":"\"Double your money\" scammers capitalize on Ethereum merge","kind":"scam","fam":"social","chains":["Ethereum"],"usd":314307.0,"lo":314307.0,"hi":314307.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/double-your-money-scammers-capitalize-on-ethereum-merge"}],"theft":true,"headline":true},{"id":"htd4e0a08fbb","date":"2022-09-13","name":"MevBot private tx","kind":"hack","fam":"code","tech":"Incorrect access control","chains":["BNB Chain"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htba40422cc3","date":"2022-09-11","name":"Dogechain","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xCrumbs/status/1568918333352714241"}],"desc":"In a tweet, @0xCrumbs disclosed that Dogechain was hacked yesterday, and the attackers exploited the vulnerability to mint 9.7 million $Doge (about $600,000) and transfer $316,000 through a cross-chain bridge. Currently 3 million remain in the starting wallet, in addition to $100,000 worth of USDC/ETH. Therefore, @0xCrumbs believes that yesterday's Dogechain maintenance was caused by the attack. SlowMist also tweeted that the attackers used Anyswap to bridge funds to the BSC and ETH chains, which were then transferred to Binance. But Dogechain officials tweeted that no funds were lost during the maintenance period.","theft":true},{"id":"ht1f24d8dc8f","date":"2022-09-09","name":"DPC","kind":"hack","fam":"code","tech":"Incorrect Reward calculation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htfcd077bcea","date":"2022-09-08","name":"New Free DAO","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1250000.0,"lo":1250000.0,"hi":1250000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mobile.twitter.com/SlowMist_Team/status/1567854876633309186"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/new-free-dao-loses-1-25-million-in-flash-loan-attack"}],"desc":"New Free DAO was exploited via flash loans when the reward calculation relied solely on deposited balance without protection. The attacker repeatedly flash-loaned funds to claim disproportionate rewards and drain ~$1.25 million in WBNB.","theft":true,"onchain":true},{"id":"ht39b929d2a1","date":"2022-09-08","name":"Ragnarok Online Invasion","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Gaming","chains":["BNB Chain"],"usd":44000.0,"lo":44000.0,"hi":44000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Ragnarok Online Invasion's ROI token contract on BSC was exploited on September 8, 2022 when an attacker called the unprotected transferOwnership function. Despite the contract having an onlyOwner modifier, it was not applied to the ownership transfer function, allowing unauthorized ownership changes and theft of ~158 BNB.","theft":true},{"id":"ht7301ef3fa7","date":"2022-09-08","name":"YYDS","kind":"hack","fam":"other","tech":"pair manipulate","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8d6e068dbb","date":"2022-09-07","name":"Investors face $11 million loss in VBit Technologies/Advanced Mining Group, an alleged crypto Ponzi scheme","kind":"fraud","fam":"insider","chains":["Bitcoin"],"usd":11000000.0,"lo":11000000.0,"hi":11000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/investors-face-11-million-loss-in-vbit-technologiesadvanced-mining-group-an-alleged-crypto-ponzi-scheme"}],"headline":true},{"id":"ht4a26c9ba1e","date":"2022-09-07","name":"GERA","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":1480000.0,"lo":1480000.0,"hi":1480000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GeraCoin/status/1567538962410995713"}],"desc":"The GERA token's deployer private key was compromised, allowing an attacker to transfer ownership of the smart contract to another address. This gave the attacker full control over the token contract.","theft":true},{"id":"htb8dcd73123","date":"2022-09-06","name":"Nereus Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Avalanche"],"usd":371000.0,"lo":371000.0,"hi":371000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/nereus-protocol/post-mortem-flash-loan-exploit-in-single-nxusd-market-343fa32f0c6"}],"desc":"Nereus Finance on Avalanche was exploited when the protocol lacked time-weighted average price protection for newly introduced collateral types. The attacker manipulated prices through Trader Joe and Curve, extracting $371,000 in USDC.","theft":true},{"id":"ht5b19ef4c55","date":"2022-09-06","name":"Flash loan attack nets attacker $370,000 from several sources","kind":"hack","fam":"other","chains":["Avalanche"],"usd":370000.0,"lo":370000.0,"hi":370000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/flash-loan-attack-nets-attacker-370000-from-several-sources"}],"theft":true,"headline":true},{"id":"hta60e1c12a4","date":"2022-09-06","name":"NXUSD","kind":"hack","fam":"market","tech":"flashloan price oracle manipulation","chains":["Avalanche"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht86e140cebe","date":"2022-09-05","name":"DAO Swap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":580000.0,"lo":580000.0,"hi":580000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1566606770650300416"}],"desc":"DaoSwap's reward system had a flaw allowing users to set themselves as their own inviter. Attackers exploited this access control vulnerability to gain unauthorized mining rewards by claiming referral bonuses.","theft":true},{"id":"ht1a0f3faacf","date":"2022-09-05","name":"ZoomproFinance","kind":"hack","fam":"market","tech":"Flashloans & Price Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3288acb16b","date":"2022-09-02","name":"ShadowFi","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":301000.0,"lo":298200.0,"hi":301000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1565549688509861888"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-exploits-bug-in-shadowfi-to-empty-300000-liquidity-pool"}],"desc":"ShadowFi's SDF token contract had flaws allowing unauthorized token burning. Attackers exploited the access control vulnerability in a two-phase attack to burn all SDF tokens in the liquidity pool and drain liquidity.","theft":true,"onchain":true},{"id":"ht82aea75861","date":"2022-09-02","name":"Crypto scam watchdog group launches NFT project, which is then exploited","kind":"scam","fam":"social","chains":["Ethereum"],"usd":4000.0,"lo":4000.0,"hi":4000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-scam-watchdog-group-launches-nft-project-which-is-then-exploited"}],"theft":true,"headline":true},{"id":"ht6a5ae516ea","date":"2022-09-01","name":"KyberSwap Classic","kind":"hack","fam":"keys","tech":"CDN Compromise","target":"DeFi Protocol","chains":["Polygon","Ethereum"],"usd":265000.0,"lo":265000.0,"hi":275000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/kyber-network-offers-bounty-following-265k-hack-of-decentralized-exchange"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attackers-steal-around-265000-of-user-funds-from-kyberswap-exchange"}],"desc":"KyberSwap frontend was compromised on September 1, 2022 via Google Tag Manager API key compromise, injecting malicious code that tricked whale wallets into approving fraudulent transfers, stealing $265K from 2 wallets.","theft":true},{"id":"htbd23e3b746","date":"2022-09-01","name":"Bad Guys by RPF","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"NFTfi","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The Bad Guys NFT WhiteListMint function failed to properly check the number of NFTs minted per wallet. Users could pass arbitrary amounts and bypass the one-per-wallet limit, allowing two accounts to mint approximately 450 of the 1,221 free NFTs.","theft":true,"onchain":true},{"id":"ht8f68681ec4","date":"2022-08-31","name":"Unable to recover from the April Rari exploit, Babylon Finance shuts down","kind":"collapse","fam":"insider","chains":["Ethereum"],"usd":3400000.0,"lo":3400000.0,"hi":3400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unable-to-recover-from-the-april-rari-exploit-babylon-finance-shuts-down"}],"headline":true},{"id":"ht8fe72d2813","date":"2022-08-31","name":"CUPID","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1564890919023034369"}],"desc":"The attacker made a profit of $78,622 through a flash loan on BNB Chain, causing the token CUPID to plummet by more than 90%, and the token VENUS to rise by more than 300% and then fall back.","theft":true},{"id":"htd63490b4d3","date":"2022-08-29","name":"Bill Murray","kind":"hack","fam":"keys","tech":"Mnemonic Leakage","chains":["Ethereum"],"usd":174000.0,"lo":174000.0,"hi":185000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/108882/bill-murray-ethereum-wallet-hacked-174k-nft-charity-auction"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bill-murrays-nft-charity-auction-nets-185000-which-is-then-immediately-stolen"}],"desc":"Actor and comedian Bill Murray's personal wallet was stolen, resulting in the loss of funds raised by the actor's charity NFT, hackers stole about 112.05 wETH (worth about $174,000), which was then converted into ETH and sent to 5 EOA, Eventually it was transferred to Binance. The transfer of stolen assets did not indicate any malicious behavior, indicating that a mnemonic phrase was most likely compromised.","theft":true},{"id":"htdfcb4ae4c1","date":"2022-08-29","name":"OptiFi","kind":"hack","fam":"code","tech":"Operation error","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/OptifiLabs/status/1564367455220219904"}],"desc":"Solana’s ecological derivative OptiFi tweeted that at around 6:00 UTC on August 29th, team members tried to update and upgrade on Solana, but the OptiFi mainnet program was shut down due to an operation error and could not be recovered, of which 661,000 USDC Locked (95% of funds are owned by team members), all user funds will be compensated.","theft":true},{"id":"ht4e858c2ddb","date":"2022-08-28","name":"DDC","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":104600.0,"lo":104600.0,"hi":104600.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1564240190851383302"}],"desc":"DDC was exploited and lost $104,600. The cause of the event is the problem of arbitrarily deducting pool fees.","theft":true},{"id":"ht4ad4b31980","date":"2022-08-27","name":"Sui","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Mysten_Labs/status/1563546631269597187"}],"desc":"Public chain project Sui tweeted that its Discord server had been hacked, and asked users not to click on any links posted on the Discord server in the past 8 hours. According to some replies to the tweet, some users have already lost money by clicking on links posted by the hackers on Sui Discod.","theft":true},{"id":"ht6df693505d","date":"2022-08-26","name":"CEO of Ragnarok metaverse game admits to treasury mismanagement, including nearly $2 million in trading losses and exorbitant salaries","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":1827000.0,"lo":1827000.0,"hi":1827000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ceo-of-ragnarok-metaverse-game-admits-to-treasury-mismanagement"}],"headline":true},{"id":"ht3c6b9321ae","date":"2022-08-24","name":"PokémonFi","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":708000.0,"lo":708000.0,"hi":708000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1562555089306685440"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/latest-pokmon-themed-rug-pull-nets-708000"}],"desc":"Pokémon piracy project PokémonFi has RugPull, the project and token first launched in April, the project recently deleted its Twitter account, but its website still exists.","theft":true},{"id":"ht4ad18f2872","date":"2022-08-24","name":"KaoyaSwap","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":118000.0,"lo":118000.0,"hi":118000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1562286943957708800"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/dWZexhFIxZKJRu1W-8nv5g"}],"desc":"KaoyaSwap's swap function had faulty logic allowing attackers to manipulate token calculations. Using a flashloan, an attacker exploited the vulnerability to extract value from the protocol's swap mechanism.","theft":true},{"id":"ht858e8d9775","date":"2022-08-24","name":"LuckyTiger NFT","kind":"hack","fam":"other","tech":"Predicting Random Numbers","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hta30aa5fd88","date":"2022-08-23","name":"SudoRare","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["Ethereum"],"usd":800000.0,"lo":800000.0,"hi":820000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Brentsketit/status/1561957211064020995"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/sudorare-nft-exchange-rug-pulls-for-820000"}],"desc":"SudoRare NFT AMM platform operated for 6 hours before founders used admin privileges to drain 519 ETH ($800K) from the liquidity pool and disappeared.","theft":true},{"id":"ht2c43469d52","date":"2022-08-20","name":"Someone buys a Bored Ape, gets scammed out of it two hours later","kind":"scam","fam":"social","chains":["Ethereum"],"usd":116000.0,"lo":116000.0,"hi":116000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/someone-buys-a-bored-ape-gets-scammed-out-of-it-two-hours-later"}],"theft":true,"headline":true},{"id":"ht4d2c87239c","date":"2022-08-20","name":"OpenSea's stale listing issue burns another collector","kind":"hack","fam":"other","chains":["Ethereum"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"ret":20000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/openseas-stale-listing-issue-burns-another-collector"}],"theft":true,"headline":true},{"id":"ht4d057ed42c","date":"2022-08-20","name":"Rainbow Bridge","kind":"hack","fam":"bridge","tech":"Fake NEAR blocks","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AlexAuroraDev/status/1520810591803293696"}],"desc":"Aurora Labs CEO Alex Shevchenko revealed that an attacker trying to steal funds from Rainbow Bridge was stopped in 31 seconds, losing 5 ETH in the process.","theft":true},{"id":"htbb2ad8d548","date":"2022-08-18","name":"The Bribe Protocol","kind":"rugpull","fam":"insider","tech":"Scam","chains":["Ethereum"],"usd":5500000.0,"lo":5500000.0,"hi":5500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1560307514381459456"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bribe-protocol-team-disappears-after-raising-5-5-million"}],"desc":"The Bribe Protocol promised a DAO infrastructure tool where \"token holders get paid to govern\", and raised $5.5 million in funding in January to work on their extensive roadmap. However, the project leaders have effectively disappeared. There are no posts on the project's Twitter account since May, their Medium page has been untouched since March.","theft":true},{"id":"ht9320064749","date":"2022-08-18","name":"DegenTown NFT project rug pulls after promotion from Magic Eden","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":923000.0,"lo":923000.0,"hi":923000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/degentown-nft-project-rug-pulls"}],"theft":true,"headline":true},{"id":"ht07e5e8854b","date":"2022-08-18","name":"Experienced crypto trader suffers $470,000 theft after signing malicious message","kind":"hack","fam":"other","usd":469146.0,"lo":469146.0,"hi":469146.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/experienced-crypto-trader-suffers-470000-theft-after-signing-malicious-message"}],"theft":true,"headline":true},{"id":"ht2adb12ff4e","date":"2022-08-18","name":"Celer cBridge","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Multiple"],"usd":240000.0,"lo":240000.0,"hi":240000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/CelerNetwork/status/1560123830844411904"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/celernetwork-suffers-dns-hijacking-attack"}],"desc":"The cBridge DNS was hijacked, redirecting users to malicious smart contracts. Users who approved transactions on the fake site had their approved token amounts drained.","theft":true},{"id":"ht72317551ef","date":"2022-08-16","name":"Hodlnaut applies for creditor protection","kind":"collapse","fam":"insider","usd":200000000.0,"lo":200000000.0,"hi":200000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hodlnaut-applies-for-creditor-protection"}],"headline":true},{"id":"ht93170c1350","date":"2022-08-16","name":"Circle","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":151600.0,"lo":151600.0,"hi":151600.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht8cb5fc77df","date":"2022-08-14","name":"Acala","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Acala","Polkadot"],"usd":52000000.0,"lo":1600000.0,"hi":52000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/acala-network-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/acalanetwork/updates-on-the-ausd-incident-22-august-2022-997efec98b35"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/misconfiguration-in-the-acala-stablecoin-project-allows-attacker-to-steal-1-2-billion-ausd"}],"desc":"A misconfiguration in the iBTC/aUSD liquidity pool's incentive mechanism allowed unlimited minting of aUSD tokens instead of LP tokens. Over 1.2 billion aUSD were minted before the network was paused and funds recovered.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5614a60425","date":"2022-08-14","name":"Brazilian crypto lender BlueBenx halts customer withdrawals and lays off employees after $32 million \"hack\"","kind":"hack","fam":"other","usd":32000000.0,"lo":32000000.0,"hi":32000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/brazilian-crypto-lender-bluebenx-halts-customer-withdrawals-and-lays-off-employees-after-32-million-hack"}],"theft":true,"headline":true},{"id":"ht84211d6b59","date":"2022-08-14","name":"Collector loses four Bored Apes valued at over $500,000 to phishing attack","kind":"scam","fam":"social","chains":["Ethereum"],"usd":546000.0,"lo":546000.0,"hi":546000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/collector-loses-four-bored-apes-valued-at-over-500000-to-phishing-attack"}],"theft":true,"headline":true},{"id":"htbd944c5ec0","date":"2022-08-13","name":"Scammer trades fake ApeCoins for Bored Ape NFT","kind":"scam","fam":"social","chains":["Ethereum"],"usd":163770.0,"lo":163770.0,"hi":163770.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-trades-fake-apecoins-for-bored-ape-nft"}],"theft":true,"headline":true},{"id":"ht0b4d00dff1","date":"2022-08-13","name":"Circle","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["Ethereum"],"usd":50500.0,"lo":50500.0,"hi":50500.0,"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht5edbd1db06","date":"2022-08-12","name":"Martin Shkreli dumps his project's token in \"hack\"","kind":"rugpull","fam":"insider","usd":459261.0,"lo":459261.0,"hi":459261.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/martin-shkreli-dumps-his-projects-token-in-hack"}],"theft":true,"headline":true},{"id":"hta56f85d462","date":"2022-08-10","name":"Blur Finance","kind":"rugpull","fam":"insider","tech":"Exit Scam","target":"DeFi Protocol","chains":["BNB Chain","Polygon"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2022/08/10/more-than-600k-vanishes-from-defi-project-blur-finance-as-developers-disappear"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blur-finance-rug-pulls-for-over-600000"}],"desc":"On August 10, 2022, Blur Finance developers executed a coordinated exit scam, withdrawing $600K from BSC and Polygon contracts, deleting social media, and disappearing, collapsing the token 99%.","theft":true},{"id":"ht681e77c8d0","date":"2022-08-10","name":"XSTABLE Protocol","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"XSTABLE Protocol suffered an exploit due to incorrect logic checks in its smart contract. The attack caused the XST token price to drop 98.4% and led to the protocol's website and social media channels being taken down.","theft":true},{"id":"ht24ee630d46","date":"2022-08-09","name":"Curve DEX","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":575000.0,"lo":428000.0,"hi":620000.0,"ret":620000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/curve-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/CurveFinance/status/1557107088962224132"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/curve-finance-frontend-compromised"}],"desc":"On August 9, 2022, Curve Finance's DNS provider (iwantmyname) was hijacked, redirecting users to a malicious frontend that injected token approval transactions. Curve's smart contracts remained secure; the team quickly identified and reverted the issue.","theft":true,"review":["recovered above loss"]},{"id":"hta95e806497","date":"2022-08-09","name":"ANCH","kind":"hack","fam":"other","tech":"Skim token balance","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"htd385994f89","date":"2022-08-08","name":"Dragoma","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Polygon"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/brand-new-dragoma-move-to-earn-game-rug-pulls"}],"desc":"Dragoma move-to-earn game was a rug pull. The core team exploited admin privileges immediately after listing on MEXC, withdrawing funds and abandoning the project, crashing the token 99.8%.","theft":true},{"id":"htf1aaef5ee4","date":"2022-08-08","name":"\"Animate your Bored Ape\" scammers linked to more phishing attacks amounting to more than $2.5 million","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/animate-your-bored-ape-scammers-linked-to-more-phishing-attacks"}],"theft":true,"headline":true},{"id":"htf68e0a3780","date":"2022-08-07","name":"Saxon James Musk","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":442000.0,"lo":442000.0,"hi":442000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1556151766076497921"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/saxon-james-musk-token-developer-rug-pulls-for-around-442000"}],"desc":"Saxon James Musk has Rug Pull. Project developers suddenly sold their token share for around 1355 WBNB (~$442,000), causing the token price to plummet by over 68%.","theft":true},{"id":"hta558adf37a","date":"2022-08-07","name":"EGD Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":36000.0,"lo":36000.0,"hi":36000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/t3k6b3m6.html"}],"desc":"EGD Finance's reward calculation directly relied on token price without flash loan protection. Attackers used a flashloan to manipulate the USDT/EGD ratio in the PancakeSwap pool, artificially inflating EGD price and claiming excessive rewards.","theft":true,"onchain":true},{"id":"htc1e3b2a416","date":"2022-08-06","name":"Steven Galanis","kind":"hack","fam":"other","tech":"Apple ID was hacked","chains":["Ethereum"],"usd":231000.0,"lo":231000.0,"hi":231000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Mr312/status/1556080763828944897"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-compromises-wallet-of-steven-galanis-ceo-of-cameo-app-stealing-231000"}],"desc":"A hacker compromised the wallet belonging to Steven Galanis, the CEO of Cameo, an app that allows people to pay various celebrities to record short messages for them. The hacker took 9,457 ApeCoin (~$69,000), 2.3 ETH (~$3,900), a Bored Ape NFT, three Otherside land plots, and other various NFTs. The hacker then flipped the Bored Ape for 77 ETH (~$131,000), and the other NFTs for a combined 16 ETH (~$27,000).","theft":true},{"id":"ht06efabf219","date":"2022-08-06","name":"GenomesDAO","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Polygon"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://panewslab.com/zh/articledetails/5rit2a09.html"}],"desc":"According to SlowMist, the GenomesDAO project on MATIC was attacked by hackers, resulting in the unexpected withdrawal of funds in its LPSTAKING contract. This incident is because the LPSTAKING contract of GenomesDAO can be arbitrarily repeatedly initialized and set key parameters, resulting in the malicious exhaustion of the collateral in the contract.","theft":true},{"id":"ht450425872b","date":"2022-08-04","name":"Velodrome","kind":"hack","fam":"other","tech":"Internal evil","chains":["Optimism","Ethereum"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"ret":350000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/VelodromeFi/status/1558499944562151425"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/team-member-admits-to-taking-more-than-400000-from-velodrome-to-try-to-recoup-personal-losses"}],"desc":"On August 4, Team at Velodrome, an AMM project built on Optimism, noticed that $350,000 had been taken from a team-operated wallet that was normally used for operational funds. They announced they were beginning an investigation into the theft, which they initially believed was due to a compromised wallet. Their team member Gabagool tweeted more details, underscoring that no user funds were lost. On August 13, Gabagool posted a long confession to his Twitter account, writing that he had stolen the $350,000, and had previously taken $56,000 over the course of two months, to try to \"revenge trade\" the money he had lost in the crypto crash. Explaining why he took the $350,000, he wrote, \"I thought I could make the 56k back and return all of the funds, which was delusional\". He also wrote that \"the majority of the funds have been returned to the Velodrome team. The rest will be.\" Velodrome later confirmed they had recovered all of the stolen money.","theft":true,"review":["sources disagree on the date"]},{"id":"ht66aaaedaa5","date":"2022-08-04","name":"EtnProduct","kind":"hack","fam":"code","tech":"Business Logic Flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"ht13e1580e07","date":"2022-08-03","name":"Solana","kind":"hack","fam":"other","tech":"Unknown","chains":["Solana"],"usd":8000000.0,"lo":6000000.0,"hi":8000000.0,"conf":"B","n":3,"src":[{"s":"rekt.news","u":"https://rekt.news/unsolved-mystery"},{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/h5Detail/8076"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thousands-of-solana-wallets-drained"}],"desc":"A large-scale incident of currency theft occurred on the Solana public chain, and a large number of users were transferred SOL and SPL tokens without their knowledge. According to SlowMist MistTrack statistics, more than 8,000 Solana wallets have been stolen so far. Assets are valued at approximately $4.5 million.","theft":true},{"id":"htcc363f5b67","date":"2022-08-03","name":"Qixi","kind":"hack","fam":"other","tech":"Underflow","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"hta1393e86c2","date":"2022-08-02","name":"Nomad","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"DeFi Protocol","chains":["Ethereum"],"usd":190000000.0,"lo":154000000.0,"hi":190000000.0,"ret":37000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/nomad-rekt"},{"s":"SlowMist Hacked","u":"https://zerion.io/blog/nomad-bridge-hack/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nomad-bridge-exploit"}],"desc":"On August 1, 2022, Nomad bridge was exploited when the protocol initialization set trusted roots to 0x00, matching the untrusted root value. This caused the Replica contract to accept any messages as valid, enabling 300+ copycat attackers to drain $190M total.","theft":true},{"id":"htc6879bb96b","date":"2022-08-02","name":"Slope Wallet","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"Wallet","chains":["Solana"],"usd":4100000.0,"lo":4000000.0,"hi":4100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1711748033954590900"}],"desc":"On August 2-3, 2022, attackers drained 9,231 Solana wallets when Slope Finance's mobile apps shipped user seed phrases in plaintext to an external logging service, exposing credentials outside the device. Every affected address had been created, imported, or used in the Slope iOS/Android apps.","theft":true},{"id":"ht1549695cdd","date":"2022-08-01","name":"ZB Exchange","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Multiple"],"usd":4300000.0,"lo":3600000.0,"hi":4800000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://news.cnyes.com/news/id/4925357"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/zb-crypto-exchange-exploited-for-more-than-3-5-million"}],"desc":"ZB Exchange's hot wallet was compromised, resulting in the theft of multiple cryptocurrencies including USDT and others. The attacker converted stolen tokens to approximately 2,224 ETH on decentralized exchanges.","theft":true},{"id":"htc5c36f9600","date":"2022-08-01","name":"Reaper Farm","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Fantom"],"usd":1698423.0,"lo":1698423.0,"hi":1700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1554423041232629761"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/reaper-farm-exploited-for-around-1-7-million"}],"desc":"ReaperVaultV2 contract's withdraw function failed to validate vault share ownership. Attackers exploited this access control flaw to destroy other users' vault shares and withdraw tokens from multiple vaults.","theft":true},{"id":"ht245146b418","date":"2022-07-29","name":"Restructuring plans reveal Babel Finance's $225 million losses during crypto market dip","kind":"collapse","fam":"insider","chains":["Bitcoin","Ethereum"],"usd":225000000.0,"lo":225000000.0,"hi":225000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/restructuring-plans-reveal-babel-finances-225-million-losses-during-crypto-market-dip"}],"headline":true},{"id":"htb0429c2baf","date":"2022-07-28","name":"Nirvana V1","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Solana"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/nirvana-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/nirvana_fi/status/1552635546626818058"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nirvana-finance-drained-of-3-5-million"}],"desc":"Nirvana V1 lost $3.5M on July 28, 2022 to a flashloan attack via Solend. Attacker borrowed 10M USDC, minted 10M+ ANA at artificially low prices by manipulating the oracle, swapped for USDT, and repaid the flashloan. ANA crashed 85% from $8.97 to $0.81.","theft":true},{"id":"hte3166ae19e","date":"2022-07-26","name":"TBIS","kind":"fraud","fam":"insider","tech":"Scam","usd":21000000.0,"lo":21000000.0,"hi":21000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theverge.com/2022/7/26/23278995/titanium-blockchain-ceo-michael-stollery-guilty-plea"}],"desc":"CEO Michael Stollery of Titanium Blockchain Infrastructure Services (TBIS) pled guilty to securities fraud in connection to a $21 million cryptocurrency scam. The company promoted its BAR token during 2017–2018, and did not register with the SEC for its ICO. TBIS made false claims including that they had ties to companies including Apple, Boeing, and IBM, and offered various services that did not actually exist. At least 75 people participated in the ICO, giving TBIS a combined $21 million, some of which went directly to Stollery's bank account and personal expenses like a condo in Hawaii."},{"id":"htd5fc35b30b","date":"2022-07-25","name":"DRAC Network","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://tokeninsight.com/en/news/peckshieldalert-defi-project-drac-network-appeared-rug-pull?at_medium=RSS"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/4-5-million-taken-from-teddy-doge-project-in-apparent-rug-pull"}],"desc":"DeFi project DRAC Network appeared Rug Pull, with the price of the token $TEDDY dropping 99.4%. 10,000 $BNB and 2 million $BUSD have been slowly transferred to Binance. It is said that the deployer deployed the contract and transferred a large quantity of $TEDDY to [address], then pump and dump the price of $TEDDY.","theft":true},{"id":"ht1f7f86ed22","date":"2022-07-25","name":"LPC","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"LPC's _transfer function incorrectly calculated balances when sender and recipient addresses were the same. Attackers used a flashloan to exploit this logic error and extract value.","theft":true},{"id":"hta9ca027ce9","date":"2022-07-24","name":"Neopets","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/159250/neopets-stung-by-major-hack"}],"desc":"The online game Neopets said it encountered a hack and is currently investigating a customer data breach. The Neopets hack may affect 69 million users, and a hacker named TarTarX sold the source of the Neopets website for 4 bitcoins code and database. Neopets recently launched NFTs for its online virtual world games.","theft":true},{"id":"htc28b633eb6","date":"2022-07-23","name":"Audius","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":1101343.0,"lo":1100000.0,"hi":6000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/audius-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/AudiusProject/status/1551377708722008065"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-makes-off-with-1-1-million-after-successful-governance-attack-on-the-audius-web3-music-platform"}],"desc":"On July 23-25, 2022, Audius governance contracts were compromised when an attacker exploited a missing initialization guard allowing repeated invoke() calls. The attacker drained 18 million AUDIO tokens (~$6M) from the treasury and attempted to delegate 10 trillion tokens to controlled wallets.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht18d95e5533","date":"2022-07-21","name":"My Big Coin","kind":"fraud","fam":"insider","tech":"Scam","usd":6000000.0,"lo":6000000.0,"hi":6000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.justice.gov/usao-ma/pr/my-big-coin-founder-convicted-cryptocurrency-fraud-scheme"}],"desc":"My Big Coin founder Crater has been found guilty of a cryptocurrency fraud scheme. Crater founded My Big Coin in 2013 to provide virtual payment services through the fraudulent digital currency \"My Big Coins,\" which he marketed to investors between 2014 and 2017 by misrepresenting the nature and value of Coins . Crater and his colleagues falsely claimed that Coins was a fully functional cryptocurrency backed by $300 million in gold, oil and other valuable assets. In reality, the coins are not backed by gold or other valuable assets, have no partnership with Mastercard, and are not easily transferable. Over the course of the scheme, Crater misappropriated more than $6 million in investor funds for personal gain and merchandise spending, including spending on antiques, art and jewelry worth hundreds of thousands of dollars."},{"id":"ht0db94fca10","date":"2022-07-21","name":"Tableland","kind":"hack","fam":"keys","tech":"Discord was hacked","chains":["Polkadot"],"usd":45819.0,"lo":45819.0,"hi":45819.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://docs.tableland.xyz/security/anatomy-of-a-fakemint"}],"desc":"The Tableland Discord server was compromised by malicious actors, successfully impersonating moderators on the channel and leading community members to a fake Tableland domain that funneled targeted assets from member ETH wallets. The perpetrators utilized a fakemint scheme, which lured community members using a pretense of an exclusive, limited mint. Instead, target victims were taken to a malicious website that tricked some of them into granting specific wallet permissions. Once granted, the perpetrators were able to siphon away Tableland Rigs and other NFTs","theft":true},{"id":"ht413b215df6","date":"2022-07-20","name":"Raccoon Network & Freedom Protocol","kind":"rugpull","fam":"insider","tech":"Scam","chains":["BNB Chain"],"usd":20000000.0,"lo":20000000.0,"hi":20816856.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://foresightnews.pro/news/detail/7414"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/20-million-taken-from-raccoon-network-and-freedom-protocol-in-likely-rug-pull"}],"desc":"Raccoon Network and Freedom Protocol are scam projects, scammers have transferred 20 million BUSD (IDO) to address 0xf800...469336.","theft":true},{"id":"htc34d33aadb","date":"2022-07-20","name":"NFT collector Franklin loses 100 ETH (~$150,000) in a joke gone wrong","kind":"other","fam":"other","chains":["Ethereum"],"usd":150646.0,"lo":150646.0,"hi":150646.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/collector-loses-100-eth-150000-in-a-joke-gone-wrong"}],"headline":true},{"id":"hte9773f4b47","date":"2022-07-19","name":"Tableland","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://textile.notion.site/Community-post-mortem-d9670ddb9bf54a59bd5a4a8912dcf0ec"}],"desc":"The permissions of the relevant administrators of the Discord of the Tableland project party were stolen. It is understood that after joining an external Discord server, Tableland members clicked the verification steps of a bot named \"Dyno\" and clicked a bookmark button with malicious javascript, and were then prompted to interact with the bookmark, triggering the malicious script to run. The attacker got hold of the admin account and posted a link on the announcement channel containing a fake website, anyone who clicked on the link and followed the wallet instructions would grant the attacker access to any NFTs held in their account.","theft":true},{"id":"hta90c3ef833","date":"2022-07-18","name":"FBI warns of fraudulent crypto apps that have stolen an estimated $42.7 million","kind":"hack","fam":"other","usd":42700000.0,"lo":42700000.0,"hi":42700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fbi-warns-of-fraudulent-crypto-apps"}],"theft":true,"headline":true},{"id":"ht3391e71ef4","date":"2022-07-17","name":"Premint","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"NFTfi","chains":["Ethereum"],"usd":375000.0,"lo":375000.0,"hi":680800.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/j5hz0v9c.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/premint-nft-tool-hacked-user-wallets-drained"}],"desc":"On July 16-17, 2022, Premint's frontend was compromised via a vulnerable open-source image upload tool that allowed an attacker to inject malicious JavaScript into a library file. The attacker created a malicious domain and updated the JavaScript to redirect to their code, which then tricked users into signing setApprovalForAll transactions, allowing theft of 314 NFTs including Bored Apes and Moonbirds.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht77e207b912","date":"2022-07-16","name":"Impermax","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Polygon"],"usd":9000000.0,"lo":9000000.0,"hi":9000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://impermax.medium.com/imx-incident-post-mortem-and-recovery-plan-aeecd4e457ce"}],"desc":"On July 16, 2022, private keys to Impermax team wallets were stolen, allowing the attacker to drain approximately 9 million IMX tokens and most of the protocol-owned liquidity. The team responded by frontrunning the attacker's potential sell-off and executed a token swap recovery plan from IMX to IBEX.","theft":true},{"id":"hte21b669316","date":"2022-07-16","name":"DeeKay","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://nftevening.com/hacker-target-nft-artist-deekays-twitter-wipe-nfts-worth-150k/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nfts-valued-at-150000-stolen-via-phishing-link-posted-to-the-hacked-twitter-account-of-nft-artist-deekay"}],"desc":"On July 16, hackers compromised the Twitter account of well-known NFT artist DeeKay. The 180,000 followers of DeeKay's hacked Twitter account saw it post a link announcing a limited number of new airdrops, which directed them to a phishing site that mimicked DeeKay's real site. One victim lost 4 Cool Cat NFTs and 3 Azuki NFTs with reserve prices around 4 ETH (~$5,350) and 12 ETH (~$16,200) respectively. The total value of the stolen NFTs was approximately $150,000. DeeKay said he wasn't sure how his Twitter account was stolen, but \"guessed that 2FA was shut down at a specific time.\"","theft":true},{"id":"ht0006432cda","date":"2022-07-14","name":"Boneheads rug pull for $3.1 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":3100000.0,"lo":3100000.0,"hi":3100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/boneheads-rug-pull"}],"theft":true,"headline":true},{"id":"hte7f34985ab","date":"2022-07-14","name":"Freeway","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/FreewayFi/status/1547306526863511558"}],"desc":"The pledge platform Freeway tweeted, “The price of its token FWT fluctuated violently on July 13 and is currently under investigation. Freeway’s blockchain bridging service provider Coffe was attacked, and a large number of FWT tokens were bridged from Coffe. The Freeway platform was not compromised in any way, nor was Supercharger. However, Freeway has temporarily disabled FWT withdrawals, deposits, and purchases on the platform,” crypto influencer FatManTerra claimed on Twitter. Projects are running a \"Ponzi scheme\" because large withdrawals are \"delayed\" even before they stop. He refers to stopping withdrawals as income of more than $100 million. FatManTerra states that the project has removed its team biographies. In an October 22 Twitter post, FatManTerra said Freeway's chief executive had made false statements about his background, which were removed from the site after FatManTerra confronted him.","theft":true},{"id":"hta5e8be8c30","date":"2022-07-14","name":"SpaceGodzilla","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/u25j5p3kdvu9.html"}],"desc":"SpaceGodzilla, a project on the BSC chain, was attacked by hackers with a flash loan. Hackers used flash loans to borrow large amounts of money, manipulated the price of SpaceGodzilla in the trading pool on PancakeSwap, and exploited vulnerabilities in the project for arbitrage. At present, the hacker has exchanged the 25,378.78 BUSD profited from this attack to BNB and transferred it through Tornado.Cash.","theft":true},{"id":"ht6ed99fbacf","date":"2022-07-13","name":"Celsius files for bankruptcy","kind":"collapse","fam":"insider","usd":1700000000.0,"lo":1700000000.0,"hi":1700000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/celsius-files-for-bankruptcy"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht1f188e011d","date":"2022-07-13","name":"SpaceGodzilla","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":25379.0,"lo":25000.0,"hi":25379.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1547456591900749824"}],"desc":"On July 13, 2022, SpaceGodzilla on BSC was exploited via a flash loan attack combined with price manipulation. The attacker borrowed 2.95M BUSD, swapped into SpaceGodzilla tokens to inflate the price in PancakeSwap, then swapped back to BUSD for a profit of 25,378 BUSD, which was converted to BNB and laundered through Tornado Cash.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht0e7c6d63e5","date":"2022-07-12","name":"Citizen Finance","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain","Polygon"],"usd":94300.0,"lo":94300.0,"hi":94300.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/citizen_finance/status/1546665208495673349"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/citizen-finance-claims-to-have-been-hacked-for-around-100000"}],"desc":"On July 12, 2022, Citizen Finance suffered an attack where an unauthorized party obtained access to private keys for BNB and Polygon chains. The attacker transferred 244 BNB (~$55K), 57,637 MATIC (~$32.3K), and 7,000 USDC for a total of ~$94.3K, causing the CIFI token to plummet over 50%.","theft":true},{"id":"ht547988bf07","date":"2022-07-11","name":"Vauld is short around $70 million","kind":"collapse","fam":"insider","chains":["Bitcoin","Ethereum","Polygon"],"usd":70000000.0,"lo":70000000.0,"hi":70000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vauld-is-short-around-70-million"}],"headline":true},{"id":"htaf957aa7c3","date":"2022-07-11","name":"Uniswap (Phishing Attack)","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Ethereum"],"usd":8167500.0,"lo":8000000.0,"hi":12900000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/sniko_/status/1546535668247060481"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uniswap-liquidity-pool-attack"}],"desc":"On July 11, 2022, a phishing campaign targeted Uniswap users by airdropping a malicious ERC20 token to 73,399 UNI holders, promising a $2K airdrop. When users interacted with the token to claim it, they signed malicious approvals granting the attacker access to their Uniswap V3 LP tokens. The attacker siphoned 7,574 ETH (~$8M) and moved 7,500 ETH through Tornado Cash.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht9322170116","date":"2022-07-10","name":"BiFi","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Ethereum","Bitcoin"],"usd":2253606.0,"lo":2253606.0,"hi":2253606.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://bifrost.medium.com/post-mortem-bifi-btc-illegal-address-registration-c21ce3ba9fc8"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/more-than-2-25-million-stolen-from-bifrosts-bifi-platform"}],"desc":"BIFROST officially released a report saying that the BTC address registration server of the BiFi service was attacked. According to the analysis, the attack was limited to the BTC address registration server, and neither the smart contract nor the BiFi protocol detected the vulnerability. BiFi issues and uses an address for each user who deposits BTC. The deposit addresses are signed and delivered to the address issuing server and the addresses are reflected on BiFi only in the case when the signature is verified. In the attack, the server key of the address issuing server was exposed and the attacker was able to self-sign their own deposit address. Since the attacker could generate a valid signature on the deposit address, BiFi mistakenly recognized the attacker’s BTC transfer as a BTC deposit into BiFi. As a result, the attacker was able to borrow 1,852 ETH with fake deposit.","theft":true},{"id":"ht35daa6cd16","date":"2022-07-10","name":"Omni","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1430000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/156800/hacker-drains-1-4-million-worth-of-eth-from-nft-lender-omni"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hackers-steal-1-43-million-from-omni-nft-lending-platform"}],"desc":"On July 10, 2022, Omni, an NFT money market, was exploited via reentrancy across two functions lacking reentrancy guards and not following the checks-effects-interactions pattern. The attacker used NFTs as collateral to borrow ETH, then cleared the debt at the reentrancy point, making the borrowing bad debt and removing the need to repay, stealing 1,300 ETH in testing funds.","theft":true,"onchain":true},{"id":"htfcdfdc55ee","date":"2022-07-06","name":"Voyager Digital files for bankruptcy","kind":"collapse","fam":"insider","usd":430000000.0,"lo":430000000.0,"hi":430000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/voyager-digital-files-for-bankruptcy"}],"headline":true},{"id":"ht621b1ebc12","date":"2022-07-06","name":"Report reveals that crypto investment firm Uprise lost 99% of customer funds trying to short Luna during its collapse","kind":"collapse","fam":"insider","chains":["Terra"],"usd":23500000.0,"lo":23500000.0,"hi":23500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/report-reveals-that-crypto-investment-firm-uprise-lost-99-of-customer-funds-trying-to-short-luna-during-its-collapse"}],"headline":true},{"id":"ht518d0727e2","date":"2022-07-06","name":"Shade Inu Token","kind":"scam","fam":"social","tech":"Scam","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/tFTNY5700G-QxrrRQT7O6A"}],"desc":"A fake Shade Inu Token project deployer removed approximately $101,000 (424 BNB) of liquidity from the liquidity pool. After investigation, this Shade Inu Token was identified as a scam, the project launched a fake Shade Inu Token, created a WBNB/SadeIT pool with the initial 200 BNB and provided liquidity to it, so the deployer made a total profit of about $53,000 ( 224 BNB).","theft":true},{"id":"ht5dae9073fb","date":"2022-07-05","name":"FlippazOne NFT","kind":"hack","fam":"other","tech":"Accesscontrol","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht6ded989e91","date":"2022-07-03","name":"The British Army","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.forbes.com/sites/carlieporterfield/2022/07/03/british-armys-youtube-and-twitter-accounts-hacked-and-flooded-with-crypto-posts/?sh=6fac1b63"}],"desc":"According to Forbes, the official Twitter and YouTube accounts of the British Army were hacked and posted about cryptocurrencies and NFTs. The Twitter account retweeted posts promoting NFTs, and the YouTube account uploaded a video about Elon Musk and cryptocurrencies. Currently, all NFTs and encrypted content have been removed from both accounts.","theft":true},{"id":"ht3442a81f14","date":"2022-07-02","name":"Crema Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Solana"],"usd":8800000.0,"lo":1682000.0,"hi":8800000.0,"ret":7120000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/crema-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Crema_Finance/status/1543416225622941696"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crema-finance-hacked-for-8-8-million"}],"desc":"On July 2, 2022, Crema Finance's Solana protocol was exploited when an attacker bypassed owner verification on tick accounts used for fee calculations. The attacker created a fraudulent tick account, obtained a flashloan from Solend, added liquidity to the CLMM pool, and exploited the manipulated pricing to drain $8.78M (69,500 SOL + $6.5M stablecoins).","theft":true,"review":["sources disagree on the loss"]},{"id":"htfbabb2188f","date":"2022-07-01","name":"Quixotic","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"NFTfi","chains":["Optimism","Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.defidaonews.com/article/6762124"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/quixotic-nft-marketplace-hacked"}],"desc":"On July 1, 2022, Quixotic NFT marketplace on Optimism was exploited due to a missing signature check in the fillSellOrder() function. The attacker minted NFTs, listed them for sale, and used the vulnerability to swap any victim's wallet tokens for the attacker's NFTs. The team paused all activity and reimbursed affected users.","theft":true,"onchain":true},{"id":"ht3c091d0da0","date":"2022-07-01","name":"Polygon & Fantom","kind":"hack","fam":"keys","tech":"DNS Hijacking Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://zh-cn.bitcoinethereumnews.com/technology/dns-hijack-compromised-ankrs-services-for-polygon-and-fantom/"}],"desc":"Polygon Chief Information Security Officer Mudit Gupta tweeted that two remote procedure call (RPC) interfaces of Polygon and Fantom were affected by a Domain Name System (DNS) hijacking attack on Friday. The reason was that a hacker hijacked Ankr's Domain Name System (DNS) to steal the user's seed stage, and Ankr quickly recovered the error and said no funds were lost.","theft":true},{"id":"htff8f025a9e","date":"2022-06-30","name":"U.S. Department of Justice charges founders of the $100 million EmpiresX ponzi scheme","kind":"fraud","fam":"insider","usd":100000000.0,"lo":100000000.0,"hi":100000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/us-department-of-justice-charges-founders-of-the-empiresx-ponzi-scheme"}],"headline":true},{"id":"ht204a9b68dc","date":"2022-06-30","name":"Quint","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1542493260114931712"}],"desc":"Metaverse project Quint was hacked and lost $130,000. The root cause of the attack is that when the reStake function executes the reStake reward reStake, the reward amount of the LP token is not updated, so that the attacker can claim the issued reward multiple times.","theft":true},{"id":"ht93e9e076db","date":"2022-06-30","name":"MAD","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":115681.0,"lo":115681.0,"hi":115681.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BeosinAlert/status/1542517440252624896"}],"desc":"$MAD was hacked, and the hacker transferred all $MAD in the contract by directly calling the transfer function of the contract holding the token, and finally made a profit of $556 BNB (worth about $115,681), which was then transferred to Tornado.Cash. The reason is that the sensitive function was not checked in the contract that holding tokens, resulting in anyone can directly call the 0x9763a894 function to transfer out the tokens held in the contract.","theft":true},{"id":"ht4227533c76","date":"2022-06-29","name":"Three Arrows Capital ordered to liquidate","kind":"collapse","fam":"insider","usd":3300000000.0,"lo":3300000000.0,"hi":3300000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/three-arrows-capital-ordered-to-liquidate"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht5abba944a1","date":"2022-06-26","name":"XCarnival","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":3800000.0,"lo":3800000.0,"hi":3800000.0,"ret":1900000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/XCarnival_Lab/status/1541060630748479488"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-makes-off-with-3-8-million-from-the-xcarnival-metaverse-bank"}],"desc":"On June 26, 2022, XCarnival NFT lending protocol was exploited via a vulnerability in collateral tracking where the orderID remained open after withdrawal. The attacker generated multiple contract addresses, used the same BAYC NFT as collateral, and repeated the deposit-borrow-withdraw cycle to obtain an infinite number of loans, siphoning 3,087 ETH (~$3.8M).","theft":true,"onchain":true},{"id":"ht53a15642fb","date":"2022-06-24","name":"Convex Finance","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ConvexFinance/status/1540104036229185536"}],"desc":"On June 23, 2022, Convex Finance's DNS was hijacked after a customer support agent at NameCheap was compromised. The attacker redirected www.convexfinance.com to a phishing site with malicious smart contracts mimicking the original addresses. At least 40 wallet addresses were tricked into approving transactions, though only limited tokens were stolen. Convex reimbursed all affected users from their treasury.","theft":true},{"id":"ht8b7d1d8ed1","date":"2022-06-24","name":"Ribbon","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":12000.0,"lo":12000.0,"hi":12000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://m.jinse.com/writings/1754332.html"}],"desc":"On June 24, 2022, Ribbon Finance suffered a similar DNS hijacking attack that same week, likely using similar methodology as the Convex attack. Users were redirected to a phishing site and tricked into approving malicious contracts, resulting in limited token losses and a mass withdrawal from the protocol.","theft":true,"review":["possible duplicate within one source"]},{"id":"htb9f9c0782a","date":"2022-06-23","name":"Harmony Bridge","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":100000000.0,"lo":100000000.0,"hi":100000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/harmony-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/harmonyprotocol/status/1540110924400324608"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/100-million-stolen-from-horizon-bridge"}],"desc":"Harmony's Horizon Bridge was hacked on June 23, 2022, stealing ~$100M across ETH, BNB, USDT, USDC, and DAI on Ethereum and BSC. Lazarus Group / APT38 (North Korea-affiliated) compromised validator private keys; the insufficient 2-of-5 validator quorum enabled the theft.","theft":true,"onchain":true,"actor":"North Korea (Lazarus Group, APT38)","attr":{"by":"FBI","date":"2023-01-23","title":"FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft","url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft"},"official":"$100M"},{"id":"ht7dfc867d08","date":"2022-06-23","name":"DeFiSaver","kind":"hack","fam":"keys","tech":"DNS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DeFiSaver/status/1540300787988979713"}],"desc":"One-stop asset management solution DeFiSaver tweeted that it experienced an attempted DNS attack and, according to its analysis, no users were affected. DeFi Saver said that what the DNS attack has in common with Convex Finance and Ribbon Finance is the domain name registration service Name cheap, reminding other projects to use it with caution.","theft":true},{"id":"ht3b2f772ac6","date":"2022-06-22","name":"pandorachainDAO","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":128000.0,"lo":128000.0,"hi":128000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://gostake.io/resource/news/7a9960908de49041e5e863fbb0b20463.html"}],"desc":"On June 22, 2022, pandorachainDAO on BSC suffered a flash loan attack exploiting price oracle manipulation. The attacker leveraged flash loans to artificially manipulate asset prices and execute profitable transactions on the platform, extracting approximately $128,000 in value.","theft":true},{"id":"ht5babff5d89","date":"2022-06-21","name":"LV PLUS","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/a7jhb1O9mHDc4Dnw5onn-Q"}],"desc":"The LV PLUS (Token LVP) project has been identified as a Rug Pull project. So far, the project has resulted in losses of about $1.5 million. LV PLUS claims to be affiliated with the \"LV Metaverse\", and the main reason for the loss, which is defined as a Rug Pull, is that the LV PLUS contract deployer sent tokens to certain wallets - these wallet addresses subsequently sold the project's tokens, causing the project's market to crash .","theft":true},{"id":"ht35e52654d9","date":"2022-06-21","name":"DHE","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":142000.0,"lo":142000.0,"hi":142000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1539031511114063873"}],"desc":"A Rug Pull occurred in the DHE project, causing the price of DHE tokens to drop by more than 91%. Total losses are currently around $142,000.","theft":true},{"id":"htb701aaec2e","date":"2022-06-21","name":"whaleswap.finance","kind":"hack","fam":"market","tech":"K value verification vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/xa9zc04d.html"}],"desc":"The whaleswap.finance project was attacked, and at least 5946 BUSD and 5964 USDT were lost. The reason may be that there is a problem with the K value verification of the whaleswap.finance Pair contract. Whenever the user exchanges, there is a problem with the parameter magnitude passed in the K value verification, which causes the K value verification to fail. The attacker first borrows a BSC-USD through a flash loan, and then returns the flash loan when the K value verification parameter is on the order of 10000^4. The parameter verification level used in the K value verification is 10000^2, which causes the K verification to fail.","theft":true},{"id":"ht002043d68c","date":"2022-06-20","name":"Two QAnon influencers running crypto scams steal more than $2 million from their followers","kind":"scam","fam":"social","usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/two-qanon-influencers-running-crypto-scams-steal-more-than-2-million"}],"theft":true,"headline":true},{"id":"ht5877dd531e","date":"2022-06-19","name":"LACOSTE","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=lacoste-discord-among-the-latest-to-be-hacked"}],"desc":"Clothing brand LACOSTE's Discord was hacked, and scammers posted phishing links on the announcement channel. Recently, the Discords of several projects have been attacked, including Clyde, Good Skellas, Duppies, Oak Paradise, Tasties, Yuko Clan, Mono Apes, ApeX Club, Anata, GREED, CITADEL, DegenIslands, Sphynx Underground Society, FUD Bois, and Uncanny Club etc.","theft":true},{"id":"hta64d273764","date":"2022-06-18","name":"SNOOD","kind":"hack","fam":"code","tech":"Reentrancy Attack","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://ethereum.stackexchange.com/questions/130472/attack-on-erc-777-smart-contract-and-uniswapv2pair-resulting-in-104-eth-liquidit"}],"desc":"The SNOOD ERC-777 smart contract was attacked, causing the liquidity of the UniswapV2Pair token to be completely drained (104 ETH).","theft":true,"onchain":true},{"id":"ht71c3683994","date":"2022-06-17","name":"Babel Finance","kind":"hack","fam":"other","tech":"Proprietary trading failure","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/160230/babel-finance-crypto-lost-280-million-proprietary-trading-restructuring"}],"desc":"Crypto Financial Services Provider Babel Finance Suspends Customer Withdrawals due to crypto market turmoil. In July, documents revealed that Babel Finance lost more than $280 million in bitcoin (BTC) and ether (ETH) as its proprietary trading failure. Specifically, it lost around 8,000 BTC and 56,000 ETH in June after facing liquidation due to a severe market downturn.","theft":true},{"id":"ht668c43fa55","date":"2022-06-16","name":"Inverse Finance Frontier","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":5800000.0,"lo":1260000.0,"hi":5800000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/inverse-rekt2"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/m20ffpy4.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-over-1-2-million-from-inverse-finance"}],"desc":"On June 16, 2022, Inverse Finance Frontier was exploited for $1.3M direct loss ($5.8M protocol loss) via oracle manipulation. Attacker flash-borrowed 27K wBTC, swapped into Curve tricrypto to inflate yvcrv3crypto LP price, then borrowed DOLA against inflated collateral.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht518864eb5f","date":"2022-06-14","name":"KnownOrigin","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=known-origin-discord-compromised"}],"desc":"KnownOrigin officially tweeted that its discord had been attacked, and reminded users not to click on any links. Other servers hacked in recent days include those of Curiosity, Meta Hunters, Parallel, Goat Society, RFTP and Gooniez.","theft":true},{"id":"ht7763440b2b","date":"2022-06-13","name":"ElonMVP","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":130000.0,"lo":130000.0,"hi":130000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.defidaonews.com/article/6757238"}],"desc":"The ElonMVP token suffered a Rug Pull, the token price fell by 99%, and over 622 BNB were transferred to Tornado.Cash, with a loss of about $130,000.","theft":true},{"id":"htbc2acf4911","date":"2022-06-13","name":"Fswap","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/fswap2021/status/1536413676688838663"}],"desc":"Fswap was attacked by a hacker on June 13. Fswap stated that the attack was a vulnerability incident of a non-attacked project and a malicious loan attack. Hackers borrowed money from BISWAP to FSWAP for transaction attacks. The hacker made about 1,751 WBNB worth about $500,000.","theft":true},{"id":"ht19f4c9ad58","date":"2022-06-12","name":"HEGE","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":429000.0,"lo":429000.0,"hi":429000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DNpSPi3xiIndpNCxL7HL6Q"}],"desc":"On June 12, the price of the HEGE token plummeted by more than 97%. The current loss amount is approximately $429,000.","theft":true},{"id":"ht9e1f3fddf7","date":"2022-06-11","name":"SHELL","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":180000.0,"lo":180000.0,"hi":180000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DNpSPi3xiIndpNCxL7HL6Q"}],"desc":"On June 11, the SHELL token price fell by more than 56%. The project owner minted 150 million tokens at one address, then transferred them and sold some of them in 12 transactions for about $180,000.","theft":true},{"id":"ht80c33a4050","date":"2022-06-11","name":"treasure swap","kind":"hack","fam":"code","tech":"K-value Verification Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/91mr6yag.html"}],"desc":"The treasure swap project was attacked. The attacker only used 0.000000000000000001 WETH to exchange all the WETH tokens in the transaction pool. The reverse of the source code found that the swap function of the attacked contract lacked the K value check. At present, the attacker has completed the attack on the two contracts [address] and [address], and accumulated a profit of 3,945 BNB.","theft":true},{"id":"htc03f0c2d0f","date":"2022-06-09","name":"Osmosis","kind":"hack","fam":"code","tech":"LP vulnerability","usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraphcn.com/news/attackers-loot-5m-from-osmosis-in-lp-exploit-2m-returned-soon-after"}],"desc":"Osmosis, the decentralized exchange (DEX) built on the Cosmos network, was shut down just before 3 a.m. ET on Wednesday after attackers exploited a liquidity provider (LP) vulnerability to steal around 5 million Dollar. About an hour after Osmosis tweeted about the attack, 4 hackers accounted for 95% of the total, according to a tweet from Osmosis, Cosmos ecosystem validator FireStake admitted on Twitter, A \"momentary error of judgement\" led to two members of their team who exploited the vulnerability for roughly $2 million, and they decided to voluntarily return the funds and \"fix the problem.\"","theft":true},{"id":"ht5e2af41f0a","date":"2022-06-09","name":"Scammers compromise verified, 5-million-follower Twitter account for Venezuelan newspaper El Universal, use it to promote fake Goblintown site","kind":"scam","fam":"social","chains":["Ethereum"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-compromise-el-universal-twitter-account"}],"theft":true,"headline":true},{"id":"ht25232612f5","date":"2022-06-08","name":"Osmosis","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Osmosis","Cosmos"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/osmosiszone/status/1534432704246292480"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/osmosis-chain-halted-after-bug-leads-to-5-million-loss"}],"desc":"On June 7-8, 2022, Osmosis suffered a $5M liquidity pool exploit where the JoinPoolNoSwap function allowed liquidity providers to withdraw 50% more than they should have. The chain halted for 2 days to prevent complete pool drainage. Osmosis Labs covered all losses using strategic reserves.","theft":true,"review":["possible duplicate within one source"]},{"id":"htcfe8443557","date":"2022-06-08","name":"Gym Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2100000.0,"lo":2100000.0,"hi":2100000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/gymnet-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/GymNet_Official/status/1534452473754157056"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/gym-network-exploited-for-2-1-million"}],"desc":"GYM Network deployed a new contract function on June 6, 2022. On June 8, attacker exploited missing caller verification in depositFromOtherContract() to create deposit records without actually transferring tokens, inflating balance and draining approximately 2,475.91 WBNB (~$716K). Funds were laundered through Tornado Cash.","theft":true},{"id":"htd99f9a2ddc","date":"2022-06-08","name":"ApolloX","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":1600000.0,"lo":1500000.0,"hi":2150000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ApolloX_com/status/1534810576198979586"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/apollox-exchange-exploited-for-1-5-million"}],"desc":"On June 8, 2022, ApolloX on BSC was exploited when a hacker accumulated 255 signatures using a flaw in the Trading Rewards Contract and used them to withdraw 53 million APX tokens from the Withdrawal Contract without proper verification. The tokens were swapped for ~$2.15M BUSD via PancakeSwap.","theft":true},{"id":"ht0b4e4d2d8a","date":"2022-06-08","name":"Players Only NFT project, founded by NBA players, rug pulls for $1.4 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/players-only-nft-project-founded-by-nba-players-rug-pulls-for-1-4-million"}],"theft":true,"headline":true},{"id":"ht32e140fcba","date":"2022-06-08","name":"Baby Elon","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":180000.0,"lo":178994.0,"hi":180000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1534398198957088775"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/en/articledetails/lc63adcv.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/baby-elon-coin-rug-pulls-for-179000"}],"desc":"The Baby Elon project on BNBChain had a rug pull on June 8, and they took 623 BNB (~$179,000) and quickly moved the funds to Tornado Cash.","theft":true},{"id":"ht8581073fae","date":"2022-06-07","name":"Equalizer Exchange","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Polygon","Optimism"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://equalizer-finance.medium.com/exploit-report-78bfd6b36689"}],"desc":"On June 7, 2022, Equalizer's vault contracts across four chains were exploited via a flawed calculation in getRatioForOneEToken(). The attacker used flash loans to manipulate vault balances and withdraw more assets than entitled. All losses were covered by Equalizer, with no impact to users.","theft":true},{"id":"ht3d9e8f3783","date":"2022-06-06","name":"A wave of Discord moderator account hacks impacts multiple NFT-related servers","kind":"hack","fam":"other","chains":["Ethereum"],"usd":243000.0,"lo":243000.0,"hi":243000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wave-of-discord-moderator-account-hacks-impacts-multiple-nft-related-servers"}],"theft":true,"headline":true},{"id":"ht0f6d130b5d","date":"2022-06-06","name":"Discover","kind":"hack","fam":"market","tech":"Flashloan & Price Oracle Manipulation","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htdccb3ddfd8","date":"2022-06-05","name":"Elrond","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Elrond"],"usd":113000000.0,"lo":113000000.0,"hi":113000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://elrond.com/blog/incident-and-recovery-report/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/decentralized-exchange-maiar-exploited-for-113-million"}],"desc":"A newly deployed VM function executeOnDestContextByCaller allowed attackers to steal 1.65M EGLD (~$113M) and convert 917k to WEGLD, creating unbacked WEGLD in circulation. The team recovered the illegal WEGLD and burned it, restoring the 1:1 backing ratio with two mainnet upgrades.","theft":true},{"id":"htd6a4c56d78","date":"2022-06-05","name":"Wintermute","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Optimism","Ethereum"],"usd":17600000.0,"lo":17600000.0,"hi":20000000.0,"ret":17000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/wintermute-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/20-million-optimism-tokens-sent-to-nonexistent-address"}],"desc":"On June 5, 2022, Wintermute lost 20 million Optimism governance tokens when an Ethereum L1 multisig address was provided for L2 deposit but had not been pre-deployed on Optimism. An attacker deployed the Gnosis Safe contract and took control of the address before Wintermute could recover the tokens.","theft":true},{"id":"ht4294eb9bb5","date":"2022-06-05","name":"Optimism","kind":"hack","fam":"code","tech":"Multi-signature address transfer vulnerability","chains":["Optimism"],"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/optimismPBC/status/1534631766576836608"}],"desc":"Optimism and Wintermute both released announcements, disclosing to the community a loss of 20 million OP tokens. At the time of the release of OP tokens, Optimism entrusted Wintermute to provide liquidity services for OP in the secondary market. As part of the agreement, Optimism will provide Wintermute with 20 million OP tokens. To receive the tokens, Wintermute gave Optimism a multi-signature address, to which Optimism transferred 20 million OPs after Optimism test sent two transactions and Wintermute confirmed it was correct. After Optimism transferred the coins, Wintermute found that they had no way to control these coins, because the multi-signature addresses they provided were only deployed on the Ethereum mainnet for the time being and have not yet been deployed to the Optimism network. To gain control of these tokens, Wintermute immediately initiated remediation operations. However, attackers have already noticed this vulnerability and deployed multi-signature to this address on the Optimism network before Wintermute, successfully controlling the 20 million tokens. At present, the Optimism hacker has returned 17 million OP tokens and transferred 1 million OP to the Vitalik address, and Vitalik has returned the funds.","theft":true,"onchain":true},{"id":"hte2e212f3cc","date":"2022-06-04","name":"Collector loses ten pricey NFTs to phishing scam","kind":"scam","fam":"social","chains":["Ethereum"],"usd":365000.0,"lo":365000.0,"hi":365000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/collector-loses-ten-pricey-nfts-to-phishing-scam"}],"theft":true,"headline":true},{"id":"ht4d82347449","date":"2022-06-04","name":"BAYC/Otherside","kind":"hack","fam":"social","tech":"Phishing","target":"NFTfi","chains":["Ethereum"],"usd":257000.0,"lo":250000.0,"hi":257000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/NFTherder/status/1533037408144572417"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bored-apes-discord-compromised-again-32-nfts-stolen"}],"desc":"Discord accounts of BAYC's community manager were compromised, and attackers posted fake limited-quantity giveaway links to a phishing site. Users were tricked into approving malicious contracts, losing 32 NFTs and over $257K in ETH.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht6e921e4339","date":"2022-06-04","name":"fomo-dao","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":110000.0,"lo":110000.0,"hi":110000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.defidaonews.com/article/6755292"}],"desc":"The fomo-dao project is suspected of being attacked, and the attacker has made a profit of $110,000, which has been transferred to Tornado.cash.","theft":true},{"id":"htde07626d3c","date":"2022-06-04","name":"Homeless Friends","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/newsflash/p-538934.html"}],"desc":"The Discord of Homeless Friends NFT was attacked, homelessfriends[.]net is a phishing website.","theft":true},{"id":"ht51246734b8","date":"2022-06-03","name":"Timechain allegedly attempts to falsely blame missing money on Terra collapse","kind":"collapse","fam":"insider","chains":["Terra"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/timechain-allegedly-attempts-to-falsely-blame-missing-money-on-terra-collapse"}],"headline":true},{"id":"htff33cd94bc","date":"2022-06-02","name":"Animoon","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":6300000.0,"lo":6300000.0,"hi":6300000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachxbt/status/1532390797479403521"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/animoon-rug-pulls-for-63-million"}],"desc":"The work of Animoon with 9999 NFTs is taken from Pokémon. They claim to have signed a non-disclosure agreement (NDA) with Pokémon partner TopDeck. But with no evidence of an actual P2E game being developed, the Animoon team disappeared, deleting their Twitter account and website.","theft":true},{"id":"ht46366b6593","date":"2022-06-02","name":"Forest Tiger Pro rug pulls for tokens notionally worth more than $4.5 million","kind":"rugpull","fam":"insider","usd":4518000.0,"lo":4518000.0,"hi":4518000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/forest-tiger-pro-rug-pulls-for-tokens-notionally-worth-more-than-4-5-million"}],"theft":true,"headline":true},{"id":"ht3efffbca15","date":"2022-06-02","name":"StarMan","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":196000.0,"lo":196000.0,"hi":196000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://v2.tokeninsight.com/en/news/starman-on-bnb-chain-appeared-rug-pull"}],"desc":"A Rug Pull occurred in StarMan, the coin price fell 99.5%, and the scammers have transferred about 640.4 BNB to Tornado Cash. Losses were valued at approximately $196,000.","theft":true},{"id":"ht20afee4010","date":"2022-06-02","name":"CoFiXProtocol","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/nkp0jggw.html"}],"desc":"The project CoFiXProtocol on BNB Chian suffered a price manipulation attack, and the attackers made a profit of about $140,000.","theft":true},{"id":"htde3d77d787","date":"2022-06-01","name":"Armadillo Coin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/en/flash/85097"}],"desc":"Rug Pull on Armadillo Coin on BNB Chian, scammers have transferred 663.4 BNB to Tornado.Cash.","theft":true},{"id":"ht558fa3357d","date":"2022-05-31","name":"Mirror Protocol","kind":"hack","fam":"market","tech":"Oracle Price Vulnerability","chains":["Terra"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/149361/mirror-protocol-suffers-new-exploit-and-could-be-drained-in-hours"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mirror-protocol-another-bug"}],"desc":"Mirror Protocol, a synthetic asset protocol built on Terra, has been attacked again, was attacked again, with more than $2 million in capital losses. The capital pools of Bitcoin, Ethereum and Polkadot have been exhausted, and the remaining capital pools are linked to stocks. If the vulnerability is not fixed before the market opens at 4:00 EST (16:00 GMT), all of its token asset pools will be at risk.","theft":true},{"id":"hta38abab446","date":"2022-05-30","name":"Mirror","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Terra"],"usd":88000000.0,"lo":2000000.0,"hi":90000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/FatManTerra/status/1529978941062139906"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/researcher-discovers-vulnerability-in-the-terra-mirror-protocol"}],"desc":"Mirror Protocol was exploited starting October 8, 2021, via inadequate access control on collateral unlock functions, allowing attackers to withdraw ~$90M over 7 months before discovery in May 2022. A follow-up $2M exploit in May 2022 exploited oracle misalignment during the LUNC-LUNA2 transition.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht4947333569","date":"2022-05-30","name":"Superlative Apes team does a \"slow rug pull\" after drawing in $2.9 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":2900000.0,"lo":2900000.0,"hi":2900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/superlative-apes-does-a-slow-rug-pull-after-drawing-in-2-9-million"}],"theft":true,"headline":true},{"id":"ht0f96f2dd02","date":"2022-05-30","name":"Another Bored Ape owner makes a typo, sells NFT for $180,000 less than they intended","kind":"other","fam":"other","chains":["Ethereum"],"usd":181000.0,"lo":181000.0,"hi":181000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/another-bored-ape-owner-makes-a-typo-sells-nft-for-180000-less-than-they-intended"}],"headline":true},{"id":"ht1cf68a2547","date":"2022-05-29","name":"Anchor","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Terra"],"usd":800000.0,"lo":800000.0,"hi":800000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://u.today/anchor-protocol-got-exploited-with-launch-of-luna-20-user-makes-free-800000"}],"desc":"After Luna 2.0 launch, Chainlink froze LUNC price updates while the oracle maintained a hardcoded $0.10 minimum. An attacker deposited bLUNA at vastly inflated collateral value and borrowed 40M UST for a net $800K profit. Anchor froze markets immediately upon discovery.","theft":true},{"id":"htc684a18e26","date":"2022-05-29","name":"Novo","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/y3y02hxy.html"}],"desc":"DeFi project Novo is suspected of being attacked, and hackers have transferred 280 BNB (about $89,600) to Tornado.cash.","theft":true,"onchain":true},{"id":"htfe6f3de585","date":"2022-05-28","name":"Pokemoney","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/r3f0aqw4.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pokemoney-blockchain-game-rug-pulls-for-3-5-million"}],"desc":"A Rug Pull occurred in the NFT metaverse game project Pokemoney on BNBChian, its Token PMY has dropped by 99.98%%, and about 11,800 BNB (about 3.5 million US dollars) have been withdrawn and transferred.","theft":true},{"id":"ht34ffbc5d92","date":"2022-05-27","name":"Elon Musk deepfake tries to get people to give scammers Bitcoin","kind":"scam","fam":"social","chains":["Bitcoin"],"usd":1700.0,"lo":1700.0,"hi":1700.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/elon-musk-deepfake-tries-to-get-people-to-give-scammers-bitcoin"}],"theft":true,"headline":true},{"id":"ht8acf16471e","date":"2022-05-25","name":"DecentraWorld","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1008207.0,"lo":1008207.0,"hi":1008207.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1529180042311389184"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/decentraworld-project-rug-pulls-for-1-million"}],"desc":"DecentraWorld’s DEWO token price plummeted, the founding team of DecentraWorld drained the project’s funds and stole 3,127 BNB (about $1 million), and the project’s official website and Twitter account were deleted.","theft":true},{"id":"hta8d187dc7e","date":"2022-05-24","name":"Scammer steals 29 Moonbirds NFTs nominally worth about $1.5 million from a single collector","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-steals-29-moonbirds-nfts-nominally-worth-about-1-5-million"}],"theft":true,"headline":true},{"id":"htfe614ff64f","date":"2022-05-24","name":"HackDao","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":65000.0,"lo":65000.0,"hi":65000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Attackers exploited HackDao's token fee mechanism and skim() function via flashloan, borrowing and liquidating themselves repeatedly without repaying. The contract's flawed accounting allowed extraction of 200 BNB (~$65K) before theft detection.","theft":true},{"id":"ht6ae7975368","date":"2022-05-24","name":"HackDao","kind":"hack","fam":"other","tech":"Skim token balance","chains":["BNB Chain"],"conf":"C","n":1,"theft":true},{"id":"hta583b6f6b7","date":"2022-05-22","name":"Beeple's Twitter account is hacked and used to promote fake NFT mints","kind":"hack","fam":"other","chains":["Ethereum"],"usd":438000.0,"lo":438000.0,"hi":438000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/beeples-twitter-account-is-hacked-and-used-to-promote-scams"}],"theft":true,"headline":true},{"id":"ht99a61ac9ba","date":"2022-05-22","name":"Crypto speculator loses over $200,000 to wallet compromise","kind":"hack","fam":"other","chains":["Ethereum"],"usd":203000.0,"lo":203000.0,"hi":203000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-speculator-loses-over-200000-to-wallet-compromise"}],"theft":true,"headline":true},{"id":"hteeba13406c","date":"2022-05-21","name":"bDollar","kind":"hack","fam":"market","tech":"Price Manipulation","chains":["BNB Chain"],"usd":730000.0,"lo":730000.0,"hi":730000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.defidaonews.com/article/6752278"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bdollar-stablecoin-suffers-730000-price-manipulation-attack"}],"desc":"The first algorithmic stablecoin project on Binance Smart Chain, bDollar, suffered a price manipulation attack, and the attacker made a profit of 2,381 WBNB (worth about $730,000). This attack mainly exploits the design loophole of the claimAndReinvestFromPancakePool function in the DAO fund proxy contract CommunityFund when adding liquidity. It does not fully consider that after the price is maliciously raised, the project party will passively use the funds in its own contract when adding liquidity. The situation of high-level connection.","theft":true},{"id":"ht8fb54afc13","date":"2022-05-20","name":"Llamascape","kind":"hack","fam":"social","tech":"Signer Phishing","target":"NFTfi","chains":["Ethereum"],"usd":70000.0,"lo":70000.0,"hi":70000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/LlamascapeNFT/status/1527494697995878418"}],"desc":"Staff member accounts on Llamascape's Discord were phished, allowing attackers to post a fake minting scam. Holders lost 30-40 ETH by interacting with the malicious contracts. The team committed to compensation and security improvements.","theft":true},{"id":"ht9a101917aa","date":"2022-05-19","name":"Users threaten to sue after yield generation project Stablegains loses $44 million in Terra collapse","kind":"followup","fam":"other","chains":["Terra"],"usd":44000000.0,"lo":44000000.0,"hi":44000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/users-threaten-to-sue-after-yield-generation-project-stablegains-loses-44-million-in-terra-collapse"}],"headline":true},{"id":"htc94ea981ab","date":"2022-05-19","name":"Kronos DAO","kind":"hack","fam":"insider","tech":"Insider Manipulation","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.pinpointnews.co.kr/news/articleView.html?idxno=117157"}],"desc":"According to Pinpoint News, Klaytn-based DeFi project Kronos DAO misappropriated users’ DAI pledged in its vaults to invest in Kairos Cash and lost 6 million DAI. The 6 million DAI staked by users turned into 6 million Kairos Cash in the Kronos Dao Vault, which Kronos Dao explained was “used as a strategic investment.” Investors, however, questioned that the explanation was insufficient and that no advance notice was given. At present, Kronos Dao has closed Kakao Talk and Telegram communication channels, leaving only Discord as a communication channel.","theft":true},{"id":"ht0986dcc351","date":"2022-05-18","name":"QANX Bridge","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":707000.0,"lo":707000.0,"hi":707000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/qanplatform/qanx-bridge-disclosure-analysis-continuously-updated-849f7a91d05e"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/quantum-resistant-blockchain-qan-suffers-bridge-attack"}],"desc":"Bridge authority credentials were compromised, allowing extraction of 4.4M QANX tokens (370 ETH, ~$707K at time of exploit). The attacker traded stolen tokens through DEX, achieving significant liquidation of the position.","theft":true},{"id":"htc43f17c288","date":"2022-05-18","name":"Feminist Metaverse","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":540000.0,"lo":533000.0,"hi":540000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/FM_Token/status/1526945914061049856"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/feminist-metaverse-token-exploited-for-533000"}],"desc":"Attackers exploited the FM token's skim() mechanism via flashloan, redirecting 75.15M FM tokens to SakeSwapPair and then to their own address for sale. 1838 BNB (~$540K) was extracted and sent to Tornado Cash.","theft":true},{"id":"ht1560cdbb70","date":"2022-05-18","name":"Seth Green NFTs","kind":"hack","fam":"social","tech":"Phishing","target":"NFTfi","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SethGreen/status/1526588358859759617"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/four-pricey-nfts-stolen-from"}],"desc":"Actor Seth Green's wallet was compromised via phishing from a cloned Gutter Cat Gang website. Attackers stole multiple NFTs including a Bored Ape with commercial rights to his upcoming TV show. Green recovered the Bored Ape through negotiation.","theft":true},{"id":"ht91bd2a7116","date":"2022-05-18","name":"Alien Frens","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/alienfrens/status/1526783057511993345"}],"desc":"NFT project Alien Frens tweeted that Discord had been attacked. Users are asked not to click on any MINT links.","theft":true},{"id":"ht27a3f5da34","date":"2022-05-18","name":"Axie Infinity","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AxieInfinity/status/1526760612419837954"}],"desc":"Axie Infinity says the Mee6 bot on its main server was hacked. Hackers use Mee6 bot to add permissions to fake Jiho account to post fake announcements about mint. MEE6 is a Discord bot that allows admins to automatically assign and remove roles and send messages. The fake announcement has now been removed.","theft":true},{"id":"htecd0da4152","date":"2022-05-18","name":"Lazy Lions","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/LazyLionsNFT/status/1526849605564272640"}],"desc":"Discord for NFT series Lazy Lions was hacked. Notably, this attack appears to infiltrate many other large NFT projects throughout the day, seemingly due to MEE6 staff being able to use MEE6 remotely to give themselves roles in any server.","theft":true},{"id":"ht33eb239c76","date":"2022-05-17","name":"FEG Token","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain","Ethereum"],"usd":1900000.0,"lo":1300000.0,"hi":1900000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/FEGtoken/status/1525965942517268480"}],"desc":"FEG's swapToSwap() function lacked input validation on the 'path' parameter, allowing attackers via flashloan to gain unlimited allowance and drain contract assets. Multiple attacks on May 15-16 extracted ~$1.3M + $1.9M total across ETH and BSC networks.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht47a4834419","date":"2022-05-17","name":"FEG","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum","BNB Chain"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1526357878503768070"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/flash-loan-attack-on-feed-every-gorilla-token-takes-1-3-million"}],"desc":"The multi-chain DeFi protocol FEG was attacked again, and the flash loan attack suffered on the BNB chain lost about $1.3 million in assets. The subsequent flash loan attack on Ethereum caused a loss of about $590,000, with a total loss of about $1.9 million in assets. This attack is similar to yesterday's attack and is caused by a vulnerability in the \"swapToSwap()\" function. This function directly uses the \"path\" entered by the user as a trusted party without screening and validating the incoming parameters. Additionally, the function will allow an unverified \"path\" parameter (address) to use the current contract's assets. Therefore, by calling \"depositInternal()\" and \"swapToSwap()\", the attacker can obtain permission to use the assets of the current contract, thereby stealing the assets within the contract.","theft":true},{"id":"htf94073e359","date":"2022-05-17","name":"天穹","kind":"hack","fam":"other","tech":"Malicious Code Injection Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.cbcnag.com/#/article?aid=f2ef90f3a8b9632610c0f6c5e54af7d3653a58794e68e7d8ec2db79e8683bf84"}],"desc":"There was an abnormality on the Tianqiong Digital Collection platform. The price of its collections on the secondary market skyrocketed thousands of times, and collections with a price of nearly 10 million yuan were sold in seconds. The Tianqiongshuzang announcement stated that the platform was maliciously attacked by hackers and used false balances to purchase and steal player collections.","theft":true},{"id":"ht0ee8b6e5da","date":"2022-05-17","name":"ApeCoin (APE)","kind":"hack","fam":"market","tech":"Flashloan","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"review":["attack tx contradicts the date"]},{"id":"ht1da4553f4f","date":"2022-05-16","name":"Scream","kind":"hack","fam":"other","tech":"Stablecoin prices de-anchor","chains":["Fantom"],"usd":35000000.0,"lo":35000000.0,"hi":35000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/147046/defi-lender-left-with-35-million-bad-debt-after-quoting-depegged-stablecoins-at-1?utm_source=cryptopanic&ut"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scream-lending-protocol-racks-up-35-million-in-bad-debt-after-hardcoding-not-so-stablecoin-prices-to-1"}],"desc":"Fantom-based DeFi lending protocol Scream caused $35 million in bad debt after failing to adjust the price of two de-pegged USD stablecoins. The two stablecoins are Fantom USD (FUSD) and Dei (DEI). Both stablecoins are still quoted at $1, according to data from the Scream dashboard. However, their trading prices have been severely de-pegged. Among them, FUSD fell to $0.69, and DEI fell to a low of $0.52. Whale players took advantage of this situation to deposit large amounts of FUSD and DEI at a discount, and siphoned all other stablecoins from the Scream platform. Stablecoins such as Fantom USDT, FRAX, DAI, MIM, and USDC have all been withdrawn from the platform. As a result, users who originally had deposits in these stablecoins would not be able to withdraw from Scream.","theft":true},{"id":"ht3ad241ab99","date":"2022-05-14","name":"Quickswap V3","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Polygon"],"usd":107600.0,"lo":107600.0,"hi":107600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://quickswap-layer2.medium.com/quickswaps-godaddy-domain-hijack-how-it-happened-our-proposal-to-restore-the-community-35be9ddbb19a"}],"desc":"Attackers hijacked QuickSwap's GoDaddy DNS, redirecting swaps to their address. Users unknowingly traded through the attacker's proxy contracts, losing $107.6K before the domain was recovered on May 18.","theft":true},{"id":"ht5e0e0cd299","date":"2022-05-14","name":"SpiritSwap V3","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Fantom"],"usd":18000.0,"lo":18000.0,"hi":18000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Spirit_Swap/status/1525216379041116160"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/spiritswap-is-the-latest-victim-of-a-domain-hijacking-attack"}],"desc":"Attacker socially engineered a GoDaddy employee to hijack SpiritSwap's domain, then deployed a phishing site with modified swap parameters. Before detection and shutdown on May 14, ~$18K was extracted (from 252 BNB total redirected).","theft":true},{"id":"htb59bb784db","date":"2022-05-14","name":"CoinGecko&Etherscan&DeFi Pulse","kind":"phishing","fam":"social","tech":"Phishing attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/coingecko/status/1525229832094617600"}],"desc":"Popular cryptocurrency websites including Etherscan, CoinGecko, and DeFi Pulse have reported incidents of malicious pop-ups prompting users to connect their MetaMask wallets. CoinGecko founder Bobby Ong said he believes the culprit is a malicious ad script from a crypto ad network called Coinzilla. The ad appears to be from a website parodying the popular Bored Apes Yacht Club NFT project, which was taken down after the scam was discovered.","theft":true},{"id":"ht400a77e238","date":"2022-05-13","name":"Blizz Finance","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Avalanche"],"usd":8300000.0,"lo":8300000.0,"hi":8300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@blizzfinance/blizz-finance-post-mortem-2425a33fe28b"}],"desc":"Blizz Finance on Avalanche was drained of ~$8.3M in May 2022 when Chainlink froze LUNA pricing at $0.10 far above market value during Terra's collapse, allowing overcollateralized borrowing.","theft":true},{"id":"hte31d332d29","date":"2022-05-12","name":"Venus Protocol","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["BNB Chain","Terra","Avalanche"],"usd":11200000.0,"lo":11200000.0,"hi":21800000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/venus-blizz-rekt"},{"s":"SlowMist Hacked","u":"https://blog.venus.io/venus-protocol-official-statement-regarding-luna-6eb45c3cb058"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unexpected-oracle-data-in-the-wake-of-terra-blockchain-halt-enables-multiple-attacks-on-other-platforms"}],"desc":"Venus LUNA market had a hardcoded $0.10 minimum price while Chainlink froze updates due to LUNA volatility. Attackers bought LUNA at drastically reduced prices and used it as collateral at $0.10/token to borrow other assets, extracting $11.2M before Venus suspended the market.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht5bc98ecac6","date":"2022-05-11","name":"Drift Trade","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["Solana"],"usd":14500000.0,"lo":14500000.0,"hi":14500000.0,"ret":14500000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On May 11, 2022, Drift Protocol on Solana experienced three interconnected bugs: users could withdraw positive PnL without realizing losses, leverage increased with long-short imbalance, and insurance funds weren't isolated per market. LUNA collapse exposed these issues, causing $8.72M net withdrawal and $14.5M shortfall.","theft":true},{"id":"hteb418c9fe1","date":"2022-05-11","name":"X2Y2","kind":"hack","fam":"social","tech":"Phishing","target":"NFTfi","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Serpent/status/1523833573815373824"}],"desc":"Attackers created fake X2Y2 URLs via Google Ads with display URLs matching the legitimate site, tricking users into connecting wallets to phishing contracts. ~100 ETH (~$200K) was stolen from victims across multiple phishing sites.","theft":true},{"id":"ht9ce723b087","date":"2022-05-10","name":"OWNLY","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":37000.0,"lo":37000.0,"hi":37000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ownlyio/status/1524149988837580800"}],"desc":"OWNLY's unstake function lacked claim status validation, allowing attackers to repeatedly call unstake() and extract 930M OWN tokens without authorization. The staking contract was drained of ~$37K in BNB equivalent before discovery.","theft":true},{"id":"htecbfe7a904","date":"2022-05-09","name":"TerraUSD (UST) stablecoin dramatically loses its peg","kind":"collapse","fam":"insider","chains":["Terra"],"usd":40000000000.0,"lo":40000000000.0,"hi":40000000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/terrausd-ust-stablecoin-struggles-to-retain-peg"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht313348468a","date":"2022-05-09","name":"G.O.A.T. token developer rug pulls for $260,000","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":260956.0,"lo":260956.0,"hi":260956.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/goat-token-developer-rug-pulls-for-260000"}],"theft":true,"headline":true},{"id":"ht3da85d6a8a","date":"2022-05-09","name":"GOAT","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":260000.0,"lo":260000.0,"hi":260000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1523550360140664832"}],"desc":"The GOAT project claimed to be \"the new standard in cryptocurrencies,\" but one of the project's developers abruptly sold their assets, taking $260,000 with them, and the token price fell to nearly $0.","theft":true},{"id":"ht8dc009a329","date":"2022-05-09","name":"Cashera","kind":"rugpull","fam":"insider","tech":"Scam","chains":["BNB Chain"],"usd":90000.0,"lo":89200.0,"hi":90000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1523379700860473344"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cashera-makes-off-with-90000"}],"desc":"Cashera is a project that claims to offer a \"banking revolution\" through its CSR crypto token. The project does a number of things to try to appear legitimate, including linking to government records showing a company named after it is registered in the UK and conducting a smart contract audit courtesy of AuditRateTech. Their website boasts \"partners\" including VISA, PayPal, Netflix and Spotify. Still, project deployers suddenly minted 23 million CSR tokens, which they exchanged for nearly $90,000 in other assets, plummeting the token value by about 70% in the process. The development team also took the project website offline.","theft":true},{"id":"hte667e46ba2","date":"2022-05-08","name":"Fortress Loans","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":3050000.0,"lo":2976004.0,"hi":3050000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/fortress-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Fortressloans/status/1523495202115051520"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-steals-3-million-from-fortress-protocol"}],"desc":"On May 8, 2022 at 20:34 UTC Fortress Loans was exploited via an insufficient governance quorum (400k FTS tokens valued at ~$18K) when an attacker acquired governance quorum and passed proposal #11 to set FTS collateral factor to 700,000,000,000,000,000, then borrowed inflated collateral value combined with oracle manipulation to steal 1,048.1 ETH and 400,000 DAI (~$2.98M total).","theft":true},{"id":"hta82dcd45d3","date":"2022-05-08","name":"Hunter","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1523153063875575809"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hunter-defi-project-rug-pulls-for-1-2-million"}],"desc":"The DeFi project Hunter has been rug pull, and currently Telegram, Discord, and the website cannot be opened.","theft":true},{"id":"htbdf4b0f9d4","date":"2022-05-07","name":"Fury of the Fur","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":303000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/rugpullfinder/status/1523082874022469633"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fury-of-the-fur-rug-pulls-for-300000"}],"desc":"The Fury of the Fur NFT project was a collection of 3D models that sort of resembled bears. However, the NFT rollout has not been smooth - out of a total supply of 9,671 NFTs, less than 2,800 NFTs have been minted. The project attempted to relaunch but failed to generate more interest, so the creators decided to pull it out — while preserving funding, of course. The project founders have left a long message to the community that they will close the project.","theft":true},{"id":"ht2f87fb0358","date":"2022-05-06","name":"Mining Capital Coin","kind":"fraud","fam":"insider","tech":"Scam","usd":62000000.0,"lo":62000000.0,"hi":62000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.justice.gov/opa/pr/ceo-mining-capital-coin-indicted-62-million-cryptocurrency-fraud-scheme"}],"desc":"The Justice Department released an indictment on May 5 showing that Mining Capital Coin CEO and founder Luiz Capuci Jr. was charged with orchestrating a $62 million investment fraud. Capuci allegedly misled investors about MCC’s plan, which he said would use investors’ funds to mine new cryptocurrencies with guaranteed returns. Instead, Capuci deposited funds into his own crypto wallet and used them to fund his own Lamborghini lifestyle, real estate and yachts. Capuci also allegedly ran a pyramid scheme of promoters, promising them lavish gifts including iPads and luxury cars."},{"id":"ht888184e970","date":"2022-05-06","name":"Pragma Money","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Fantom"],"usd":1500000.0,"lo":1500000.0,"hi":1503506.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://web3isgoinggreat.com/?id=pragma-defi-protocol-developers-rug-pull-for-15-million"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pragma-defi-protocol-developers-rug-pull-for-15-million"}],"desc":"DeFi project Pragma Money on Fantom has announced that around $1.5 million in FTM has been drained from their treasury and project wallets.\r\nAppears to be done by a team member.","theft":true},{"id":"ht305a2bd7a1","date":"2022-05-06","name":"Day of Defeat","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":1350000.0,"lo":1350000.0,"hi":1350000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKAlert/status/1522301583605780480"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/day-of-defeat-project-rug-pulls-for-135-million"}],"desc":"Day of Defeat has rug pull, value has suddenly dropped by over 96%, and over $1.35 million in assets has been moved from BSC-based projects to external wallets. After the funds ran out, the project claimed they had been hacked by outside actors and had “reported to Binance and local authorities.”","theft":true},{"id":"htf3a42f41b2","date":"2022-05-06","name":"OpenSea","kind":"hack","fam":"keys","tech":"Account Compromise","chains":["Ethereum"],"usd":20000.0,"lo":20000.0,"hi":20000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Serpent/status/1522494914550181888"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/opensea-discord-hacked"}],"desc":"Sentinel founder Serpent tweeted that OpenSea's official Discord was attacked. Hackers used bot accounts to post fake links in the channel, and said that \"OpenSea has reached a cooperation with YouTube. Click the link to participate in the mint pass NFT limited to 100 pieces.\" Users should be aware of the risks and do not click on links provided by hackers.","theft":true},{"id":"ht96ec72102f","date":"2022-05-06","name":"Someone hijacks a Ferrari domain to host scam NFT mint","kind":"scam","fam":"social","chains":["Ethereum"],"usd":800.0,"lo":800.0,"hi":800.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/someone-hijacks-a-ferrari-domain-to-host-scam-nft-mint"}],"theft":true,"headline":true},{"id":"htacbbaafdbe","date":"2022-05-05","name":"\"Double your money\" scam using an old livestream of Elon Musk, Jack Dorsey, and Cathie Wood earns crypto scammers $1.3 million in 24 hours","kind":"scam","fam":"social","chains":["Ethereum","Bitcoin"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/double-your-money-scam-using-elon-musk-livestream-earns-crypto-scammers-1-3-million"}],"theft":true,"headline":true},{"id":"ht58ffc6ca1f","date":"2022-05-04","name":"MM Finance Cronos","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["Cronos","Cosmos","Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/madmeerkat-finance-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/@MMFinance/dns-hi-jacking-post-mortem-compensation-3e2b5bb21183"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mmfinance-suffers-apparent-frontend-breach"}],"desc":"On May 4, 2022, MM.Finance's DNS infrastructure was compromised, allowing attackers to inject a malicious contract address. Users interacting with swap, add liquidity, or remove liquidity functions had their funds siphoned to the attacker's wallet. Approximately $2M in CRO was stolen and laundered through Tornado Cash to OKX.","theft":true,"review":["possible duplicate within one source"]},{"id":"hta77b195d0d","date":"2022-05-02","name":"Rainbow Bridge","kind":"hack","fam":"bridge","tech":"Fake NEAR blocks","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptopotato.com/how-a-hacker-lost-his-eth-while-attacking-rainbow-bridge/"}],"desc":"Rainbow Bridge was attacked by forged blocks. However, it was blocked by an automatic watchdog mechanism, depriving the attacker of 2.5 ETH.","theft":true},{"id":"ht6e913a9b09","date":"2022-05-01","name":"Solana","kind":"hack","fam":"other","tech":"Downtime","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/metaplex/status/1520608064155521024"}],"desc":"Solana-based NFT team at Metaplex, a web application and deployment platform, discontinued the program section today, Solana shows the program deployment of its program section, when further stabilized, the Solana team will be used to deploy a bot to use it for Deploy a bot. When attempting to complete a test transaction, 0.01 SOL will be charged for labor. The collected penalty funds will be provided to the configuration account of the Candy Machine instance.","theft":true},{"id":"ht032ecc2943","date":"2022-04-30","name":"Rari Capital","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum","Arbitrum"],"usd":80000000.0,"lo":80000000.0,"hi":80000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/fei-rari-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/feiprotocol/status/1520344430242254849"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/80-million-stolen-from-fei-protocol-and-rari"}],"desc":"Rari Capital's Fuse lending pools were exploited via a reentrancy vulnerability in exitMarket() when an attacker used a Balancer flashloan to deposit collateral, then recursively borrowed assets and withdrew collateral before borrow records were updated, stealing approximately 28,380 ETH and related assets.","theft":true,"onchain":true},{"id":"htae32c83cb3","date":"2022-04-30","name":"Saddle Finance","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":10500000.0,"lo":10000000.0,"hi":11078985.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/saddlefinance/status/1520451021725741056"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/saddle-finance-loses-more-than-11-million-to-hack"}],"desc":"On April 30, 2022, Saddle Finance metapool was exploited via flash loan-assisted swaps manipulating LP token pricing. The attacker exploited inconsistencies in price calculations in the sUSD/saddleUSD-V2 metapool, which used the incorrect MetaSwapUtils library, enabling extraction of ~$11M.","theft":true},{"id":"ht8a7be90174","date":"2022-04-30","name":"Phishing sites appearing to be the \"Otherside\" Bored Ape land project steal NFTs valued at $6 million","kind":"scam","fam":"social","chains":["Ethereum"],"usd":6100000.0,"lo":6100000.0,"hi":6100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phishing-sites-appearing-to-be-the-otherside-bored-ape-land-project-steal-nfts-valued-at-6-million"}],"theft":true,"headline":true},{"id":"ht1c45d4b3a9","date":"2022-04-30","name":"Babylon Finance","kind":"hack","fam":"code","tech":"Affected by the Rari Capital vulnerability","chains":["Ethereum"],"usd":3400000.0,"lo":3400000.0,"hi":3400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/babylon-finance/babylon-finance-is-shutting-down-b58abf1bc251"}],"desc":"In April, attackers exploited a vulnerability to steal $80 million from Rari Capital, and the asset management project Babylon Finance, Rari's main lending pool, lost $3.4 million as a result. On Aug. 31, Babylon Finance founder Ramon Recuero published a blog post announcing that Babylon would be shutting down and pledging to distribute remaining project funds to holders.","theft":true},{"id":"ht6afe5c7400","date":"2022-04-28","name":"DEUS Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Fantom"],"usd":13400000.0,"lo":13400000.0,"hi":13400000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deus-dao-rekt-2"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1519530463337250817"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/deus-finance-exploited-for-13-4-million-in-the-second-hack-in-two-months"}],"desc":"DEUS Finance exploited on April 28, 2022 for $13.4M via flashloan oracle manipulation. A $143M flashloan skewed the DEI/USDC pool on Solidly, inflating DEI's oracle price to enable overborrowing. Attacker moved funds through Tornado Cash.","theft":true,"review":["attack tx contradicts the date","possible duplicate within one source"]},{"id":"htc46b6e18fe","date":"2022-04-25","name":"133 NFTs valued at $2.4 million stolen when hacked Bored Apes Instagram advertises fake land airdrop","kind":"hack","fam":"other","chains":["Ethereum"],"usd":2400000.0,"lo":2400000.0,"hi":2400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/133-nfts-valued-at-24-million-stolen-when-hacked-bored-apes-instagram-advertises-fake-land-airdrop"}],"theft":true,"headline":true},{"id":"htdb30fb15be","date":"2022-04-25","name":"Wiener DOGE","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/l6XES9gtYlclw59AF1whdg"}],"desc":"Wiener DOGE token exploited via flash loan attack. The deflationary token failed to exclude LP pairs from transfer fees, allowing an attacker to drain tokens from liquidity pools. The k-value was destroyed, and the attacker profited approximately 78 BNB.","theft":true,"onchain":true},{"id":"htec5a6bc836","date":"2022-04-25","name":"BAYC","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BoredApeYC/status/1518637579633053701"}],"desc":"The official Instagram of the NFT project Bored Ape Yacht Club (BAYC) was hacked, and the attackers have stolen 91 NFTs including 4 BAYC, 7 MAYC, 3 BAKC, 1 CloneX, etc.","theft":true},{"id":"htb6388290ed","date":"2022-04-24","name":"Last Kilometer","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"usd":26495.0,"lo":26495.0,"hi":26495.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/l6XES9gtYlclw59AF1whdg"}],"desc":"The Last Kilometer project was exploited in a flash loan attack, resulting in a loss of $26,495.","theft":true},{"id":"hta286411264","date":"2022-04-24","name":"PI-DAO","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":6445.0,"lo":6445.0,"hi":6445.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/l6XES9gtYlclw59AF1whdg"}],"desc":"The PI-DAO project was exploited in a flash loan attack, resulting in a loss of $6,445.","theft":true},{"id":"ht945f0fee1f","date":"2022-04-24","name":"Medamon","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["BNB Chain"],"usd":3159.0,"lo":3159.0,"hi":3159.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/l6XES9gtYlclw59AF1whdg"}],"desc":"The Medamon project was exploited in a flash loan attack, resulting in a loss of $3,159.","theft":true},{"id":"ht331b533be9","date":"2022-04-23","name":"Akutars","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.ccvalue.cn/article/1396448.html"}],"desc":"The Akutars (@AkuDreams) project auction contract was permanently unable to withdraw 11,539.5 ETH due to multiple code flaws. According to SlowMist analysis, even if the problem of users' inability to refund is solved, due to the inconsistency between the number of bidders and the number of auctions and the defects of the project party's withdrawal function, Akutars funds will eventually be permanently locked.","theft":true,"onchain":true},{"id":"htd0ac07605e","date":"2022-04-22","name":"AkuDreams NFT project earns $34 million that its team will never be able to withdraw","kind":"hack","fam":"other","chains":["Ethereum"],"usd":34000000.0,"lo":34000000.0,"hi":34000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/akudreams-earns-34-million-team-will-never-be-able-to-withdraw"}],"theft":true,"headline":true},{"id":"ht809efd33f3","date":"2022-04-21","name":"Terra (LUNA)","kind":"hack","fam":"social","tech":"Phishing","target":"Chain","chains":["Terra"],"usd":4310000.0,"lo":4310000.0,"hi":4310000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/SlowMist_Team/status/1516961806509563904"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-phish-4-3-million-from-terra-users"}],"desc":"Scammers ran malicious Google ads for Terra ecosystem projects, impersonating Anchor and Astroport. Users were redirected to fake sites where they entered seed phrases after connecting wallets, allowing attackers to drain 52 wallets totaling $4.31M between April 12-21.","theft":true},{"id":"htb8dce6d426","date":"2022-04-21","name":"Hacker pulls $1 million from defi project, then destroys contract without withdrawing the funds","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":1041237.0,"lo":1041237.0,"hi":1041237.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-pulls-1-million-from-defi-project-then-destroys-contract-without-withdrawing-the-funds"}],"theft":true,"headline":true},{"id":"ht699c82ffbf","date":"2022-04-21","name":"Zeed Finance","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1517052623354232832"}],"desc":"Zeed Finance experienced an arithmetic error in reward distribution calculation. The vulnerability allowed the attacker to manipulate calculations to extract approximately $1M.","theft":true,"onchain":true},{"id":"htf735a10ff8","date":"2022-04-20","name":"Rogue Society team resurfaces after being called out for rug pulling $5.5 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":5500000.0,"lo":5500000.0,"hi":5500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rogue-society-team-resurfaces-after-being-called-out-for-rug-pulling-55-million"}],"theft":true,"headline":true},{"id":"ht9e3efe8acc","date":"2022-04-20","name":"MaxAPY Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1516676658350428160"}],"desc":"A Rug Pull occurred in MaxAPY Finance, an automatic pledge protocol on BNB Chain, and its official Twitter account and Telegram group have been deleted. MaxAPY contract owners have transferred 1,042 BNB.","theft":true},{"id":"htdacf5d7462","date":"2022-04-19","name":"Rich Bulls Club team resurfaces after being called out for rug pulling $3.7 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":3700000.0,"lo":3700000.0,"hi":3700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rich-bulls-club-team-resurfaces-after-being-called-out-for-rug-pulling-37-million"}],"theft":true,"headline":true,"review":["possible duplicate within one source"]},{"id":"hta441ccfe1e","date":"2022-04-19","name":"Developers drain over $1.1 million from $CHEDDA","kind":"hack","fam":"other","usd":1173805.0,"lo":1173805.0,"hi":1173805.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/developers-drain-11-million-from-chedda"}],"theft":true,"headline":true},{"id":"ht141102d6b9","date":"2022-04-19","name":"NFT influencer 0x_fxnction suffers $240,000 wallet compromise","kind":"hack","fam":"other","chains":["Solana"],"usd":240000.0,"lo":240000.0,"hi":240000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-influencer-0xfxnction-suffers-240000-wallet-compromise"}],"theft":true,"headline":true},{"id":"htc06cfbebfa","date":"2022-04-18","name":"$650,000 phishing attack against MetaMask user reveals that credentials are automatically backed up to iCloud","kind":"scam","fam":"social","chains":["Ethereum"],"usd":650000.0,"lo":650000.0,"hi":650000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/metamask-credentials-backed-up-to-icloud"}],"theft":true,"headline":true},{"id":"ht261d321b77","date":"2022-04-18","name":"2omb and Redemption defi projects endure repeated flash loan attacks","kind":"hack","fam":"other","chains":["Fantom"],"usd":189625.0,"lo":189625.0,"hi":189625.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/2omb-and-redemption-defi-projects-endure-repeated-flash-loan-attacks"}],"theft":true,"headline":true},{"id":"htfe576095ad","date":"2022-04-17","name":"Ugly People","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecAlert/status/1515628794505138178"}],"desc":"The Discord of NFT project Ugly People has been hacked, and attackers are spreading fake mint links.","theft":true},{"id":"ht5431b3747f","date":"2022-04-16","name":"Beanstalk","kind":"hack","fam":"market","tech":"Flashloan Governance Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":182000000.0,"lo":181000000.0,"hi":182000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/beanstalk-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1515683983836979201"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/beanstalk-farms-stablecoin-project-loses-182-million-to-exploit"}],"desc":"An attacker flashloaned $1B+ from Aave, Uniswap, and SushiSwap to gain 2/3 governance voting power and execute malicious proposals (Bip18 to drain the protocol, Bip19 to donate to Ukraine as cover), stealing $181M in non-Bean assets.","theft":true,"onchain":true},{"id":"htd2c37e527e","date":"2022-04-16","name":"FaceDAO","kind":"phishing","fam":"social","tech":"Phishing attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"According to official sources, a large amount of FACE tokens were dumped on-chain, and the investigation turned out that one of the FACE tokens held by the team was transferred and sold by an unauthorized account.","theft":true},{"id":"ht544aa3d7a4","date":"2022-04-16","name":"Metaconz","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/iamdoo2/status/1515278116268421120"}],"desc":"The developer of Klaytn-based NFT project Metaconz tweeted that a malicious bot was installed on the administrator account of Metaconz’s Discord overseas team on Saturday, causing 79 users to lose 11.9 ETH (about $36,000), the team said. It promised to compensate all losses, and 53 users have so far been compensated. In addition, the developer reminded that if the user executes the setApprovalForAll function in Etherscan, please transfer the wallet unconditionally. Therefore, in this attack, the hacker used this function to deprive the victim of the wallet permission.","theft":true},{"id":"ht95beb37a5e","date":"2022-04-15","name":"Rikkei Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1100000.0,"lo":1074678.0,"hi":1100000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/RikkeiFinance/status/1514838355758161920"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rikkei-finance-exploited-for-1-million"}],"desc":"Rikkei Finance lending protocol lacked permission controls in the setOracleDate function, allowing an attacker to manipulate oracle prices. With only 0.0001 BNB as collateral, the attacker borrowed all USDC, BTC, DAI, USDT, and BUSD from liquidity pools by inflating collateral value through the malicious oracle.","theft":true,"onchain":true},{"id":"htdb54fcf494","date":"2022-04-14","name":"Influencer \"The Real Tarzann\" (aka Mike Holston) rug pulls NFT project to the tune of $700,000","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/influencer-the-real-tarzann-aka-mike-holston-rug-pulls-nft-project-to-the-tune-of-700000"}],"theft":true,"headline":true},{"id":"ht33aaa2e17f","date":"2022-04-14","name":"Unicorn Nodes defi project rug pulls hours after launch","kind":"rugpull","fam":"insider","chains":["Avalanche"],"usd":129000.0,"lo":129000.0,"hi":129000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/unicorn-nodes-defi-project-rug-pulls-hours-after-launch"}],"theft":true,"headline":true},{"id":"ht489b38e264","date":"2022-04-13","name":"RCMP says more than $2 million has been lost to crypto scams in Richmond, B.C. since January","kind":"scam","fam":"social","usd":2070000.0,"lo":2070000.0,"hi":2070000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rcmp-says-more-than-2-million-has-been-lost-to-crypto-scams-in-richmond-b-c--since-january"}],"theft":true,"headline":true},{"id":"ht7b7065113e","date":"2022-04-13","name":"Fake SkyVerse project draws in more than $150,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":153050.0,"lo":153050.0,"hi":153050.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-skyverse-project-draws-in-more-than-150000-and-counting"}],"theft":true,"headline":true},{"id":"ht3b6c6cd6d1","date":"2022-04-12","name":"Elephant Money","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":22200000.0,"lo":22000000.0,"hi":22200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/elephant-money-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1512832398643265537"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-cashes-out-more-than-11-million-from-elephant-money"}],"desc":"On April 12, 2022, Elephant Money on BSC was exploited via flash loan attack. Attacker borrowed 131K WBNB and 91M BUSD, manipulated ELEPHANT price via the manipulable oracle, and exploited insufficient flash loan guards in the TRUNK redemption mechanism to steal ~$22.2M.","theft":true,"onchain":true},{"id":"hte151af2677","date":"2022-04-11","name":"Ichi token plummets 90% after Rari liquidity pool is emptied","kind":"hack","fam":"other","usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ichi-token-plummets-90-after-rari-liquidity-pool-is-emptied"}],"theft":true,"headline":true},{"id":"ht89c43f6829","date":"2022-04-11","name":"CF Token","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Token","chains":["BNB Chain"],"usd":1900000.0,"lo":1900000.0,"hi":1900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1513390068450308097"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-drains-creat-future-tokens-through-flaw-that-allows-anyone-to-transfer-the-contents-of-another-persons-wallet"}],"desc":"CF token contract exposed a public _transfer function with an unvalidated 'from' address parameter, allowing arbitrary transfers from any holder. The attacker executed 6 transactions to transfer 4.2M CF tokens, converting them to 4,200+ BNB and cashing out via Tornado Cash.","theft":true},{"id":"ht9b1e9fc00f","date":"2022-04-11","name":"NFT collector suffers wallet compromise and loses over 100 NFTs, priced at over $600,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-collector-suffers-wallet-compromise-and-loses-over-100-nfts-priced-at-over-600000"}],"theft":true,"headline":true},{"id":"htd780a45e37","date":"2022-04-11","name":"Marvin Inu","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1649643151433052.html"}],"desc":"According to official news, Marvin Inu’s cross-chain bridge was hacked, and tokens worth 110 ETH were stolen and sold, causing a sharp drop in price. The project party has closed the cross-chain bridge and fixed the loopholes. At the same time, it has adjusted the purchase tax to 0%, and promised to repurchase and destroy the tokens to make up for this loss after the price fluctuations stabilize.","theft":true},{"id":"hte14309e3f0","date":"2022-04-11","name":"Creat Future","kind":"hack","fam":"code","tech":"Overflow","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"hte8aa1c0e6b","date":"2022-04-10","name":"UGC","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://forkast.news/headlines/twitter-hacker-fake-azuki-nft/"}],"desc":"The Education Grants Council (UGC) of India was hacked, the hackers used the Twitter account to post a fake Azuki NFT airdrop link and changed the profile to the Azuki NFT co-creator, replacing the avatar with an Azuki-related image. The agency recovered the account after it was held hostage for six hours.","theft":true},{"id":"htce25615844","date":"2022-04-09","name":"GYMNetwork","kind":"hack","fam":"market","tech":"Flashloan + token migrate flaw","chains":["BNB Chain"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht3a16a9ebb8","date":"2022-04-07","name":"Starstream Finance","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mobile.twitter.com/SlowMist_Team/status/1512482819326492676"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/starstream-treasury-drained"}],"desc":"Starstream Finance's treasury was drained via an unprotected execute() function in the DistributorTreasury contract that allowed external calls bypassing owner restrictions on token withdrawals.","theft":true},{"id":"ht7a4542afef","date":"2022-04-07","name":"Legal action begins against developer who solicited investments to build an OpenSea competitor, then used it to fund his NFT trading","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/0penft-legal-action"}],"theft":true,"headline":true},{"id":"htc8b4e99cf3","date":"2022-04-07","name":"WonderHero","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Gaming","chains":["BNB Chain"],"usd":320000.0,"lo":320000.0,"hi":325000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blockchain-bridge-for-wonderhero-exploited"}],"desc":"WonderHero's hot wallet private keys were compromised, likely via phishing targeting the seed phrase, resulting in theft of approximately $320,000 in BNB.","theft":true},{"id":"htdd1b1b6866","date":"2022-04-06","name":"Scammer creates a fake site to revoke wallet permissions, then pretends there is an OpenSea vulnerability to trick people into using it","kind":"scam","fam":"social","chains":["Ethereum"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-creates-a-fake-site-to-revoke-wallet-permissions"}],"theft":true,"headline":true},{"id":"ht2bcb7f302c","date":"2022-04-05","name":"Vires Finance","kind":"fraud","fam":"insider","tech":"Unknown","usd":530000000.0,"lo":530000000.0,"hi":530000000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.dlnews.com/articles/defi/waves-vires-finance-sasha-ivanov-role-in-crypto-530m/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/waves-protocol-losses"}],"desc":"In 2022, the DeFi protocol Vires Finance on the Waves blockchain suffered losses exceeding $530 million, with its founder Sasha Ivanov facing allegations of fraud. Research suggests that his wallet may have been linked to the outflow of funds, though Ivanov has denied all accusations, calling them “baseless rumors.” The incident had major market and legal repercussions—Waves' native token (WAVES) plunged by 95%, and the stablecoin USDN also sharply depegged. Investors including Alameda Research and Avraham Eisenberg have filed lawsuits against Ivanov in efforts to recover their losses, with legal proceedings still ongoing."},{"id":"ht689e1d5702","date":"2022-04-05","name":"Another $1 million lawsuit is filed against OpenSea for stolen apes","kind":"other","fam":"other","chains":["Ethereum"],"usd":165000.0,"lo":165000.0,"hi":165000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bored-ape-opensea-lawsuit-3"}],"headline":true},{"id":"ht8a57816419","date":"2022-04-04","name":"Scammer takes advantage of a platform's poor UX to steal several pricey Bored Ape NFTs","kind":"scam","fam":"social","chains":["Ethereum"],"usd":587000.0,"lo":587000.0,"hi":587000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammer-uses-poor-ux-to-steal-pricey-bored-ape-nfts"}],"theft":true,"headline":true},{"id":"htdbca65ae17","date":"2022-04-03","name":"User loses £55,000 (~$72,000) to Trezor phishing email","kind":"scam","fam":"social","chains":["Bitcoin"],"usd":72000.0,"lo":72000.0,"hi":72000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trezor-phishing-email"}],"theft":true,"headline":true},{"id":"ht4c0e090599","date":"2022-04-02","name":"Inverse Finance Frontier","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":15600000.0,"lo":15600000.0,"hi":15600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/inverse-finance-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/inverse-finance-exploited"}],"desc":"On April 2, 2022, an attacker injected ~$3M in ETH into SushiSwap INV/ETH to artificially inflate the Keep3r price feed, then borrowed $15.6M (DOLA, ETH, WBTC, YFI) from Inverse Finance's Anchor market using inflated INV collateral.","theft":true},{"id":"ht1d7effc965","date":"2022-04-01","name":"Taiwanese singer Jay Chou has Bored Ape stolen","kind":"hack","fam":"other","chains":["Ethereum"],"usd":424541.0,"lo":424541.0,"hi":424541.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/taiwanese-singer-jay-chou-has-bored-ape-stolen"}],"theft":true,"headline":true},{"id":"ht1deec70112","date":"2022-04-01","name":"Multiple NFT projects","kind":"hack","fam":"keys","tech":"Discord was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/295598.html"}],"desc":"According to the official news of each project, the Discord of NFT projects whose servers are currently under attack include BAYC, Doodles, Nyoki, Shamanz, Zooverse, Dreadfuls, Freaky Labs, and Kaijukingz. In addition, the source code of the verification robot Captcha has been leaked, and the private message tool Ticket tool has been attacked.","theft":true},{"id":"ht3a3012a3d5","date":"2022-03-31","name":"Voltage Finance","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Fuse"],"usd":4670000.0,"lo":3600000.0,"hi":4670000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/voltage-finance-rekt"},{"s":"SlowMist Hacked","u":"https://ola-finance.medium.com/ola-and-voltage-lending-exploit-on-fuse-post-mortem-214c13d88443"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ola-finance-hacked-for-3-6-million"}],"desc":"Voltage Finance on Fuse was drained of ~$4.67M via a reentrancy attack. The attacker funded a flash loan, borrowed against collateral, then used ERC677's transfer callback to reenter and withdraw collateral without repaying, repeating until markets were empty before bridging to Ethereum and BNB Chain.","theft":true},{"id":"ht4836a402bb","date":"2022-03-31","name":"Former Cosmic Cowgirls head community moderator accuses the project of rug-pulling","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":1046000.0,"lo":1046000.0,"hi":1046000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/former-cosmic-cowgirls-head-community-moderator-accuses-the-project-of-rug-pulling"}],"theft":true,"headline":true},{"id":"htb096474bde","date":"2022-03-30","name":"BasketDAO","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BasketDAOOrg/status/1509009439315034115"}],"desc":"BasketDAO's BMIZapper contract lacked input validation in the _primitiveToBMI function, allowing arbitrary external calls. The attacker passed a malicious address to drain all approved crypto assets held by the contract.","theft":true},{"id":"ht826542e3f5","date":"2022-03-30","name":"Jet Protocol","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Solana"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CharlieYouAI/status/1508842093514567687"}],"desc":"Castle Finance developer Charlie You discovered a critical vulnerability in Solana's ecological lending protocol, Jet Protocol, that could allow attackers to withdraw tokens from arbitrary accounts. It is reported that Charlie You was discovered in January this year, but it has existed since the code update on December 15, 2021. Charlie You said that the vulnerability may cause up to 20 million US dollars in financial losses. For now, the Jet Protocol team has fixed it.","theft":true},{"id":"ht09b1a1bce7","date":"2022-03-29","name":"Creator of apparent $21 million Bored Bunny rug pull miraculously resurfaces following DOJ action against a different rug pull","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":21100000.0,"lo":21100000.0,"hi":21100000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/creator-of-apparent-21-million-bored-bunny-rug-pull-miraculously-resurfaces"}],"theft":true,"headline":true},{"id":"ht96c0a1ddd7","date":"2022-03-29","name":"BNB DEFI","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1508626057913520128"}],"desc":"A Rug Pull occurred in BNB DEFI, and the DEFI token fell by 68% in a short time. At present, the project has closed the community, and DEFI tokens have been exchanged for about 255 BNB.","theft":true},{"id":"ht31c7cfab4d","date":"2022-03-29","name":"Redacted Cartel","kind":"hack","fam":"code","tech":"Custom Approval Logic","conf":"C","n":1,"theft":true},{"id":"hte085993c10","date":"2022-03-28","name":"Owner of two pricey Ape NFTs sells them for $140 in a possible hack","kind":"hack","fam":"other","chains":["Ethereum"],"usd":425000.0,"lo":425000.0,"hi":425000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/owner-of-two-pricey-ape-nfts-sells-them-for-140-in-a-possible-hack"}],"theft":true,"headline":true,"review":["possible duplicate within one source"]},{"id":"htf558d00f30","date":"2022-03-28","name":"Another collector loses a Bored Ape to a phishing scam","kind":"scam","fam":"social","chains":["Ethereum"],"usd":368660.0,"lo":368660.0,"hi":368660.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/another-collector-loses-a-bored-ape-to-a-phishing-scam"}],"theft":true,"headline":true},{"id":"ht308ca60e0d","date":"2022-03-28","name":"Cryptovoxels","kind":"hack","fam":"social","tech":"Phishing","target":"Gaming","chains":["Ethereum"],"usd":171000.0,"lo":171000.0,"hi":171000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/1648481767086002.html"}],"desc":"Cryptovoxels' Discord server was compromised via a vulnerable bot. An attacker posted a phishing link promising 0.01 ETH parcels, tricking users into connecting MetaMask wallets and approving malicious transactions that drained approved assets.","theft":true},{"id":"htdac212b65a","date":"2022-03-28","name":"BuccaneerFi","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1508337292020445187"}],"desc":"The project BuccaneerFi on the BNB Chain has a Rug Pull. At present, the project social media account and community have been deleted, and about 841 BNB have been transferred to Tornado Cash.","theft":true},{"id":"ht54126693df","date":"2022-03-27","name":"Revest Finance","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":2000000.0,"lo":120000.0,"hi":2010000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/revest-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/RevestFinance/status/1507968623792607233"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/revest-finance-is-hacked-for-2-million"}],"desc":"On March 27, 2022, Revest Finance was exploited via ERC1155 reentrancy when the fnftId counter was incremented after the external callback. The attacker re-entered the mint function to create multiple FNFTs pointing to the same pool, then redeemed all to drain ~$2M in BLOCKS, ECO, and RENA tokens.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htbffea544ce","date":"2022-03-27","name":"NFT trader loses a Mutant Ape NFT to an NFT swap scam","kind":"scam","fam":"social","chains":["Ethereum"],"usd":73585.0,"lo":73585.0,"hi":73585.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-trader-loses-a-mutant-ape-nft-to-an-nft-swap-scam"}],"theft":true,"headline":true},{"id":"ht7aefc30fbe","date":"2022-03-26","name":"Auctus","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":726000.0,"lo":726000.0,"hi":726000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Auctus options protocol had a beta contract allowing arbitrary low-level calls with controlled calldata. An attacker exploited this to drain approved user funds from wallets, targeting those who had granted unlimited approval to the contract.","theft":true,"onchain":true},{"id":"ht768799a99f","date":"2022-03-26","name":"InuSaitama","kind":"hack","fam":"other","tech":"Arbitrage attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Saitamaguru1/status/1507771365381840900"}],"desc":"InuSaitama is suspected to have suffered an arbitrage attack. The attacker ([address])\r\n Saitamask ([address]) exchanged almost 10 times the value of SAITAMA Token through swap, and then exchanged it back to ETH through uniswap, and transferred it to [address], with a total profit of about 4.","theft":true},{"id":"ht41ec6e1a92","date":"2022-03-25","name":"Maison Ghost","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MaisonGhost/status/1507191251816300548"}],"desc":"Maison Ghost’s Discord was hacked, the hacker posted a fake minting link, and within minutes about 300 NFTs were stolen, including the Sandbox and 3landers NFTs, which were then sold for 128 ETH and eventually sent to Tornado.","theft":true},{"id":"ht777ae4f4af","date":"2022-03-24","name":"Pye suffers a $2.6 million loss in a flash loan attack","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":2600000.0,"lo":2600000.0,"hi":2600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pye-suffers-a-2-6-million-loss-in-a-flash-loan-attack"}],"theft":true,"headline":true},{"id":"ht84b5daabbb","date":"2022-03-24","name":"Hacked verified Twitter accounts impersonate BAYC founders, scam $1 million with fake ApeCoin airdrop","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacked-verified-twitter-accounts-impersonate-bayc-founders-scam-1-million"}],"theft":true,"headline":true},{"id":"ht713c7a4aa2","date":"2022-03-23","name":"Ronin Bridge","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":624000000.0,"lo":610000000.0,"hi":625000000.0,"ret":5700000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ronin-rekt"},{"s":"SlowMist Hacked","u":"https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/axie-infinity-suffers-625-million-exploit"}],"desc":"On March 23, 2022 the Ronin Network bridge (connecting Axie Infinity sidechain to Ethereum) suffered the largest cryptocurrency theft in history when attackers compromised validator node private keys, gaining control of 5 of 9 validators and using the majority to approve fraudulent withdrawals of 173,600 ETH and 25.5 million USDC ($624M total). The breach was discovered six days later on March 29.","theft":true,"onchain":true,"actor":"North Korea (Lazarus Group, APT38)","attr":{"by":"FBI","date":"2022-04-14","title":"FBI Statement on Attribution of Malicious Cyber Activity Posed by the Democratic People's Republic of Korea","url":"https://www.fbi.gov/news/press-releases/fbi-statement-on-attribution-of-malicious-cyber-activity-posed-by-the-democratic-peoples-republic-of-korea"},"official":"$620M"},{"id":"ht6dc7c20001","date":"2022-03-23","name":"Cashio","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Solana"],"usd":52027994.22,"lo":52000000.0,"hi":52800000.0,"ret":14070000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cashio-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/i/web/status/1506571243067224064"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/robin-hood-esque-attacker-steals-52-million-from-cashio-then-returns-smaller-amounts-and-pledges-to-donate-the-rest-to-charity"}],"desc":"Cashio's infinite-mint bug arose from two missing account-validation checks in the collateral deposit path, letting attackers use fake tokens as Saber LP collateral. ~2 billion CASH were minted and swapped for ~$52.8M in USDC, USDT and UST; CASH crashed to $0.00005.","theft":true},{"id":"ht043089015d","date":"2022-03-23","name":"MekaVerse","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/MekaVerse/status/1506531849643991041"}],"desc":"NFT project MekaVerse tweeted that the official Discord was hacked. In addition, according to other users in the community, the wallets of hundreds of thousands of bots are suspected to have been stolen, and it seems that no users have been affected.","theft":true},{"id":"ht4af0ff7a6c","date":"2022-03-23","name":"VEVE","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/veve_official/status/1506462178223616001"}],"desc":"The NFT project VEVE officially tweeted that the system was exploited, resulting in a large number of gems being illegally obtained.","theft":true},{"id":"ht00175a0df4","date":"2022-03-22","name":"Arthur","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["Ethereum"],"usd":1643033.0,"lo":1643033.0,"hi":1643033.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/cr0ssETH/status/1506086576601849857"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-more-than-1-5-million-after-compromising-wallets-belonging-to-crypto-whale-arthur0x"}],"desc":"Twitter user cr0ss.eth said Defiance Capital founder Arthur's hot wallet was suspected to have been stolen. OpenSea data shows that in Arthur's wallet address [address], 60 NFTs including 17 azuki and 5 cloneX were transferred on the chain, totaling about 310 ETH.","theft":true},{"id":"ht305d86342f","date":"2022-03-22","name":"REALSWAK","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1506187501609775107"}],"desc":"The NFT project REALSWAK has a Rug Pull, and its official social account (@REALSWAK) has been cancelled. Scammers have transferred 1,300 BNB to the TornadoCash mixer.","theft":true},{"id":"htdc3edaf28f","date":"2022-03-22","name":"CompoundTUSDSweepTokenBypass","kind":"hack","fam":"code","tech":"Insufficient validation","conf":"C","n":1,"theft":true},{"id":"ht3c59b35213","date":"2022-03-21","name":"Team behind the NeoNexus NFT project raises several million dollars, then abandons it","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/team-behind-the-neonexus-nft-project-raises-several-million-dollars-then-abandons-it"}],"theft":true,"headline":true},{"id":"htd3ac5e32a7","date":"2022-03-21","name":"One Ring Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","Fantom"],"usd":1454672.0,"lo":1400000.0,"hi":1454672.24,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/oneringfinance/onering-finance-exploit-post-mortem-after-oshare-hack-602a529db99b"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-1-45-million-from-onering-finance-using-code-that-self-destructs-after-the-attack"}],"desc":"One Ring Finance was exploited via flash loan price manipulation when the protocol's LP token price calculation lacked time-weighted averaging. The attacker pre-positioned assets through Celer Network's cBridge and deployed a contract to drain liquidity.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht9c7d12f356","date":"2022-03-21","name":"Phishing scheme promising to animate one's apes nets attacker a collector's three pricey Bored Apes","kind":"scam","fam":"social","chains":["Ethereum"],"usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/phishing-scheme-promising-to-animate-ones-apes-nets-attacker-a-collectors-three-pricey-bored-apes"}],"theft":true,"headline":true,"review":["possible duplicate within one source"]},{"id":"ht99917c6a68","date":"2022-03-20","name":"Umbrella Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/UmbNetwork/status/1505529412695076868"}],"desc":"Umbrella Network's Polar Stream staking contracts on Ethereum and BSC suffered an unchecked underflow in the withdrawal function. The attacker drained LP tokens and used them to withdraw liquidity from UMB-ETH Uniswap and UMB-BNB Pancakeswap pools.","theft":true,"onchain":true},{"id":"ht7956e9eef8","date":"2022-03-20","name":"LI.FI","kind":"hack","fam":"code","tech":"Token Approval Abuse","target":"DeFi Protocol","chains":["Ethereum"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.li.finance/20th-march-the-exploit-e9e1c5c03eb9"}],"desc":"LI.FI's swap aggregator was exploited via unchecked external calls in the swap contract. The attacker drained $600,000 from 29 user wallets that had granted infinite token approvals.","theft":true,"onchain":true},{"id":"ht44b2a01426","date":"2022-03-20","name":"Hubspot","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/blockfi-confirms-unauthorized-access-to-client-data-hosted-on-hubspot"}],"desc":"Crypto lender BlockFi has confirmed a data breach at Hubspot, one of its third-party vendors, Cointelegragh reported. Hubspot stores BlockFi's user data, including names, email addresses, and phone numbers. According to the announcement, hackers stole BlockFi’s customer data on March 18. Hubspot has confirmed that an unauthorized third party obtained certain BlockFi customer data deposited on its platform. BlockFi is currently cooperating with Hubspot's investigation to clarify the overall impact of the data breach. While the exact details of the stolen data have yet to be identified and disclosed, BlockFi emphasized that data such as passwords, government-issued IDs, and Social Security numbers were never stored on Hubspot.","theft":true},{"id":"htd2d01bacf2","date":"2022-03-18","name":"Australian regulatory agency begins lawsuit against Facebook over failing to address scammy crypto ads","kind":"scam","fam":"social","usd":650000.0,"lo":650000.0,"hi":650000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/australian-regulatory-agency-begins-lawsuit-against-facebook-over-failing-to-address-scammy-crypto-ads"}],"theft":true,"headline":true},{"id":"htd7b2989340","date":"2022-03-17","name":"ApeCoin","kind":"hack","fam":"market","tech":"Flashloan Governance Attack","target":"Token","chains":["Ethereum"],"usd":820000.0,"lo":500000.0,"hi":1100000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/wilburforce_/status/1504437189979119622"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/people-briefly-borrow-bored-ape-nfts-to-claim-as-much-as-1-1-million-in-ape-tokens"}],"desc":"ApeCoin airdrop lacked snapshot protection against flash loans. An attacker flash-loaned BAYC NFTs from NFTX, claimed the airdrop allocation for those NFTs (60,564 APE tokens), and sold them for ~$820K profit in ETH.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htf975e2593e","date":"2022-03-16","name":"Discord hack targeting Rare Bears NFT project nets attacker $800,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":817259.0,"lo":817259.0,"hi":817259.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/discord-hack-targeting-rare-bears-nft-project-nets-attacker-800000"}],"theft":true,"headline":true},{"id":"ht046daf9a37","date":"2022-03-15","name":"Hundred Finance","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Gnosis"],"usd":6200000.0,"lo":6000000.0,"hi":12066426.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/agave-hundred-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/HundredFinance/status/1503754916300476420"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hundred-finance-and-agave-finance-are-both-exploited-for-a-collective-12-million"}],"desc":"On March 15-16, 2022, an attacker exploited a reentrancy vulnerability in Hundred Finance's callback handling to borrow $6 million across multiple markets. The attacker deposited ~$2M USDC collateral, then repeatedly borrowed against it via the onTokenTransfer() callback which triggered before debt was updated.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht5a292d46c4","date":"2022-03-15","name":"Agave","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Gnosis"],"usd":5500000.0,"lo":5400000.0,"hi":5500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Agave_lending/status/1503725275917565954"}],"desc":"On Gnosis Chain, attackers exploited xDAI's non-standard _callAfterTransfer() callback reentrancy; using flashloans to stack borrows before balance updates, they withdrew amounts far exceeding collateral value.","theft":true,"onchain":true},{"id":"ht651aa4edeb","date":"2022-03-15","name":"DEUS Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Fantom","Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3096984.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deus-dao-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1503632734299701250"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hackers-make-off-with-over-3-million-from-deus-finance"}],"desc":"Deus Finance derivatives platform was exploited via oracle manipulation. A flash loan was used to move prices in Solidly and Spirit pools, causing the Muon oracle to report inflated prices. This triggered cascading liquidations rendering users insolvent.","theft":true},{"id":"hte926e7c0ab","date":"2022-03-14","name":"Discord compromise targets fans of the Wizard Pass project in a two-for-one scam that both accepted payments for fake NFTs and stole the NFTs that victims already owned","kind":"scam","fam":"social","chains":["Ethereum"],"usd":169000.0,"lo":169000.0,"hi":169000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/discord-compromise-targets-fans-of-the-wizard-pass-project-in-a-two-for-one-scam-that-both-accepted-payments-for-fake-nfts-and-stole-the-nfts-that-victims-already-owned"}],"theft":true,"headline":true},{"id":"hte8062e0ce6","date":"2022-03-14","name":"NFTflow","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/post/5177108"}],"desc":"Several NFT players posted on social media that a project called \"NFTflow\" had a Rug Pull, ran away without completing the pre-sale, and transferred the 92 ETHs from the sale to the Tornado mixer. According to the official website, NFTflow calls itself \"a platform for creating liquid markets for illiquid NFTs on StarkNet\".","theft":true},{"id":"htf23813160f","date":"2022-03-14","name":"PulseDAO Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Fantom"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/RugDocIO/status/1503160281442050054"}],"desc":"According to RugDoc on Twitter, PulseDAO Finance has rugpulled. Social and website are closed. 4342 FTM was removed by contract developer.","theft":true},{"id":"ht4ad90bc5c8","date":"2022-03-13","name":"Paraluni Masterchef","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1700000.0,"lo":1700000.0,"hi":1700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1502815435498176514"}],"desc":"Paraluni MasterChef lost $1.7M on March 13, 2022 to a flashloan-funded reentrancy attack. Attacker borrowed 157K USDT and 157K BUSD via PancakeSwap, exploited depositByAddLiquidity's missing pool ID validation, and triggered reentrancy via malicious transferFrom before state updated.","theft":true,"onchain":true},{"id":"ht46c9d56f0a","date":"2022-03-11","name":"Facebook bans crypto scammer who pulled in up to $140,000 by impersonating economist David Rosenberg","kind":"scam","fam":"social","chains":["Bitcoin"],"usd":143584.0,"lo":143584.0,"hi":143584.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/facebook-bans-crypto-scammer-who-pulled-in-up-to-140000-by-impersonating-economist-david-rosenberg"}],"theft":true,"headline":true},{"id":"ht0fa06cdfdd","date":"2022-03-10","name":"ActiveCampaign（AC）","kind":"hack","fam":"keys","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2022/03/16/unchained-capital-discloses-data-leak-at-email-marketing-partner/"}],"desc":"ActiveCampaign (AC), an external email marketing provider used by Unchained, was hacked last week, according to Joe Kelly, CEO of Bitcoin financial services firm Unchained Capital. Information shared with AC, including customer email addresses, usernames, account status, whether customers have active multi-signature vaults or loans using Unchained Capital, and possibly IP addresses may have flowed out without authorization. Kelly said no systems on Unchained were affected, meaning customer profile information that was never shared with AC was not leaked. Kelly added that while customer Bitcoin custody is protected by multi-signature cold storage, customers should still be aware of what's going on and be wary of phishing attacks.","theft":true},{"id":"ht8cc5df0fd7","date":"2022-03-09","name":"Fantasm Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Fantom"],"usd":2622097.0,"lo":2622097.0,"hi":2682648.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/fantasm_finance/status/1501569232881995785"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fantasm-finance-exploited"}],"desc":"Fantasm Finance's mint function validated msg.value instead of the actual FTM amount transferred, allowing attackers to mint XFTM without collateral. The attacker drained the reserve of 1,008.5 ETH (~$2.62M), swapped it through Tornado Cash, and XFTM fell ~98%.","theft":true},{"id":"ht6d366291bb","date":"2022-03-09","name":"Pirate X","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":78000.0,"lo":78000.0,"hi":78000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BlockSecTeam/status/1501474721384497157"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pirate-x-pirate-blockchain-gaming-platform-exploited"}],"desc":"Pirate X gaming platform staking wallet was compromised. An attacker sold 9.6M PXP tokens from the protocol, profiting approximately 212 BNB. The team acknowledged bypassing security inspection before launching a vulnerable conversion feature.","theft":true},{"id":"ht097b455aca","date":"2022-03-05","name":"Bacon Protocol","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bacon-protocol-hacked-for-1-million"}],"desc":"Bacon Protocol NFT mortgage lending platform was exploited via reentrancy in the lend() function. The contract used ERC777 without considering callback security, allowing an attacker to reenter lend() to obtain excessive lending credits and drain ~$1M.","theft":true,"onchain":true},{"id":"ht67afa36070","date":"2022-03-05","name":"BattleCatsArena apparently rug pulls several weeks after launch","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":54943.0,"lo":54943.0,"hi":54943.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/battlecatsarena-apparently-rug-pulls"}],"theft":true,"headline":true},{"id":"ht2076a6c9c4","date":"2022-03-03","name":"Treasure","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Arbitrum","Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1539000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/treasure-dao-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2022/03/03/stolen-smol-brains-nfts-returned-to-users-hours-after-treasure-exploit/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nba-player-deaaron-fox-ditches-nft-project"}],"desc":"Treasure marketplace's buyItem() function failed to validate token types, allowing attackers to purchase NFTs by specifying incorrect ERC721/ERC1155 amounts for free.","theft":true,"onchain":true,"review":["possible duplicate within one source","sources disagree on the date"]},{"id":"ht782c3bab7b","date":"2022-03-02","name":"Bug in Treasure NFT marketplace results in listings being sold for free","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/treasure-nft-marketplace-bug"}],"theft":true,"headline":true},{"id":"ht20ec2c0d2b","date":"2022-03-01","name":"One contracted developer writes malicious code for 32 different NFT projects","kind":"hack","fam":"other","chains":["Ethereum"],"usd":580325.0,"lo":580325.0,"hi":580325.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/one-contracted-developer-writes-malicious-code-for-32-different-nft-projects"}],"theft":true,"headline":true},{"id":"hta030bed7b2","date":"2022-02-28","name":"Elexir draws in more than $1.3 million, then announces an end to the project a week later and \"reimburses\" investors with $300,000","kind":"rugpull","fam":"insider","chains":["Avalanche"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/elexir-ends-project"}],"theft":true,"headline":true},{"id":"hta82d2012be","date":"2022-02-28","name":"NFT collector files $6 million lawsuit against OpenSea, LooksRare, and the company behind Bored Apes for not doing more to discourage thefts","kind":"other","fam":"other","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bored-ape-opensea-lawsuit-2"}],"headline":true},{"id":"ht74bda0c7f6","date":"2022-02-26","name":"Howlerz NFT drop goes incredibly badly, with heavy botting, a poorly-implemented contract, and buyers falling for a scam contract","kind":"scam","fam":"social","chains":["Ethereum"],"usd":675000.0,"lo":675000.0,"hi":675000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/howlerz-nft-drop-goes-badly"}],"theft":true,"headline":true},{"id":"ht71d81c88cb","date":"2022-02-26","name":"Co-founder and primary artist for Starcatchers NFT project uses insider knowledge to buy the project's rare NFTs to flip after reveal","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/co-founder-and-primary-artist-for-starcatchers-insider-trades"}],"headline":true},{"id":"ht0a6fbb487f","date":"2022-02-25","name":"Pixelmon raises $70 million only to reveal hilariously bad NFTs","kind":"hack","fam":"other","chains":["Ethereum"],"usd":70000000.0,"lo":70000000.0,"hi":70000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pixelmon-raises-70-million-only-to-reveal-hilariously-bad-nfts"}],"theft":true,"headline":true},{"id":"htf428b42e7a","date":"2022-02-23","name":"Flurry Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":293000.0,"lo":293000.0,"hi":293000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKCommunity/status/1496263106485444608"}],"desc":"Flurry Finance yield aggregator was exploited via manipulation of the rhoToken multiplier. An attacker switched an address from EOA to contract and artificially inflated rhoToken balance, then redeemed inflated shares to withdraw underlying stablecoins from the FinanceRabbit strategy vault.","theft":true},{"id":"htdd6b6827d7","date":"2022-02-20","name":"OpenSea","kind":"hack","fam":"social","tech":"Phishing","target":"NFTfi","chains":["Ethereum"],"usd":3045310.0,"lo":2000000.0,"hi":3400000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/dfinzer/status/1495302784689704966"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/seventeen-opensea-users-hit-by-phishing-attack"}],"desc":"OpenSea users received phishing emails impersonating the platform and requesting wallet connection for a contract migration. Attackers tricked users into approving malicious transactions that transferred NFTs to attacker-controlled wallets. The attack stole approximately 640 ETH worth of NFTs from 28 wallets.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht28673d6e9b","date":"2022-02-19","name":"Gold Mine Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Fantom"],"usd":800000.0,"lo":800000.0,"hi":800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/rugdocio/status/1494737976819163139?s=21"}],"desc":"Rugdoc.io tweeted that the Fantom ecological project Gold Mine Finance has rug pull.","theft":true},{"id":"ht1a0f6cd398","date":"2022-02-19","name":"MOX","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"MOX was hacked because transferFrom Function did not check the authorization limit.","theft":true,"onchain":true},{"id":"htb9bf771c95","date":"2022-02-18","name":"Rigoblock","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":464000.0,"lo":464000.0,"hi":464000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/RigoBlock/status/1494351180713050116"}],"desc":"RigoBlock's Dragos contracts lacked the onlyOwner modifier on the setMultipleAllowances function, allowing attackers to modify token allowances without authorization. An attacker exploited this to drain 160.86 ETH from the protocol's liquidity pools. The attacker later returned 90% of funds, retaining 10% as a bounty.","theft":true},{"id":"ht444d5dfff8","date":"2022-02-18","name":"Former owner of a reportedly stolen Bored Ape files million-dollar lawsuit against OpenSea","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bored-ape-opensea-lawsuit-1"}],"headline":true},{"id":"htf23252287c","date":"2022-02-17","name":"TopGoal","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"Gaming","chains":["BNB Chain"],"usd":1100000.0,"lo":1100000.0,"hi":1100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@TopGoal_NFT/latest-update-and-solution-of-todays-hacking-event-e18774b6e69a"}],"desc":"TopGoal's hot wallet was compromised, leading to the theft of over 4.8 million TMT tokens used for TopPrize rewards distribution. The attacker swapped TMT tokens for BNB on PancakeSwap and used Tornado Cash to obscure the transfer. User assets and NFTs remained secure as they were stored separately.","theft":true},{"id":"ht27a4566770","date":"2022-02-15","name":"BNB42 rug pulls for over $2.7 million","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":2780000.0,"lo":2780000.0,"hi":2780000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bnb42-rug-pulls-for-over-2-7-million"}],"theft":true,"headline":true},{"id":"ht23240bd9a2","date":"2022-02-14","name":"Titano Finance","kind":"hack","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1949000.0,"lo":1949000.0,"hi":1949000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://titano.medium.com/important-update-2018edb0a0b1"}],"desc":"Titano Finance relied on a contractor to deploy the PLAY contract, but the contractor included a backdoor allowing either the contract owner or deployer to modify the PrizeStrategy. The contractor exploited this privilege to steal 4,828.7 BNB. All stolen funds were returned to Titano's treasury on February 23rd.","theft":true},{"id":"ht8e59b682c8","date":"2022-02-12","name":"IRA Financial / Gemini","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"CEX","chains":["Ethereum","Bitcoin"],"usd":36000000.0,"lo":36000000.0,"hi":36000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://gostake.io/resource/news/9d5c0fa2e75934a56a782cf97b61778e.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/retirement-accounts-drained-in-ira-financial-hack"}],"desc":"Hackers obtained IRA Financial's master API key from unencrypted emails between Gemini and IRA, which contained a single point of failure that bypassed security protocols. The attackers consolidated funds from all sub-accounts into one and withdrew approximately $36M in Bitcoin and Ether within a two-hour window before Gemini could freeze accounts.","theft":true},{"id":"ht6855a39afc","date":"2022-02-11","name":"Porn actress Lana Rhoades apparently abandons her NFT project after its launch","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lana-rhoades-rug-pull"}],"theft":true,"headline":true},{"id":"ht6a15497e40","date":"2022-02-11","name":"Build Finance","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["Ethereum"],"usd":470000.0,"lo":470000.0,"hi":470000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/finance_build/status/1493223190071554049"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/buildfinance-dao-hostile-takeover"}],"desc":"Build Finance DAO suffered a governance takeover when an attacker submitted a proposal to grant themselves minting and treasury controls. Low participation allowed the malicious proposal to pass unnoticed. The attacker minted 1.1 billion BUILD tokens, drained liquidity pools on Uniswap and Balancer, and stole 130,000 METRIC tokens from the treasury, ultimately extracting 160 ETH.","theft":true,"onchain":true},{"id":"ht06c646bc67","date":"2022-02-11","name":"Crowdfunded TitanReach MMO game project \ncrashes and burns after developer spends investor money on a bad crypto gamble and a Tesla","kind":"fraud","fam":"insider","usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/titanreach-mmo-game-developer-spends-investor-money-on-a-bad-crypto-gamble-and-a-tesla"}],"headline":true},{"id":"ht17a19955d9","date":"2022-02-11","name":"FutureSwap","kind":"hack","fam":"keys","tech":"Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/futureswapx/status/1491979618571591685"}],"desc":"Decentralized derivatives trading platform FutureSwap tweeted that an account with around 300,000 FST reward reserves (0.3% of supply) was compromised yesterday. The credentials for this account were compromised by human error, and the attacker was able to gain access on Arbitrum and transfer the available reward FST to himself.","theft":true},{"id":"ht554f0e4681","date":"2022-02-10","name":"Dego Finance","kind":"hack","fam":"keys","tech":"Deployer Key Compromised","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Cronos"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/dego-finance-rekt"},{"s":"SlowMist Hacked","u":"https://degofinance.medium.com/to-dego-community-summary-of-the-event-after-a-thorough-investigation-and-efforts-5315a98d9984"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dego-finance-hacked"}],"desc":"On February 10, 2022, Dego Finance was hacked when the contract deployer's private key was compromised. Attackers drained approximately $10-14.4M from liquidity pools on Uniswap and PancakeSwap across Ethereum, BSC, and Cronos.","theft":true},{"id":"ht148ea75dc8","date":"2022-02-10","name":"BabyMuskCoin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":653300.0,"lo":653300.0,"hi":653300.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CertiKCommunity/status/1491483014467047437?s=19"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/baby-musk-coin-rug-pulls"}],"desc":"BabyMuskCoin plummeted 99%, 1,571 BNB (~$660,000) was dumped, and funds were moved to Tornado. The project team claimed to have been scammed through Telegram, but Twitter and the website were down, suspected of Rugpull.","theft":true},{"id":"htfaef8fd33f","date":"2022-02-08","name":"Superfluid","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Polygon","Ethereum"],"usd":8700000.0,"lo":8700000.0,"hi":13000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/superfluid-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/superfluid-exploited"}],"desc":"On February 8, 2022 Superfluid (money streaming protocol on Polygon) suffered an exploit of approximately $8.7 million via a vulnerability in the CTX (context) validation mechanism where the attacker injected a forged context containing an arbitrary sender address, allowing agreement contracts to execute transfers on behalf of other accounts.","theft":true},{"id":"htaab388faf2","date":"2022-02-08","name":"PayBito","kind":"hack","fam":"other","tech":"Ransomware","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://securityaffairs.co/wordpress/127683/cyber-crime/lockbit-ransomware-hit-paybito.html"}],"desc":"On February 8, the LockBit ransomware group claimed to have stolen substantial customer data from cryptocurrency exchange PayBito. PayBito is a cryptocurrency exchange operated by HashCash, a global blockchain, and IT services company. Some of the stolen data is published on the group's Tor leak site. In this cyberattack, the ransomware group successfully stole a database containing personal data information from more than 100,000 customers worldwide. In addition, the group also stole some email data and password hashes, some of which can easily be decrypted. To make matters worse, the gang also managed to steal the administrator's personal data, claiming that the stolen data would be released on February 21, 2022, if the ransom is not paid.","theft":true},{"id":"htc4024cc551","date":"2022-02-08","name":"Sandbox LAND","kind":"hack","fam":"code","tech":"Access control","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht989925005d","date":"2022-02-07","name":"EarnHub claims they've been hacked for around $284,000","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":284000.0,"lo":284000.0,"hi":284000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/earnhub-claims-theyve-been-hacked-for-around-284000"}],"theft":true,"headline":true},{"id":"ht22165cc894","date":"2022-02-06","name":"Meter","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":4300000.0,"lo":4300000.0,"hi":7700000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/meter-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Meter_IO/status/1490103308421255168"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/meter-passport-bridge-exploited"}],"desc":"On February 5-6, 2022, Meter's bridge was exploited via missing validation on an alternative deposit function variant. Attacker called the function directly with arbitrary amounts, draining $4.4M from Meter and causing $3.3M cascading loss in Hundred Finance collateral pools.","theft":true,"review":["sources disagree on the loss"]},{"id":"htce69e9b605","date":"2022-02-06","name":"The team behind Doodled Dragons rugpulls again with \"Balloonsville\", taunts buyers and the NFT platform they used","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":590000.0,"lo":590000.0,"hi":590000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/team-behind-doodled-dragons-rug-pulls-again"}],"theft":true,"headline":true},{"id":"ht56cead70b8","date":"2022-02-06","name":"Contracted developer makes off with all the funds for the Ratz Club NFT project","kind":"hack","fam":"other","chains":["Solana"],"usd":140000.0,"lo":140000.0,"hi":140000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/contractor-steals-ratz-club-funds"}],"theft":true,"headline":true},{"id":"ht10b10b3084","date":"2022-02-04","name":"Trader trying to cash out their rewards from a DeFi platform loses more than $35,000 to a Twitter support scammer","kind":"scam","fam":"social","chains":["Avalanche"],"usd":35000.0,"lo":35000.0,"hi":35000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/twitter-support-scammer-trader-joe"}],"theft":true,"headline":true},{"id":"htd8d777eadb","date":"2022-02-04","name":"TecraSpace","kind":"hack","fam":"other","tech":"Any token is destroyed","chains":["Ethereum"],"conf":"C","n":1,"theft":true},{"id":"ht0cfbce7f36","date":"2022-02-03","name":"KlaySwap","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Klaytn"],"usd":1900000.0,"lo":1830000.0,"hi":1900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/klayswap/klayswap-incident-report-feb-03-2022-f20ba2d8e4dd"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/klayswap-hacked"}],"desc":"KlaySwap was compromised via BGP hijack against its infrastructure provider, redirecting traffic to serve a malicious JavaScript SDK. The attack captured user transactions and stole approximately $1.9 million.","theft":true},{"id":"ht1991f187bd","date":"2022-02-02","name":"Portal","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"DeFi Protocol","chains":["Solana"],"usd":326000000.0,"lo":320000000.0,"hi":326000000.0,"ret":140000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/wormhole-rekt"},{"s":"SlowMist Hacked","u":"https://wormholecrypto.medium.com/wormhole-incident-report-02-02-22-ad9b8f21eec6"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wormhole-bridge-hack"}],"desc":"On February 2, 2022, attackers exploited Wormhole Portal by using a deprecated insecure signature verification function to mint 120,000 wrapped ETH on Solana without locking equivalent collateral on Ethereum, then redeemed for real ETH.","theft":true},{"id":"ht4d75481696","date":"2022-02-02","name":"The Heart Project","kind":"fraud","fam":"insider","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/HeartNFTs/status/1488743536195301377"}],"desc":"The official Discord server of the NFT project The Heart Project was hacked. Scammers deleted most of The Heart Project's Discord channels and posted scam links. According to The Heart Project, some users clicked on fraudulent links and said they lost assets. The Heart Project says it will reimburse users for lost ether."},{"id":"htebb748b758","date":"2022-02-01","name":"Bitbns","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","usd":7500000.0,"lo":7500000.0,"hi":7500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cryptoslate.com/indian-exchange-bitbns-admits-it-was-hacked-for-7-5m-last-february/"}],"desc":"BitBNS exchange in India was hacked on February 1, 2022, via AWS cloud storage misconfiguration exposing private key backups. Attacker drained hot wallets for $7.5-8M; incident was concealed until March 2023.","theft":true},{"id":"htd3a81e3056","date":"2022-01-31","name":"All \"iloveponzi\"'s apes gone! Veteran hacker makes $700,000 stealing and flipping big name NFTs","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":700000.0,"lo":700000.0,"hi":700000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/all-iloveponzis-apes-gone"}],"headline":true},{"id":"htf09afcaf7a","date":"2022-01-31","name":"Streamer Ice Poseidon admits to scamming his followers out of $500,000 with his \"Cxcoin\" made for streamers","kind":"fraud","fam":"insider","chains":["BNB Chain"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/streamer-ice-poseidon-admits-to-scamming-his-followers"}],"headline":true},{"id":"ht26b5226de8","date":"2022-01-31","name":"Realux, a project promising to \"democratize\" and \"resolve the wealth gap\" in real estate, rug pulls $23,000 only hours after launch","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":23000.0,"lo":23000.0,"hi":23000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/realux-rug-pulls"}],"theft":true,"headline":true},{"id":"ht1d434618f7","date":"2022-01-29","name":"Fake Bored Ape project pulls in $17,500 following high-profile endorsement of Bored Apes","kind":"hack","fam":"other","chains":["Ethereum"],"usd":65000.0,"lo":65000.0,"hi":65000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-bored-ape-project-pulls-in-17500"}],"theft":true,"headline":true},{"id":"ht0f27b283d5","date":"2022-01-28","name":"Lazy Lion Ape Club rug pulls for 50 ETH ($125,000)","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":125000.0,"lo":125000.0,"hi":125000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lazy-lion-ape-club-rug-pulls"}],"theft":true,"headline":true},{"id":"ht9096f122cf","date":"2022-01-27","name":"Qubit","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":80000000.0,"lo":80000000.0,"hi":80000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/qubit-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/@QubitFin/protocol-exploit-report-305c34540fa3"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/qubit-finance-exploited"}],"desc":"On January 27-28, 2022 an attacker drained $80 million from Qubit Finance's QBridge cross-chain bridge by calling the deposit function with a zero address token and no ETH, exploiting improper use of call() instead of SafeERC20 verification to bypass input validation. The attacker minted 77,162 qXETH and borrowed $37.6M in wETH, $28.5M in BTC-B, and stablecoins.","theft":true,"onchain":true},{"id":"hte189130187","date":"2022-01-27","name":"Wegrocoin","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1486500426174189573"}],"desc":"The project Wegrocoin (WEGRO) on BSC suffered a Rug Pull and lost more than 1000 BNB.","theft":true},{"id":"ht2ffa688fe6","date":"2022-01-26","name":"Mercenary","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":760000.0,"lo":760000.0,"hi":760000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1486305364018556928%7Ctwgr%5E%7Ctw"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/mercenary-game-rug-pulls"}],"desc":"The social media accounts of NFT project Mercenary have been deleted. Deployers spent over $760,000.","theft":true},{"id":"ht5e4af39b68","date":"2022-01-26","name":"WeGro token plunges in value as its developer apparently drains 1,000 BNB ($378,000)","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":378000.0,"lo":378000.0,"hi":378000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/wegro-token-rug-pull"}],"theft":true,"headline":true},{"id":"ht5c25636dfd","date":"2022-01-26","name":"InfinityToken","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coincodecap.com/infinity-token-rugged-more-than-1390-wbnb"}],"desc":"Rug Pull occurred in the BSC ecological InfinityToken (INF), which lost more than 1390 WBNB.","theft":true},{"id":"htb5ffbf347c","date":"2022-01-25","name":"OpenSea","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"NFTfi","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1800000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1485547426467364864"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/opensea-users-lose-collective-1-8-million"}],"desc":"OpenSea's listing system contained a bug where transferred NFTs remained listed on the marketplace via the API despite appearing delisted. Attackers exploited this to purchase previously thought-delisted NFTs at old, far below-market prices and immediately resold them for profit. Three attackers collectively extracted over $1M by buying popular NFTs like Bored Ape Yacht Club at historical listing prices.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht7cf4329839","date":"2022-01-24","name":"Blockverse","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":1216500.0,"lo":1216500.0,"hi":1216500.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.pcgamer.com/unofficial-minecraft-nft-game-blockverse-disappears-with-more-than-dollar1m/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blockverse-rug-pulls"}],"desc":"Blockverse is a Minecraft-based NFT game. Through OpenSea, investors can buy Blockverse characters and a cryptocurrency called $Diamond. Unfortunately, investors withdrew all real money invested in Blockverse, shutting down and deleting the project’s official website, Discord, and Twitter. After three days of silence, the Blockverse founders resurfaced on Twitter, apologizing and explaining their actions. More than three weeks later, the Blockverse team's promise to \"get back on track\" has not materialized. The Blockverse Twitter account has not been updated further, its website remains offline, and the Medium account hosting the Blockverse white paper has disappeared.","theft":true},{"id":"ht916d55340d","date":"2022-01-23","name":"SolFire Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coincodecap.com/solfire-finance-rugged"}],"desc":"The SolFire Finance project owner stole all investor funds and moved them to the ETH chain via a cross-chain bridge. The project's GitHub account and Twitter account have been deleted and the site is no longer accessible.","theft":true},{"id":"htf79ec4cf54","date":"2022-01-23","name":"Solfire Finance rug pulls for $4.8 million","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":4800000.0,"lo":4800000.0,"hi":4800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/solfire-finance-rug-pull"}],"theft":true,"headline":true},{"id":"ht5026867d56","date":"2022-01-21","name":"Scammers set up a new server at the URL previously used by Ozzy Osbourne's NFT project, stealing thousands","kind":"scam","fam":"social","chains":["Ethereum"],"usd":40894.0,"lo":40894.0,"hi":40894.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-set-up-a-new-server-with-previous-ozzy-osbourne-nft-project-url"}],"theft":true,"headline":true},{"id":"ht461b9c8edc","date":"2022-01-20","name":"Kingfund Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":141000.0,"lo":141000.0,"hi":141000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PeckShieldAlert/status/1483790509399511042"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/kingfund-finance-rug-pulls-for-141000"}],"desc":"Kingfund Finance had a Rug Pull and lost over 300 WBNB. Upon inquiry, the official Twitter of the project has been cancelled.","theft":true},{"id":"ht11b81105fe","date":"2022-01-20","name":"MetaMask","kind":"hack","fam":"keys","tech":"Information Leakage","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/@alxlpsc/critical-privacy-vulnerability-getting-exposed-by-metamask-693c63c2ce94"}],"desc":"@alxlpsc disclosed on medium that MetaMask has serious privacy leaks. The vulnerability mainly uses MetaMask to automatically load NFT image URLs. Basic attack idea: the attacker can set the URI of the NFT to a server URL that he can control, and transfer the NFT to the target account; when the user logs in to MetaMask, MetaMask will automatically scan the NFT owned by the account, and initiate a pointer to The HTTP request to the attacker's server; the attacker can obtain the victim's IP information from the access log.","theft":true},{"id":"ht90966c132d","date":"2022-01-19","name":"AFKSystem","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/RugDocIO/status/1436440692021157895"}],"desc":"According to Rugdoc, AFKSystem rug all of their vaults for a combined profit of around $12 million. Although AFKSystem has severely cut their governance authority. But they still retain an important privilege - changing the routers that sell the harvested tokens.","theft":true},{"id":"ht33b64124fd","date":"2022-01-19","name":"Multichain","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":3000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MultichainOrg/status/1483110393543544832"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/multichain-publicly-announces-vulnerability-and-is-quickly-hacked"}],"desc":"Multichain's token contracts for WETH, PERI, OMT, WBNB, MATIC, and AVAX lacked proper validation of ERC20 permit() function calls. An attacker exploited this vulnerability to steal tokens from users who had previously granted approvals. A white-hat responder later returned approximately $1M of the $3M total loss, retaining 62 ETH as a bounty.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht744bb8246e","date":"2022-01-18","name":"Crypto.com","kind":"hack","fam":"keys","tech":"Session Key Compromised","target":"CEX","chains":["Ethereum","Bitcoin"],"usd":34000000.0,"lo":33700000.0,"hi":34000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cryptocom-rekt"},{"s":"SlowMist Hacked","u":"https://www.cpomagazine.com/cyber-security/crypto-com-hack-originating-from-2fa-bypass-exceeds-30-million-forcing-refunds-and-new-security-measures/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/crypto-com-exploited"}],"desc":"Crypto.com's 2FA system vulnerability allowed attackers to bypass authentication and withdraw $33.7M (4,836 ETH + 444 BTC + $66.2K USD) from 483 user accounts without entering 2FA codes.","theft":true},{"id":"ht77513d3e19","date":"2022-01-18","name":"Crosswise","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":879000.0,"lo":879000.0,"hi":879000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cryptotimes.io/crosswise-was-exploited-leading-to-the-loss-of-879k/"}],"desc":"Crosswise's MasterChef contract had public exposure of privileged functions, allowing an attacker to gain unauthorized access. The hacker exploited this to set a trusted forwarder, compromise owner privileges, and withdraw 692K CRSS tokens. After swapping to WBNB, the attacker laundered 547 WBNB through Tornado Cash.","theft":true},{"id":"ht8aa324a3e6","date":"2022-01-18","name":"Once popular play-to-earn game BNB Heroes rug pulls after a period of inactivity from the team","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":190000.0,"lo":190000.0,"hi":190000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bnb-heroes-rug-pulls"}],"theft":true,"headline":true},{"id":"ht249258858c","date":"2022-01-17","name":"Crypto Burger","kind":"hack","fam":"code","tech":"Improper Access Control","target":"Gaming","chains":["BNB Chain"],"usd":770000.0,"lo":770000.0,"hi":770000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@cryptoburgernft/a-tough-day-for-crypto-burgers-b371da577c8b"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cryptoburgers-hacked"}],"desc":"On January 16-17, 2022, the CryptoBurgers play-to-earn game was exploited when the BURG token's burn function lacked access control, allowing attackers to burn tokens from the PancakeSwap liquidity pool to manipulate prices. Using flashloans, two attackers drained approximately $700K-$770K in BNB from the protocol by exploiting the unprotected burn mechanism.","theft":true},{"id":"htf1030205cc","date":"2022-01-16","name":"wxBTRFLY","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/redactedcartel/status/1482497468713611266?s=20"}],"desc":"White hat hackers at @immunefi discovered a critical vulnerability in the wxBTRFLY Token contract. The transferFrom function in the contract did not update the recipient's authorization correctly, and would incorrectly update the msg.sender's authorization. Although the vulnerability itself is serious, the cause is not complicated (more like a clerical error produced by the developer). What is more interesting is the official repair method. Since the contract itself does not support upgrade, the contract code cannot be updated directly; the contract does not support suspension, so it is not possible to transfer user assets by means of snapshot + migration. The final official measure was to launch an attack transaction by itself, transferring the assets of all users affected by the vulnerability to a multi-signature wallet.","theft":true},{"id":"ht1456279cc6","date":"2022-01-15","name":"Float Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":1160000.0,"lo":1100000.0,"hi":1160000.0,"ret":250000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/FloatProtocol/status/1482184042850263042"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/float-protocol-rari-capital-pool-exploited"}],"desc":"Float Protocol's pool on RariCapital was exploited through oracle manipulation of the FLOAT/USDC Uniswap V3 pool. Insufficient liquidity in the pool allowed an attacker to create a fake position marking FLOAT at trillions of USDC per token. The exploited Uniswap V3 oracle reported this manipulated price, allowing the attacker to use FLOAT as infinite collateral to borrow all available assets.","theft":true},{"id":"htd155e3caf6","date":"2022-01-15","name":"CityDAO","kind":"hack","fam":"social","tech":"Phishing","target":"DAO","chains":["Ethereum"],"usd":95000.0,"lo":92000.0,"hi":95000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/CityDAO/status/1480421505385197575"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blockchain-city-dao-scammed"}],"desc":"CityDAO's Discord was compromised via social engineering, allowing the attacker to hijack an administrator account. The attacker created a fake land-drop announcement pointing users to a phishing site, where victims connected their wallets and unknowingly approved fraudulent transactions. The attacker extracted 29.67 ETH by exploiting Discord webhooks to ensure the phishing announcement immediately appeared to all logging-in users.","theft":true},{"id":"htcf20df8b77","date":"2022-01-14","name":"Chinese police arrest eight people over a $7.8 million rug pull","kind":"followup","fam":"other","usd":7800000.0,"lo":7800000.0,"hi":7800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/chinese-police-arrest-eight-people-over-a-7-8-million-rug-pull"}],"headline":true},{"id":"ht0159c59e13","date":"2022-01-13","name":"Frosties","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1100000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cryptoslate.com/frosties-nft-investors-rug-pulled-loses-over-1-million/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/frosties-rug-pull"}],"desc":"The creator of the NFT project Frosties absconded with the money, causing investors to lose more than $1 million. According to available information, there are 8,888 NFTs in the series with a floor price of 0.04 ETH, roughly over $120. Within an hour, all NFTs were sold, but instead of getting their assets, investors found out that the project developers closed all communication with community members. Etherscan data shows that developers have moved most of the funds from the OpenSea account to another wallet.","theft":true},{"id":"ht1eb473dded","date":"2022-01-12","name":"Multiple IDO Projects","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/RugDocIO/status/1481107278841270274"}],"desc":"7 IDO projects on BSC are suspected to be running, namely $GOTEM (gotEM), $ONEP (HarmonyPad), $HBARP (HbarPad), $MPLAY (MetaPlay), $ELIT (Electrinity) and $PEE (MicroPee) $QDrop (QuizDrop), swept away more than 5,744 WBNB, and the funds were transferred out through Tornado.Cash.","theft":true},{"id":"htcab2360987","date":"2022-01-11","name":"NFT developers rugpull for a third time, this time with \"Big Daddy Ape Club\"","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/big-daddy-ape-club-rug-pull"}],"theft":true,"headline":true},{"id":"ht96d0530311","date":"2022-01-11","name":"LooksRare","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/LooksRareNFT/status/1480624772081852419"}],"desc":"NFT marketplace LooksRare suffered a DDoS attack hours after its launch, resulting in a brief offline. Some users reported that they could not connect their wallets and list their NFTs. The LooksRare team quickly restored the site.","theft":true},{"id":"ht24eacd3289","date":"2022-01-10","name":"Lympo","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"NFTfi","chains":["Ethereum"],"usd":18700000.0,"lo":18700000.0,"hi":18700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/lympo-official/lympo-statement-to-the-community-914d6b453b1f"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lympo-breach"}],"desc":"Lympo's hot wallet was compromised, resulting in the theft of 165.2 million LMT tokens worth $18.7M. The attacker transferred the stolen tokens across 10 project wallets before consolidating them into a single address and swapping them for ETH on Uniswap and SushiSwap. The LMT token price dropped 92% following the incident. Cold wallet reserves remained secure.","theft":true},{"id":"ht38dac1582b","date":"2022-01-09","name":"Celebrity-promoted Rich Dwarves Tribe NFT project rug pulls for around $3 million","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":2916665.0,"lo":2916665.0,"hi":2916665.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rich-dwarves-tribe-nft-project-rug-pulls-for-3-million"}],"theft":true,"headline":true},{"id":"ht1437727557","date":"2022-01-09","name":"Doodled Dragons takes at least $30,000 after tweeting \"our charity will instead now be... my bank account\"","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/doodled-dragons-takes-at-least-30000"}],"theft":true,"headline":true},{"id":"hte219b37f03","date":"2022-01-09","name":"Arbitrum One","kind":"hack","fam":"other","tech":"Downtime","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.odaily.news/newsflash/272238"}],"desc":"According to the block explorer, the last block of the Arbitrum One network was generated at 18:29 Beijing time, and no new blocks and new transactions have been generated for more than 2 hours. At the same time, the Matemask wallet cannot connect to the Arbitrum One network.","theft":true},{"id":"htb8c8a3b810","date":"2022-01-08","name":"LCX","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Ethereum"],"usd":7940000.0,"lo":6800000.0,"hi":8000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/lcx-rekt"},{"s":"SlowMist Hacked","u":"https://www.lcx.com/hot-wallet-incident-report/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/lcx-hacked-6-8-million"}],"desc":"On January 8, 2022 at 10:23 PM GMT, attackers compromised LCX's Ethereum hot wallets and transferred $7.94 million in assets including ENJ, LINK, SAND, and stablecoins. Funds were converted within 45 minutes; LCX recovered ~60% through law enforcement.","theft":true},{"id":"ht1e7176fd4e","date":"2022-01-07","name":"DaoMetaland","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Rug Pull occurred in the DaoMetaland project on BSC, and the current loss exceeds 640 BNB. DaoMetaland's official Twitter has been deleted.","theft":true},{"id":"htb5ce2c8bbd","date":"2022-01-07","name":"StoboxCompany","kind":"hack","fam":"keys","tech":"Private Key Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/StoboxCompany/status/1479263023772672004"}],"desc":"The digital asset service provider StoboxCompany was attacked by hackers, and its official statement that the private key had been leaked, affected by this, the token fell by 96.93%. StoboxCompany officially stated that the address of the deployer of Stobox tokens was hacked. Since the address of the deployer of ETH and BSC is the same, all reserve funds have been stolen or liquidated. Remind users to stop buying/selling, and the official will restore the STBU snapshot to the last transaction before the hacker attack.","theft":true},{"id":"ht59726736c6","date":"2022-01-06","name":"Bored Bunny","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/0xRNMTQ/status/1478549762219466752?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1478549762219466752%7Ctwgr%5E%7Ctwcon%5Es1"}],"desc":"NFT project Bored Bunny is suspected of being a Rug Pull project. Some netizens said that 2,000 ETH raised have been transferred out, and some of them have been transferred to Binan. In addition, this address had similar behavior 1-2 months ago, associated with 2 NFT items that almost went to zero. Currently Bored Bunny's Discord has turned off all people all channels to speak.","theft":true},{"id":"ht8b462cfaa2","date":"2022-01-04","name":"Arbix Finance","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["BNB Chain"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/arbix-rekt"},{"s":"SlowMist Hacked","u":"https://rekt.news/zh/arbix-rekt/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/arbixfinance-rug-pull"}],"desc":"Arbix Finance on BSC executed a rug pull on January 4, 2022, draining ~$10M in user funds via admin minting privileges. Team deleted web/social presence and moved funds via AnySwap.","theft":true},{"id":"htb56eee9278","date":"2022-01-04","name":"Solana","kind":"hack","fam":"other","tech":"DDoS Attack","chains":["Polygon"],"usd":52000.0,"lo":52000.0,"hi":52000.0,"conf":"B","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraphcn.com/news/solana-hit-with-another-network-incident-causing-degraded-performance"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/copy-of-solana-baby-ape-social-club"}],"desc":"Solana was down for 4 hours on January 4th, however, Solana.Status showed no problems with the network. The Solana blockchain suffered its third incident in just a few months, resulting in network congestion and failed transactions, with users debating whether it was caused by another DDos attack or just a network issue. Anatoly Yakovenko, co-founder of Solana Labs, denied there was a DDoS attack this time around.","theft":true},{"id":"htae34251ada","date":"2022-01-02","name":"DefiChain","kind":"hack","fam":"code","tech":"Incorrect Fee Accounting","target":"Chain","chains":["DefiChain"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DeFiChain’s atomic swap implementation contained a fee-denomination vulnerability that allowed attackers to substitute BTC for DFI while preserving the numerical fee amount. This caused the protocol to pay disproportionately large fees in BTC-denominated assets, introducing unbacked dBTC into circulation. The vulnerability existed from approximately June 2021 and was discovered on January 2, 2022.","theft":true},{"id":"ht285c96ff05","date":"2022-01-01","name":"Tinyman","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Algorand"],"usd":3000000.0,"lo":2000000.0,"hi":3000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://tinymanorg.medium.com/technical-report-1-first-insights-cbc12109ef08"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tinymans-liquidity-pools-drained"}],"desc":"Tinyman's AMM pools were exploited via a vulnerability in the liquidity withdrawal mechanism. An attacker could receive the same token twice after a burn rather than two different tokens, extracting twice as much liquidity as authorized. The initial attack was imitated by others, with approximately $3M in losses and $2M in additional at-risk liquidity before the team urged removal from all pools.","theft":true},{"id":"ht7c6fe39601","date":"2022-01-01","name":"Blockchain game CryptoBike apparently rugpulls only days after launch","kind":"rugpull","fam":"insider","chains":["BNB Chain"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cryptobike-rug-pulls"}],"theft":true,"headline":true},{"id":"hta9f27168f5","date":"2022-01-01","name":"NFT collector loses $38,000 in what he believes is an OpenSea or Rarible glitch","kind":"hack","fam":"other","usd":38000.0,"lo":38000.0,"hi":38000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-collector-loses-38000"}],"theft":true,"headline":true},{"id":"ht48cc6c82fd","date":"2021-12-31","name":"Vesper Finance","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/VesperFi/status/1476713007526957065"}],"desc":"Vesper Finance tweeted that its No. 23 lending pool Vesper Lend beta launched on the interest rate agreement Fuse has been attacked again. The attacker manipulated an oracle and depleted the beta test borrowing pool of DAI, ETH, WBTC, and USDC of approximately $1 million. This is not an attack on the Vesper contract, no VSP or VVSP is threatened. Vesper has banned the lending of all tokens in Beta Vesper Lend Rari Pool #23, and also switched the oracle from VUSD/USDC to VUSD/ETH (Uni v3). Prior to this, the Vesper Lend loan pool on Rari Fuse was attacked, and the attacker made a profit of 3 million US dollars.","theft":true},{"id":"hta5e0719509","date":"2021-12-31","name":"$YEAR creator rings in the New Year by rugpulling about $225,000","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":225000.0,"lo":225000.0,"hi":225000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/year-rug-pull"}],"theft":true,"headline":true},{"id":"ht1b8583bc38","date":"2021-12-30","name":"NFT collector scammed out of $2.2 million in a phishing attack","kind":"scam","fam":"social","chains":["Ethereum"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/all-my-apes-gone"}],"theft":true,"headline":true},{"id":"ht205c085e7a","date":"2021-12-30","name":"SashimiSwap","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":210000.0,"lo":200000.0,"hi":210000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://sashimisashimi5.medium.com/statement-on-hackers-attack-322ab6a5c31d"}],"desc":"SashimiSwap was exploited via improper swap and router architectural design. An attacker used a 400 ETH flash loan to create fraudulent token pairings with liquidity, then exploited the UniswapRouter contract's swap logic to extract value. The attack was initiated on December 30, 2021 at 09:06 UTC, resulting in approximately $210K in losses.","theft":true},{"id":"ht42050b66ae","date":"2021-12-28","name":"MASK Token","kind":"scam","fam":"social","tech":"Scam","chains":["Ethereum"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/cobynft/status/1475569815821733894"}],"desc":"On December 28th, according to Twitter user coby.eth, a fake MetaMask governance token was created and launched on the DEXTools platform. The creator of the token used malicious code to make users browse the token information, and a pop-up interface showed that the MASK Token was verified and displayed A forged platform verification mark (blue certification symbol) is displayed. coby.eth stated that after the transaction volume exceeded US$1 million, the token was transformed into a \"Pixiu plate\", and users could only buy but not sell. According to browser data, the total transaction volume of this \"Pixiu Pan\" MASK Token is close to 10 million U.S. dollars, with a total of 642 related transactions and close to 400 addresses.","theft":true},{"id":"htb9625ad4ab","date":"2021-12-28","name":"Traders duped out of $1.8 million in a fake MetaMask governance token scheme","kind":"hack","fam":"other","chains":["Ethereum"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fake-metamask-governance-token-scheme"}],"theft":true,"headline":true},{"id":"ht9c601ca1a2","date":"2021-12-28","name":"Rapper Waka Flocka Flame has an OpenSea account hacked to the tune of $19,000","kind":"hack","fam":"other","chains":["Ethereum"],"usd":19000.0,"lo":19000.0,"hi":19000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/waka-flocka-flame-opensea-account-hacked"}],"theft":true,"headline":true},{"id":"ht43fd926670","date":"2021-12-27","name":"MetaDAO","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":3231200.0,"lo":3231200.0,"hi":3231200.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cryptobriefing.com/metadao-makes-off-with-3-2m-in-rug-pull/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/metadao-rugpulls"}],"desc":"MetaDAO took a Rug Pull, took away the funds (800 ETH, about 3.2 million US dollars), and has been transferred to Tornado.cash mixed currency. MetaDAO's website is currently unavailable due to suspension.","theft":true},{"id":"ht4c9863679a","date":"2021-12-27","name":"MetaSwap","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain","Ethereum","Polygon"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/metaswap-gas-incommunicado-as-experts-link-mgas-price-drop-to-rug-pull"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/metaswap-gas-rug-pulls"}],"desc":"The assets of MetaSwap, a project on the BSC chain, were transferred. The total amount of stolen funds of 1100 BNB was transferred to the Tornado.cash wallet (BSC version), and the price of MGAS tokens fell by 46.99%. All official accounts related to Metaswap - including Twitter , Instagram and Medium - all deleted.","theft":true},{"id":"ht68c194265e","date":"2021-12-25","name":"JungleFreaks and Sandbox NFTs are stolen from a collector","kind":"hack","fam":"other","chains":["Ethereum"],"usd":41100.0,"lo":41100.0,"hi":41100.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/junglefreaks-and-sandbox-nfts-are-stolen-from-a-collector"}],"theft":true,"headline":true},{"id":"ht736d11b8d2","date":"2021-12-23","name":"Monkey Kingdom","kind":"hack","fam":"social","tech":"Phishing","target":"NFTfi","chains":["Solana"],"usd":1300000.0,"lo":1300000.0,"hi":1300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/MonkeyKingdom_/status/1473312369556213769"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monkey-kingdom-discord-scam"}],"desc":"Monkey Kingdom's Discord was compromised via a breach in Grape (a Solana token-membership protocol), allowing attackers to impersonate admins. Bots flooded the Discord with fake minting links directing users to malicious websites requiring wallet connection. Users who authorized the transactions had their SOL tokens stolen. Some victims lost as much as 650 SOL each.","theft":true},{"id":"ht167901f9d8","date":"2021-12-23","name":"NFT collector scammed out of Bored Ape NFT: \"This was my kids college. My mortgage.\"","kind":"scam","fam":"social","chains":["Ethereum"],"usd":290000.0,"lo":290000.0,"hi":290000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bayc-collector-scammed-college-fund"}],"theft":true,"headline":true},{"id":"ht368b6b7d37","date":"2021-12-21","name":"Gamma","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":8200000.0,"lo":8200000.0,"hi":8200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Visor Finance's staking contract was exploited via reentrancy in the delegateTransferERC20 interface. Attackers recursively called the withdrawal function before state updates were completed, stealing 8,812,958 VISR tokens (~$8.2M).","theft":true},{"id":"ht9cc15d2db0","date":"2021-12-21","name":"Visor Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":8200000.0,"lo":8200000.0,"hi":8200000.0,"conf":"A","n":4,"src":[{"s":"rekt.news","u":"https://rekt.news/visor-finance-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/visorfinance/post-mortem-for-vvisr-staking-contract-exploit-and-upcoming-migration-7920e1dee55a"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/visor-finance-hacked-for-about-8-2-million"}],"desc":"Uniswap V3 liquidity management protocol Visor Finance was hacked again. Hackers took advantage of the loopholes to withdraw more than 8.8 million VISRs and sold them on Uniswap, causing the VISR tokens to plummet by nearly 95% and profit over 120 ETH through Tornado Cash. Money laundering. According to SlowMist analysis, this attack is due to a flaw in the RewardsHypervisor contract when checking the permissions of the user's recharge, causing the attacker to construct a malicious contract to arbitrarily cast mortgage credentials. Prior to this June, Visor Finance was also hacked and lost more than US$500,000.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht9adc90a783","date":"2021-12-21","name":"Gamma","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Gamma Strategies (formerly Visor) was exploited for at least $4.5M via infinite mint vulnerability. Attacker minted unlimited tokens and converted to other assets; token migration announced two days later.","theft":true,"review":["possible duplicate within one source"]},{"id":"htda8bbd41e6","date":"2021-12-21","name":"Bent Finance","kind":"hack","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["Ethereum"],"usd":1750000.0,"lo":1750000.0,"hi":1800000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bent-finance"},{"s":"SlowMist Hacked","u":"https://bentfi.medium.com/bent-update-12ae69a41dc6"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/1-8-million-from-bent-finance"}],"desc":"Bent Finance was exploited by rogue developer who inserted backdoor into contracts during period lacking multisig protection, extracting 513k cvxcrv LP tokens (~440 ETH/$1.75M).","theft":true,"review":["possible duplicate within one source"]},{"id":"ht074af28f97","date":"2021-12-21","name":"Fractal","kind":"hack","fam":"keys","tech":"Account Compromise","usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/zachbussey/status/1473324507200905226"}],"desc":"The Discord server run by Fractal, a gaming NFT marketplace, was hacked, a fake Discord bot disguised as an official posted a fake minting link in Fractal's \"#announcements\" channel, and nearly 3,500 people fell victim to it, losing nearly 600,000 Dollar. In its announcement, the company said it would fully compensate victims of the hack.","theft":true},{"id":"ht8e0e531478","date":"2021-12-21","name":"Fractal","kind":"fraud","fam":"insider","tech":"Account Compromise","chains":["Solana"],"usd":150000.0,"lo":150000.0,"hi":150000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/fractalwagmi/status/1473331954238070789"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/another-discord-scam-earns-perpetrators-about-150000"}],"desc":"A Discord server run by Fractal in the recently launched game NFT market was hacked. The hacker defrauded 373 members of 800 Solana cryptocurrencies worth US$150,000. The startup said in its announcement that it will compensate the victims in full.","review":["possible duplicate within one source"]},{"id":"ht29b664cb0c","date":"2021-12-18","name":"Grim Finance","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Fantom"],"usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/grim-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/financegrim/status/1472357770846519312"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/grim-finance-exploited-for-30-million"}],"desc":"Grim Finance's GrimBoostVault lacked reentrancy guards. Attackers exploited this via nested calls during safeTransferFrom to accumulate false collateral through repeated deposits.","theft":true,"onchain":true},{"id":"htbb7212ae79","date":"2021-12-18","name":"Dozens of users report money disappearing from their El Salvadoran Chivo Wallet accounts","kind":"fraud","fam":"insider","chains":["Bitcoin"],"usd":96224.0,"lo":96224.0,"hi":96224.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/chivo-wallets-missing-money"}],"headline":true},{"id":"ht4511097b60","date":"2021-12-15","name":"WePiggy","kind":"hack","fam":"market","tech":"Abnormal liquidation","chains":["Ethereum"],"usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://wepiggy-com.medium.com/incident-report-for-che-market-of-wepiggy-oec-protocol-679b218e9314"}],"desc":"At 5:21 (UTC+8) on December 15, 2021, the WePiggy-OEC agreement made a short-term error in the CHE oracle, which caused the price of CHE in WePiggy to be much higher than the market price, resulting in abnormal liquidation for users who borrowed CHE assets. Calculated at the price at the time of the incident, the total loss of user assets is approximately US$400,000.","theft":true},{"id":"htf5c266f4fb","date":"2021-12-15","name":"Tweet from a crypto miner answers the question of where all the GPUs went","kind":"fraud","fam":"insider","chains":["Ethereum"],"usd":13500.0,"lo":13500.0,"hi":13500.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/where-all-the-gpus-went"}],"headline":true},{"id":"ht462e605012","date":"2021-12-15","name":"CoinMarketCap","kind":"hack","fam":"code","tech":"Data error","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bitpush.news/?p=2040103"}],"desc":"The data on CoinMarketCap's website flashed bugs, and the quotes of multiple cryptocurrencies were wrong.","theft":true},{"id":"ht330860f76f","date":"2021-12-14","name":"Brincfi","kind":"other","fam":"other","usd":1100000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/brincfi-rekt-coldcase"}]},{"id":"ht4813e2e4a8","date":"2021-12-14","name":"Laurent Correia rug pulls $960,000 with his abandoned \"Billionaire Dogs\" NFT project","kind":"rugpull","fam":"insider","chains":["Ethereum"],"usd":960000.0,"lo":960000.0,"hi":960000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/laurent-correia-rug-pulls-960000"}],"theft":true,"headline":true},{"id":"ht6490672007","date":"2021-12-14","name":"NerveBridge","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":537000.0,"lo":537000.0,"hi":537000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Attacker exploited a flaw in Nerve Bridge's MetaPool swap function where the swap function underestimated LP token value compared to swapUnderlying. Using a flash loan attack, the attacker received inflated LP tokens for deposited fUSDT, then removed BUSD liquidity and used swapUnderlying to extract additional fUSDT for a total profit of 900 BNB.","theft":true},{"id":"htdeb058e835","date":"2021-12-14","name":"Bug in major cryptocurrency trackers shows wildly inaccurate data","kind":"hack","fam":"other","usd":340000.0,"lo":340000.0,"hi":340000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cryptocurrency-price-tracker-bug"}],"theft":true,"headline":true},{"id":"ht6e2816b0ed","date":"2021-12-14","name":"A hacker racks up a $45,000 AWS bill for their victim, only to generate $800 worth of Monero","kind":"hack","fam":"other","chains":["monero"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-racks-up-45000-aws-bill"}],"theft":true,"headline":true},{"id":"ht9a18cdf65c","date":"2021-12-13","name":"Vulcan Forged","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum","Polygon"],"usd":135000000.0,"lo":102820974.0,"hi":140000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/vulcan-forged-rekt"},{"s":"SlowMist Hacked","u":"https://rekt.news/zh/vulcan-forged-rekt/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vulcan-forged-users-lose-collective-135-million-in-hack"}],"desc":"On December 13, 2021, Vulcan Forged's NFT marketplace suffered a $140M hack affecting 96 high-value wallets when Venly's semi-custodial servers were compromised. The attacker extracted credentials and exfiltrated ~4.5M PYR tokens from customer wallets. Vulcan Forged refunded 100% of losses within 24 hours.","theft":true},{"id":"htf03b583e8a","date":"2021-12-13","name":"Typing error costs NFT trader nearly $300,000","kind":"other","fam":"other","chains":["Ethereum"],"usd":297000.0,"lo":297000.0,"hi":297000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/typing-error-costs-nft-trader-nearly-300000"}],"headline":true},{"id":"ht0a7d36bb01","date":"2021-12-13","name":"Definer","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/YokbbrGD-G_cbMKoMWyJtw"}],"desc":"On December 13, the DeFi platform Definer oracle was attacked. This incident was caused by the problem of Definer’s implementation of the oracle in OEC. It used the token balance of a single liquidity pool at a point in time as the price source, which led to the accident. The implementation of Ethereum used ChainLink’s The oracle does not have this problem.","theft":true},{"id":"htf5607494b9","date":"2021-12-13","name":"Dharma","kind":"hack","fam":"other","tech":"Downtime","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Dharma_HQ/status/1381759523371708416"}],"desc":"Dharma Wallet officially tweeted that there was a downtime. After Dharma updated Twitter, it said that it has returned to normal and all funds are safe.","theft":true},{"id":"htbbb62214f8","date":"2021-12-11","name":"AscenDEX","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","BNB Chain","Polygon"],"usd":77000000.0,"lo":77000000.0,"hi":77700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/ascendex-rekt"},{"s":"SlowMist Hacked","u":"https://www.wu-talk.com/html/kuaixun/2021_2359.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ascendex-hacked-for-77-million"}],"desc":"On December 11, 2021, AscendEX exchange discovered unauthorized transfers of $77 million from its hot wallets across Ethereum, BSC, and Polygon due to compromised private keys, likely via phishing or malware.","theft":true},{"id":"ht793af74b1d","date":"2021-12-11","name":"Gelato Network","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":744000.0,"lo":744000.0,"hi":744000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/gelato-network/sorbet-finance-vulnerability-post-mortem-6f8fba78f109"}],"desc":"Smart contract automation tool Gelato Network tweeted: \"We have been alerted to a critical vulnerability in Sorbet Finance's G-UNI router contract. This vulnerability only affects users interacting with the Sorbet UI.\" Gelato Network released a security incident investigation report, saying that white hat hackers transferred a total of $27 million in assets to ensure the safety of user assets, but there were still $744,000 of funds that were maliciously attacked by MEV. The project stated that the vulnerability that emerged this time is similar to the previous dydx vulnerability, and the smart contract at risk can make arbitrary low-level calls aimed at executing transactions on 1inch, making potential exploits possible.","theft":true},{"id":"ht6fea86c53b","date":"2021-12-11","name":"ONUS","kind":"hack","fam":"code","tech":"Ransomware","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cystack.net/research/the-attack-on-onus-a-real-life-case-of-the-log4shell-vulnerability"}],"desc":"The payment system of ONUS, the largest cryptocurrency trading platform in Vietnam, running a vulnerable version of Log4j suffered a cyber attack. Cyclos notified ONUS to repair the system on December 13, but it was too late. Although ONUS has fixed the security loopholes in the Cyclos instance, the window of loopholes allowed attackers to successfully steal data from sensitive databases. The stolen database contained nearly 2 million user data, including KYC (Know Your Customer) data, hashed passwords, etc. Subsequently, the attacker asked ONUS to pay a ransom of 5 million, otherwise the stolen data would be made public. On December 25, because ONUS did not pay the full ransom, the attackers sold customer data on the dark web data exchange market.","theft":true},{"id":"ht262070971d","date":"2021-12-08","name":"PIZZA","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["EOS"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://pizza-finance.medium.com/a-brief-review-on-the-12-08-spiderman-hacking-incident-8739c23322ab"}],"desc":"At 8 pm on December 8, the hacker account itsspiderman used an overflow vulnerability to issue additional tripool market-making certificates in eCurve out of thin air, pledged and loaned most of the tokens in the agreement in PIZZA. Afterwards, hackers created more than 1.3 million accounts and dispersed the stolen assets. The loss of the PIZZA protocol in this attack is equivalent to about 5 million U.S. dollars. After negotiations, the hackers agreed to a ransom of $500,000.","theft":true},{"id":"ht7dc2f6157d","date":"2021-12-07","name":"8ightDAO","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Harmony"],"usd":1750000.0,"lo":1750000.0,"hi":1750000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/8ight-finance-rekt"},{"s":"SlowMist Hacked","u":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/8ight-finance-completely-drained"}],"desc":"On December 6, 2021, 8ight Finance (Harmony-based OHM fork) lost ~$1.75M from treasury when admin private keys transmitted via unencrypted channels (Facebook group, Google Drive) were compromised.","theft":true,"review":["possible duplicate within one source"]},{"id":"htd26de43fd4","date":"2021-12-05","name":"Pizza DeFi","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["EOS"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Pizza DeFi was exploited via an integer overflow in eCurve that allowed unbounded minting of Tripool tokens. The attacker used these tokens as collateral to drain $5M in assets.","theft":true},{"id":"ht60b26ea0c7","date":"2021-12-04","name":"Bitmart","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","BNB Chain"],"usd":196000000.0,"lo":150000000.0,"hi":200000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bitmart-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/sheldonbitmart/status/1467316252855226368"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/200-million-stolen-from-bitmart"}],"desc":"BitMart's hot wallets were compromised on December 4, 2021, resulting in theft of $196M: $100M on Ethereum and $96M on Binance Smart Chain.","theft":true},{"id":"ht3ec72327da","date":"2021-12-03","name":"Polygon","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Polygon"],"usd":2040000.0,"lo":2040000.0,"hi":2068130.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.polygon.technology/all-you-need-to-know-about-the-recent-network-upgrade/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/polygon-loses-2-million"}],"desc":"White-hat hackers discovered a critical vulnerability in Polygon's PoS genesis contract MRC20 token where the transfer function lacked balance/allowance checks. This would have allowed stealing ~9.3 billion MATIC tokens. Before the fix was deployed, threat actor stole 801,601 MATIC tokens. White hat received $2.2M bug bounty for the disclosure.","theft":true},{"id":"ht43ad388417","date":"2021-12-02","name":"Badger DAO","kind":"hack","fam":"keys","tech":"CDN Compromise","target":"DeFi Protocol","chains":["Ethereum"],"usd":120000000.0,"lo":120000000.0,"hi":120000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/badger-rekt"},{"s":"SlowMist Hacked","u":"https://badger.com/technical-post-mortem"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/120-million-stolen-from-badgerdao"}],"desc":"On December 2, 2021, Badger DAO suffered a $120M hack when an attacker used a compromised Cloudflare API key to inject malicious code into the frontend. Users unknowingly approved token transfers via spoofed UI, allowing the attacker to drain approximately 2,100 BTC and 151 ETH from ~200 accounts.","theft":true},{"id":"ht3e374942d4","date":"2021-12-02","name":"Saddle Finance","kind":"other","fam":"other","usd":11000000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/saddle-finance-rekt2"}]},{"id":"ht158dcef677","date":"2021-11-30","name":"MonoX","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum","Polygon","Bitcoin"],"usd":31000000.0,"lo":31000000.0,"hi":31400000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/monox-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/monoswap/exploit-post-mortem-33921a779b43"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/31-million-stolen-from-monox"}],"desc":"On November 30, 2021 MonoX was hacked for $31.4 million across Ethereum and Polygon when an attacker exploited a swap function that allowed same-asset swaps, using rapid swaps to manipulate the __updateTokenInfo function and artificially inflate MONO token price through a feedback loop, draining $18.2M WETH and $10.5M MATIC.","theft":true,"onchain":true},{"id":"ht6a39db2837","date":"2021-11-28","name":"Snowdog DAO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Avalanche"],"usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptosrus.com/snowdog-rug-pull-rocks-avalanche-what-happened/"}],"desc":"This weekend, the biggest rug pull in Avalanche history shocked the network and its users. SDOG is the first meme coin launched on Avalanche, with a price of up to 10 million U.S. dollars, and the team admitted that they \"smashed it up.\" On the other hand, however, what they called a \"game theory experiment\" went wrong. Snowdog DAO is the protocol behind the SDOG token, and as of press time, its value has lost more than 90%. This is a complex plan that involves insiders using a \"key\" in a smart contract that only they can access.","theft":true},{"id":"ht6d0ebedcf7","date":"2021-11-28","name":"Visor Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":975720.0,"lo":975720.0,"hi":975720.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GammaStrategies/status/1464702295153774594"}],"desc":"Attacker exploited Visor's OHM-ETH 1% LP management contract by manipulating the Uniswap V3 pool price through large swaps. The steep liquidity gradient in the OHM-ETH pair made it susceptible to price manipulation via asset dump-and-buyback. User funds were secured and losses were covered by Visor's treasury.","theft":true},{"id":"ht4ed00a3dbe","date":"2021-11-27","name":"Lever","kind":"hack","fam":"code","tech":"Borrow Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":652000.0,"lo":652000.0,"hi":652941.949,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://levernetwork.medium.com/full-report-of-the-lever-hack-ee508cf7488c"}],"desc":"Attacker exploited Lever's liability calculation to execute a flash loan attack using two malicious contracts. Contract A borrowed 2,100 BNB and deposited 2,000 into Lever's vault for interest-bearing tokens, then borrowed 1,500 BNB. Contract B received the collateral without Lever verifying that the xWBNB wasn't already used as collateral, allowing repayment with uncollateralized borrowed funds.","theft":true},{"id":"ht5d6a0472d8","date":"2021-11-27","name":"dYdX","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":211000.0,"lo":211000.0,"hi":211000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://dydx.exchange/blog/deposit-proxy-post-mortem"}],"desc":"DeFi Derivatives Agreement dYdX released an investigation report on the deposit contract accident on November 27, stating that there has been a serious loophole in the agent smart contract that has been handling deposits to the dYdX exchange since November 24. At around 12:00 UTC on the 27th, dYdX The team performed a white hat hacking operation to save vulnerable user funds, totaling approximately US$2 million. These funds are sent to a non-custodial escrow contract, and only the original owner of these funds can retrieve them. However, when the dYdX team performed the white hat hacking operation, an estimated $211,000 of funds was used by the MEV robot, and the user has now been fully compensated.","theft":true},{"id":"htc6a617062a","date":"2021-11-25","name":"Snowdog","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["Avalanche"],"usd":30000000.0,"lo":18100000.0,"hi":30000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/snowdog-rekt"},{"s":"SlowMist Hacked","u":"https://www.mon-livret.fr/le-premier-memecoin-lance-sur-avalanche-se-termine-en-arnaque-de-30-millions-de-dollars.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/snowdogdao-token-ends-badly"}],"desc":"SnowdogDAO ($SDOG) on Avalanche launched November 14, 2021, raising $45M in 8 days. On November 25, the team moved liquidity to a private Snowbank-controlled AMM pool requiring a secret challenge key. Only 7% of holders could liquidate, while three addresses drained $10M, $7.7M, and $3.3M, blocking $18.1M in total liquidity.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htbff5124354","date":"2021-11-25","name":"Alleged serial scammer launches \"MetaWorld\" project for at least the third time","kind":"fraud","fam":"insider","chains":["Polygon"],"usd":14000.0,"lo":14000.0,"hi":14000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/metaworld-scammer"}],"headline":true},{"id":"ht1340096ae7","date":"2021-11-23","name":"Ploutoz","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":365000.0,"lo":365000.0,"hi":365000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1463113809111896065?s=21"}],"desc":"Attacker manipulated the DOP token price on Ploutoz Finance and used it as collateral to borrow CAKE, ETH, BTCB and other assets. After exchanging borrowed tokens to BNB via ParaSwap and PancakeSwap, attacker cashed out through Tornado Cash. Initial funds for the attack were withdrawn from Tornado Cash, indicating pre-planned coordination.","theft":true,"onchain":true},{"id":"ht524a8ef81f","date":"2021-11-23","name":"OlympusDAO","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/125170/olympusdao-mistake-lets-user-spend-50000-to-buy-1-43-million-in-ohm"}],"desc":"The administrator of OlympusDAO, a new algorithmic stablecoin protocol based on Ethereum, said on Discord, the administrator of Discord said that yesterday, someone bonds OHM/DAI bonds that are considered to be closed so that they can get a large discount and receive 1,697 OHM (over 1.4 million U.S. dollars) instead of 59 OHM (approximately US$50,000). After OlympusDAO discovered this incident, it immediately closed the bond contract.","theft":true},{"id":"ht56b085a092","date":"2021-11-23","name":"Optics Bridge","kind":"fraud","fam":"insider","tech":"Multi-signature permission vulnerability","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/_prestwich/status/1462588535450439684"}],"desc":"Optics Bridge was attacked and ownership of the multi-signature wallet was transferred. cLabs engineer Tim Moreton said that the multi-signature permission of Optics, a cross-chain communication protocol on Celo, was replaced because someone activated the Optics recovery mode (recovery mode) on the Ethereum GovernanceRouter contract, which caused the recovery account to take over the Optics protocol and overwrite it. The original multi-signature permissions. Tim Moreton said that he believes that the funds on the current cross-chain bridge are not risky. Tim Moreton also said that the situation occurred within 15 minutes after cLabs expelled James Prestwich. The team is currently contacting James Prestwich to find a solution. The team is currently working to exit the recovery mode and restore the community's multi-signature governance. James Prestwich responded on Twitter that he had never had the right to activate the recovery mode and expressed regret for cLabs and Celo's damage to his reputation."},{"id":"htbe52ad50a4","date":"2021-11-21","name":"Formation.Fi","kind":"hack","fam":"market","tech":"Flash Loan Attack","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://formation-fi.medium.com/greetings-formation-fi-community-supporters-investors-and-friends-b09d673cda8a"}],"desc":"DeFi protocol Formation.Fi was attacked by flash loans. The main reason for this incident is that the project party underestimated the impact of fee on totalTokens when designing the function swapIn, and ignored the impact of decimal point accuracy between different tokens.","theft":true},{"id":"ht3289a96b3f","date":"2021-11-19","name":"Phantom Galaxies","kind":"fraud","fam":"social","tech":"Malware","target":"NFTfi","chains":["Ethereum"],"usd":1100000.0,"lo":1100000.0,"hi":1100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/animocabrands/status/1461381098261258242"}],"desc":"Hackers compromised Phantom Galaxies' Discord server using malware that bypassed 2FA on admin accounts. Attackers created a fake NFT minting page charging 0.1 ETH as a 'minting fee' that directed funds to their wallet. In three hours, fraudsters stole 265 ETH before Animoca Brands discovered and halted the scam, later covering all losses."},{"id":"ht749942de3b","date":"2021-11-14","name":"Nerve","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":537000.0,"lo":537000.0,"hi":537000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/bqSAwKQn9ZN79r6cELIi9w"}],"desc":"Attacker exploited the same MetaPool vulnerability in Nerve Finance that previously affected Synapse Bridge. Using flash loan attacks on fUSDT and UST MetaPools, the attacker exhausted pool liquidity by exploiting the inconsistent calculation of LP token value between swap and swapUnderlying functions.","theft":true,"onchain":true},{"id":"htf81b73b43d","date":"2021-11-11","name":"Curve Finance","kind":"hack","fam":"market","tech":"Governance Attack","chains":["Ethereum"],"usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AndreCronjeTech/status/1458588862998003713"}],"desc":"The stablecoin transaction protocol Curve caused losses to users who provided USDM liquidity due to the \"governance attack\" of the USDM stablecoin protocol Mochi. At present, Curve has dealt with urgently to avoid a wider range of losses. Previously, the Mochi project party purchased Convex's CVX tokens, voted to increase the USDM pool rewards to increase the liquidity of USDM and other assets, and then converted a large amount of USDM tokens owned by the project party into DAI after the liquidity increased. The team A total of 46 million USDM was exchanged for DAI. Based on the USDM to DAI exchange rate, the user loss that provides USDM liquidity to other stablecoins may be close to 30-40 million U.S. dollars.","theft":true},{"id":"htb36c5205e6","date":"2021-11-10","name":"MediaMarkt","kind":"hack","fam":"other","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/mediamarkt-hit-by-hive-ransomware-initial-240-million-ransom/"}],"desc":"According to a report from BleepingComputer on November 10, the electronic retail giant MediaMarkt suffered a ransomware attack. This attack affected many MediaMarkt retail stores throughout Europe, especially those in the Netherlands. The attacker initially asked for a ransom of 240 million US dollars. It was dropped to 50 million U.S. dollars and demanded to be paid in Bitcoin. According to the company later, customer data is \"completely secure.\" The company's stores are now also reopening for exchanges, returns, and repair orders.","theft":true},{"id":"ht9fcc4dbcf6","date":"2021-11-09","name":"Robinhood","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.robinhood.com/news/2021/11/8/data-security-incident"}],"desc":"Robinhood, a stock and cryptocurrency trading platform, stated that on the evening of November 3, an intruder entered the company’s system and stole the personal information of millions of users. The full names of the users, the names of about 310 users, the date of birth and postal code were leaked, and the more detailed account information of about 10 users was leaked. The intruder demanded blackmail for payment. The company notified law enforcement and continued to investigate the incident with the help of the external security company Mandiant. Robinhood stated that the attack had been contained. Robinhood believed that it did not expose social security numbers, bank account numbers or debit card numbers, and did not cause any economic losses to customers due to the incident.","theft":true},{"id":"ht6eedf7e164","date":"2021-11-07","name":"Farmers World","kind":"hack","fam":"code","tech":"Malicious Code Injection Attack","usd":15700000.0,"lo":15700000.0,"hi":15700000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.wu-talk.com/html/kuaixun/2021_2241.html"}],"desc":"According to reports, a currency stolen event occurred in Farmers World, a farm-type game on the WAX ​​chain, and the amount may exceed 100 million yuan. Some players have found that the game shows \"Insufficient RAM\" prompts, which cannot be solved even after adding WAXP. According to the official Discord discussion information: Neither the project smart contract nor the WAX ​​wallet has vulnerabilities, but the address where the user pledged WAXP is not the official address of the game. It may be that the game \"plug-in\" script changed the user pledge address, causing the user to be unable to obtain RAM resources.","theft":true},{"id":"ht6d2e658c9c","date":"2021-11-07","name":"ChainSwap","kind":"hack","fam":"code","tech":"Caller Impersonation","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":4400000.0,"lo":4400000.0,"hi":4400000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"ChainSwap bridge suffered an access control vulnerability in its cross-chain quota code. The attacker exploited a logical flaw that allowed invalid, non-whitelisted addresses to bypass authorization, take control of target projects' BSC contracts, and mint tokens directly to the attacker's address for sale.","theft":true},{"id":"htd9ece26217","date":"2021-11-06","name":"Chinese police bust Filecoin miner-related Ponzi scheme","kind":"fraud","fam":"insider","usd":62500000.0,"lo":62500000.0,"hi":62500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/filecoin-ponzi-scheme"}],"headline":true},{"id":"ht71018ffa1b","date":"2021-11-06","name":"Synapse Protocol","kind":"hack","fam":"bridge","tech":"Price Manipulation","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://synapseprotocol.medium.com/11-06-2021-post-mortem-of-synapse-metapool-exploit-3003b4df4ef4"}],"desc":"The asset cross-chain bridge launched by the cross-chain protocol Synapse Protocol is suspected to have loopholes, and the attacker manipulated the virtual price of nUSD Metapool, reducing it by about 12.5%. Ultimately, although the funds were withdrawn from the metapool itself, the funds were not lost. When the validator is offline, the address that took the funds from the LP tries to move the funds through the bridge, so the transaction has not yet been processed. However, the validators unanimously decided not to process this transaction because it was malicious to the LP and the entire network: as a result, ~$8.2 million in nUSD was not minted to the attacker's address on the target chain. The nUSD will be returned to the affected Avalanche LPs instead.","theft":true},{"id":"htc3b32fe594","date":"2021-11-05","name":"Ooki","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Polygon","BNB Chain"],"usd":55000000.0,"lo":55000000.0,"hi":55040167.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bzx-rekt"},{"s":"SlowMist Hacked","u":"https://bzx.network/blog/prelminary-post-mortem"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-55-million-from-bzx"}],"desc":"On November 5, 2021 an unknown hacker sent a phishing email containing a Word document with embedded malware to a bZx protocol developer. The developer executed the malware, allowing the attacker to exfiltrate the private key used to drain $55 million across Polygon and BSC networks.","theft":true},{"id":"ht47b4f93a7a","date":"2021-11-03","name":"Blockchain Global enters liquidation","kind":"collapse","fam":"insider","usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/blockchain-global-enters-liquidation"}],"headline":true},{"id":"htb451f3f7eb","date":"2021-11-03","name":"Vesper Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":3000000.0,"lo":3000000.0,"hi":3370000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/vesperfinance/on-the-vesper-lend-beta-rari-fuse-pool-23-exploit-9043ccd40ac9"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vesper-finance-hack"}],"desc":"Vesper Lend on Rari Fuse Pool #23 exploited when Uniswap v3 oracle returned infinite VUSD price due to missing bounds checking. Attacker claimed unlimited collateral and borrowed ~$3.37M in miscellaneous assets.","theft":true},{"id":"ht2d78f97d05","date":"2021-11-01","name":"Squid Games","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"Gaming","chains":["BNB Chain"],"usd":3380000.0,"lo":3360000.0,"hi":12000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.washingtonpost.com/world/2021/11/02/squid-game-crypto-rug-pull/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/squid-game-scam"}],"desc":"SQUID token (November 1, 2021) was a honeypot that allowed buying but blocked most holder sells. Price rose to $2,800, but developers withdrew the ~$3.38M SQUID/BNB pool and abandoned the project, leaving 43,000+ buyers with unsellable tokens.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htc29cff677a","date":"2021-11-01","name":"Chivo","kind":"hack","fam":"code","tech":"Wallet Stolen","target":"Wallet","usd":22650.0,"lo":22650.0,"hi":22650.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bbc.com/zhongwen/trad/business-58656282"}],"desc":"Chivo Wallet is a national digital wallet issued by the government of El Salvador on September 7 for the implementation of the Bitcoin Act. To this end, El Salvador promised that users who download and authenticate the Chivo Wallet will receive a $30 bitcoin reward. This move allowed the official wallet of El Salvador to exceed 2 million users in one month. Between October 9th and October 14th, Cristosal, a human rights organization in El Salvador, received 755 notices about Salvadorans reporting that their Chivo wallet identity was stolen.","theft":true},{"id":"ht16dc2536aa","date":"2021-10-31","name":"NFT collector scammed out of almost $1 million","kind":"scam","fam":"social","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-collector-scammed-out-of-almost-1-million"}],"theft":true,"headline":true},{"id":"ht9560931875","date":"2021-10-31","name":"Developer of \"Monkey Jizz\" cryptocurrency makes off with $270,000","kind":"rugpull","fam":"insider","usd":270000.0,"lo":270000.0,"hi":270000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/monkey-jizz-cryptocurrency-developer-makes-off-with-270000"}],"theft":true,"headline":true},{"id":"ht330ffff9bd","date":"2021-10-30","name":"BXH","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["BNB Chain"],"usd":139000000.0,"lo":139000000.0,"hi":139195315.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/BXH_Blockchain/status/1454366374353010695"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/bxh-exchange-exploited-for-139-million"}],"desc":"Attacker gained access to BXH's administrative private key, allowing digital signature of a transaction transferring $139 million in tokens directly to the attacker's account. The details suggest an insider or compromised system with access to the admin key storage, making this likely an inside job or successful targeted malware infection.","theft":true},{"id":"ht21b1f50659","date":"2021-10-29","name":"AnubisDAO","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum"],"usd":60000000.0,"lo":60000000.0,"hi":60000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://decrypt.co/84924/anubisdao-investors-lose-60-million-in-alleged-rug-pull"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/60-million-disappears-in-anubisdao"}],"desc":"AnubisDAO collected 13,556 ETH (~$60M) from investors in October 2021 but redirected all funds to attacker wallets within 20 hours. Funds were later laundered through Tornado Cash in July 2023.","theft":true},{"id":"ht35854c5be2","date":"2021-10-29","name":"AutoShark","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":580000.0,"lo":580000.0,"hi":2000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1454026801869590529"}],"desc":"Attacker exploited AutoShark's swap mining reward calculation using large-volume trades via flash loan. By performing multiple swaps in a single block to accumulate 3.18M FINS tokens, the attacker bypassed the single-transaction mitigation measures that AutoShark had previously deployed after an earlier attack.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht03eb8e4000","date":"2021-10-28","name":"Rapper Tekashi 6ix9ine releases a series of NFTs, only for the project not to deliver anything it promised","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/tekashi-6ix9ine-rug-pulls"}],"theft":true,"headline":true},{"id":"ht8258f836c2","date":"2021-10-28","name":"A much-hyped Miss Universe NFT project turns out to be a rugpull","kind":"rugpull","fam":"insider","chains":["wax"],"usd":376000.0,"lo":376000.0,"hi":376000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/miss-universe-nft-project-rug-pulls"}],"theft":true,"headline":true},{"id":"ht6a69c59bbf","date":"2021-10-27","name":"CREAM Lending","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":130000000.0,"lo":130000000.0,"hi":130000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cream-rekt-2"},{"s":"SlowMist Hacked","u":"https://medium.com/cream-finance/post-mortem-exploit-oct-27-507b12bb6f8e"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cream-hacked-for-third-time"}],"desc":"On October 27, 2021, CREAM Finance was exploited for $130 million via flashloan-enabled oracle manipulation. Attacker used flashloans from MakerDAO and Aave to manipulate yUSD price, then minted unbacked yUSD and crYUSD by exploiting vault accounting and composability across Curve and Aave.","theft":true,"onchain":true},{"id":"ht0bd255c086","date":"2021-10-24","name":"Saturnbeam","kind":"rugpull","fam":"insider","tech":"Rug Pull","usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.reddit.com/r/CryptoCurrency/comments/q5byhb/sat_saturnbeam_just_got_rugpulled_they_were/"}],"desc":"The IDO project SaturnBeam of MoonSwap, a decentralized exchange on the Moonriver chain, ran away, and MoonSwap tweeted a warning that SaturnBeam would refund the money within 24 hours.","theft":true},{"id":"hteb81e5c4c4","date":"2021-10-24","name":"Youtube channels","kind":"fraud","fam":"insider","tech":"YouTube was hacked","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/youtube-channels-hacked-and-rebranded-for-live-streaming-crypto-scams"}],"desc":"According to Cointelegraph reports, some Youtube channels were hacked and seized control. The original content and information of these channels were destroyed by hackers. Hackers pretended to be large technology companies or cryptocurrency exchanges to commit fraud. These channels were also used by hackers for $3 to $4,000. Sold at varying prices. The Google Threat Analysis Team (TAG) stated that the hackers who attacked the Youtube channel came from a Russian-speaking forum. In addition, Google has shared the findings with the FBI for further investigation."},{"id":"htcd88f6f2dd","date":"2021-10-23","name":"Alpha Homora","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":147000.0,"lo":147000.0,"hi":147000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.alphafinance.io/mev-bots-uniswap-implicit-assumptions/"}],"desc":"MEV bot extracted value from Alpha Homora V2 via sandwich attack on Uniswap V2 addLiquidity function. The attacker took advantage of implicit assumptions in Uniswap's contract that were not enforced at the contract level, allowing slippage to bypass checks on certain trade paths.","theft":true},{"id":"ht0d684c10d2","date":"2021-10-23","name":"CoinMarketCap","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/haveibeenpwned/status/1451650181552750594"}],"desc":"Email addresses belonging to 3.1 million CoinMarketCap users were leaked last week, according to Have I Been Pwned.Have I Been Pwned says that the website’s database was breached on Oct. 12, 2021. Exactly 3,117,548 email addresses, not including passwords, were stolen in the security breach.","theft":true},{"id":"hte8dbc438b4","date":"2021-10-21","name":"Polygon Plasma Bridge","kind":"hack","fam":"bridge","tech":"Double Spend Attack","chains":["Polygon"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/immunefi/polygon-double-spend-bug-fix-postmortem-2m-bounty-5a1db09db7f1"}],"desc":"Bug bounty platform Immunefi says white hat hacker Gerhard Wagner submitted a critical vulnerability affecting the Polygon Plasma Bridge on October 5, 2021 that allows attackers to withdraw their burn transactions from the bridge multiple times for up to 223 times. About $850 million is at risk, and an attack with just $100,000 would result in a loss of $22.3 million. Polygon confirmed the bug and immediately began fixing the underlying issue, which was resolved within a week. Polygon agreed to pay up to $2 million for the submission.","theft":true},{"id":"ht85713658ab","date":"2021-10-21","name":"Avaterra Finance","kind":"hack","fam":"insider","tech":"Contract Vulnerability","chains":["Avalanche"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coincodecap.com/avaterra-finance-hacked"}],"desc":"Avalanche ecological stability income aggregation agreement Avaterra Finance was attacked by hackers. The security company Rugdoc analyzed that the contract of the agreement is a fork of Goose, but their token contains custom elements, and anyone can call its minting function. In the end, the hacker called the contract and minted and dumped thousands of tokens.","theft":true},{"id":"htc51f2e73d5","date":"2021-10-20","name":"Successful exploit of the CreatureToadz NFT project briefly nets a poorly-disguised hacker 88 ETH (almost $350,000)","kind":"hack","fam":"other","chains":["Ethereum"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"ret":350000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/creaturetoadz-nft-project-briefly-exploited"}],"theft":true,"headline":true},{"id":"ht0bc157dddc","date":"2021-10-20","name":"Pancake Hunny","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/pancakehunny/pancakehunny-incident-report-b5b74557b0ad"}],"desc":"Pancake Hunny, the DeFi protocol on BSC, was attacked by lightning loans, and HUNNY tokens fell by about 70% in a short time. The hacked transactions included 513 transfers, and Gas consumption reached 19 million, of which a large number of transfers were related to Alpaca tokens.","theft":true},{"id":"htbc66fb4cb9","date":"2021-10-18","name":"Glide Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Elastos"],"usd":300000.0,"lo":300000.0,"hi":300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/GlideFinance/status/1449775133992755206"}],"desc":"Attacker exploited a fee parameter error in Glide Finance's contract. The team had changed a fee parameter post-audit from 1,000 to 10,000 but failed to update the corresponding value in the contract code, leaving the incorrect parameter at 1,000 and allowing attackers to drain funds via incorrectly-calculated fees.","theft":true},{"id":"ht9515412b22","date":"2021-10-15","name":"CryptoRom","kind":"fraud","fam":"insider","tech":"Scam","usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://threatpost.com/cryptorom-scammers-apple-enterprise-features/175474/"}],"desc":"The report released by Sophos stated that the crypto fraud application CryptoRom stole 1.4 million U.S. dollars through the use of \"super signature service\" and Apple's developer enterprise plan. It is reported that fraudsters gain the trust of victims through Facebook and dating platforms (such as Tinder, Grindr, Bumble, etc.), and then lure them to install a fake cryptocurrency application CryptoRom and invest. The victim installs apps, invests, makes a profit, and is allowed to withdraw funds. After being encouraged, they were forced to invest more, but once they deposited a larger amount, they could no longer withdraw cash. To date, Bitcoin addresses related to the scam have sent more than 1.39 million U.S. dollars, and there may be more addresses related to the scam. According to the report, most of the victims are iPhone users. The report stated that CryptoRom bypassed all security checks in the App Store and remained active every day. The report also stated that Apple “should warn users about installing apps through temporary distribution or through the enterprise configuration system that these apps have not been reviewed by Apple.”"},{"id":"ht40f4e564e4","date":"2021-10-14","name":"Indexed Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/indexed-finance-rekt"},{"s":"SlowMist Hacked","u":"https://ndxfi.medium.com/indexed-attack-post-mortem-b006094f0bdc"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-steals-16-million-from-indexed-finance"}],"desc":"On October 14, 2021, Indexed Finance's DEFI5 and CC10 pools were drained of $16M via a sophisticated flashloan attack. The attacker used massive flashloans to knock pool balances out of equilibrium, purchased component assets at heavily discounted rates, and executed the entire attack within a single transaction.","theft":true,"onchain":true},{"id":"ht0056e81527","date":"2021-10-13","name":"OpenSea","kind":"hack","fam":"code","tech":"Malicious Code Injection Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.checkpoint.com/2021/10/13/check-point-software-prevents-theft-of-crypto-wallets-on-opensea-the-worlds-largest-nft-marketplace/"}],"desc":"According to news, the security research company discovered that there is a serious security vulnerability in OpenSea in the NFT market, which may cause hackers to steal the user's entire encrypted wallet. Then OpenSea responded that a repair was implemented within one hour of discovering the problem, and other measures will be taken to strengthen community safety education.","theft":true},{"id":"ht8e8aa547ef","date":"2021-10-08","name":"Mirror","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Terra"],"usd":90000000.0,"lo":90000000.0,"hi":90000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/mirror-rekt"}],"desc":"Mirror Protocol was exploited from October 8, 2021 through May 17, 2022 (discovered) via duplicate ID vulnerability in collateral unlock logic, allowing excessive unlocks without proportional validation. Over seven months, attackers siphoned $89.7M before detection due to limited Terra monitoring.","theft":true},{"id":"ht287d65b030","date":"2021-10-08","name":"StarkWare","kind":"hack","fam":"code","tech":"Unknown","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockbeats.info/flash/50975"}],"desc":"Quantitative trading company mgnr stated on Twitter that StarkWare has an urgent security issue, but did not disclose the specific details. Louis Guthmann, the head of ecology of the StarkWare team, confirmed that there is indeed a problem. “This is not a security vulnerability on dYdX. ) Is only related to a specific user.\" mgnr said he has contacted the StarkWare and Solana teams.","theft":true},{"id":"ht1612d082c6","date":"2021-10-06","name":"Evolved Apes","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://finance.yahoo.com/news/another-nft-rug-pull-evolved-084902519.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/evolved-apes-creator-rug-pulls"}],"desc":"The official Twitter account and website of the NFT project Evolved Apes, the project developer \"Evil Ape\" disappeared last week, and took away 798 ETH worth US$2.7 million.","theft":true},{"id":"hta42b2fc78f","date":"2021-10-06","name":"Four NFT projects on the Solana blockchain rug-pull in one day","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":396000.0,"lo":396000.0,"hi":396000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/four-solana-nft-projects-rug-pull"}],"theft":true,"headline":true},{"id":"htdd40bb0176","date":"2021-10-06","name":"My Farm Pet","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"usd":31424.0,"lo":31424.0,"hi":31424.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/news/p-517619.html"}],"desc":"My Farm Pet was suspected of being attacked by lightning loans, and today fell 79.86%.","theft":true},{"id":"hta40e274693","date":"2021-10-05","name":"Lido Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.lido.fi/vulnerability-response-update/"}],"desc":"Staking liquidity solution Lido Finance discovered a loophole through the Lido vulnerability bounty program, which can be used by whitelisted node operators to steal a small portion of user funds. Approximately 20,000 ETH were exposed to risk at the time of the vulnerability report. At present, the team has taken short-term remedial measures. The white hat for reporting the vulnerability is Dmitri Tsumak, the founder of StakeWise, who is expected to receive the highest reward of the vulnerability bounty program of $100,000.","theft":true},{"id":"htef0a239dc5","date":"2021-10-05","name":"Liquid Network","kind":"hack","fam":"code","tech":"Block signature problem","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.liquid.net/liquid-hard-fork-diagnostic-report/"}],"desc":"The Bitcoin sidechain Liquid Network launched by Blockstream encountered block signature-related issues after the recent upgrade, resulting in no block generation for more than 7 hours. According to Liquid Network's block explorer, the last block is 1517039, and it was generated 7 hours ago. Liquid Network said on Twitter, \"It is investigating a block signature issue related to a recent feature upgrade, but user funds are safe and will not be affected.\"","theft":true},{"id":"ht71ed142afa","date":"2021-10-04","name":"Compound","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":68800000.0,"lo":68800000.0,"hi":68800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://rekt.news/compound-rekt/"}],"desc":"While the decentralized lending agreement Compound tried to fix the loopholes in the liquidity mining token distribution contract through the No. 63 or No. 64 community proposal, another COMP token worth US$68.8 million (a total of 202,472 COMP) was due to The call of the drip() function was entered into the liquidity mining token distribution contract that has existing loopholes.","theft":true},{"id":"ht920cd7b06a","date":"2021-10-04","name":"pNetwork","kind":"hack","fam":"bridge","tech":"Spoofed Event Log","target":"DeFi Protocol","chains":["BNB Chain","Bitcoin"],"usd":13000000.0,"lo":13000000.0,"hi":13000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On September 19, 2021, pNetwork's cross-chain bridge was exploited when an attacker crafted fraudulent peg-out event logs. The Rust event-log processor failed to validate that requests originated from authorized pNetwork contracts, processing the fake withdrawal requests. The attacker stole 277 BTC (wrapped to BSC) worth approximately $13M.","theft":true},{"id":"ht75f957bd2b","date":"2021-10-02","name":"AutoShark Finance","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1444102942689148933"}],"desc":"The DeFi protocol AutoShark Finance on the Binance Smart Chain was attacked by lightning loans. The main reason was that the exchange mining function was used by hackers in a series of transactions. Hackers could use lightning loans to occupy most of the mining pool (to make up for exchange losses/fees) ), at the same time, the exchange fee reward was obtained, and a total profit of 3.18 million FINS was obtained. Afterwards, the hacker exchanged FINS for 1,388 BNB (approximately US$580,000).","theft":true},{"id":"ht6efde83838","date":"2021-10-01","name":"Baller Ape Club NFT developers rug pull for $2.6 million","kind":"rugpull","fam":"insider","chains":["Solana"],"usd":2600000.0,"lo":2600000.0,"hi":2600000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/baller-ape-club-developers-rug-pull"}],"theft":true,"headline":true},{"id":"htb5e4bec14e","date":"2021-10-01","name":"Iconics","kind":"hack","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":140000.0,"lo":138000.0,"hi":140000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cryptoslate.com/solana-nft-iconics-defrauds-people-of-130000-in-sol/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/nft-project-developer-steals-138000"}],"desc":"Iconics, an NFT project on Solana, was accused of being a “Rug pull.” The 17-year-old artist behind Iconics made about $140,000 before disappearing. The project developers also deleted Iconics’ Twitter account and disabled Discord channel chat.","theft":true},{"id":"ht9e90122adb","date":"2021-10-01","name":"Coinbase","kind":"hack","fam":"keys","tech":"Session Key Compromised","target":"CEX","conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cpomagazine.com/cyber-security/coinbase-hack-attributed-to-a-multi-factor-authentication-flaw-that-allowed-scammers-to-steal-cryptocurrenc"}],"desc":"Attackers exploited a vulnerability in Coinbase's SMS-based account recovery process to bypass 2FA on 6,000+ customer accounts. Threat actors leveraged phishing campaigns to obtain email, password, and phone number combinations, then used the SMS recovery flaw to intercept 2FA tokens and drain accounts. Coinbase reimbursed affected customers.","theft":true},{"id":"htc552ac3d34","date":"2021-10-01","name":"POAP","kind":"fraud","fam":"insider","tech":"Minting Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/poapxyz/status/1443932604529614853"}],"desc":"POAP, the proof of attendance badge protocol, stated that its minting system was hacked on September 29, and several POAPs of XCOPY and Polygonal Mind were fraudulently issued and sold. At the request of the artist, POAP has burned down the relevant NFT."},{"id":"ht28e5cd3591","date":"2021-09-29","name":"Compound V2","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":147000000.0,"lo":80000000.0,"hi":147000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/compound-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/compoundfinance/status/1441097386449719301"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/compound-founder-threatens-users"}],"desc":"Compound V2's Comptroller had a conditional logic bug when Proposal 62 activated on September 29-30, 2021. An off-by-one error (> instead of >=) in the COMP distribution calculation allowed users to claim far more tokens than intended.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht0a075dee49","date":"2021-09-27","name":"Bitfinex","kind":"hack","fam":"code","tech":"Handle inventory defects with fixed precision and extended value range","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.deversifi.com/23-7-million-dollar-ethereum-transaction-fee-post-mortem/"}],"desc":"The non-custodial exchange DeversiFi released a post-mortem analysis report for the previous gas transaction that included 7676.62 ETH, saying that the potential problems in the EthereumJS library are combined with the gas fee changes related to the EIP-1559 upgrade in some cases, and the Ledger hardware wallet may exist The display problem of, may lead to extremely high transaction fees. When this happens, only wallets with very large funds will be affected, and other users will display transaction failures during transactions. In addition, after Bitfinex negotiated with the miners, the miners had returned 7,626 ETH, and the remaining 50 ETH was provided to the miners as a refund fee. It was previously reported that a major wallet on the Bitfinex exchange made a $100,000 USDT transfer with a total of 7676.62 ETH (approximately US$23.54 million) in Gas fees. The final recipient was a non-custodial spin-off from Bitfinex in 2019. Exchange DeversiFi.","theft":true},{"id":"ht0294ec309f","date":"2021-09-23","name":"Bitcoin.org","kind":"fraud","fam":"insider","tech":"Malicious Code Injection Attack","usd":17000.0,"lo":17000.0,"hi":17000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/CobraBitcoin/status/1440905892543832064"}],"desc":"The Bitcoin.org website has activities to give back to the community, and it is suspected that the website has been hacked. The homepage of the website shows a Bitcoin address and states that any first 10,000 users who pay to this address will receive double the amount in return. Cobra, the co-owner of the Bitcoin.org website, tweeted that Bitcoin.org has been hacked and is investigating how hackers set up fraud patterns on the website. It is expected that operations will be suspended for a few days. According to reports, the attackers stole more than 17,000 U.S. dollars."},{"id":"ht6b48903af3","date":"2021-09-21","name":"Vee Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Avalanche"],"usd":35000000.0,"lo":34000000.0,"hi":35000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/veefinance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/VeeFinance/status/1440102406499356675"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/vee-finance-platform-hacked"}],"desc":"Vee Finance on Avalanche was exploited on September 21, 2021 for ~$34-35M ($9M BTC + $26.2M ETH). The attacker manipulated Pangolin DEX prices by creating fake trading pairs and executing manipulative trades to distort prices that Vee Finance used as its single oracle source.","theft":true},{"id":"ht27855dd8c8","date":"2021-09-20","name":"pNetwork loses $12 million to a bug","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":12000000.0,"lo":12000000.0,"hi":12000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/pnetwork-loses-12-million-to-a-bug"}],"theft":true,"headline":true},{"id":"htcafa395583","date":"2021-09-20","name":"pNetwork","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","target":"Bridge","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/pNetworkDeFi/status/1439690593211490324"}],"desc":"The cross-chain protocol pNetwork released an analysis report in response to the previous attack that resulted in the theft of 277 BTC, stating that at 17:20 UTC on September 19, 2021, the pNetwork system was attacked by hackers who attacked multiple pToken bridges. Including pBTC-on-BSC, TLOS-on-BSC, PNT-on-BSC, pBTC-on-ETH, TLOS-on-ETH and pSAFEMOON-on-ETH. However, hackers only cross-chain bridges in pBTC-on-BSC The attack was successful and 277 BTC were stolen from the pBTC-on-BSC collateral. Other pToken bridges were not affected and the funds were safe.","theft":true},{"id":"htfe217f767b","date":"2021-09-17","name":"JayPegs Automart","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"DeFi Protocol","chains":["Ethereum"],"usd":3100000.0,"lo":3000000.0,"hi":3100000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/jaypegs-automart-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/3-million-taken-from-sushiswap"}],"desc":"JayPegs Automart DONA auction ($3.1M) on SushiSwap MISO exploited when contractor injected malicious code into the frontend deployment, redirecting proceeds to their wallet. Funds were fully recovered after identification and legal threats.","theft":true},{"id":"ht25efde5f69","date":"2021-09-17","name":"Defibox","kind":"hack","fam":"code","tech":"Compatibility Issue","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://support.defibox.cc/hc/zh-cn/articles/4406632860569"}],"desc":"Defibox discovered an abnormal exchange situation of the EOS-EMOON trading pair at 22:00 on September 16th. After an emergency investigation, the swap contract was suspended at 0:00 on September 17th, and it was reopened on the morning of September 17th after auditing and multiple signings were completed. Swap contract. This exchange abnormality is caused by the incompatibility between the Defibox Swap contract and the EMOON contract. Before the event, the number of pots was 482636464535179.88 EMOON/4866.1494 EOS. When the contract was suspended, the EMOON pot was 5790970803030.11 EMOON/3.4553EOS, resulting in about 4863 EOS. loss. At present, the Defibox team has eliminated this type of risk caused by other burning tokens, and has upgraded the Swap contract to further improve the security of the contract. The Defibox Foundation will activate the risk reserve and pay 4863 EOS to the EMOON community.","theft":true},{"id":"ht4702b499d7","date":"2021-09-16","name":"MISO","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/sushi-s-token-launchpad-miso-hacked-for-3m"}],"desc":"The DONA token auction of the Jay Pegs Auto Mart project on the SushiSwap Launchpad platform MISO was attacked. The attacker inserted malicious code into the MISO front end and changed the auction wallet address to his own wallet address. The loss has now reached 865 ETH (approximately 3.07 million). Dollar). Joseph Delong, CTO of SushiSwap, said on Twitter that the vulnerability has been fixed and that FTX and Binance have been asked to provide the attacker's KYC information, but both exchanges refused to cooperate. In addition, Joseph Delong also stated that he has reported the case to the FBI through his lawyer and reminded the project party to check whether there are similar front-end vulnerabilities. According to the Ethereum block explorer Etherscan, the attacker returned all ETH to SushiSwap. The operation was divided into two transactions, the first return 100 ETH, the second return 700 ETH, and the third return 65 ETH.","theft":true,"onchain":true},{"id":"htb34094db8a","date":"2021-09-15","name":"NowSwap","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":1069000.0,"lo":1000000.0,"hi":1069000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/PuPuThrashing/status/1438058002817323009"}],"desc":"NowSwap DEX on Ethereum was exploited on September 15, 2021 when K constant value mismatch (updated in 2 of 3 code locations during upgrade) allowed attacker to swap 1 wei for 98% of pool reserves.","theft":true},{"id":"htaae6b74922","date":"2021-09-15","name":"Secret Network","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/SecretNetwork/status/1437856678830133258"}],"desc":"The private public chain Secret Network stated on Twitter that the main network has undergone an unplanned upgrade, from secret-2 to secret-3, to prevent major network security issues from causing financial losses. The team stated that neither the native token SCRT nor the cross-chain bridge contract were affected. Only a single smart contract was affected. The contract came from SecretSwap. A vulnerability was exploited, allowing the attacker to take away the pledged SEFI contract. funds. At present, the cross-chain bridge is still closed, and the deposit function of the exchange is also closed.","theft":true},{"id":"ht89d25b3777","date":"2021-09-15","name":"Nimbus Platform","kind":"hack","fam":"code","tech":"Incorrect calculation","conf":"C","n":1,"theft":true},{"id":"htad1d50e727","date":"2021-09-14","name":"Arbitrum One","kind":"hack","fam":"code","tech":"Security Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/offchainlabs/arbitrum-one-outage-report-d365b24d49c"}],"desc":"The expansion of the Ethereum network, Arbitrum One, released a report on network failures. Beginning at 10:14 on September 14th, EST, Arbitrum One was out of service for 45 minutes, during which time the Arbitrum Sequencer was offline, and funds were never at risk. The root cause of the downtime was a bug that caused the Sequencer to get stuck when receiving a large number of transactions in a short period of time. The Arbitrum team has located the problem and deployed a fix. The team also stated that even if the Sequencer fails, it will not affect the continuous operation of the network. Users can bypass the Sequencer and submit transactions directly to Ethereum.","theft":true},{"id":"htfebbabb882","date":"2021-09-14","name":"Klondike Finance","kind":"hack","fam":"market","tech":"Flash loan attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Klondike Finance was attacked by hackers, with a total loss of approximately 35,281.71 KXUSD (6.5629 WETH).","theft":true,"onchain":true},{"id":"ht43988dd8d2","date":"2021-09-14","name":"Solana","kind":"hack","fam":"code","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://solana.com/news/9-14-network-outage-initial-overview"}],"desc":"The beta version of the mainnet of the public chain Solana has been unstable since 19:52 Beijing time last night, and it has been 12 hours since the Solana chain application has not been able to operate normally. According to information released by Solana Status, the Solana validator community chose to restart the network cooperatively, and the snapshot height is slot 96542804. Solana Status recommends that the verification node be updated to Mainnet-Beta 1.6.24 version. On September 21, Solana officially released a preliminary overview of the network outage on September 14. It is reported that on September 14, Solana’s network was offline for 17 hours. There was no financial loss, and the network resumed full functionality within 24 hours. The cause of network stagnation is denial of service attacks. At 12:00 UTC time, Grape Protocol launched IDO on Raydium, and transactions generated by robots congested the network. These transactions caused a memory overflow, causing many validating nodes to crash, forcing the network to slow down and eventually stop. When the verification node network cannot agree on the current state of the blockchain, the network will go offline, preventing the network from confirming new blocks.","theft":true},{"id":"ht449dfba058","date":"2021-09-12","name":"Zabu Finance","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Avalanche"],"usd":3200000.0,"lo":3200000.0,"hi":3200000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2021/09/13/avalanche-based-zabu-finance-exploited-in-32m-hack/"}],"desc":"On September 12, 2021, Zabu Finance's ZABUFarm contract on Avalanche failed to account for deflationary token transfer fees. Attacker was credited with full input amount despite fees, draining liquidity.","theft":true},{"id":"ht91a7506469","date":"2021-09-10","name":"OpenSea","kind":"hack","fam":"code","tech":"Contract Vulnerability","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://chainb.com/?P=Cont&id=32317"}],"desc":"A vulnerability in NFT marketplace OpenSea resulted in at least 42 NFTs being sent to a burn address, worth at least $100,000. The issue was first raised by Nick Johnson, lead developer of the Ethereum Name Service (ENS), who noted that when he transferred an ENS domain name (in the form of an NFT), it was transferred to a burn address. This means it was accidentally sent to an uncontrolled address and can no longer be moved. Regarding the destroyed ENS domain name, Johnson said it was the first registered ENS domain name, called rilxxlir.eth, which was held by an ENS account when Johnson registered it with personal funds. In order to transfer the ENS domain name to his own account, he went to OpenSea to perform the transfer, only to find that it had been sent to a destruction address by mistake. Since Johnson is still the controller of the ENS domain name, he can still make changes, just cannot move the domain name. Johnson then received further reports from others who were similarly affected and compiled a list of 32 affected transactions involving 42 NFTs. Most NFTs use the ERC-721 standard, but a few use ERC-1155. He looked at the floor price of each NFT, which totaled about $100,000. Johnson claims that OpenSea has now fixed the vulnerability.","theft":true},{"id":"ht70e0f9e9ce","date":"2021-09-09","name":"dYdX","kind":"hack","fam":"code","tech":"Contract deployment error","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/dydxfoundation/status/1435641354860834816"}],"desc":"Twitter netizen \"mhonkasalo\" stated that there was a bug in the dYdX pledge contract. The user received 0 stkDYDX when pledged, the front end was disabled, and there were 64 affected addresses. Later, dYdX released the \"Pledge Contract Bug\" incident report. During the deployment of the upgradeable smart contract, the dYdX security module made an error, which caused the ratio of DYDX to stkDYDX to change from 1 to 0, so that users who pledged DYDX did not receive stkDYDX. dYdX stated that the error was caused by an error in the smart contract deployment process. It believed that there was no error in the code itself. The security module was previously audited by the smart contract, and based on the liquidity module design, the design was also audited. The security module is thoroughly tested before deployment. At present, user funds are safely locked in the security module until the end of the 28-day epoch, and no security module rewards are distributed and no withdrawals are possible. In order to restore the contract function, an upgrade is required. The suggested solution is to restore the security module function, allow the pledged user to retrieve the funds, and compensate the user for the wrong reward for participating in the security module.","theft":true},{"id":"ht360ae30e2a","date":"2021-09-04","name":"Banksy","kind":"phishing","fam":"social","tech":"Phishing attack","usd":5000.0,"lo":5000.0,"hi":5000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/pranksy/status/1432624092797079552"}],"desc":"A user claimed on Twitter that he had mistakenly entered an NFT auction scam and was taken away by an art website worth 336,000 US dollars of Ethereum. However, the development of the story is somewhat unexpected, because the other party returned 100 ETH in full. In this scam, the victim reported that he inquired about the NFT auction on Monday from a certain population on Discord, and then he thought he was lucky enough to win the bid for the first NFT on the website and paid 100 ETH (about 336,000 US dollars) for this. ). However, according to a BBC report on Tuesday, a hacker exploited a security hole in the artist Banksy's website and set up a web page (banksy.co.uk/NFT) to sell so-called non-fungible tokens (NFT). In the end, although the hacker returned the money, the user still lost $5,000 in transaction fees.","theft":true},{"id":"htf280e90cb4","date":"2021-09-04","name":"ETC","kind":"hack","fam":"code","tech":"Ethereum client Geth vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/eth_classic/status/1433965057348616195"}],"desc":"Ethereum Classic (ETC) tweeted that the ETC mainnet was forked due to previous vulnerabilities in the Ethereum client Geth. At present, most of the computing power is on the mainnet. Core-geth node operators should update to v1.12.1 or higher as soon as possible.","theft":true},{"id":"ht2d173789b9","date":"2021-09-03","name":"DAO Maker Vesting","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/daomaker-rekt"},{"s":"SlowMist Hacked","u":"https://www.coinfirm.com/blog/dao-maker-hack/"}],"desc":"On September 4, 2021, DAO Maker's vesting contracts were exploited via an unauthenticated init() function allowing contract reset and ownership claim. The attacker used emergencyExit() to extract ~$4M from vesting contracts for DERC, CPD, CAPS, and SHO.","theft":true,"onchain":true},{"id":"ht301ffca77b","date":"2021-09-03","name":"Siren","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Polygon"],"usd":3500000.0,"lo":3500000.0,"hi":3500000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On September 3, 2021, the SIREN protocol on Polygon was exploited via reentrancy in withdrawCapital, allowing repeated withdrawals before balance updates. The attacker drained ~$3.5M across multiple AMM pools (KNC, SUSHI, USDC, WETH, WMATIC), affecting 26 LP addresses.","theft":true},{"id":"hte56c63701d","date":"2021-09-03","name":"OpenZeppelin","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-post-mortem/14958"}],"desc":"OpenZeppelin released a bug fix analysis. Whitehat Zb3 submitted a serious reentrant vulnerability in OpenZeppelin's TimelockController contract on August 21, 2021, which affected a project hosted on the Immunefi vulnerability bounty platform. The project chose to remain anonymous and has paid an undisclosed amount (including an anonymous bonus) to White Hat. OpenZeppelin paid White Hat a bonus of $25,000 to recognize their contribution to community security and released a patch. As far as it knows, this is the only serious vulnerability that OpenZeppelin has in its open source smart contract library. The vulnerability has been patched in the affected projects, and OpenZeppelin has released an updated contract version to fix the vulnerability. All projects that use TimelockController should be migrated.","theft":true},{"id":"ht504dc85ac0","date":"2021-09-03","name":"Tomb Finance","kind":"hack","fam":"other","tech":"Fee Collection Mechanism Flaw","chains":["Fantom"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://tombfinance.medium.com/tomb-finance-post-mortem-480fa68375b2"}],"desc":"The Tomb Finance token TOMB, an algorithmic stablecoin project linked to the Fantom ecosystem and FTM, had the biggest drop of 77% yesterday, and was suspected of being attacked by the community. In this regard, Tomb Finance stated that it used to collect service fees when selling TOMB. The mechanism Gatekeeper was used by a third party, which led to panic selling, but the project was not attacked and no funds were stolen.","theft":true},{"id":"hta5381f7d8c","date":"2021-08-30","name":"C.R.E.A.M. Finance exploited again, this time for $25 to $30 million","kind":"hack","fam":"other","usd":29000000.0,"lo":29000000.0,"hi":29000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/cream-finance-exploited-again"}],"theft":true,"headline":true},{"id":"ht2a23e6dcbb","date":"2021-08-30","name":"CREAM Lending","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":18800000.0,"lo":2300000.0,"hi":18800000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cream-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/cream-finance/c-r-e-a-m-finance-post-mortem-amp-exploit-6ceb20a630c5"}],"desc":"On August 30, 2021, CREAM Finance suffered a reentrancy attack losing 418M AMP tokens and 1,308 ETH (~$18.8M). Using a 500 ETH flash loan as seed capital, the attacker exploited a reentrancy vulnerability in the AMP token callback handler to self-liquidate and withdraw more collateral than deposited.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htcd8615bf10","date":"2021-08-29","name":"Bilaxy","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":21700000.0,"lo":21700000.0,"hi":21709378.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Bilaxy_exchange/status/1432103507557974016"}],"desc":"On August 28-29, 2021, cryptocurrency exchange Bilaxy's hot wallet was compromised, resulting in the theft of approximately $21.7 million in various ERC20 tokens including USDT, USDC, and UNI. The attacker transferred 200 ETH to Tornado Cash to mix the stolen funds.","theft":true},{"id":"ht4e87db864f","date":"2021-08-29","name":"Xtoken","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/xtoken-rekt-x2"},{"s":"SlowMist Hacked","u":"https://medium.com/xtoken/xsnx-post-mortem-666d35071f38"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/xtoken-second-hack"}],"desc":"An attacker used an $81M flashloan from dYdX to manipulate SNX price downward, then exploited an access control vulnerability in xToken's callFunction to purchase SNX at artificially depressed prices, stealing $4.5M in value.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht6465d19e03","date":"2021-08-25","name":"Scammers posing as Bored Ape Yacht Club founders scam NFT collector Sohrob Farudi out of $800,000","kind":"scam","fam":"social","usd":800000.0,"lo":800000.0,"hi":800000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-scam-collector-out-of-800000"}],"theft":true,"headline":true},{"id":"ht79120e7b2c","date":"2021-08-25","name":"Dot.Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain","Polkadot"],"usd":429724.0,"lo":429724.0,"hi":429724.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@Knownsec_Blockchain_Lab/knowsec-blockchain-lab-dot-finance-flash-loan-security-incident-analysis-98f7b5707a15"}],"desc":"On August 25, 2021, Dot.Finance on BSC was exploited via a flash loan attack that manipulated the VaultPinkBNB contract's token pricing. The attacker injected Cake tokens to inflate the performanceFee parameter, enabling the mintFor function to create excessive pink tokens worth approximately $429.7K.","theft":true},{"id":"hta9fc123a94","date":"2021-08-24","name":"Scammers posing as OpenSea support staff steal $480,000 from NFT collector Jeff Nicholas","kind":"scam","fam":"social","usd":480000.0,"lo":480000.0,"hi":480000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/scammers-posing-as-opensea-support-staff-steal-480000"}],"theft":true,"headline":true},{"id":"ht2b41027cee","date":"2021-08-21","name":"BitConnect","kind":"fraud","fam":"insider","tech":"Scam","usd":2000000000.0,"lo":2000000000.0,"hi":2000000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.justice.gov/opa/pr/56-million-seized-cryptocurrency-being-sold-first-step-compensate-victims-bitconnect-fraud"}],"desc":"In May of this year, the SEC filed a lawsuit against five people suspected of promoting BitConnect. The SEC believes that BitConnect is an unregistered digital asset securities product, and the program has raised more than $2 billion from retail investors through the promoter network. BitConnect is a cryptocurrency investment plan with the characteristics of a Ponzi scheme launched in 2017. Its token BCC was one of the 20 most valuable cryptocurrencies at the time, with a market value of more than 2.6 billion U.S. dollars. In September, the founder of BitConnect, Glenn Arcaro, admitted to participating in a fraud scheme, which was allegedly amounting to US$2 billion.","review":["single source for a loss of $500M or more"]},{"id":"htaf061386c0","date":"2021-08-21","name":"Sentinel","kind":"hack","fam":"keys","tech":"Affected by the HitBTC event","usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"Sentinel, a Cosmos ecological dVPN project, stated on Twitter that the $40 million DVPN tokens were stolen due to the leak of the mnemonic phrase on the HitBTC exchange. Sentinel stated that the user's own DVPN was safe, and HitBTC had the problem. They reported the hacking incident to Sentinel one hour after the incident. So Sentinel hopes that HitBTC will take action to return DVPN to users. HitBTC responded that Sentinel was trying to shirk responsibility for its technical defects and deceive everyone. HitBTC believes that Sentinel’s technology has vulnerabilities that can easily cause user mnemonics to be publicly disclosed. Such vulnerabilities are common in the Sentinel network, and the blockchain and software have not been thoroughly tested, and the company has not invested enough Time and resources to protect users. Therefore, HitBTC recommended that Sentinel fix the security vulnerabilities in the software, conduct more tests, and restart the current centralized system.","theft":true},{"id":"hteef05744ca","date":"2021-08-20","name":"Finiko","kind":"fraud","fam":"insider","tech":"Scam","usd":100000000.0,"lo":100000000.0,"hi":100000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coingeek.com/100m-btc-ponzi-scheme-finiko-founder-arrested-in-russia/"}],"desc":"The founder of one of Russia's largest cryptocurrency scams has been in jail for allegedly defrauding US$100 million from its investors. Finiko was established in Kazan in 2019 and pretended to be a legitimate BTC investment company. In December 2020, Finiko released its native digital currency FNK. According to local reports, the founders will take BTC from investors and reward them with FNK tokens."},{"id":"htf0eeb4ddf8","date":"2021-08-19","name":"Liquid Global","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":91350000.0,"lo":90000000.0,"hi":91350000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.liquid.com/warm-wallet-incident"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/liquid-global-cryptocurrency-exchange-hacked-for-90-million"}],"desc":"On August 19, 2021, Japanese cryptocurrency exchange Liquid Global's warm wallets were compromised, resulting in the theft of approximately $91-97 million in various cryptocurrencies including BTC, ETH, TRX, and XRP. The attack leveraged data from a prior November 2020 breach to compromise the MPC wallet system.","theft":true},{"id":"htef90e9a048","date":"2021-08-19","name":"Luna Yield","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Solana"],"usd":6700000.0,"lo":6700000.0,"hi":6700000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coingeek.com/solana-sees-first-rug-pull-luna-yield-disappears-with-6-7m-in-digital-currency/https://coingeek.com/solana-sees-first-rug-pull-lu"}],"desc":"The Solana chain has experienced its first carpet pull. Luna Yield ($LUNY) is a revenue aggregator launched through the Solana launchpad \"SolPad\", which has disappeared and is a variety of digital currencies worth about 6.7 million U.S. dollars. Luna Yield advertises itself as a legal project that can aggregate and optimize yield agriculture for its users; it is even supported by the famous Solana-based project launchpad \"SolPad\", which enables projects that submit \"qualified documents\" Raise funds through its initial DEX product (IDO) on the Solana-based decentralized platform. Although Luna Yield submitted \"qualified documents\", its attitude towards investors was indifferent. Before the August 16 fundraising, Luna Yield appeared to be legitimate. Three days after its IDO, Luna Yield sent the funds it raised to the hybrid service Tornado Cash to make it untraceable, and then it closed its website and all social media accounts-no one was able to contact the Luna Yield team.","theft":true},{"id":"ht696468d3de","date":"2021-08-19","name":"Pinecone Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@PineconeFinance/pinecone-pct%E8%B4%A8%E6%8A%BC%E6%B1%A0%E6%94%BB%E5%87%BB%E4%BA%8B%E4%BB%B6-dfa2b03c8bfc"}],"desc":"On August 18-19, 2021, Pinecone Finance's staking pool was exploited when an attacker bypassed the frontend and directly invoked the smart contract to deposit more PCT tokens than their account balance. Due to failed balance verification, the attacker withdrew more tokens than deposited, extracting approximately $200K before the PCT token price collapsed 61%.","theft":true},{"id":"htbbcc82ddbd","date":"2021-08-19","name":"Solend","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Solana"],"usd":16000.0,"lo":16000.0,"hi":16000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/solendprotocol/status/1428611597941891082"}],"desc":"On August 19, 2021 at 12:40 GMT, Solend's UpdateReserveConfig() admin function was exploited when an attacker bypassed authorization checks by invoking the function with the admin's public key without requiring a valid signature. The attacker attempted to make lending accounts liquidatable, resulting in $16K in liquidations that were fully compensated by the liquidator.","theft":true},{"id":"ht200e0c70b0","date":"2021-08-16","name":"SurgeBNB","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":5000000.0,"lo":5000000.0,"hi":5000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/XSURGEDEFI/status/1427359459102404609"}],"desc":"SurgeBNB suffered a reentrancy attack funded by a 10,000 BNB flash loan. The sell function updated balances after external calls, letting attacker repeatedly withdraw value.","theft":true,"onchain":true},{"id":"ht0e45e3ddfe","date":"2021-08-15","name":"Ref Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["NEAR"],"usd":3203000.0,"lo":3202539.0,"hi":3203000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/finance_ref/status/1426649258812448774"}],"desc":"On August 14-15, 2021, Ref Finance was exploited when a faulty security hotfix failed to properly validate and debit users' LP token balances when removing liquidity from pools. This allowed attackers to withdraw more tokens than they should have, extracting approximately 507K NEAR and 1M REF tokens worth ~$3.2M.","theft":true},{"id":"ht9fbaf89eec","date":"2021-08-13","name":"NEKO","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2200000.0,"lo":2200000.0,"hi":2200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.mazeprotocol.com/neko-hacking-incident-report-e46cdf179fd9"}],"desc":"On August 13, 2021, Neko Network's MainPool smart contract was exploited via an improper access control vulnerability. The attacker exploited a mismatch between the account being mortgaged for a loan (onBehalfOf) and the account receiving borrowed funds, allowing them to mortgage other users' assets while receiving funds to their own address, stealing over $2.2M in stablecoins.","theft":true},{"id":"htde597693c3","date":"2021-08-13","name":"Acala Network","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Acala"],"usd":1600000.0,"lo":1600000.0,"hi":1600000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A misconfiguration in Acala's iBTC/aUSD liquidity pool (deployed August 14, 2022) allowed minting of 1.28 billion unbacked aUSD tokens. The network halted swaps, burned the tokens, and limited realized losses to ~$1.6M despite the massive depeg.","theft":true},{"id":"ht8974f8d348","date":"2021-08-12","name":"DAO Maker Vesting","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":7000000.0,"lo":7000000.0,"hi":7376245.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.newsweek.com/dao-maker-hack-7m-stolen-defi-heist-1618785"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/dao-maker-project-exploited"}],"desc":"DAO Maker's vesting system was exploited when the init() function lacked access control, allowing an attacker to reset parameters on 4 token contracts (DERC, CPD, CAPS, SHO) and drain tokens via emergencyExit. Stolen tokens were swapped on DEXes, causing significant price impact.","theft":true},{"id":"ht54839f43ad","date":"2021-08-10","name":"Poly Network","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum","BNB Chain","Polygon"],"usd":611000000.0,"lo":611000000.0,"hi":613062100.7,"ret":611000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/polynetwork-rekt"},{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/Poly_Network_exploit"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/611-million-stolen-from-poly-network"}],"desc":"Poly Network was exploited for $611M on August 10, 2021 across Ethereum ($273M), BSC ($253M) and Polygon ($85M) via an access control and cryptography vulnerability in cross-chain bridge contracts. The attacker voluntarily returned nearly all funds within 15 days, keeping only transaction fees.","theft":true,"onchain":true},{"id":"ht141a88a7ab","date":"2021-08-10","name":"Punk Protocol","kind":"hack","fam":"code","tech":"Delegatecall Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":8950000.0,"lo":3950000.0,"hi":8950000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/punkprotocol-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/punkprotocol/punk-finance-fair-launch-incident-report-984d9e340eb"}],"desc":"On August 10, 2021, Punk Protocol was exploited for $8.95M when attacker used delegatecall to rerun unguarded Initialize function, changing forge address to gain withdrawal control. White-hat frontran and recovered ~$5M, keeping $1M as finder's fee.","theft":true,"review":["sources disagree on the loss"]},{"id":"hta18b400236","date":"2021-08-10","name":"\"Women-led\" NFT project, \"Fame Lady Squad\", turns out to be a bunch of dudes","kind":"other","fam":"other","chains":["Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/fame-lady-squad-turns-out-to-be-a-bunch-of-dudes"}],"headline":true},{"id":"ht30ee3f4dda","date":"2021-08-08","name":"Zerogoki","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"usd":670000.0,"lo":670000.0,"hi":670000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/bachonchain/status/1424263990402715648"}],"desc":"On August 8, 2021, Zerogoki was exploited for approximately $670K when an attacker provided a price oracle signed by legitimate private keys but containing crafted token swap amounts, bypassing normal validation and allowing unauthorized fund extraction.","theft":true},{"id":"htda0f15b009","date":"2021-08-04","name":"WaultSwap","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"DeFi Protocol","chains":["BNB Chain"],"usd":930000.0,"lo":930000.0,"hi":930000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Wault_Finance/status/1422759668317925376"}],"desc":"On August 4, 2021, WaultSwap was exploited when an attacker manipulated the $WUSD pegging mechanism by repeatedly staking USDT to artificially increase the $WEX price in the USDT-WEX liquidity pool, then swapping $WEX back to $USDT for profit, extracting approximately $930K.","theft":true,"onchain":true},{"id":"ht75dd74be5d","date":"2021-08-04","name":"VERA","kind":"scam","fam":"social","tech":"Scam","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.reddit.com/r/CryptoCurrency/comments/owkokz/scam_alert_vera_tokens/"}],"desc":"Some Twitter users reported receiving a token airdrop named VERA (The Vera) project, but the tokens in the wallet were stolen after the official website was authorized. After inquiry, it was found that the project was suspected to be an airdrop trap. The specific method was to airdrop 80,000 tokens (worth approximately US$9,600) through a single address to attract user attention, and set up a mechanism to allow users to fail transactions on Pancakeswap, which in turn led users to the official website to cheat. Authorize the implementation of theft.","theft":true},{"id":"ht087ff436c5","date":"2021-08-03","name":"Popsicle Finance","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":20700000.0,"lo":20000000.0,"hi":25000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/popsicle-rekt"},{"s":"SlowMist Hacked","u":"https://popsiclefinance.medium.com/popsicle-finance-post-mortem-after-fragola-hack-f45b302362e0"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/25-million-taken-from-popsicle-finance"}],"desc":"On 3 August 2021 an attacker exploited Popsicle Finance's Sorbetto Fragola UniswapV3 optimizer pool where share transfers did not update fee-tracking state, allowing the same fee rewards to be claimed multiple times across accounts, draining ~$20.7M.","theft":true,"onchain":true},{"id":"htce2787fcad","date":"2021-08-03","name":"BSV","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bitcoinethereumnews.com/economy/bsv-has-been-hit-by-a-major-51-percent-attack/"}],"desc":"Starting at around 23:45 on August 3, Beijing time, BSV suffered a “large-scale” 51% attack, resulting in the simultaneous mining of three versions of the chain.","theft":true},{"id":"hta2ba13cabc","date":"2021-08-02","name":"Stazie","kind":"phishing","fam":"social","tech":"Phishing attack","usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/77404/founder-of-nft-game-loses-16-cryptopunks-and-bunch-of-eth-to-scammer"}],"desc":"A crook named \"cryptopunksbot\" was published on CryptoPunk's Discord server, providing NFT investors with the opportunity to win ten elusive NFT avatars. Stazie, the co-founder of the NFT game project Hedgie, accepted the false offer poster, but this move eventually cost him 16 CryptoPunks, which may be worth at least $1 million. Stazie inadvertently sent the wallet seed phrase to the scammer, resulting in the loss of some ETH. The scammer sold 5 CryptoPunks for 149 ETH ($385,000).","theft":true},{"id":"ht1b69daa8ca","date":"2021-07-31","name":"Russian Ponzi scheme collapses after defrauding investors of around $95 million","kind":"fraud","fam":"insider","chains":["Bitcoin","Ethereum"],"usd":95000000.0,"lo":95000000.0,"hi":95000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/finiko-collapses"}],"headline":true},{"id":"htf02553362b","date":"2021-07-28","name":"Levyathan","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/levyathan-rekt"},{"s":"SlowMist Hacked","u":"https://www.bsc.news/post/levyathan-falls-casualty-to-unlimited-mint-exploit-despite-certik-audit"}],"desc":"Levyathan developers stored private keys with minting capability on GitHub. The attacker used these to pass a timelock transaction on July 28 and execute an ownership transfer on July 30, minting 100 quintillion LEV tokens. The weak timelock controls lacked multisig authorization.","theft":true,"onchain":true},{"id":"ht905ab999c2","date":"2021-07-28","name":"PolyYeld Finance","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Polygon"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f"}],"desc":"On July 28, 2021, PolyYeld Finance was exploited when attackers discovered that the Masterchef contract could not properly handle xYELD's transfer tax reward distribution system. Attackers minted approximately 4.995 billion YELD tokens and converted 4% of them to ~123 ETH (~$250K) before the token crashed 100%.","theft":true},{"id":"ht908476fecb","date":"2021-07-24","name":"THORChain","kind":"phishing","fam":"social","tech":"Phishing attack","target":"Bridge","usd":76000.0,"lo":76000.0,"hi":76000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coinvoice.cn/news_flashes/8328"}],"desc":"THORChain (RUNE), a decentralized cross-chain transaction protocol, claims that hackers airdrop UniH tokens to Ethereum addresses as bait to steal RUNE tokens in users' wallets. Hackers have airdropped UniH tokens with malicious contracts to at least 76,000 Ethereum addresses. Once receiving users sell their newly received UniH tokens (or even just approve the sale) on decentralized trading platforms such as Uniswap, the hackers will They can steal any RUNE tokens they have in their wallets. This is because the RUNE token uses a non-standard token contract called \"tx.origin\". According to Thorchain’s RUNE token contract code “Beware of phishing contracts that may steal tokens by intercepting tx.origin”, it knows that this type of attack may occur. In just a few hours, hackers have stolen USD 76,000 worth of tokens. currency.","theft":true},{"id":"htbb1930f7ac","date":"2021-07-23","name":"An attacker steals coins by giving out coins of their own","kind":"hack","fam":"other","usd":76000.0,"lo":76000.0,"hi":76000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-steals-coins-by-giving-out-coins-of-their-own"}],"theft":true,"headline":true},{"id":"ht5445c855d4","date":"2021-07-22","name":"THORChain DEX","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":8000000.0,"lo":8000000.0,"hi":8000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/thorchain-rekt2"},{"s":"SlowMist Hacked","u":"https://twitter.com/THORChain/status/1418360743523618825"}],"desc":"On July 23, 2021, THORChain's ETH Router was exploited when an attacker deployed a custom contract to trick Bifrost Protocol into accepting fake asset deposits, triggering refunds of real assets. The attacker limited impact and requested a 10% bug bounty, suggesting a white-hat teaching lesson.","theft":true},{"id":"hta70be1e9a2","date":"2021-07-21","name":"Sanshu Inu","kind":"hack","fam":"code","tech":"Reward Mechanism Flaw","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocksecteam.medium.com/the-analysis-of-the-sanshu-inu-security-incident-28c0c7c0e783"}],"desc":"Using the mechanism of deflation token KEANU to attack the reward vulnerabilities in the Memestake contract deployed by Sanshu Inu, the attacker finally made a profit of about 56 ETH.","theft":true},{"id":"ht9e528a0a7a","date":"2021-07-19","name":"Array Finance","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocksecteam.medium.com/the-analysis-of-the-array-finance-security-incident-bcab555326c1"}],"desc":"The DeFi project Array Finance was attacked by a lightning loan. The attacker used Array Finance's pricing mechanism to rely on aBPT's totalSupply to attack Array Finance. Officials stated that the attacker made a profit of about 272.94 ETH, worth about $515,000.","theft":true},{"id":"htc08c15c2f8","date":"2021-07-16","name":"Bunny","kind":"hack","fam":"code","tech":"Unbacked Mint","target":"DeFi Protocol","chains":["BNB Chain","Polygon"],"usd":2400000.0,"lo":2400000.0,"hi":2402462.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/pancakebunny2-rekt"},{"s":"SlowMist Hacked","u":"https://pancakebunny.medium.com/polybunny-post-mortem-compensation-42b5c35ce957"}],"desc":"On July 16, 2021, attacker minted 2.1M unbacked polyBUNNY tokens via QuickSwap price manipulation on Polygon. The token crashed 82% ($10 to $2), causing $2.4M loss. Bunny compensated users with $2.4M in MND tokens.","theft":true},{"id":"ht50fde567b3","date":"2021-07-15","name":"Bondly","kind":"hack","fam":"social","tech":"Phishing","target":"DeFi Protocol","chains":["Ethereum","Polkadot"],"usd":5900000.0,"lo":5900000.0,"hi":5900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bondly-rekt"},{"s":"SlowMist Hacked","u":"https://bondlyfinance.medium.com/bondly-attack-july-14th-2021-postmortem-beb7cf02e9ba"}],"desc":"Bondly's CEO was phished for admin credentials, allowing the attacker to mint 373M BONDLY tokens and crash the price 82% by dumping on liquidity pools.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht0111111548","date":"2021-07-15","name":"THORChain DEX","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":5000000.0,"lo":5000000.0,"hi":7600000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/thorchain-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/THORChain/status/1415813696857591813"}],"desc":"On July 16, 2021, an attacker exploited an override function in THORChain's Bifrost bridge, wrapping the router contract to repeatedly extract value from liquidity pools by manipulating reported deposit amounts, draining approximately $4.9-7.4 million.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"htbdd94bee37","date":"2021-07-15","name":"T-Mobile","kind":"hack","fam":"other","tech":"SIM Card Attack","usd":55000.0,"lo":55000.0,"hi":55000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/07/15/another-bitcoin-investor-sues-t-mobile-over-sim-swap-attack/"}],"desc":"Mobile phone operator T-Mobile filed a lawsuit for failing to prevent the SIM exchange scam, which cost a customer $55,000 in Bitcoin. The plaintiff Richard Harris accused T-Mobile of improper behavior, including failing to adequately protect customer information, hiring appropriate support personnel, and violating federal and state laws that caused him to lose 1.63 bitcoins.","theft":true},{"id":"ht339f6c31d5","date":"2021-07-14","name":"ApeRocket","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1260000.0,"lo":1260000.0,"hi":1260000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://aperocket.medium.com/moving-forward-24b9ae22c428"}],"desc":"On July 14, 2021 ApeRocket (DeFi yield farming aggregator) suffered two coordinated flashloan attacks on BSC and Polygon within hours when attackers borrowed massive amounts of AAVE and CAKE (representing >99% of vault holdings), deposited them to inflate share counts, and dumped minted SPACE tokens for profit, causing SPACE to crash 63% because reward calculation lacked flashloan protection.","theft":true},{"id":"ht81cafae89a","date":"2021-07-14","name":"Rabbit Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/@anonymousdev84728/rug-pull-warning-rabbit-finance-ca14a75bc3ec"}],"desc":"Medium user Anonymous Dev published an article stating that there are a large number of loopholes in the BSC ecological Rabbit Finance code, which may be suspected of running away. The vulnerabilities include: 1. The total supply of tokens RABBIT is not the hard cap of 203,000,000 as the team claims; 2. The owner of Rabbit's FairLaunch can issue unlimited RABBIT tokens at any time; 3. 100% of the positions can be liquidated at any time and funds It can be stolen at any time, and there is no maximum limit on the configurable protocol parameters; 4. All funds on the platform may be stolen, and Rabbit’s EOA account can be upgraded to execute the contract at any time. The official did not respond to this matter. Although the Rabbit team did not explain why the vulnerabilities existed, or outright pleaded guilty, the Rabbit team was forced to at least add some restrictions to these security risks through a 24-hour Timelock.","theft":true},{"id":"ht6610351d52","date":"2021-07-14","name":"pSPACE","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["Polygon"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/peckshield/status/1415231793020628992"}],"desc":"The Polygon Space Token (pSPACE) of the Polygon platform suffered a lightning loan attack. It is reported that this is a profit-inflation bug.","theft":true},{"id":"htf100b0d356","date":"2021-07-13","name":"DeFiPie","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":124999.0,"lo":124999.0,"hi":124999.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/defipie/hacking-investigation-85e07454f1c9"}],"desc":"On July 12-13, 2021, DeFiPie (now pieLABS) was exploited via a reentrancy vulnerability combined with an overborrowing flaw. The attacker created a malicious token contract with a modified transfer function and used reentrancy in the doTransferOut function to borrow more than their collateral, extracting approximately $125K in liquidity.","theft":true},{"id":"htb9111570b3","date":"2021-07-13","name":"Axie Infinity","kind":"hack","fam":"keys","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/AxieInfinity/status/1414892981883006977"}],"desc":"The NFT project Axie Infinity tweeted that its market platform was attacked by DDoS and that someone was sending spam to its server in an attempt to make it unusable. Officials say the funds are currently safe.","theft":true},{"id":"htee3bd6abd4","date":"2021-07-12","name":"helios","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Polygon"],"usd":1446704.0,"lo":1446704.0,"hi":1446704.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://rugdoc.io/project/helios-cash/"}],"desc":"DeFi project helios on Polygon rug pull. ([address])","theft":true},{"id":"ht7498db328e","date":"2021-07-11","name":"DAFI Protocol","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DafiProtocol/status/1414031232137052163"}],"desc":"According to official sources, DAFI Protocol, an on-chain incentive protocol, stated that DAFI worth 200,000 US dollars was sold due to the “cross-chain asset bridge ChainSwap attack”. DAFI Protocol requests the community to withdraw liquidity from Uniswap and LP plans until further notice. DAFI Protocol added that the DAFI token contract and Super Staking are safe.","theft":true},{"id":"ht0c17f9b28b","date":"2021-07-11","name":"Dora Factory","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Polkadot"],"usd":42373.0,"lo":42373.0,"hi":42373.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DoraFactory/status/1414158149615964160"}],"desc":"According to official sources, Dora Factory, a multi-chain service infrastructure based on Polkadot, suffered a contract vulnerability in the cross-chain asset bridge ChainSwap. The 7,872 DORA locked in the ChainSwap cross-chain bridge contract was taken out by hackers and sold through Uniswap.","theft":true},{"id":"htd655cc8d09","date":"2021-07-11","name":"DAO ventures","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/VenturesDao/status/1414536764941914119"}],"desc":"According to official sources, the DeFi asset management platform DAO ventures was stolen 300,000 DVG tokens due to a loophole in the ChainSwap contract of the cross-chain asset bridge. DAOventures stated that it has taken snapshots of DVG holders and LPs before the attack, and stated that it will compensate the affected token holders. The DAOventures team stated that the user's assets in DAOventures are safe. Before the compensation plan is announced, DAOventures reminds users not to purchase the DVG of the transaction for the time being and pay attention to the latest developments of the team.","theft":true},{"id":"ht042e0f9885","date":"2021-07-11","name":"OptionRoom","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Polkadot"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/option_room/status/1414006279778054144"}],"desc":"According to official news, Polkadot's ecological oracle and prediction protocol OptionRoom stated that it was affected by the \"cross-chain asset bridge ChainSwap attack\", and many projects including OptionRoom were affected by the hacker attack. Hackers can obtain 2.3 million ROOM tokens on Ethereum and 10 million ROOM tokens on BSC. OptionRoom noticed the hacking before the hackers sold any tokens and decided to remove liquidity from Uniswap and Pancakeswap to protect token holders and liquidity providers from being sold to the liquidity pool by hackers. By selling the deployer's tokens to the Uniswap pool, OptionRoom was able to recover $342,117. In this way, OptionRoom successfully extracted liquidity on behalf of the liquidity provider of the project. The recovered amount will be allocated according to the share of the liquidity provider.","theft":true},{"id":"ht533a6a772b","date":"2021-07-11","name":"Umbrella Network","kind":"hack","fam":"bridge","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/UmbNetwork/status/1414073273495687171"}],"desc":"According to official sources, the DeFi oracle Umbrella Network was stolen over 3 million UMB tokens due to a loophole in the ChainSwap contract of the cross-chain asset bridge.","theft":true},{"id":"htf7c1c4b5c8","date":"2021-07-10","name":"Multichain","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"CEX","chains":["Ethereum","BNB Chain","Fantom"],"usd":7900000.0,"lo":7870000.0,"hi":7900000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/anyswap-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/multichainorg/anyswap-multichain-router-v3-exploit-statement-6833f1b7e6fb"}],"desc":"On July 10, 2021, Anyswap/Multichain bridge was exploited when an attacker identified two V3 router transactions with identical ECDSA R values. This signature collision enabled reverse-calculation of the MPC private key, allowing unauthorized extraction of ~$7.8M across Ethereum, BSC, and Fantom.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht9fcb9cf944","date":"2021-07-10","name":"ChainSwap Bridge","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":4400000.0,"lo":4000000.0,"hi":4400000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/chainswap-rekt"},{"s":"SlowMist Hacked","u":"https://chain-swap.medium.com/chainswap-exploit-11-july-2021-post-mortem-6e4e346e5a32"}],"desc":"On July 11, 2021, ChainSwap bridge was exploited when attackers identified a logical flaw in the cross-chain quota code. The vulnerability allowed invalid, non-whitelisted addresses to bypass authorization and increase the on-chain bridge quota. Attackers minted new tokens for multiple protocols and stole approximately $4.4 million across Ethereum and BSC, affecting Wilder World, Antimatter, Optionroom, and others.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht1a10f17ad4","date":"2021-07-09","name":"Circle","kind":"fraud","fam":"insider","tech":"Scam","usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/business/2021/07/08/circle-says-it-lost-2m-to-email-fraudsters-in-june/"}],"desc":"Circle Internet Financial, the issuer of the US dollar stable currency USDC, reported in a regulatory filing with the US Securities and Exchange Commission (SEC) that Circle Internet Financial lost US$2 million in email fraud last month. Circle stated that the email fraud incident did not affect customer funds and accounts, Circle's information system is still safe, and the US$2 million is the company's own funds."},{"id":"ht5b9e457912","date":"2021-07-09","name":"Android application","kind":"fraud","fam":"insider","tech":"Scam","usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.lookout.com/lookout-unearths-android-crypto-mining-scams?utm_source=PR&utm_medium=WEB&utm_campaign=WW-US-MU-MU-MU-P_NON_CryptoScams"}],"desc":"Lookout Threat Lab security researchers exposed more than 170 Android applications, and the number of deceived users exceeded 93,000. Among them, 25 applications managed to evade the Google Play Store detection and successfully launched, but this is mainly because they do not involve any malicious operations, and may even be purely to fool users. Lookout security researchers pointed out that these counterfeit applications belong to the BitScam and CouldScam series respectively, claiming to provide cloud-based cryptocurrency mining services that can aggregate the computing power of users' mobile devices and share mining revenue. These apps are not free, and various additional payment excuses such as subscriptions and upgrades will be made. Prices range from 12.99 to 259.99 US dollars, and cryptocurrencies such as BTC or ETH are accepted as payment methods. LookoutThreatLab estimates that these malware creators defrauded 300,000 U.S. dollars through illegal sales and 50,000 U.S. dollars in cryptocurrency through fake payments and upgrade services."},{"id":"hte55e748057","date":"2021-07-06","name":"Bitcoin.org","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/07/06/bitcoinorg-hit-with-ddos-attack-bitcoin-demanded-as-ransom/"}],"desc":"Cobra, the anonymous creator and principal of Bitcoin.org, tweeted that the Bitcoin.org website is being subjected to an \"absolutely large-scale\" distributed denial of service (DDoS) attack, as well as a Bitcoin ransom demand. Currently Bitcoin.org is accessible.","theft":true},{"id":"ht9cfbb55d77","date":"2021-07-04","name":"RAI Finance","kind":"hack","fam":"bridge","tech":"Affected by ChainSwap Attack","chains":["Polkadot"],"usd":414013.0,"lo":414013.0,"hi":414013.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/rai-finance/hacker-has-returned-part-of-the-rai-stolen-due-to-a-loophole-in-the-chainswap-contract-9b1161eafc51"}],"desc":"RAI Finance, a cross-chain transaction protocol based on the Polkadot blockchain, issued a post stating that due to the vulnerability of the ChainSwap smart contract, the RAI access and payment permission addresses connected to it were also hacked and stolen. The total amount of stolen RAI in the account reached 2.9 million. On July 5, Rai Finance tweeted that after investigation by the team, hackers had returned 2.2 million RAIs to ChainSwap Deployer. The total loss caused by this incident was reduced to 670,000 RAI.","theft":true},{"id":"ht5db43772dd","date":"2021-07-04","name":"Saudi Aramco","kind":"hack","fam":"code","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.thetechherald.com/tech-news/saudi-aramco-data-breach-not-a-ransomware-attack-zerox-group-used-0day-exploit-on-third-party-servers-to-grab-"}],"desc":"A blackmailer with an ID of ZeroX is suspected of using a 0day vulnerability attack to steal 1TB of Saudi Aramco's corporate data resources. According to the ID's post on the dark web forum, the data leaked this time involves the complete information of 14,254 employees, internal analysis reports, pricing tables, refinery locations, enterprise-related system project specifications, and the most important customer data, etc. Sensitive information, the earliest data range can be traced back to 1993, spanning 28 years. The blackmailer gave Saudi Aramco a validity period of 662 hours (approximately 28 days) and demanded to pay 50 million U.S. dollars in Monero or sell it for 5 million U.S. dollars. This has also become a large-scale data breach after Saudi Aramco was hacked in 2012, 35,000 computers were affected, and 75% of the company’s computer data was deleted.","theft":true},{"id":"ht41220b4fd4","date":"2021-07-03","name":"Haven Protocol","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Haven"],"usd":8187000.0,"lo":8186549.0,"hi":8187000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://havenprotocol.medium.com/haven-protocol-technical-overview-of-june-2021-exploits-6f4573fbf216"}],"desc":"Beginning June 22, 2021, Haven Protocol was exploited through multiple vulnerabilities including miner reward validation bypass, xJPY to xBTC conversion exploitation, and hidden burn/mint amount bugs. An unknown quantity of XHV tokens were minted before the network rolled back to pre-attack state on July 20 via hard fork.","theft":true},{"id":"hta301dc2667","date":"2021-07-03","name":"ChainSwap","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":800000.0,"lo":800000.0,"hi":800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://chain-swap.medium.com/chainswap-post-mortem-and-compensation-plan-90cad50898ab"}],"desc":"On July 2, 2021, ChainSwap, an Ethereum-BSC bridge protocol, was exploited via a bridge logic flaw where attackers bypassed signature verification by exploiting incorrect authQuotaOf implementation, allowing them to mint tokens across multiple protocols using the bridge and steal approximately $800K.","theft":true,"onchain":true},{"id":"ht654c765415","date":"2021-07-03","name":"DEXTools","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DEXToolsApp/status/1411260068079845381"}],"desc":"The DEX trading tool DEXTools (DEXT) tweeted that it was recently hacked and affected some DEXT holders.","theft":true},{"id":"htbee55eeebc","date":"2021-07-02","name":"XDX Swap","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Huobi Eco Chain","HECO"],"usd":176000.0,"lo":176000.0,"hi":176000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/newsflash/p-507462.html"}],"desc":"On July 2, 2021, XDX Swap on the HECO chain was exploited via a suspected backdoor in the cross-chain decentralized exchange code, allowing an attacker to extract approximately $176K (85.17 ETH). Most funds were subsequently recovered with support from Star Labs and the HECO White Hat Security Alliance.","theft":true},{"id":"htd6c2f224b2","date":"2021-06-29","name":"THORChain DEX","kind":"hack","fam":"bridge","tech":"Bridge Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":350000.0,"lo":140000.0,"hi":350000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/THORChain/status/1409637636638011395"}],"desc":"On June 29, 2021, THORChain was exploited via a same-symbol deposit flaw where ERC20 tokens with the 'ETH' symbol were incorrectly identified as genuine ETH, allowing attackers to exchange fake ETH for other tokens and steal approximately $350K. This was the first of three consecutive attacks on THORChain.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht8d660e0bb7","date":"2021-06-29","name":"Merlin","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":330000.0,"lo":300000.0,"hi":330000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/merlin3-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/RugDocIO/status/1409821481941540866"}],"desc":"Merlin was exploited for $330K when an attacker deployed a fake Alpaca-BNB vault and sent 1000 BNB to trick the contract into inflating reward calculations.","theft":true},{"id":"ht14a327ccf2","date":"2021-06-28","name":"Vitae","kind":"fraud","fam":"insider","tech":"Scam","usd":1119810.0,"lo":1119810.0,"hi":1119810.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptoadventure.com/vitae-coin-founders-arrested-over-alleged-crypto-scam/"}],"desc":"European Union legal body Europol has cracked down on the Belgian Ponzi scheme Vitae. Europol raided 17 locations associated with the site, which were advertised as social media sites with their own cryptocurrencies, confiscating German currency and luxury cars totalling over 1 million euros. The company operates in Switzerland under the name VITAE AG."},{"id":"ht40a28dec92","date":"2021-06-28","name":"Safe Dollar","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Polygon"],"usd":248000.0,"lo":200000.0,"hi":250000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/safedollar-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/06/28/stablecoin-safedollar-hit-by-cyberattack/"}],"desc":"On June 28, 2021, SafeDollar's staking pool on Polygon was exploited via incompatibility with deflationary tokens. The attacker used flash-loaned PLX to deplete the contract's actual balance to ~2 tokens while maintaining inflated deposit records, causing the reward formula to mint massive SDO amounts. These were sold for ~$248K in USDC and USDT.","theft":true},{"id":"ht1504f6267b","date":"2021-06-25","name":"xWin Finance","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":281599.0,"lo":270000.0,"hi":300000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://peckshield.medium.com/xwin-finance-incident-root-cause-analysis-71d0820e6bc1"}],"desc":"A flashloan attacker exploited invalid slippage control logic in xWin's reward distribution system, which did not properly validate transaction slippage limits. The attacker obtained a flashloan of 76,000 BNB, manipulated the swap price, and extracted 303,998 XWIN tokens by exploiting the broken slippage validation in the _swapBNBToTokens function.","theft":true,"onchain":true},{"id":"hta691274538","date":"2021-06-24","name":"SharedStake","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/immunefi/sharedstake-insider-exploit-postmortem-17fa93d5c90e"}],"desc":"An insider with access to a disclosed timelock vulnerability exploited it to bypass vesting contract protections and withdraw 500K SGT governance tokens. The vulnerability had been identified on April 26 and shared with the team, but the insider used this knowledge to drain locked tokens four times on June 19-23.","theft":true},{"id":"ht3e52af0049","date":"2021-06-23","name":"Africrypt","kind":"scam","fam":"social","tech":"Scam","target":"CEX","usd":2300000000.0,"lo":2300000000.0,"hi":2300000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bloomberg.com/news/articles/2021-06-23/s-african-brothers-vanish-and-so-does-3-6-billion-in-bitcoin"}],"desc":"According to Bloomberg News, the founder of the cryptocurrency investment platform Africrypt lost contact and 69,000 bitcoins (currently valued at approximately US$2.3 billion) on the platform were transferred. At 4 o'clock, Ameer Cajee, chief operating officer of Africrypt, told the client that the platform was hacked and asked them not to report the lost funds to the authorities. The investor has since hired a lawyer to conduct an investigation, but the lawyer has not been able to contact the founder of the company and has notified the South African Criminal Investigation Department. In addition, the lawyer found that funds on the Africrypt platform were transferred from their accounts and customer wallets, and made it untraceable through the Bitcoin mixer.","theft":true,"review":["single source for a loss of $500M or more"]},{"id":"ht7092827db7","date":"2021-06-23","name":"StableMagnet","kind":"rugpull","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["BNB Chain"],"usd":27000000.0,"lo":1750000.0,"hi":27000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/stablemagnet-rekt"},{"s":"SlowMist Hacked","u":"https://www.banklesstimes.com/news/2022/01/30/ethical-hacker-helps-recover-millions-lost-in-stablemagnet-rug-pull/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/stablemagnet-makes-off-with-27-million-in-rug-pull"}],"desc":"StableMagnet team deployed an intentional smart contract backdoor hidden in unverified linked libraries (block explorer gap), enabling them to drain liquidity pools and steal tokens from wallets with active approvals.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht9cc9eddc3a","date":"2021-06-22","name":"Eleven Finance","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":4500000.0,"lo":300000.0,"hi":4500000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/11-rekt"},{"s":"SlowMist Hacked","u":"https://elevenfinance.medium.com/eleven-finance-nrv-vault-exploit-and-loss-of-funds-a-post-mortem-437a79ded743"}],"desc":"On June 22, 2021, Eleven Finance's NRV vaults were drained for $4.5M via a logic flaw in emergencyBurn(). The attacker used flashloans to obtain assets, converted them to Nerve-bridged tokens, and deposited them into MasterMind. The function failed to burn shares, allowing repeated withdrawals from the same position.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht2b3aaccde7","date":"2021-06-21","name":"StakeHound / Fireblocks","kind":"hack","fam":"keys","tech":"Key Brute Forced","target":"DeFi Protocol","chains":["Ethereum"],"usd":72000000.0,"lo":72000000.0,"hi":75000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.calcalistech.com/ctech/articles/0,7340,L-3910671,00.html"}],"desc":"StakeHound's 38,178 ETH became inaccessible when a 3-of-4 threshold signature key backup procedure failed. Fireblocks lost custody of 2 key shards during a machine failure in March 2021, and StakeHound failed to execute disaster recovery or verify the backup through third-party services. The keys became permanently unrecoverable.","theft":true},{"id":"ht7cf967a323","date":"2021-06-21","name":"Impossible Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":500000.0,"lo":245000.0,"hi":500000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://decrypt.co/74105/binance-smart-chain-defi-project-impossible-finance-hacked"}],"desc":"Impossible Finance was attacked via flash loan when an attacker created a fake token (AAA/BBB) to manipulate liquidity pool prices. The attacker extracted 229.84 ETH (~$500K) through multiple swaps at artificial prices.","theft":true,"review":["sources disagree on the loss"]},{"id":"htb8258216b1","date":"2021-06-20","name":"Polydex","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Polygon"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://polydex.medium.com/plx-locker-smart-contract-incident-post-mortem-75342124a3e8"}],"desc":"A reentrancy vulnerability in the PLX Locker smart contract exploiting ERC777 token callbacks allowed an attacker to recursively call withdraw functions and drain 500K worth of assets. The attacker bridged stolen funds to Ethereum before the team could patch the timelock-delayed fix.","theft":true},{"id":"htde9b1c0959","date":"2021-06-19","name":"Visor Finance","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":504845.0,"lo":504845.0,"hi":504845.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://visorfinance.medium.com/visor-beta-incident-report-1b2521b9266"}],"desc":"An attacker compromised a single admin account managing Hypervisor emergency withdraw functions, enabling extraction of 504,845 USD from unpositioned assets awaiting LP placement. The team had not yet migrated to a multisig setup and the attacker lacked full visibility into safeguards, limiting losses. The team restored all withdrawn amounts using treasury funds.","theft":true},{"id":"ht2591504322","date":"2021-06-16","name":"Alchemix V2","kind":"hack","fam":"code","tech":"Borrow Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":6500000.0,"lo":6500000.0,"hi":6530000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/alchemix-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/DefiantNews/status/1405152562110599171"}],"desc":"Alchemix alETH vault exploited via incorrect vault indexing in the deployment script. Wrong index in debt calculations allowed collateral withdrawal without loan repayment.","theft":true},{"id":"htd3dc40bc7e","date":"2021-06-10","name":"JBS","kind":"hack","fam":"other","tech":"Ransomware","usd":11000000.0,"lo":11000000.0,"hi":11000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.wsj.com/articles/jbs-paid-11-million-to-resolve-ransomware-attack-11623280781"}],"desc":"JBS USA Holdings Inc. paid an $11 million ransom to cybercriminals last week that temporarily destroyed a plant that handles about a fifth of the nation's meat supply, the chief executive said. . Andre Nogueira, CEO of the U.S. division of Brazilian meat company JBS SA, said the bitcoin ransom was to protect the JBS meat plant from further damage and limit the potential impact on restaurants, grocery stores and farmers that depend on JBS.","theft":true},{"id":"htb71f8f0384","date":"2021-06-10","name":"EvoDefi","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@Knownsec_Blockchain_Lab/knownsec-blockchain-lab-evodefi-attack-event-analysis-e1cba8a789ce"}],"desc":"A design flaw in EvoDefi's MasterChef fork allowed attackers to arbitrage reward distribution by exploiting an incorrect update logic that failed to deduct minted rewards. The vulnerability allowed repeated reward claims without proper accounting.","theft":true},{"id":"ht9adcb76081","date":"2021-06-08","name":"GainSwap","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["HECO"],"usd":8000000.0,"lo":8000000.0,"hi":8000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.chaincatcher.com/article/2069096"}],"desc":"At around 4:00 a.m. on June 8, the GainSwap project, which had been online for less than 12 hours, suddenly swept away nearly $8 million in digital assets pledged by users, closed the website access, and then entered a state of losing contact and running away. This is also Heco. One of the projects with the largest amount of running away on the show. In January 2022, according to the public security information of Chizhou City, Anhui Province, the police in Chizhou City recently cracked a case of illegally obtaining virtual currency data from a computer system using blockchain technology, involving a value of about 50 million yuan. After the cooperation of the police in Guangdong, Sichuan and Hunan, all eight suspects were arrested. The police seized and seized the assets involved in the case, such as villas and luxury cars worth tens of millions purchased by the suspect with the full amount of the stolen money, and frozen about 6 million virtual assets.","theft":true},{"id":"hte557a2323d","date":"2021-06-07","name":"88mph","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A critical initialization bug in the 88mph NFT contract allowed anyone to call initialize() multiple times, enabling arbitrary contract owner takeover and unrestricted NFT minting. An attacker could have stolen all underlying assets by minting/burning user NFTs. Reported via Immunefi with $42,069 bounty; 88mph patched within 2 hours.","theft":true},{"id":"ht785d6ce262","date":"2021-06-06","name":"Fetch.ai","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Multiple"],"usd":2600000.0,"lo":2600000.0,"hi":2600000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.reuters.com/technology/london-court-orders-binance-trace-cryptocurrency-hackers-2021-08-13/"}],"desc":"Unknown fraudsters gained access to Fetch.ai's Binance account and sold FET tokens at significantly reduced prices to associated entities for profitable resale. On June 6, 2021, approximately 2.6M USD worth of tokens were extracted. Fetch.ai successfully obtained a London High Court order requiring Binance to trace and freeze the attacker's accounts.","theft":true,"review":["sources disagree on the date"]},{"id":"ht79f06be0db","date":"2021-06-05","name":"PolyButterfly","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Polygon"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://u.today/beware-polygon-matic-flooded-with-rug-pulls"}],"desc":"On June 5, 2021, PolyButterfly, a decentralized financial protocol based on Polygon, disappeared. Its website has been closed, and its Twitter account and Telegram chat history have been deleted. Before this mysterious disappearance, it was revealed that the PolyButterfly code had a dangerous backdoor that allowed the product team to remove customer liquidity. According to RugDoc, the scammers stole more than 600 ether, or more than $1,500,000.","theft":true},{"id":"ht65be8aff4a","date":"2021-06-05","name":"BurgerSwap","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/P771680.html"}],"desc":"BurgerSwap, an automated market maker on the Binance Smart Chain, was once again attacked by lightning loans. The attacker took advantage of the re-entry vulnerability in the contract, repeated the swap operation many times, controlled the price through re-entry and counterfeit currency, and finally realized the purpose of attack arbitrage.","theft":true},{"id":"ht3430230e8b","date":"2021-06-05","name":"Sia","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/siastats/status/1401198314159280129"}],"desc":"Siastats tweeted that the Sia network, a decentralized storage project, has been under continuous DDoS attacks in the past two days. The targets of the attacks are network hosts and storage providers. The attacks have caused about 30% of host connections to be interrupted. Siastats stated that network functions were not affected. Only some of the host operators indicated that the Internet connection was interrupted. The affected operators can contact the Sia Foundation to mitigate the negative impact of the attack. The attack did not cause huge losses, and the network will continue to operate normally.","theft":true},{"id":"htb69bfe3ec2","date":"2021-06-03","name":"Hunny Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://watchpug.medium.com/pancakehunny-performance-fee-minting-attack-analysis-e347d12bfdde"}],"desc":"An incorrect calculation in the Hunny Minter contract allowed an attacker to execute a malicious contract 91 times, locking 1.1M in tokens via incorrect accounting logic. While the team disputed token theft, significant value was locked and dumped to markets.","theft":true,"onchain":true},{"id":"ht843968b133","date":"2021-05-29","name":"Belt Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":6300000.0,"lo":6200000.0,"hi":6300000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/belt-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/Mudit__Gupta/status/1398885049987043329"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-nets-6-3-million-in-belt-finance-exploit"}],"desc":"Belt Finance on BSC lost $6.3M on May 29, 2021 to a flash loan exploit. Attacker used flash loans to deposit into undersubscribed strategies and manipulate pool ratios, exploiting faulty vault-share valuation that assumed strategies remained balanced.","theft":true},{"id":"htf9caa0f631","date":"2021-05-27","name":"BurgerSwap","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["BNB Chain"],"usd":7200000.0,"lo":7000000.0,"hi":7200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/burgerswap-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/burger_swap/status/1398161871778115586"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/trivial-bug-costs-burgerswap-7-2-million"}],"desc":"BurgerSwap exploited May 28, 2021 for $7.2M in BURGER, WBNB, and USDC. Missing code line in Uniswap V2 fork enabled reentrancy. Attacker created a fake token to manipulate price, then executed profitable swaps funded by a PancakeSwap flashloan.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht4f66da3765","date":"2021-05-27","name":"JulSwap","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["BNB Chain"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/tg_cryptos/status/1398090345368408064"}],"desc":"The JulSwap of the DEX protocol and the automated liquidity protocol on the BSC chain was attacked by lightning loans, and $JULB fell more than 95% in a short time.","theft":true,"onchain":true},{"id":"ht9d444fd3b6","date":"2021-05-26","name":"Merlin","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":680000.0,"lo":680000.0,"hi":6800000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/merlin2-rekt"},{"s":"SlowMist Hacked","u":"https://rekt.news/merlinlabs-rekt/"}],"desc":"On May 26, 2021, Merlin Lab (PancakeBunny fork) was exploited for ~$680K via reward calculation flaw. Attacker deposited small amount, sent 180 CAKE to LINK-BNB vault, exploited getReward() function that calculated rewards from contract balance rather than user deposit, and repeated process 36 times. Second $550K attack followed 8 hours later.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht95d3975948","date":"2021-05-26","name":"Merlin","kind":"hack","fam":"code","tech":"Rounding Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":550000.0,"lo":550000.0,"hi":550000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/merlinlabs-rekt"}],"desc":"Merlin Labs (PancakeBunny fork) suffered a second exploit 8 hours after the first on May 26, 2021, draining ~$550K. The priceCalculator had critical math errors in share price computation that allowed attackers to manipulate prices and drain funds.","theft":true},{"id":"hte0f9ba3c2a","date":"2021-05-24","name":"AutoShark","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":822800.0,"lo":750000.0,"hi":822800.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/autoshark-rekt"},{"s":"SlowMist Hacked","u":"https://rekt.news/autoshark-rekt/"}],"desc":"In May 2021, AutoShark Finance on BSC was exploited for ~$822,800 via flashloan attack. The attacker flash-loaned BNB to manipulate the SHARK-BNB pool, donated tokens directly into SharkMinter to inflate reward calculations, and dumped newly minted SHARK through 1inch and AnySwap.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht64c888a092","date":"2021-05-23","name":"DeFi100","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"usd":32000000.0,"lo":32000000.0,"hi":32000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.republicworld.com/technology-news/other-tech-news/defi100-coin-scam-defi100-creators-rug-pull-investors-disappear-with-32-dollars-million."},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/defi100-rug-pull-or-simple-website-defacement"}],"desc":"The official website of the DeFi protocol DeFi100 on Binance Smart Chain (BSC) is no longer accessible. Previously, Twitter user \"Mr. Whale\" pointed out that the project may be a scam. \"About 32 million US dollars of user funds were swept away by the team. road\". About 10 hours ago, the words \"We lied to you, you can't do anything with us\" appeared on the DeFi100 official website, and the page was subsequently deleted. The DeFi100 project website was no longer accessible. It is not yet certain whether the website was hacked or the project team itself Close the website. DeFi100 is a decentralized flexible synthetic asset index product on the Binance Smart Chain, developed by an anonymous team.","theft":true},{"id":"ht440a3ae15b","date":"2021-05-23","name":"Bogged Finance","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://boggedfinance.medium.com/bog-flash-loan-attack-what-happened-and-whats-next-token-migration-192a9d96b9b7"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attackers-drain-3-million-from-bog-liquidity-pool"}],"desc":"A flashloan attacker exploited a bug in Bogged's deflationary token _txBurn() method, which charged only 1% instead of the intended 5% fee per transfer. This allowed the attacker to manipulate self-transfers to inflate staking reward calculations and mint 15M BOG tokens. The token crashed 98% from $8.50 to $0.15.","theft":true},{"id":"ht683295a0f7","date":"2021-05-19","name":"Bunny","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":45000000.0,"lo":45000000.0,"hi":45000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/pancakebunny-rekt"},{"s":"SlowMist Hacked","u":"https://pancakebunny.medium.com/hello-bunny-fam-a7bf0c7a07ba"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/45-million-stolen-from-pancakebunny-finance"}],"desc":"On May 19, 2021, PancakeBunny was exploited via flashloan-enabled oracle manipulation. Attacker manipulated USDT/BNB and BUNNY/BNB exchange rates to mint 7M BUNNY and steal 114,631 WBNB (~$45M), crashing BUNNY price.","theft":true,"onchain":true},{"id":"ht717032fc7f","date":"2021-05-18","name":"Venus Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["BNB Chain"],"usd":100000000.0,"lo":100000000.0,"hi":145000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://quillhashteam.medium.com/200-m-venus-protocol-hack-analysis-b044af76a1ae"}],"desc":"An attacker manipulated XVS spot price via low liquidity on centralized exchanges, driving it from $70 to $143 and back to $76. Using inflated XVS collateral, they borrowed 2,000 BTC and 5,700 ETH. Liquidations cascaded as borrowers defaulted, and Venus absorbed 100M+ USD in bad debt.","theft":true},{"id":"hte9588df83a","date":"2021-05-17","name":"BearnFi","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["BNB Chain"],"usd":18000000.0,"lo":18000000.0,"hi":18000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/bearn-rekt"}],"desc":"BearnFi's BvaultsBank contract interpreted deposit amounts inconsistently between BUSD and ibBUSD. Attackers exploited this via flashloan cycles to inflate withdrawal amounts.","theft":true},{"id":"hta8ad26646d","date":"2021-05-17","name":"FinNexus","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":7000000.0,"lo":7000000.0,"hi":7600000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/phoenix-finance/finnexus-statement-regarding-the-may-2021-hack-d69e1b7617dc"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/finnexus-hacked-for-7-6-million-in-likely-inside-job"}],"desc":"The private key to the FinNexus contract deployer account was compromised, allowing the attacker to assume contract ownership. The attacker minted 323M FNX on Ethereum (~$6M) and 60M FNX on BSC (~$1.6M), then immediately dumped tokens on markets. FNX price collapsed from $0.356 to $0.0272 (92% decline).","theft":true},{"id":"ht590418c148","date":"2021-05-16","name":"bEarn Fi","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["BNB Chain"],"usd":11000000.0,"lo":10850000.0,"hi":11000000.0,"conf":"A","n":3,"src":[{"s":"SlowMist Hacked","u":"https://bearndao.medium.com/bvaults-busd-alpaca-strategy-exploit-post-mortem-and-bearn-s-compensation-plan-b0b38c3b5540"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hacker-drains-10-85-million-from-bearn-fi"}],"desc":"The DeFi protocol bEarnFi stated that on May 16, its bVaults BUSD-Alpaca strategy was attacked, and nearly 10.86 million BUSD in the pool was exhausted. However, the remaining bvault and other pools of the platform are not at risk. At the same time, bEarnFi released a rough compensation plan, which will create a compensation fund, which will consist of the remaining savings funds, development funds, DAO funds, and part of the expenses incurred by the agreement. After that, a snapshot of the balance will be taken to deploy compensation contracts. Affected users will receive an additional 5% of their deposit amount.","theft":true,"onchain":true},{"id":"ht6c1316283f","date":"2021-05-15","name":"Sony Life","kind":"fraud","fam":"insider","tech":"Insider Manipulation","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/us-returns-154-million-in-bitcoins-stolen-by-sony-employee/"}],"desc":"Ishii, an employee of Tokyo Sony Life Insurance Company (\"Sony Life\"), allegedly misappropriated US$154 million when attempting to transfer funds between the company’s financial accounts. According to court documents, Ishii changed the transfer address of a Sony Life transaction to Silvergate bank account that you control. Ishii later converted funds into more than 3879 bitcoins through Coinbase. The Coinbase set up to automatically transfer all added funds to an offline cryptocurrency cold wallet with the bitcoin address [address]. However, on December 1, after cooperating with Japanese law enforcement agencies, the FBI seized 3789.16242937 BTC in Ishii's wallet after obtaining the private key. The Tokyo Metropolitan Police Department arrested the 32-year-old Ishii on the same day and alleged In mid-May, he was charged with a fraudulent remittance of 154 million U.S. dollars."},{"id":"ht7c4af3da36","date":"2021-05-14","name":"flash.sx / vaults.sx","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["EOS"],"usd":13000000.0,"lo":11742000.0,"hi":13000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cmichel.io/eos-vault-sx-hack/"}],"desc":"A reentrancy vulnerability in vaults.sx's flashloan contract allowed an attacker to recursively extract 1.18M EOS and 462K USDT. The attacker distributed funds across 246 accounts attempting to evade recovery. EOS BPs froze accounts by supermajority consensus and the attacker was social-engineered into nulling their keys; all users were made whole.","theft":true},{"id":"ht9305a95839","date":"2021-05-13","name":"xToken","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"usd":25000000.0,"lo":25000000.0,"hi":25000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/FrankResearcher/status/1392515198674681863"}],"desc":"The DeFi pledge and liquidity strategy platform xToken was attacked, and the xBNTaBancor pool and the xSNXaBalancer pool were immediately exhausted, causing nearly $25 million in losses. The SlowMist security team analyzed that the two modules that were hacked this time were the xBNTa contract and the xSNXa contract in xToken. The two contracts were subjected to a \"counterfeit currency\" attack and an oracle manipulation attack.","theft":true},{"id":"ht7ffcd45b6b","date":"2021-05-12","name":"$24.5 million emptied from xToken platform","kind":"hack","fam":"other","usd":24500000.0,"lo":24500000.0,"hi":24500000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/24-5-million-emptied-from-xtoken-platform"}],"theft":true,"headline":true},{"id":"ht9eb3a49434","date":"2021-05-12","name":"Xtoken","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":24000000.0,"lo":24000000.0,"hi":24000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/xtoken-rekt"}],"desc":"On May 12, 2021, xToken was exploited when an attacker used an $81M flash loan (61,800 ETH) from dYdX to manipulate Kyber Network's oracle, enabling minting of xSNXa tokens at manipulated prices for ETH and SNX. The xBNTa contract had an additional flaw allowing minting with any token, not just BNT.","theft":true},{"id":"ht1239db633e","date":"2021-05-09","name":"Rari Capital","kind":"hack","fam":"code","tech":"Arbitrary External Call","target":"DeFi Protocol","chains":["Ethereum"],"usd":14000000.0,"lo":10000000.0,"hi":15000000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/rari-capital-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/rari-capital/5-8-2021-rari-ethereum-pool-post-mortem-60aab6a6f8f9"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/rari-capital-exploit"}],"desc":"On May 8, 2021, attacker exploited Rari's ibETH integration; using dYdX flashloan and ibETH.work's arbitrary call capability, attacker artificially inflated ibETH.totalETH() to withdraw more ETH than deposited, draining ~$11M from Rari's Ethereum Pool.","theft":true},{"id":"htf76aa46f12","date":"2021-05-07","name":"ValueDefi","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":11000000.0,"lo":10000000.0,"hi":11000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/value-rekt3"},{"s":"SlowMist Hacked","u":"http://www.togater.com/584.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/value-defi-hacked-for-third-time-in-six-months"}],"desc":"ValueDefi custom-weighted pools drained on May 7, 2021. Uninitialized contracts lacked the 'initialized = true' flag, allowing attacker to re-initialize, set themselves as operator/owner, and drain vBWAP/BUSD LP tokens via governanceRecoverUnsupported().","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"htb15d672481","date":"2021-05-07","name":"Colonial Pipeline","kind":"hack","fam":"keys","tech":"Ransomware","usd":2700000.0,"lo":2700000.0,"hi":2700000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_attack"}],"desc":"On May 7, 2021, Colonial Pipeline, the largest oil and gas pipeline operator in the United States, was targeted by a ransomware attack. The ransomware attack involved national critical infrastructure, which caused global shock and widespread concern. Was blackmailed to pay 5 million U.S. dollars worth of Bitcoin. Court documents show that the government recovered 63.7 bitcoins ($2.3 million).","theft":true},{"id":"ht2a68215649","date":"2021-05-06","name":"Hpool","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.huoxing24.com/flash/20210506151318337250.html"}],"desc":"In response to users reporting that the official website of Hpool could not be opened, Hpool officially responded that the front end of the official website was attacked by DDOS.","theft":true},{"id":"ht0b0fe94bf6","date":"2021-05-05","name":"ValueDefi","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":10000000.0,"lo":5817780.0,"hi":10000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/value-rekt2"},{"s":"SlowMist Hacked","u":"https://medium.com/valuedefi/vstake-pool-incident-post-mortem-4550407c9714"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/value-defi-hacked-for-second-time-in-six-months"}],"desc":"ValueDefi's vSwap pool on BSC was exploited via reinitialization vulnerability in access control. Attacker re-initialized pool, set themselves as operator, called governanceRecoverUnsupported() to drain 10,839.16 vBWAP/BUSD LP tokens and associated collateral.","theft":true,"review":["possible duplicate within one source","sources disagree on the loss"]},{"id":"ht1a28ff0351","date":"2021-05-04","name":"Mask Network","kind":"hack","fam":"code","tech":"Robot attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.8btc.com/article/6630371"}],"desc":"The Mask Network official stated that the contract address of the second round of ITO was attacked by robots, and the address has been officially blacklisted.","theft":true},{"id":"htdbbb758fd7","date":"2021-05-02","name":"Spartan","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["BNB Chain"],"usd":30000000.0,"lo":30000000.0,"hi":30500000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/spartan-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/05/02/binance-smart-chains-spartan-protocol-loses-30m-in-exploit/"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-steals-30-million-from-spartan-protocol"}],"desc":"On May 1, 2021, Spartan Protocol on BSC suffered the first flashloan attack on the chain, losing $30M. An attacker obtained a 100k WBNB flashloan, inflated the liquidity pool's asset balance through multiple transactions, then burned pool tokens to withdraw an unfair share because the contract checked current balance instead of cached balance.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht893eda5c60","date":"2021-05-02","name":"Fei Protocol","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/zh-tw/flash/id-89290"}],"desc":"Fei Labs, the development team of the decentralized stablecoin project Fei Protocol, tweeted that a vulnerability involving the ETH joint curve contract was discovered and disclosed on May 2 and the contract was immediately suspended. The vulnerability has not been exploited and will not affect any users. . This loophole will cause the flash loan market manipulation to exhaust Fei Protocol's Protocol Control Fund (PCV). In addition, Fei Protocol awarded the vulnerability discoverer Alexander Schlindwein a $800,000 TRIBE token reward. Currently, OpenZeppelin and Alexander Schlindwein have assisted in repair review and verification, sending ETH from the joint curve to the reserve stabilizer instead of the ETH-FEI Uniswap pool to eliminate the attack vector, and adding to the pool to prevent malicious arbitrage Other reviews.","theft":true},{"id":"ht9f06b28124","date":"2021-04-29","name":"Hotbit","kind":"hack","fam":"keys","tech":"Network attacks","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/cryptocurrency-exchange-hotbit-hacked-2-million-users/"}],"desc":"Hotbit said that it suffered a serious cyber attack on April 29th, which caused a large number of basic services to be paralyzed. At the same time, the attacker tried to hack into Hotbit's wallet, but this behavior was identified and blocked by the risk control system. Since the attacker could not access any cryptocurrency assets, he deleted Hotbit's database. Hotbit is currently checking the authenticity and security of the backup data, and will restore servers and services later. At the same time, Hotbit claimed that the attackers obtained plaintext customer information stored in the database, including mobile phone numbers, email addresses, and encrypted currency asset data. Therefore, it is recommended that users pay attention to prevent phishing attacks.","theft":true},{"id":"ht9769b609c4","date":"2021-04-28","name":"Uranium Finance","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["BNB Chain"],"usd":50000000.0,"lo":50000000.0,"hi":57200000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/uranium-rekt"},{"s":"SlowMist Hacked","u":"https://c.foresightnews.pro/news/detail/66454"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/uranium-finance-exploited-50-million"}],"desc":"Uranium Finance on BSC suffered a calculation error in its v2 pair swap function. The sanity check validation used an incorrect constant (1,000,000) that was 100x too large compared to actual balance adjustments (10,000), allowing attackers to send minimal value and extract maximum reserves through the swap function.","theft":true,"onchain":true,"review":["possible duplicate within one source"]},{"id":"ht1973f91379","date":"2021-04-24","name":"FTX","kind":"hack","fam":"other","tech":"DDoS Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.szlllz.com/shangye/kuaixun/34586.html"}],"desc":"At 00:35 on April 24th, SBF, the co-founder of the FTX exchange, tweeted that the website suffered a small DDOS attack. User funds and core systems will not be affected, only the throughput of API and GUI will be affected.","theft":true},{"id":"ht33dcdc0975","date":"2021-04-21","name":"Thodex","kind":"rugpull","fam":"insider","tech":"Scam","target":"CEX","chains":["Bitcoin"],"usd":2500000000.0,"lo":2000000000.0,"hi":2500000000.0,"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.theblock.co/post/166475/ceo-of-collapsed-turkish-crypto-exchange-thodex-faces-extradition-from-albania-following-arrest"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/thodex-ceo-takes-2-billion-in-investments"}],"desc":"Six siblings of Turkish exchange Thodex executives and CEO have been formally arrested, a Turkish court said. And Thodex CEO Faruk Fatih Özer disappeared, leaving behind a collapsed exchange with total losses estimated to range from $24 million to $2.5 billion. Faruk was arrested in August more than a year after fleeing Turkey. In September 2023, Faruk and his siblings were sentenced to 11,196 years in prison and will also pay a fine of 135 million lira (approximately $5 million).","theft":true},{"id":"hta1e561dd40","date":"2021-04-19","name":"EasyFi","kind":"hack","fam":"social","tech":"Malware","target":"DeFi Protocol","chains":["Polygon"],"usd":59000000.0,"lo":46900000.0,"hi":80000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/ChainNewscom/status/1384336818959704064"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/80-million-taken-from-easyfi"}],"desc":"On April 19, 2021 an attacker compromised EasyFi CEO Ankitt Gaur's admin machine with malware-tampered MetaMask to exfiltrate admin keys, then transferred 2.98M EASY tokens (~$75M) and drained ~$6M in stablecoins from liquidity pools. The incident was catalogued in Taylor Monahan's Lazarus/BlueNoroff research.","theft":true,"review":["sources disagree on the loss"]},{"id":"hte3f3277178","date":"2021-04-19","name":"Easyfi","kind":"other","fam":"other","usd":6000000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/easyfi-rekt"}]},{"id":"htf7287aea98","date":"2021-04-16","name":"Celsius","kind":"fraud","fam":"insider","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/04/15/celsius-suffers-third-party-data-breach-customers-report-phishing-texts-emails/"}],"desc":"Encrypted lending service Celsius has discovered a data breach in one of its third-party service providers, which has exposed the personal information of its customers. According to the email, the hacker gained access to the \"third-party email distribution system\" used by Celsius. Hackers use this information to send fraudulent emails and text messages to trick them into revealing the private keys of their funds. On April 14, Celsius users started reporting a fraudulent website claiming to be the official Celsius platform. Some users also receive text messages and emails claiming to be Celsius official, can link to the website, and prompt the recipient to enter sensitive information. It is reported that Celsius' competitor BlockFi suffered a similar data breach last spring."},{"id":"ht25bbc81c67","date":"2021-04-13","name":"Africrypt investors disappear with $3.6 billion of investor funds","kind":"fraud","fam":"insider","chains":["Bitcoin"],"usd":3600000000.0,"lo":3600000000.0,"hi":3600000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/africrypt-investors-disappear-with-3-6-billion-of-investor-funds"}],"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"htf1fa713a1b","date":"2021-04-12","name":"PancakeSwap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["BNB Chain"],"usd":1800000.0,"lo":1800000.0,"hi":1800000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cryptopwnage.medium.com/1-800-000-was-stolen-from-binance-smart-chain-pancakeswap-lottery-pool-ca2afb415f9"}],"desc":"An insider with admin lottery access exploited a predictable block-hash-based RNG by orchestrating multiple transactions in the same block with varied gas prices. This allowed manipulation of the random number generator to predict winning tickets and withdraw 59,765 CAKE (~$1.8M) from the lottery prize pool.","theft":true},{"id":"ht240191b353","date":"2021-04-05","name":"Polkatrain","kind":"hack","fam":"code","tech":"Reward Logic Flaw","target":"DeFi Protocol","chains":["Polkadot"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://polkatrain-com.gitbook.io/polkatrian-en/the-response-for-hacker-attack-incident-from-polkatrain-team"}],"desc":"The POLT_LBP contract's rebate mechanism lacked maximum rebate limits or exhaustion checks. An attacker repeatedly called the swap function to extract rebate rewards, draining 57K DOT (~$3M) from the contract. The contract's _update function failed to validate rebate constraints.","theft":true},{"id":"htc9a5fc68b6","date":"2021-04-04","name":"Force DAO","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["Ethereum"],"usd":367000.0,"lo":367000.0,"hi":367000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.forcedao.com/xforce-exploit-post-mortem-7fa9dcba2ac3"}],"desc":"Force DAO was exploited hours after launch when the xFORCE vault contract assumed failed ERC20 transfers would revert. The Aragon Minime token returns false instead, allowing attackers to claim tokens without proper validation and drain ~$367K in FORCE.","theft":true},{"id":"htd7516c116f","date":"2021-04-01","name":"FTX loses $800 million to MobileCoin market manipulation","kind":"hack","fam":"other","usd":800000000.0,"lo":800000000.0,"hi":800000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/ftx-mobilecoin-exploit"}],"theft":true,"headline":true,"review":["single source for a loss of $500M or more"]},{"id":"ht74491b0d60","date":"2021-03-20","name":"Turtle Dex","kind":"rugpull","fam":"insider","tech":"Liquidity Rug","target":"DeFi Protocol","chains":["BNB Chain"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/binance-smart-chain-s-turtledex-rugpulls-shortly-after-launch"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/turtledex-creators-steal-2-5-million"}],"desc":"TurtleDex on BSC executed a coordinated rugpull on March 19-20, 2021 days after raising 9K BNB (~$2.5M). Team drained liquidity from PancakeSwap and Ape Swap pools, converted to ETH, and withdrew via Binance.","theft":true},{"id":"ht371002ed60","date":"2021-03-20","name":"Acer","kind":"hack","fam":"code","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/computer-giant-acer-hit-by-50-million-ransomware-attack/"}],"desc":"Renowned computer maker Acer has been hit by a ransomware gang, REvil, demanding up to $50 million in XMR to decrypt the company's computers and not leak data on the dark web. The ransomware gang announced on their data breach website that they had compromised Acer and shared as evidence some images of allegedly stolen files for files containing financial spreadsheets, bank balances and bank communications .","theft":true},{"id":"htd400f0a2ef","date":"2021-03-18","name":"SIL.Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Sil_Finance/status/1372982093471449096"}],"desc":"DeFi gathers reasonable financial services SIL.Finance contract has high-risk loopholes. Later, SIL.Finance issued an article saying that the incident was caused by a vulnerability in the smart contract permissions, which in turn triggered a general preemptive trading robot to submit a series of transactions for profit. After discovering that the smart contract could not be withdrawn due to high-risk loopholes, after 36 hours of efforts such as SlowMist, it has successfully recovered USD 12.15 million.SIL.Finance stated that if any user assets are damaged in this incident, the team decided to use its own funds to launch a compensation plan: all users who suffered losses will receive 2 times the compensation, which will be issued in SIL.","theft":true},{"id":"ht38967fb66c","date":"2021-03-16","name":"Iron Finance","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Polygon","BNB Chain"],"usd":170000.0,"lo":170000.0,"hi":170000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://ironfinance.medium.com/iron-finance-vfarms-incident-post-mortem-16-march-2021-114e58d1eaac"}],"desc":"Iron Finance lost $170,000 when a ValueDefi error inflated farming reward rates by 365x, allowing attackers to drain all SIL rewards from the IRON/SIL and IRON/BUSD pools.","theft":true},{"id":"ht93c84ac942","date":"2021-03-15","name":"TSD (True Seigniorage Dollar)","kind":"hack","fam":"market","tech":"Malicious Proposal","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"usd":7095000.0,"lo":7095000.0,"hi":7095340.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://tokenpost.com/Stablecoin-TSD-Comes-Under-Attack-With-118B-Coins-Minted-And-Sold-By-Hacker-7404"}],"desc":"An attacker accumulated 33%+ of TSD governance tokens by purchasing at low market prices, then proposed replacement of the token implementation contract with a malicious version via DAO governance vote. The attacker's voting weight passed the proposal, enabling the malicious contract to mint 11.8B TSD and immediately dump on PancakeSwap.","theft":true},{"id":"ht4ca5ca15c0","date":"2021-03-15","name":"DEUS Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Fantom"],"usd":3000000.0,"lo":3000000.0,"hi":3000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"DEUS Finance lost $3M to a flash loan attack that manipulated the USDC/DEI oracle, triggering incorrect liquidations due to insufficient price checks.","theft":true},{"id":"ht2aa9fe5099","date":"2021-03-15","name":"PancakeSwap / Cream Finance","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"DeFi Protocol","chains":["BNB Chain","Ethereum"],"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Both Cream Finance and PancakeSwap had their GoDaddy-hosted DNS records hijacked simultaneously. Attackers redirected users to phishing sites requesting seed phrases and private keys. Both teams regained DNS control within hours on March 15, 2021 (by 17:30 UTC for PancakeSwap).","theft":true},{"id":"ht4760cbe013","date":"2021-03-15","name":"Multiple DeFi protocols","kind":"hack","fam":"keys","tech":"DNS attack","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.sohu.com/a/455998320_100217347"}],"desc":"Many DeFi protocol websites on BSC (Binance Smart Chain) were attacked by DNS, including Cream Finance and BSC header DEX PancakeSwap. The attacker requested users to submit personal private keys or mnemonics through the website. The relevant project team has passed Twitter Remind users not to visit the website and do not submit information such as private keys. Later PancakeSwap and Cream Finance both stated that they had regained access to DNS.","theft":true},{"id":"ht0fa1e0b287","date":"2021-03-14","name":"Roll","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":5700000.0,"lo":5700000.0,"hi":5700000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/roll-rekt"},{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/232964.html"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/roll-hacked-for-5-7-million"}],"desc":"On March 14, 2021, an attacker obtained Roll's hot wallet private key and stole approximately $5.7 million in social tokens (WHALE, RARE, PICA), selling them on Uniswap and laundering proceeds through Tornado Cash.","theft":true},{"id":"hta61cf4a09c","date":"2021-03-10","name":"HSO","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["HECO"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.wu-talk.com/html/kuaixun/2021_1052.html"}],"desc":"The oracle project HSO on the Huobi Eco-Chain HECO carried out IDO and ran away with 30,000 HT. The website and TELEGRAM could not be opened. Later, under the full promotion of HECO core code contribution team Star Lab, HECO technical community and HECO White Hat Security Alliance, 24823 HTs have been recovered.","theft":true},{"id":"ht3ecec2cd2b","date":"2021-03-08","name":"DODO AMM","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":3800000.0,"lo":500000.0,"hi":3800000.0,"ret":1890000.0,"conf":"B","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/au-dodo-rekt"},{"s":"SlowMist Hacked","u":"https://dodoexhelp.zendesk.com/hc/en-us/articles/900004873746--3-1-million-assets-recovered-Crowdpooling-to-be-re-enabled-after-new-audits-next-week"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/hackers-take-3-8-million-from-dodo"}],"desc":"DODO's V2 Crowdpooling contract left init() callable after funding, allowing an attacker to reconfigure pools with worthless tokens and drain the real reserves. Around $3.8M was taken, but $3.1M was returned within a day as MEV bots captured most of the exploit profit.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"ht422fdcfcf9","date":"2021-03-05","name":"CNA","kind":"hack","fam":"other","tech":"Ransomware","usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bloomberg.com/news/articles/2021-05-20/cna-financial-paid-40-million-in-ransom-after-march-cyberattack"}],"desc":"CNA, one of the largest insurance companies in the United States, paid a ransom of US$40 million (approximately 257 million yuan) after being attacked by ransomware in March to regain control of its network. The company has confirmed that an organization named Phoenix is ​​the perpetrator of this attack.","theft":true},{"id":"htf71342227c","date":"2021-03-05","name":"Paid Network","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":27000000.0,"lo":3000000.0,"hi":27000000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/paid-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/attacker-steals-3-million-from-paid-network"}],"desc":"PAID Network's token contract was compromised on March 5, 2021 when an attacker gained access to the deployment wallet's private key. The attacker upgraded the contract to enable unlimited token minting, creating 59.4M unauthorized PAID tokens.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"hta94e0e12a9","date":"2021-03-05","name":"Curve Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/sqarticledetails/230930.html"}],"desc":"Curve Finance tweeted that a vulnerability was found in the Pool Factory v1 version of the fund pool, and it is recommended that v1 users use crv.finance to withdraw funds immediately. Curve.fi and Pool Factory v2 fund pools do not respond. But it only affects the v1 pool, and hackers cannot use it to steal user funds.","theft":true},{"id":"ht51ab589237","date":"2021-03-04","name":"Meerkat Finance","kind":"rugpull","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["BNB Chain"],"usd":31000000.0,"lo":31000000.0,"hi":31000000.0,"ret":31000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/meerkat-finance-bsc-rekt"},{"s":"SlowMist Hacked","u":"https://www.chainbs.com/article/2059798"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/meerkat-defi-team-briefly-rug-pulls"}],"desc":"Meerkat Finance was drained one day after launch on March 4, 2021 when vaults containing $31M were compromised. The attacker exploited permissionless proxy initialization to gain admin control and drain funds, with the team later launching a 95%+ refund program.","theft":true},{"id":"ht632d5783d7","date":"2021-03-01","name":"Seascape","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/229955.html"}],"desc":"An early investor's private key was compromised, allowing an attacker to transfer 18,750 CWS tokens from the investor's wallet. The tokens were immediately liquidated on-chain.","theft":true},{"id":"ht27299ed2ce","date":"2021-03-01","name":"Gab","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2021/03/01/gab-refuge-for-the-deplatformed-hacked-for-pretty-much-everything-including-trump-data/"}],"desc":"The 70 GB data of Gab, a social networking platform that supports Bitcoin, was hacked. Gab has handed over the hacked data to the reporting website Distributed Denial of Secrets. Emma Best, founder of Distributed Denial of Secrets, said that the hacked data included public posts, personal information and passwords, and private account posts and messages.","theft":true},{"id":"ht06d6d37f7f","date":"2021-03-01","name":"Tether","kind":"hack","fam":"other","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/Tether_to/status/1366075544287207430"}],"desc":"Tether officially tweeted that forged documents allegedly \"between Tether personnel and representatives of Deltec Bank & Trust and other institutions\" are circulating online. In addition, Tether officially received a ransom request for sending 500 BTC to [address] today. The sender stated that unless they receive Bitcoin before tomorrow, they will leak documents to the public in order to \"destroy the Bitcoin ecosystem.\" Tether said it will not pay the ransom. And remind customers, employees, and the encryption community to stay vigilant and ensure operational safety. Tether stated that it has reported falsified communications and related ransom demands to law enforcement.","theft":true},{"id":"ht992a4fc195","date":"2021-02-28","name":"Armor","kind":"fraud","fam":"insider","tech":"Scam","chains":["Ethereum"],"usd":850000.0,"lo":850000.0,"hi":850000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.fxfrank.com/blockchain/54243.html"}],"desc":"DeFi Insurance Agreement The Armor team claimed that some team members were scammed by OTC and were defrauded of 1.2 million ARMOR tokens. The scammers have already dumped all tokens for a profit of 600 ETH (approximately US$850,000). The Armor team disclosed that the scammers pretended to be strategic investors on social media, falsely claiming to purchase tokens from the team through OTC, defrauded 1.2 million ARMOR tokens in OTC transactions, and then sold them. According to the Armor team, \"No hacking, the project is still safe.\""},{"id":"ht9a14dc6dac","date":"2021-02-27","name":"Furucombo","kind":"hack","fam":"code","tech":"Delegatecall Hijack","target":"DeFi Protocol","chains":["Ethereum"],"usd":14000000.0,"lo":14000000.0,"hi":15000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/furucombo-rekt"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/transaction-batching-protocol-furucombo-suffers-14-million-evil-contract-hack"}],"desc":"Furucombo exploited February 27, 2021 for ~$14M via delegatecall hijack. Attacker deployed a fraudulent contract impersonating Aave v2 implementation. Furucombo failed to authenticate the target, allowing the attacker to drain pre-approved tokens (3,900+ stETH and USDC) from ~22 users.","theft":true},{"id":"ht8114982b03","date":"2021-02-27","name":"Yeld.finance","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["Ethereum"],"usd":160000.0,"lo":160000.0,"hi":160000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/YeldF/status/1365623299552772096"}],"desc":"The DAI pool of Yeld.finance, the DeFi revenue aggregator, was attacked by a lightning loan, resulting in a loss of 160,000 DAI, involving more than 10 users. Tether, TrueUSD and USDC were not affected. According to reports, Yeld’s problem is consistent with the previous Yearn.Finance DAI pool vulnerability problem. The official also stated that the affected users will be repaid with tokens, which will be rewarded with income from the DAI pool to make up for some of their losses. Later, Yeld.finance officially stated that the 160,000 DAI caused by the lightning loan attack has been returned. This event is suspected to be the work of a white hat, and the official will further update the details.","theft":true},{"id":"ht6efd4f9e46","date":"2021-02-22","name":"Primitive Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://primitivefinance.medium.com/whitehack-by-primitive-finance-most-funds-are-safe-user-action-required-4dd31c387b8"}],"desc":"A serious loophole has been discovered in the Primitive Finance smart contract on the Ethereum chain options agreement. Since the contract cannot be upgraded or suspended, the official chose to hack the smart contract to protect user funds. The hacked funds are safe. All hacked funds will be returned to their owners.","theft":true},{"id":"ht44fb6b3f4e","date":"2021-02-20","name":"Cryptopia","kind":"hack","fam":"other","tech":"Unknown","target":"CEX","usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/troubled-nz-crypto-exchange-cryptopia-suffers-another-hack-in-the-midst-of-liquidation-process/"}],"desc":"According to Stuff.co.nz, hackers took approximately 62,000 New Zealand dollars (45,000 USD) worth of cryptocurrency from the troubled exchange. The investigation revealed that the hacker accessed a dormant wallet that belongs to the US-based blockchain company Stakenet and is controlled by Grant Thornton, the liquidator of Cryptopia. According to the survey results, the dormant wallet holds XSN worth approximately US$1.96 million, which is the native token of Stakenet.","theft":true},{"id":"htbaf7b7366a","date":"2021-02-19","name":"F2Pool","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.wu-talk.com/html/kuaixun/2021_983.html"}],"desc":"F2Pool was attacked by DDos, and some addresses experienced short-term failures, which have been restored.","theft":true},{"id":"htde436b54a3","date":"2021-02-19","name":"UL","kind":"hack","fam":"keys","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/underwriters-laboratories-ul-certification-giant-hit-by-ransomware/"}],"desc":"UL LLC (commonly known as Underwriters Laboratories) suffered a ransomware attack that encrypted its server and caused the server to shut down the system when it recovered. To prevent the attack from spreading further, the company shut down the system so that certain employees could not perform their work. According to sources familiar with the attack, UL decided not to pay the ransom, but to restore from backup.","theft":true},{"id":"htd0e945d87a","date":"2021-02-18","name":"KMA","kind":"hack","fam":"other","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/kia-motors-america-suffers-ransomware-attack-20-million-ransom/"}],"desc":"According to CryptoPotato, the ransomware group DoppelPaymer launched another attack, this time leaking sensitive data of KMA, the North American branch of automaker Kia Motors. Criminals demand Bitcoin to pay the ransom, and the total ransom may be as high as 600 Bitcoins (worth more than 30 million U.S. dollars). KMA stated that the company has experienced “IT outages involving internal, reseller, and customer-facing systems” and stated that it is working to resolve these issues. The ransom note left by the DoppelPaymer ransomware group stated that they had broken into KMA's system.","theft":true},{"id":"hta929bfd67d","date":"2021-02-15","name":"Verge","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/privacy-coin-verge-third-51-attack-200-days-xvg-transactions-erased/"}],"desc":"The privacy coin Verge (XVG) underwent a reorganization of 560,000 blockchains after a 51% attack on Monday. Lucas Nuzzi of CoinMetrics stated that the history of token transactions over 200 days has been deleted.","theft":true},{"id":"ht81eafa96af","date":"2021-02-13","name":"Alpha Finance","kind":"hack","fam":"code","tech":"Borrow Logic Flaw","target":"DeFi Protocol","chains":["Ethereum","BNB Chain"],"usd":37500000.0,"lo":37500000.0,"hi":37500000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/alpha-finance-rekt"},{"s":"SlowMist Hacked","u":"https://medium.com/cream-finance/alpha-homora-v2-exploit-post-mortem-344d277bdea6"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/37-5-million-stolen-from-cream"}],"desc":"Alpha Finance was exploited when an attacker used recursive flash loans to borrow against inflated sUSD debt in the CREAM Iron Bank. A rounding error in the borrow function math enabled manipulation of undercollateralized lending.","theft":true},{"id":"ht4b840493ab","date":"2021-02-12","name":"BT Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/btdotfinance/status/1358989066814033920"}],"desc":"BT Finance was exploited via flash loan attack that manipulated price oracles, draining over $1.5 million from the protocol.","theft":true},{"id":"htac186b377d","date":"2021-02-09","name":"Growth DeFi","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/the-big-combo"}],"desc":"On 8 February 2021 an attacker created a worthless rAXZZ token and a GRO/rAXZZ Uniswap pool, then used the single-asset deposit feature of Growth DeFi's stkGRO/rAAVE farming contract which failed to validate LP token identity, accepting the GRO/rAXZZ LP shares as legitimate GRO/rAAVE LP shares, allowing the attacker to mint 14,513 stkGRO/rAAVE shares and drain the pool.","theft":true},{"id":"ht6b7bdda308","date":"2021-02-08","name":"KeepChange","kind":"hack","fam":"other","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://keepchange.medium.com/data-breach-at-keepchange-b0770a272945"}],"desc":"Bitcoin trading market KeepChange stated that the exchange received a request for withdrawal from a customer's account to an address belonging to the attacker, and a control subsystem of the platform suspended the request, resulting in no loss of Bitcoin. However, the attackers stole some customer data, including email addresses, names, number of transactions, total transaction amounts, and passwords.","theft":true},{"id":"ht31494ef95d","date":"2021-02-05","name":"ArmorFi","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/armorfi/status/1356784271923503108"}],"desc":"The DeFi insurance project ArmorFi has paid a $1.5 million bug bounty to the white hat hacker Alexander Schlindwein. Because the hacker discovered a \"critical loophole\" in the agreement, and may cause all the company's underwriting funds to be depleted.","theft":true},{"id":"ht6295e0690d","date":"2021-02-04","name":"Yearn Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":11000000.0,"lo":11000000.0,"hi":11000000.0,"conf":"A","n":5,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/yearn-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/iearnfinance/status/1357451290561937408"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/yearn-finance-loses-11-million"}],"desc":"On February 4, 2021, attacker used flashloans to acquire 215,000 ETH, then deposited borrowed USDC/DAI into Yearn's yDAI vault at manipulated exchange rates without sufficient slippage protection. The vault lost $11M; attacker profited ~$2.7M after $3.5M in fees.","theft":true,"onchain":true},{"id":"ht5eb7b85672","date":"2021-02-01","name":"Cryptopia","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Multiple"],"usd":45000.0,"lo":45000.0,"hi":45000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Cryptopia's dormant XSN token wallet, under liquidators' control, was compromised during the exchange's liquidation proceedings. Hackers stole NZD 62,000 (~$45,000) worth of XSN tokens from a $1.96 million address that had been inactive since the exchange's initial hack in 2019.","theft":true},{"id":"htb4fa01e1a4","date":"2021-02-01","name":"Multi Financial","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/223202.html"}],"desc":"According to feedback from Binance Smartchain investors, on February 1st, the BSC listed project Multi Financial ran away, and it only took about 5000 BNB in ​​one day. The compromised investor stated that it had reported that Binance had blocked the address of the project party and reported to the police. Recently, there have been many running incidents on BSC. The popcornswap project has approached 48,000 BNB. In a few days, three other projects (Zap Finance and Tin Finance, SharkYield) ran away. The current SharkYield ran away is suspected to have taken away 6000 BNB. Binance said that BSC is the same public chain as Ethereum and should not be responsible for the above projects. It hopes that users will manually intervene in investment and select high-quality projects to participate.","theft":true},{"id":"htc3c2febbf2","date":"2021-01-31","name":"popcornswap","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btchangqing.cn/187817.html"}],"desc":"Another DeFi project popcornswap on Binance Smart Chain has gone. It is reported that some users said in the community that the project used cake's LP, the contract was open source but there was no audit, and the LP was run in less than two hours. Currently, there are more than 40,000 BNB in ​​the wallet and no action is taken.","theft":true},{"id":"ht7315cb1761","date":"2021-01-28","name":"PopcornSwap rug pulls","kind":"hack","fam":"other","chains":["BNB Chain"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/popcornswap-rug-pulls"}],"theft":true,"headline":true},{"id":"ht7c36553699","date":"2021-01-27","name":"SushiSwap","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":103842.0,"lo":103842.0,"hi":103842.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://beincrypto.com/sushiswap-suffers-another-attack-hacker-steals-81-eth/"}],"desc":"Attacker exploited SushiMaker's fee-conversion mechanism by creating a fake DIGG/WETH trading pair with minimal liquidity. By routing 0.05% of DIGG/WBTC swap fees through this illiquid pool, the attacker caused massive slippage and captured 81 ETH in outsized fees that should have gone to xSUSHI stakers.","theft":true},{"id":"ht324069d614","date":"2021-01-27","name":"refi.finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://m.bitalk.com/flash/detail/448654413024858112"}],"desc":"Weibo user “CryptoBlanker” broke the news: the refi.finance project party directly used the reserved setBoardroom() function to change the Boardroom address to the address it deployed. Light BAS was taken away 2,600, worth 111 ETH (about 144,000 US dollars).","theft":true},{"id":"htcaac893fd9","date":"2021-01-25","name":"Sushi Badger Digg","kind":"hack","fam":"code","tech":"Swap Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":103842.0,"lo":103842.0,"hi":103842.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Sandwich attack exploiting SushiMaker's fee-conversion vulnerability in the DIGG/WBTC Sushiswap pool. When Sushiswap added DIGG/WBTC to Onsen but failed to set up a bridge in SushiMaker, the attacker routed protocol fees through an illiquid pool, capturing 81 ETH in excessive slippage fees intended for xSUSHI holders.","theft":true,"onchain":true},{"id":"ht0b3501646f","date":"2021-01-25","name":"BuyUCoin","kind":"hack","fam":"other","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/breach-at-indian-exchange-buyucoin-allegedly-exposes-325k-users-personal-data"}],"desc":"User information of BuyUCoin, an Indian cryptocurrency exchange, was leaked, and personal data of more than 325,000 people appeared in the database of the hacker organization. According to Indian news media Inc42, a hacker group called ShinyHunters placed a database containing the names, phone numbers, email addresses, tax identification numbers and bank account information of more than 325,000 BuyUCoin users.","theft":true},{"id":"ht67553c2aa7","date":"2021-01-20","name":"Saddle Finance","kind":"hack","fam":"other","chains":["Bitcoin"],"usd":275000.0,"lo":275000.0,"hi":275000.0,"conf":"A","n":2,"src":[{"s":"rekt.news","u":"https://rekt.news/saddle-finance-rekt"},{"s":"Web3 Is Going Great","u":"https://www.web3isgoinggreat.com/single/saddle-finance-exploited-within-hours-of-launch"}],"theft":true},{"id":"hta770e65cc7","date":"2021-01-20","name":"Firo","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/firoorg/status/1351703001849757697"}],"desc":"The privacy coin project Firo stated on Twitter that it is currently under 51% attacks and it is recommended that users do not trade during this period until the network returns to normal.","theft":true},{"id":"htbaee314e5b","date":"2021-01-11","name":"Gretchen Whitmer","kind":"hack","fam":"other","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://eu.freep.com/story/news/local/michigan/2021/01/10/death-threats-governor-whitmer-bitcoin-extortion/6615135002/"}],"desc":"On January 11, the Michigan state police claimed that an anonymous person mailed death threats to Governor Gretchen Whitmer and employees of the state in an attempt to collect $2 million worth of Bitcoin. The letter said that unless the governor transfers more than $2 million in cryptocurrency to him before January 25, the state employee will die. A Michigan State Police spokesperson responded that the threat was not credible.","theft":true},{"id":"ht47ac414915","date":"2021-01-11","name":"Tor","kind":"hack","fam":"other","tech":"Network Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://darknetdaily.com/2021/01/09/all-v3-onion-addresses-down-after-attack-on-the-tor-network/"}],"desc":"The Tor network was attacked and all v3 onion addresses were inaccessible. Darknetdaily posted that this seems to be a new type of attack that will affect the entire network and cause the consensus authorization node to overload. Hugbunter, the administrator of the dark web forum Dread, said that all v3 onion addresses are currently inaccessible. The cause of the accident is unknown, but it may cause a huge attack on the entire network. Hugbunter speculated that an article he published earlier might have spawned this attack. The article advocated that competitors in the market should be prevented from launching DDoS attacks against each other.","theft":true},{"id":"htfb2afd38b7","date":"2021-01-06","name":"ZKS","kind":"hack","fam":"other","tech":"Malicious Code Injection Attack","chains":["zkSync Era"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coinonpro.com/kuaixun/178459.html"}],"desc":"The ZKSwap token ZKS, a decentralized exchange based on ZK Rollup, has problems due to Uniswap adding liquidity. ZKSwap officially stated that the reason for this phenomenon was that someone used scripts to brush transactions, resulting in a higher price for first adding liquidity. The project party can only sell a part of ZKS to return the price to normal levels. All the USDT obtained from selling ZKS has been injected into the liquidity pool and will not be withdrawn in the next 3 months","theft":true},{"id":"ht16ccb341a5","date":"2020-12-29","name":"Cover Protocol","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":9400000.0,"lo":3000000.0,"hi":9400000.0,"conf":"B","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/cover-rekt"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/12/28/cover-protocol-attack-perpetrated-by-white-hat-funds-returned-hacker-claims/"}],"desc":"Cover Protocol's Blacksmith contract was exploited on December 28-29, 2020, due to incorrect memory/storage reference in reward calculation logic, allowing unbounded minting of approximately 40 quintillion COVER tokens. Funds were returned by a white hat hacker.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht41400b9c16","date":"2020-12-28","name":"LuBian","kind":"hack","fam":"keys","tech":"Weak Key Generation","target":"Other","chains":["Bitcoin"],"usd":3500000000.0,"lo":3500000000.0,"hi":3500000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/the-one-that-got-away"}],"desc":"On December 28, 2020, LuBian Bitcoin mining pool (6% of network hashrate in 2020) was hacked. An attacker exploited weak key generation in LuBian's infrastructure to brute-force private keys and steal 127,426 BTC (~$3.5B).","theft":true,"review":["sources disagree on the date"]},{"id":"hte28a8217e0","date":"2020-12-26","name":"Altilly","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"CEX","chains":["Multiple"],"usd":750000.0,"lo":750000.0,"hi":750000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://peakd.com/hive-167922/@blind-spot/altilly-exchanged-hacked-altilly-responds-to-the-community"}],"desc":"Attacker gained access to Altilly's hosting provider account via compromised API keys lacking 2FA. The attacker rebooted servers in rescue mode, created new system user accounts, deleted all backups across hosting and offsite services, and rendered encrypted wallets inaccessible. The exchange permanently shut down with no fund recovery.","theft":true},{"id":"htaa68f68d75","date":"2020-12-24","name":"Livecoin","kind":"hack","fam":"keys","tech":"API Key Compromised","target":"CEX","chains":["Multiple"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/russian-crypto-exchange-livecoin-hacked-after-it-lost-control-of-its-servers/"}],"desc":"Attacker gained control of Livecoin's backend servers and nodes via compromised credentials. Once in control, hackers manipulated exchange rates to absurd levels (Bitcoin to $450K, ETH to $15K) and drained multiple assets from hot wallets. The exchange shut down permanently and never recovered.","theft":true},{"id":"ht33ecfa15c3","date":"2020-12-21","name":"Exmo","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Multiple"],"usd":10500000.0,"lo":10500000.0,"hi":10500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/12/22/exmo-exchange-now-says-it-lost-6-of-total-crypto-assets-in-mondays-hack/"}],"desc":"EXMO detected suspicious withdrawal activity on December 21, with attackers stealing approximately 5% of the exchange's total assets from compromised hot wallets. Multiple cryptocurrencies including BTC, ETH, XRP, ETC, ZEC, and USDT were transferred out during a coordinated withdrawal.","theft":true},{"id":"htc4f229dc3b","date":"2020-12-18","name":"Warp Protocol","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":7800000.0,"lo":7700000.0,"hi":7800000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/warp-finance-rekt"},{"s":"SlowMist Hacked","u":"https://warpfinance.medium.com/warp-finance-exploit-summary-recovery-of-funds-5b8fe4a11898"}],"desc":"On December 17-18, 2020, an attacker exploited Warp Finance's gameable oracle by flash loaning 2.9M DAI and 344.8K WETH from dYdX to manipulate DAI/Uniswap prices, inflating LP collateral value to borrow 3.86M DAI and 3.9M USDC, draining $7.76 million total.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht2523623b75","date":"2020-12-14","name":"OneCoin","kind":"fraud","fam":"insider","tech":"Scam","usd":440000000.0,"lo":440000000.0,"hi":440000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/OneCoin"}],"desc":"On December 14th, the Procuratorate of Cordoba, Argentina prosecuted 12 scammers involved in the OneCoin cryptocurrency Ponzi scheme and ordered their arrests last Thursday. Eight of them have been arrested. It was previously reported that the OneCoin Ponzi scheme caused relevant investors to suffer a total of US$4.4 billion in financial losses from their investment in the project from April 2014 to March 2018."},{"id":"htcdd7a9205a","date":"2020-12-14","name":"Nexus Mutual","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"DeFi Protocol","chains":["Ethereum"],"usd":8000000.0,"lo":8000000.0,"hi":8000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/NexusMutual/status/1338441875326427137"}],"desc":"Attacker gained remote access to founder Hugh Karp's computer and replaced his MetaMask extension with a malicious version. The compromised wallet was then used to sign and transfer 370,000 NXM tokens (~$8M) to attacker-controlled addresses. The attacker later demanded 4,500 ETH ransom.","theft":true},{"id":"htbaba74bc6c","date":"2020-12-14","name":"DeTrade Fund","kind":"fraud","fam":"insider","tech":"Scam","chains":["Ethereum"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptocoindaddy.com/detrade-fund-exit-scams-runs-away-with-1438-ether/"}],"desc":"According to reports, DeTrade Fund was the biggest scam on Friday, the platform allowing any user to profit by putting money into its arbitrage system and defrauding more than 1,400 ETH raised in a pre-sale. Twitter user Artura discovered that DeTrade Fund is actually run by a Lithuanian. Shortly after Artura’s tweet, the scam’s affiliate addresses distributed hundreds of ETH to presale participants, returning around 65-70% of the initial stolen funds."},{"id":"htfed8c7c5e4","date":"2020-12-08","name":"Aeternity","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"Chain","chains":["Aeternity"],"usd":5201000.0,"lo":5201000.0,"hi":5201240.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://forum.aeternity.com/t/how-to-prevent-51-attack-on-aeternity-as-pow-blockchain/8516"}],"desc":"Unknown attacker(s) controlled over 51% of Aeternity's hash power on December 5-8, enabling double-spend attacks. The attacker deliberately reorganized blocks and double-spent 29 million Æ coins across targeted exchanges (OKEx, Huobi, Gate.io, Binance). A subsequent January 8 attempt to repeat the attack was detected and blocked by community members.","theft":true},{"id":"ht6868b99771","date":"2020-12-08","name":"Foxconn","kind":"hack","fam":"keys","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/"}],"desc":"Foxconn was attacked by ransomware, which temporarily caused problems in its production facilities in Mexico and resulted in the theft of data. It is reported that the ransomware attack occurred on Thanksgiving weekend and the hacker was a DoppelPaymer group. The target of the attack was the Foxconn factory in Juarez, Chihuahua. About 1,200 servers were infected. 100GB of unencrypted files were stolen. The ransomware attack also caused 20TB to 30TB of backup data to be deleted. It is reported that the DoppelPaymer group demanded a ransom of 1804.0955 Bitcoin (approximately 220 million yuan) in exchange for an encryption key and promise not to publish the stolen data. Foxconn did not pay, and at least part of the data has been published on the dark web. In response, Foxconn responded that its factories in the Americas have indeed been attacked by cyber ransomware recently. At present, its internal information security team has completed software and operating system security updates, and at the same time improved the level of information security protection. At the same time, the affected factories are restoring the network, which has little impact on the group's overall operations.","theft":true},{"id":"htf5827a939f","date":"2020-12-05","name":"Poloniex","kind":"hack","fam":"other","tech":"DDoS Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://support.poloniex.com/hc/en-us/articles/1500000118862"}],"desc":"The cryptocurrency exchange Poloniex issued an announcement stating that since December 5th at 6:30 UTC (14:30 Beijing time), its service was interrupted due to a distributed denial of service (DDoS) attack. At present, Poloniex has resumed normal trading, and user funds have not suffered any loss.","theft":true},{"id":"ht4f0e6d3eec","date":"2020-12-02","name":"Compounder Finance","kind":"hack","fam":"insider","tech":"Admin Drain","target":"DeFi Protocol","chains":["Ethereum"],"usd":12464316.0,"lo":12464316.0,"hi":80000000.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/deathbed-confessions-c3pr"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/209456.html"}],"desc":"Twenty-two days after launch, Compounder Finance's development team replaced audited strategy pools with malicious 'Evil Strategy' contracts, removing restrictions on the withdraw function and draining every asset pool. Despite advertising 24-hour timelocks, the team retained ability to swap strategy contracts as a premeditated exit.","theft":true,"review":["sources disagree on the loss"]},{"id":"htde32c7d6ab","date":"2020-12-01","name":"BTC Markets","kind":"hack","fam":"keys","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/btc-markets-privacy-breach-exposes-all-customers-to-potential-phishing-attacks"}],"desc":"On December 1, the Australian cryptocurrency exchange BTC Markets accidentally disclosed the full names and email addresses of all its customers in marketing emails sent to customers, which may expose all customers to potential phishing attacks. These emails are sent in batches of 1,000, which means that every customer has received the names and email addresses of 999 other users. BTC Markets CEO Caroline Bowler said that the company sincerely apologized for the incident and emphasized that the executives of the exchange are currently working around the clock to minimize the impact of violations and implement “additional security features”. To prevent future information leakage. Bowler advises BTC Markets customers to ensure that two-factor authentication is enabled to protect their accounts and to change the password of their email account.","theft":true},{"id":"htf839883a72","date":"2020-11-30","name":"Saffron Finance","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/saffronfinance_/status/1333086689913425922"}],"desc":"DeFi asset mortgage platform Saffron Finance issued an announcement stating that Epoch 1 redemption errors caused by contract loopholes resulted in 50 million DAI deposits deposited by Epoch 1 being locked for 8 weeks. The team is currently working on an emergency fix to solve this problem and will transition to Epoch 2. Saffron Finance is a DeFi asset mortgage platform released by an anonymous team. The token is SFI, allowing liquidity providers to select customized risk exposures to obtain returns. In each cycle, users can choose different risk-return combinations (A, AA, S) on Saffron to provide liquidity. A cycle of 14 days (LP locks within 14 days). After the cycle ends, users can remove liquidity and obtain Interest and prorated SFI.","theft":true},{"id":"ht4fc3b664d3","date":"2020-11-30","name":"SushiSwap","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":15000.0,"lo":15000.0,"hi":15000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-43549"}],"desc":"SushiMaker malicious-pool fee capture attack where an attacker created a malicious pool and redirected SushiSwap fees to it. The attacker captured approximately 15,000 USD in accumulated fees through access control vulnerabilities in the fee-distribution mechanism.","theft":true},{"id":"htdd91f3a42b","date":"2020-11-30","name":"Rari Capital","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/rari-capital/rari-capital-11-29-2020-bug-resolved-and-deployed-acaecc6a313b"}],"desc":"DeFi robo-advisor Rari Capital released an official Twitter saying that contract vulnerabilities have been fixed with the cooperation of Quantstamp and no funds have been lost. Previously, due to loopholes in the RGT Distributor contract, RGT token application and deposit and withdrawal operations have been suspended. Rari Capital is currently reviewing the code update to confirm that there are no other vulnerabilities in the entire code.","theft":true},{"id":"ht0897a73015","date":"2020-11-26","name":"Compound","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/208210.html"}],"desc":"Compound's price feed error caused the liquidation of $90 million in assets. According to DeBank founder, the huge liquidation of Compound was caused by the dramatic fluctuations in the DAI price of the oracle information source Coinbase Pro. It is a typical oracle attack to manipulate the information source that the oracle relies on to perform short-term price manipulation to achieve misleading prices on the chain.","theft":true},{"id":"ht232e48d76d","date":"2020-11-21","name":"Pickle","kind":"hack","fam":"code","tech":"Missing Input Validation","target":"DeFi Protocol","chains":["Ethereum"],"usd":19700000.0,"lo":19700000.0,"hi":20000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/pickle-finance-rekt"},{"s":"SlowMist Hacked","u":"https://twitter.com/picklefinance/status/1330242051468910596"}],"desc":"Pickle's ControllerV4.swapExactJarForJar function lacked jar whitelisting, allowing an attacker to create fake jars and siphon 19.76M DAI from the pDAI jar via missing input validation.","theft":true,"onchain":true},{"id":"ht56908e6390","date":"2020-11-18","name":"88mph","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://peckshield.medium.com/88mph-incident-root-cause-analysis-ce477e00a74d"}],"desc":"On November 18th, an attacker exploited the vulnerability to obtain $100,000 in MPH tokens. After that, 88mph discovered a vulnerability in MPHinter, the MPH token minting contract, which could allow a potential attacker to steal all ETH in the Uniswap fund pool. With the help of the well-known white hat samczsun, ETH has been withdrawn into the governance multi-signature, so all funds are safe. In addition, 88mph stated that because the attacker put $100,000 in the LP pool (liquidity fund pool), the funds have been transferred to the governance wallet, and they have decided to allocate these funds to generations including MPH and ETH. Coin holders.","theft":true},{"id":"ht2b1562e173","date":"2020-11-17","name":"Origin Protocol","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":7700000.0,"lo":7000000.0,"hi":7700000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/hack-epidemic"},{"s":"SlowMist Hacked","u":"https://medium.com/originprotocol/urgent-ousd-has-hacked-and-there-has-been-a-loss-of-funds-7b8c4a7d534c"}],"desc":"On 2020-11-17 at 00:47:19 UTC an attacker exploited a flash-loan-funded reentrancy in OUSD VaultCore's mint function to inflate totalSupply. The contract failed to validate the transferred-in asset and lacked reentrancy protection, allowing the attacker to redeem against the inflated supply and drain the vault.","theft":true},{"id":"htb44e2bf19a","date":"2020-11-16","name":"CheeseBank","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/cheese-bank-s-multi-million-dollar-hack-explained-by-security-firm"}],"desc":"On November 6, 2020, CheeseBank was exploited for $3.3M via price oracle manipulation. The attacker borrowed 21,000 ETH via dYdX flashloan, purchased Cheese tokens on Uniswap to pump the price, deposited LP tokens, and borrowed all available stablecoins (USDC/USDT/DAI) against the inflated collateral.","theft":true},{"id":"ht94fb4b7b92","date":"2020-11-14","name":"ValueDefi","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":7400000.0,"lo":6000000.0,"hi":7400000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/value-defi-rekt"},{"s":"SlowMist Hacked","u":"https://decrypt.co/48256/saddest-hack-in-crypto-value-defi-hacked-for-6-million"}],"desc":"On November 14, 2020, Value DeFi's MultiStablesVault was exploited for $7.4M DAI via a two-stage flashloan attack that manipulated stablecoin exchange rates through Curve's AMM-based oracle. The attacker voluntarily returned $2M after Value DeFi offered a $1M bounty.","theft":true},{"id":"ht6e30121b2e","date":"2020-11-13","name":"Liquid","kind":"hack","fam":"keys","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blog.liquid.com/security-incident-november-13-2020"}],"desc":"Mike Kayamori, CEO of cryptocurrency exchange Liquid, posted a notice on the official website that a data leakage security incident occurred on the exchange on November 13. A domain hosting provider that manages a core domain name mistakenly transferred control of the account and domain name to a malicious intruder, allowing it to change DNS records, thereby controlling a large number of internal email accounts, and being able to partially damage the exchange’s Infrastructure and gain access to stored documents. After detecting the intruder, immediate action was taken to intercept and contain the attack to prevent further intrusions and reduce the risk of customer accounts and assets, while conducting a comprehensive review of the infrastructure. It can be confirmed that the customer's funds are safe, and the cold wallet based on MPC (Multi-Party Computing Protocol) is safe and has not been damaged. The relevant regulatory agencies have been notified of the intrusion and will continue to communicate in the next few days. The attacker may have obtained the user's email, name, address, and password. At present, Liquid is investigating whether the attacker has accessed the identity documents and photos submitted to KYC for verification, and will provide updates after the investigation.Liquid announced the final findings on January 20, 2021. Liquid stated that 169,782 items of user data including email addresses, names, encryption passwords, API keys, etc. have been leaked. Among them, the personal information that may be accessed illegally is the user who went through the KYC process before October 2018, such as the user's ID card, self-portrait picture, proof of address and other identity verification documents 28,639.","theft":true},{"id":"ht4b02b7b63b","date":"2020-11-12","name":"Akropolis","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum","Polkadot"],"usd":2000000.0,"lo":2000000.0,"hi":2030000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/akropolis-rekt"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/akropolis-defi-protocol-paused-as-hackers-get-away-with-2m-in-dai"}],"desc":"On November 12, 2020, Akropolis lost $2 million in DAI from its yCurve and sUSD pools. The attacker used a flash loan to exploit a bug in the SavingsModule smart contract where the deposit logic minted tokens twice, allowing withdrawal of double the intended amount.","theft":true},{"id":"ht6ed1e1d8b5","date":"2020-11-10","name":"SharkTron","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Tron"],"usd":10000000.0,"lo":10000000.0,"hi":10000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.fxstreet.com/cryptocurrencies/news/over-400-million-trx-tokens-stolen-by-defi-protocol-sharktron-202011091401"}],"desc":"According to FXStreet, the community accused Daniel Wood of the DeFi project based on the Tron blockchain and the anonymous developer of the JustSwap whitelist project SharkTron for running away. Although the specific losses are not yet known, Twitter users reported that they lost 366 million to 400 million TRX (worth about 10 million US dollars). The TRON Foundation officially tweeted that it has contacted Binance to jointly track down the stolen funds and related personnel, and that some funds have been frozen by Binance. The TRON Foundation will also cooperate with other exchanges to track stolen funds. In addition, the TRON Foundation recommends that the victims submit a report to the local police.","theft":true},{"id":"ht7af37feb5d","date":"2020-11-09","name":"ElectrumSV","kind":"hack","fam":"keys","tech":"Security Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://aaron67.cc/2020/11/08/lost-600-bsv/"}],"desc":"On November 9th, a user named \"aaron67\" posted about his BSV theft experience, saying that please stop using the multisig accumulator multi-signature solution implemented by ElectrumSV immediately. The locking script of this scheme had serious bugs, so that 600 BSV was stolen on November 6th. After the incident, the user had contacted Roger Taylor, the author of ElectrumSV, for the first time, and the serious bug was subsequently confirmed. At the same time, the Note.SV developers stated that they had done an analysis for the first time to find the source of the bug, and notified the wallet author and community users.","theft":true},{"id":"ht2d75ed10df","date":"2020-11-08","name":"Grin","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"Chain","chains":["Grin"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/11/08/privacy-coin-grin-is-victim-of-51-attack/"}],"desc":"Unknown miner(s) acquired 57.4% of Grin's network hash power on November 7-8, enabling 51% attack capabilities. The attacker reorganized at least one forked block, likely through rented hashrate from cloud mining services during a price surge.","theft":true},{"id":"htb388e9272b","date":"2020-11-06","name":"Ledger","kind":"hack","fam":"social","tech":"Phishing","target":"Wallet","chains":["Multiple"],"usd":271000.0,"lo":271000.0,"hi":271000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://nairametrics.com/2020/11/06/crypto-owners-robbed-of-1150000-xrp/"}],"desc":"Phishing campaign targeting Ledger users with fake data-breach alert emails claiming security compromise and urging firmware updates. Attackers used Punycode domain spoofing (e.g., ledģėr.com) to disguise malicious URLs and trick users into compromising their hardware wallet recovery phrases.","theft":true},{"id":"ht6925f87fc8","date":"2020-11-04","name":"PercentFinance","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"usd":1000000.0,"lo":1000000.0,"hi":1000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/PercentFinance/status/1324104920727982080"}],"desc":"DeFi lending platform PercentFinance wrote in a blog on November 4 that some currency markets encountered problems that could cause users' funds to be permanently locked. The team frozen currency markets specifically for USDC, ETH, and WBTC. A total of 446,000 USDC, 28 WBTC and 313 ETH have been frozen, valued at approximately US$1 million. The article stated that half of these fixed funds belonged to PercentFinance's \"community improvement team.\" Withdrawals in other markets have already begun, but the team urges users not to borrow money from any of PercentFinance's markets during this period. It is reported that PercentFinance is a fork of Compound Finance.","theft":true},{"id":"hta37d9f8685","date":"2020-11-02","name":"Axion","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/certik-dissects-the-axion-network-incident-and-subsequent-price-crash"}],"desc":"Insider(s) injected malicious code into Axion's OpenZeppelin dependencies prior to deployment, enabling unlimited token minting via the unstake function. Attacker minted 79 billion AXN and dumped on the market, causing 99% price collapse and netting 1,300 ETH (~$500K) despite passing audits from Hacken and Certik.","theft":true},{"id":"hte8f3a9e340","date":"2020-10-30","name":"EtherCrash","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":2500000.0,"lo":2500000.0,"hi":2500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://itwire.com/security/ethereum-gambling-game-loses-us$2-5m-in-alleged-inside-job.html"}],"desc":"EtherCrash's cold wallet, claimed to be the most mature Ethereum gambling game, was compromised on October 27. Two large withdrawals totaling ~$2.5M were made and exchanged to DAI on Uniswap. The single-key wallet design left it vulnerable with no recovery options.","theft":true},{"id":"ht7162cd3cc6","date":"2020-10-26","name":"Harvest Finance","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":24000000.0,"lo":21500000.0,"hi":24000000.0,"conf":"A","n":4,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/harvest-finance-rekt"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/hacker-steals-24-million-from-cryptocurrency-service-harvest-finance/"}],"desc":"Harvest Finance exploited October 26, 2020 for $24-34M via Curve oracle manipulation. Attacker deployed $50M flashloan to skew the Curve y-pool USDT/USDC balance, then repeatedly minted fTokens at depressed valuation and redeemed at normal price (~30 times in 7 minutes).","theft":true,"onchain":true},{"id":"ht48f54d2009","date":"2020-10-12","name":"Electrum","kind":"hack","fam":"other","tech":"Fake software updates","target":"Wallet","usd":22000000.0,"lo":22000000.0,"hi":22000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/bitcoin-wallet-trick-has-netted-criminals-more-than-22-million/"}],"desc":"An investigation by ZDNet revealed that hackers stole $22 million from users of Bitcoin wallet Electrum by enticing users to install fake software updates. And this technique was highest in 2018. Since this attack was first discovered two years ago, the Electrum team has taken some measures to prevent this attack. But this attack still applies to users who use older versions of the application.","theft":true},{"id":"ht7439da05bf","date":"2020-10-11","name":"WLEO","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Ethereum"],"usd":42000.0,"lo":42000.0,"hi":42000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://decrypt.co/44645/ethereum-project-wleo-hacked-for-42000-on-uniswap"}],"desc":"Attacker gained access to the WLEO token contract's issuing mechanism and minted unlimited tokens. The attacker swapped the minted WLEO for ETH on Uniswap's liquidity pool, extracting ~$42K worth of Ethereum from the pool and causing a complete rug pull.","theft":true},{"id":"ht4b9f589995","date":"2020-10-11","name":"Curve Finance","kind":"phishing","fam":"social","tech":"Phishing attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-30048"}],"desc":"Recently, a user suffered a phishing attack while visiting the Curve exchange website, and lost 20 Bitcoins. It is reported that the fraud group used the Google advertising system to purchase Google search ads, pretending to be the Curve exchange for fraudulent advertising. Due to google’s new advertising program, ads are usually displayed in the first place in search, which has caused many users to be deceived.","theft":true},{"id":"ht809874b877","date":"2020-10-10","name":"UniCats","kind":"scam","fam":"social","tech":"Scam","chains":["Ethereum"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/43927/ethereum-user-scammed-for-140000-in-uniswap-uni-tokens"}],"desc":"Encrypted wallet ZenGo researcher Alex Manuskin revealed that UniCats, a so-called \"yield farming platform\" based on the Ethereum network, is suspected of stealing at least $200,000 in encryption from several users, including the governance token UNI of the decentralized financial platform Uniswap assets. A backdoor in the smart contract allows UniCats to retain control of its user tokens even if these tokens have been withdrawn from the user pool. Previous attacks against Bancor also used similar vulnerabilities.","theft":true},{"id":"ht99c8a9a399","date":"2020-10-08","name":"DeFi Saver","kind":"hack","fam":"other","tech":"Exchange leak","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-29307"}],"desc":"The decentralized wallet imToken tweeted that users reported that 310,000 DAI had been reduced, which conflicted with DeFi Saver Exchange. imToken recommends that the automated management system of collateralized bond warehouses (CDP) imi stated that its security team is investigating the incident and trying to troubleshoot all user wallets that hit and issue warnings. DeFiSaver responded that this part of the funds is safe and is contacting users. DeFiSaver admitted that this was related to the foreign exchange benefits reported in June.","theft":true},{"id":"htf2e8eb3030","date":"2020-10-05","name":"Coindaq.io","kind":"fraud","fam":"insider","tech":"Scam","usd":15000.0,"lo":15000.0,"hi":15000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://beincrypto.com/user-claims-to-lose-15k-in-alleged-crypto-scam-promoted-on-google-ads/"}],"desc":"A user named Kazuo Kusunose posted on Google forums that he had lost $15,000 due to an encryption scam discovered in Google ads. Allegedly, the suspicious website named Coindaq.io tried to use the digital renminbi that China is studying, claiming that users can deposit funds on the platform to participate in the sale of digital renminbi. The victim expressed the hope that Google can investigate the matter and establish a webpage targeted at the alleged fraud."},{"id":"ht0beae6410e","date":"2020-09-29","name":"KuCoin","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":281000000.0,"lo":150000000.0,"hi":281000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/kucoin-cryptocurrency-exchange-hacked-for-150-million/"}],"desc":"On September 25-26, 2020, attackers obtained the private keys to KuCoin's hot wallets and stole approximately $280 million. The Lazarus Group, working on behalf of North Korea, was attributed as the attacker. KuCoin recovered $235 million (84%) through on-chain tracking, contract upgrades, and law enforcement cooperation.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht4db07fbc6c","date":"2020-09-29","name":"Kucoin","kind":"other","fam":"other","usd":45000000.0,"conf":"C","n":1,"src":[{"s":"rekt.news","u":"https://rekt.news/epic-hack-homie"}]},{"id":"ht4f1d14ba1f","date":"2020-09-28","name":"Eminence","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":15000000.0,"lo":15000000.0,"hi":15000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"rekt.news","u":"https://rekt.news/eminence-rekt-in-prod"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/tech/2020/10/01/defi-degens-hit-hard-by-eminence-exploit-will-be-partially-compensated/"}],"desc":"Eminence, an incomplete unaudited DeFi project by Andre Cronje, was exploited less than 3 hours after launch. The attacker borrowed 15M DAI from Uniswap, bought EMN, burned half for eAAVE to artificially inflate the price, then withdrew from the bonding curve at the manipulated price, draining the protocol.","theft":true},{"id":"ht4ddd5bb739","date":"2020-09-26","name":"GemSwap","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/cryptoculgin/status/1310922743555080192"}],"desc":"On September 26, the SushiSwap imitation project named GemSwap was exposed and LP was taken away. The query found that the project posted a tweet at around 15:00 today and revealed that it was attacked by the developer of \"whatitdobb\". It is understood that the project completed the liquidity migration earlier today, but the developer who initiated the attack had The relevant permission was obtained and the tokens in the liquidity pool were able to be taken away. The specific losses caused by this attack are currently unclear.","theft":true},{"id":"htb0eea92cd7","date":"2020-09-20","name":"LV Finance","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Ethereum"],"usd":4000000.0,"lo":4000000.0,"hi":4000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ihodl.com/topnews/2020-09-21/defi-project-lv-finance-turns-out-exit-scam/"}],"desc":"According to the intelligence of the SlowMist Zone, the LV Finance project of the Ethereum mining project is suspected of running away within an hour and 4 million have been transferred away. Unlike previous projects, the project used fake audit websites and provided false audit information to trick investors into doing business. Invest and run away when the amount in the fund pool is large enough after a period of time. Currently, the project website lv.finance is no longer accessible.","theft":true},{"id":"htce967a7669","date":"2020-09-20","name":"Soda Protocol","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":160000.0,"lo":160000.0,"hi":160000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://new.qq.com/omn/20200924/20200924A07M1U00.html"}],"desc":"Hackers exploited a variable naming error in the WETHCalculator.sol smart contract, where 'amount' was used instead of 'lockedAmount', allowing unauthorized drainage of over 400 ETH from the liquidity mining pool.","theft":true},{"id":"hte765327250","date":"2020-09-19","name":"Bantiample","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["BNB Chain"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.quadrigainitiative.com/casestudy/bantiampleexitscam.php"}],"desc":"The Bantiample team, a project on the Binance Smart Chain, has cashed out 3000 BNB to run away. At present, the main developer of the team has deleted the Telegram account, and the project token BMAP has fallen by more than 90% in a single day. According to the project's description, BMAP is a kind of AMPL-like imitation. Every time a user participates in a transaction, the total amount is reduced by 1%. However, it is actually just a common token, and it does not have the functions described by the project party. It just uses the AMPL project hotspot to commit fraud.","theft":true},{"id":"ht069de52d0e","date":"2020-09-16","name":"Arbistar","kind":"scam","fam":"social","tech":"Scam","usd":120000000.0,"lo":120000000.0,"hi":120000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/national-court-of-spain-takes-the-investigation-of-the-alleged-ponzi-crypto-scheme-arbistar/"}],"desc":"According to Spanish prosecutors, they are investigating Arbistar's alleged manipulation of a Bitcoin trading scam. The disappearance of investor funds has affected 32,000 households who cannot use their savings invested in Bitcoin trading platform Arbistar. Earlier, it was reported that crypto company Arbistar announced that it would close a trading tool called Community Bot. The operator said that all funds on the platform are currently frozen and prevent users from withdrawing funds. Allegedly, the amount stolen may exceed 100 million euros (120 million U.S. dollars), which may be the “largest scam in Spain” related to cryptocurrencies.","theft":true},{"id":"ht1dcc2421c1","date":"2020-09-14","name":"bZx","kind":"hack","fam":"code","tech":"Replay Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bzx.network/blog/incident"}],"desc":"bZx officially tweeted that at 3:28 am Eastern time (15:30, September 13th, Beijing time), we began to study the decline in TVL of the agreement. By 6:18 AM EST (18:30, September 13th, Beijing time), we confirmed that several iTokens had repeated incidents. Lending is temporarily suspended. The duplicate method has been patched from the iToken contract code, and the agreement has resumed normal operation. According to the information of the founder of Compound, there are a total of US$2.6 million in LINK, US$1.6 million in ETH, and US$3.8 million in stablecoins, with a total of US$8 million in assets affected. 1inch co-founder Anton Bukov tweeted that the attacker had stolen about 4,700 ETH in this incident and attached the address of the stolen funds. In response, bZx said that the funds are currently not at risk. The funds listed have been deducted from our insurance fund. On September 16, bZx released an iToken repeat incident report, and the attacker has returned all funds.","theft":true},{"id":"ht6d466d6ef2","date":"2020-09-13","name":"bzx","kind":"hack","fam":"other","tech":"Incorrect transfer","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"ht12816b2811","date":"2020-09-10","name":"Coral","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["EOS"],"usd":420000.0,"lo":420000.0,"hi":420000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.sohu.com/a/417422116_100217347"}],"desc":"The wRAM token contract had a reentrancy vulnerability in the buyram function. When wram::buyram was called multiple times simultaneously, the asynchronous call to eosio::buyram caused the same RAM bytes value to be used across multiple calls, allowing minting of more tokens than intended.","theft":true},{"id":"ht4b2f44e1f8","date":"2020-09-10","name":"SYFI","kind":"hack","fam":"code","tech":"Arithmetic Error","target":"DeFi Protocol","chains":["Ethereum"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/A_mplify/status/1302852331680051200"}],"desc":"An anonymous trader exploited a rebase bug in SYFI's unaudited contract code. By staking a small amount and leveraging the arithmetic error in the rebase logic, they extracted nearly $250K in realized gains while crashing the token price from $174 to $0.0004.","theft":true},{"id":"ht9da6359e41","date":"2020-09-09","name":"EMD","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["EOS"],"usd":2468838.0,"lo":2468838.0,"hi":2468838.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.mytoken.io/news/159516.html"}],"desc":"According to SlowMist Zone intelligence, EOS project EMD is suspected to be on the run. To date, EmeraldMine1 has transferred 780,000 USDT, 490,000 EOS and 56,000 DFS to Account SJI111111111, and 121,000 EOS has been transferred to Changenow coin Laundering. Current lost MARKET value: US $2,468,838 =17,281,866 RMB.","theft":true},{"id":"ht4a72af2495","date":"2020-09-09","name":"Soft Finance","kind":"hack","fam":"code","tech":"Unknown","chains":["Ethereum"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-19763"}],"desc":"A user with a Twitter account named Amplify revealed that he made a profit of US$250,000 from a system vulnerability in the new DeFi project Soft Finance.","theft":true},{"id":"ht58d9066e37","date":"2020-09-08","name":"Eterbase","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin","Ethereum","XRP","Tezos","Algorand","Tron"],"usd":5400000.0,"lo":5400000.0,"hi":5400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/slovak-cryptocurrency-exchange-eterbase-discloses-5-4-million-hack/"}],"desc":"Attackers compromised Eterbase's internet-connected hot wallets holding Bitcoin, Ethereum, XRP, Tezos, Algorand and TRON. The stolen funds were transferred to attacker-controlled addresses and subsequently moved through multiple exchanges including Binance and Huobi.","theft":true},{"id":"ht4cdd2b4e21","date":"2020-09-08","name":"Banco Estado","kind":"hack","fam":"code","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/chilean-bank-shuts-down-all-branches-following-ransomware-attack/"}],"desc":"Banco Estado Bank, one of the three largest banks in Chile, had to shut down its nationwide business on the 7th due to a cyber attack by REvil ransomware.","theft":true},{"id":"ht2e2fba053d","date":"2020-09-07","name":"Argentine National Immigration Service","kind":"hack","fam":"other","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://u.today/4000000-bitcoin-ransom-demanded-from-argentinas-official-immigration-agency"}],"desc":"It is said that hackers used the encrypted virus NetWalker to enter the database and steal information from federal agencies. The dark web payment page linked in the ransomware description shows that the hacker initially paid $2 million worth of bitcoin to unlock the file. Within a week, this number had increased to 355 BTC, which is approximately $3.62 million.The Argentine government refused to pay the ransom.","theft":true},{"id":"ht6207c3ada8","date":"2020-09-07","name":"TSEM","kind":"hack","fam":"keys","tech":"Ransomware","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.calcalistech.com/ctech/articles/0,7340,L-3848490,00.html"}],"desc":"Hackers carried out ransomware attacks against Tower Semiconductor Ltd (TSEM), a maker of wireless chips and camera sensors listed on the Israeli Nasdaq, and demanded hundreds of thousands of dollars in bitcoin ransoms. For safety reasons, TSEM shut down some running servers and suspended production in some factories.","theft":true},{"id":"ht427f177638","date":"2020-09-06","name":"CherryFi","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.quadrigainitiative.com/hackfraudscam/cherryficontractvulnerabilities.php"}],"desc":"The transfer logic of TRON's DeFi project CherryFi calls the safeTransfer function to perform specific transfer operations. However, the USDT transfer logic does not return a value, which causes the safeTransfer call to never succeed, which leads to the lockup of funds, and therefore users cannot perform USDT transfers in and out. It is understood that the CherryFi code has not been audited.","theft":true},{"id":"htea7197e4b0","date":"2020-09-04","name":"Chainlink","kind":"hack","fam":"keys","tech":"Spam attacks","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/76986/chainlink-nodes-attack-eth"}],"desc":"Nine Chainlink node operators were subjected to so-called \"spam attacks.\" The attackers obtained approximately 700 ETH (worth approximately $335,000 at the time) from their \"hot wallets\".","theft":true},{"id":"htf448efbac2","date":"2020-08-30","name":"Empire Market","kind":"fraud","fam":"insider","tech":"Scam","usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/sources-say-worlds-largest-darknet-empire-market-exit-scammed-30-million-in-bitcoin-stolen/"}],"desc":"The well-known darknet market Empire Market has closed its operations. When it exited, the website defrauded about 2638 bitcoins from 1.3 million users, worth nearly 30 million U.S. dollars."},{"id":"htbf85ab9167","date":"2020-08-30","name":"Electrum","kind":"hack","fam":"keys","tech":"Fake software update","target":"Wallet","usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coolwallet.io/1400-bitcoins-btc-stolen-from-an-outdated-electrum-wallet/"}],"desc":"GitHub user \"1400 BitcoinStolen\" said that a huge amount of his Bitcoin money had disappeared in the hack. This user uses a bitcoin purse Electrum, the user has no security update the software, so when he transfers the currency, it prompts to update and fix potential problems, but when he according to tip operation, the software takes advantage of a vulnerability to connect the hacker server, 1400 bitcoins (worth $16 million) is placed into the hacker's wallet.","theft":true},{"id":"ht6c5a83cc64","date":"2020-08-30","name":"ETC","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/08/29/ethereum-classic-hit-by-third-51-attack-in-a-month/"}],"desc":"Bitfly tweeted that another massive 51% attack on ETC today resulted in the restructuring of more than 7,000 blocks, equivalent to about two days of mining time. All missing blocks are removed from balances that have never expired, and all expenditures are checked for missing transactions.","theft":true},{"id":"htff1af10bc5","date":"2020-08-30","name":"Ledger","kind":"hack","fam":"keys","tech":"Information Leakage","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/ledger-cto-discusses-wallet-s-safety-after-multiple-security-setbacks"}],"desc":"Encrypted wallet provider Ledger recently experienced database leaks and wallet vulnerabilities, putting users' bitcoins at risk. The chief technology officer of Ledger stated that in terms of database leakage, the attacker accessed part of our e-commerce and marketing database through a third-party misconfigured API key on our website, allowing unauthorized access to our customers’ contact information and Order data. Ledger fixed this issue on the same day and disabled the API key.","theft":true},{"id":"htdf1ae488c0","date":"2020-08-28","name":"Degen.Money","kind":"hack","fam":"code","tech":"Double Authorization Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.panewslab.com/zh/articledetails/1598608813032363.html"}],"desc":"Twitter users reported that DeFi's liquidity mining project Degen.Money exploited a double approval vulnerability to get users' Money. The first authorization gives the pledge contract, and the second authorization gives the right to transfer money, which will result in the user's funds being taken away by the attacker. YFI founder Andre Cronje says the project does have risks.","theft":true},{"id":"hte1e468873c","date":"2020-08-28","name":"NZX","kind":"hack","fam":"other","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bbc.com/news/53918580"}],"desc":"The New Zealand Stock Exchange (NZX) went offline for two days in a row due to a cyber attack. NZX said on Tuesday it was first hit by a distributed denial of service (DDoS) attack from abroad. The emails threatening DDoS attacks came from Fancy Bear, a well-known Russian hacking group.","theft":true},{"id":"htc8d169faae","date":"2020-08-25","name":"Coinbit","kind":"scam","fam":"social","tech":"Scam","target":"CEX","usd":85000000.0,"lo":85000000.0,"hi":85000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.seoul.co.kr/news/newsView.php?id=20200826500071"}],"desc":"South Korea’s third largest digital currency exchange, Coinbit, was seized and investigated by South Korean police. Its chairman and operator were suspected of internal transactions and manipulation of market prices. The police claimed that the company was suspected of using illegal means to earn at least 100 billion won in illegal profits (approximately 85 million US dollars), and Coinbit was also suspected of forging more than 99% of its transaction volume.","theft":true},{"id":"ht6df01bf964","date":"2020-08-25","name":"BTC ERA","kind":"phishing","fam":"social","tech":"Phishing attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.infosecurity-magazine.com/news/malicious-actors-bitcoin-launch/"}],"desc":"Some cybercriminals have been counterfeiting the BTC ERA trading platform in order to infect potential users with malware. The cybersecurity company discovered that the perpetrators had been sending emails allegedly from BTC ERA to induce users to invest and pay.","theft":true},{"id":"htba8f806a17","date":"2020-08-25","name":"Filecoin","kind":"hack","fam":"code","tech":"DDoS Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/newsflash/p-458791.html"}],"desc":"The Filecoin space race started, and the CDSI alliance node \"t02398\" suffered a large number of malicious and illegal attacks. The attacker sent a large number of messages through the filtered whitelist to block the node, consuming a lot of calculations on the Lotus node, making the node unable to complete the task normally and eventually losing computing power.","theft":true},{"id":"ht7da64178d9","date":"2020-08-24","name":"YFValue","kind":"hack","fam":"code","tech":"Staking Pool Vulnerability","chains":["Ethereum"],"usd":170000000.0,"lo":170000000.0,"hi":170000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://valuedefi.medium.com/yfv-update-staking-pool-exploit-713cb353ff7d"}],"desc":"The DeFi project YFValue (YFV) officially released an announcement stating that the team found a loophole in the YFV pledge pool yesterday, and malicious participants used the vulnerability to reset the YFV timer in the pledge separately. There is a risk of being locked in $170 million in funds. Currently, a malicious participant is trying to blackmail the team using this vulnerability.","theft":true},{"id":"htc4c7781f67","date":"2020-08-24","name":"CryptoTrader.Tax","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/08/24/hacker-stole-1000-traders-personal-data-from-crypto-tax-reporting-service/"}],"desc":"According to Coindesk, a hacker has stolen more than 1,000 user data from crypto-tax service provider CryptoTrader.Tax and is trying to sell information on dark web forums.","theft":true},{"id":"htfd25492459","date":"2020-08-19","name":"KuCoin","kind":"phishing","fam":"social","tech":"Phishing attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/kucoin-warns-of-impersonator-website-offering-incentives-to-deposit-crypto"}],"desc":"KuCoin, a cryptocurrency exchange, warned of fraudulent websites using its brand to try to steal cryptocurrencies. The website provides false rewards to induce users to deposit digital assets.","theft":true},{"id":"htf14df50906","date":"2020-08-18","name":"OKEx","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"CEX","chains":["Ethereum Classic"],"usd":5600000.0,"lo":5600000.0,"hi":5600000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/08/17/okex-mulls-etc-delisting-after-losses-from-two-51-attacks/"}],"desc":"Attackers conducted a 51% attack on Ethereum Classic to execute a double-spend against OKEx. They deposited ETC, withdrew it, then reorganized the blockchain to erase the deposit transaction while keeping their funds, resulting in a net $5.6M theft via unconfirmed transaction reversal.","theft":true},{"id":"ht305c18bbf4","date":"2020-08-15","name":"Bitcoin ATM","kind":"fraud","fam":"insider","tech":"Scam","usd":30000.0,"lo":30000.0,"hi":30000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://m.jiemian.com/article/4832187.html"}],"desc":"The Hong Kong police arrested three men on suspicion of defrauding nearly 230,000 Hong Kong dollars (US$30,000) from Bitcoin ATMs. This is the first such case in Hong Kong. These exchanges suspect that criminals have used the “loopholes” of ATMs to withdraw cash without official authorization."},{"id":"ht2b9c63a970","date":"2020-08-14","name":"BASED","kind":"hack","fam":"other","tech":"Unknown","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoluo.cn/kuaixun/detail-132183.html"}],"desc":"The DeFi liquidity farming anonymous project BASED officially announced that it would redeploy the pledge pool. The official tweeted that a hacker tried to freeze \"Pool1\" permanently, but the attempt failed, and \"Pool1\" will continue as planned. The mortgage funds and BASED tokens are currently safe.","theft":true},{"id":"ht8c34d951ae","date":"2020-08-14","name":"Ledger","kind":"hack","fam":"other","tech":"Unknown","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.blockglobe24.com/news-flash/17597.html"}],"desc":"A cryptocurrency trader tweeted that a hacker hacked into his Ledger crypto wallet and stole more than 100,000 ERC-20 tokens. In addition, the trader said his account was safe because he had just reset his password last week.","theft":true},{"id":"ht0175248873","date":"2020-08-13","name":"YAM","kind":"hack","fam":"market","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":750000.0,"lo":750000.0,"hi":750000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/yam-finance/yam-post-rescue-attempt-update-c9c90c05953f"}],"desc":"On August 13, 2020, the well-known Ethereum DeFi project YAM officially issued a post on Twitter indicating that there were loopholes in the contract. The price plummeted by 99% within 24 hours, resulting in the “permanent destruction” of the governance contract, with a value of 750,000 USD Curve tokens. It is locked and cannot be used. Since the value of totalSupply was taken during rebase, the value of totalSupply calculated incorrectly will not be immediately applied to initSupply through mint, so before the next rebase, the community still has a chance to recover this error and reduce losses. But once the next rebase is executed, the entire mistake will become irreparable.","theft":true},{"id":"ht2fdd33c49e","date":"2020-08-11","name":"NUGS/NEXE","kind":"rugpull","fam":"insider","tech":"Rug Pull","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/linked/74527/token-nugs-nexe-exit-scam-listing-uniswap"}],"desc":"Two small-scale token projects, NUGS and NEXE, appeared to have committed \"travel fraud\" shortly after being launched on Uniswap. The NUGS project blamed this move on a \"smart contract vulnerability\". On its official telegram channel, NUGS stated that its smart contract is now \"unfixable.\" Another project, NEXE, is also suspected to have gone, and the social media account of this project has been deleted.","theft":true},{"id":"ht6e50ada094","date":"2020-08-07","name":"Domestic cloud server","kind":"hack","fam":"keys","tech":"Remote Intrusion","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://s.tencent.com/research/report/1078.html"}],"desc":"Tencent Security Threat Intelligence Center has detected a large number of attacks originating from overseas IP and some domestic IP against domestic cloud server tenants. The attacker blasted into the server through SSH (port 22), and then executed malicious commands to download the Muhstik botnet Trojan. The botnet will control the compromised server to perform SSH lateral movement, download the Monero mining Trojan, and accept remote commands to launch DDoS attacks.","theft":true},{"id":"htba6ae7126e","date":"2020-08-06","name":"Ethereum Classic","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Layer 1","chains":["Ethereum Classic"],"usd":1680000.0,"lo":1680000.0,"hi":1680000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/etherchain_org/status/1291216063628226562"}],"desc":"Attackers executed a second 51% attack on Ethereum Classic within a week, controlling the network's hash power to reorganize 4,236 blocks and execute double-spends. The attack lasted over 15 hours, resulting in at least $1.68M in stolen value through block reorganization and transaction reversal.","theft":true},{"id":"ht151a601150","date":"2020-08-05","name":"Jon Prosser","kind":"hack","fam":"keys","tech":"Account Compromise","usd":4000.0,"lo":4000.0,"hi":4000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/jon_prosser/status/1291162451833225216"}],"desc":"According to a tweet published by Jon Prosser on August 5, its YouTube channel with 262,000 subscribers was hacked, the channel name was changed to \"NASA [news]\", and a live broadcast about SpaceX CEO Elon Ma Skr gave false news of Bitcoin. In about two hours, the illegal profit was $4,000.","theft":true},{"id":"ht591d297f16","date":"2020-08-04","name":"Opyn","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":371000.0,"lo":371000.0,"hi":371000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/opyn/opyn-eth-put-exploit-c5565c528ad2"}],"desc":"The Opyn ETH Put contract had a critical bug in its exercise function: msg.value was checked inside a loop but only the first batch of ETH was actually received. Attackers called exercise() with multiple vaults in a single transaction, reusing the same ETH batch to withdraw collateral multiple times.","theft":true,"onchain":true},{"id":"ht29dcd3d926","date":"2020-08-01","name":"CWT","kind":"hack","fam":"other","tech":"Ransomware","usd":4500000.0,"lo":4500000.0,"hi":4500000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cybelangel.com/blog/ragnar-locker-targets-cwt/"}],"desc":"CWT, the fifth largest travel company in the United States, agreed to pay $4.5 million worth of bitcoin to hackers who hijacked its computer systems.","theft":true},{"id":"htadca0026b9","date":"2020-08-01","name":"ETC","kind":"hack","fam":"other","tech":"The miner using the old software","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-7810"}],"desc":"Bitfly tweeted that today, the ETC blockchain has undergone a chain reorganization of 3693 blocks at a block height of 10904146. This causes all state construction nodes to stop synchronizing. The ETC blockchain did not produce blocks for nearly 6 hours, and then the block production returned to normal.","theft":true},{"id":"htbe07af585e","date":"2020-08-01","name":"YYFI","kind":"fraud","fam":"insider","tech":"Scam","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://decrypt.co/37601/yfi-clones-when-one-wifey-is-not-enough"}],"desc":"YFII's hard fork project YYFI has completely become an \"exit scam\" in the early morning of August 1. From the very beginning, this project seems to be determined to prepare for its own run."},{"id":"htaa2b7e9b15","date":"2020-07-31","name":"2gether","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin","Ethereum"],"usd":1183000.0,"lo":1183000.0,"hi":7000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.securitylab.ru/news/530338.php"}],"desc":"Attackers compromised 2gether's infrastructure, stealing approximately 27% of platform funds: 114 Bitcoin and 276 Ether from user accounts. The platform announced reimbursement options converting losses to 2GT tokens.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht132ea38ab4","date":"2020-07-25","name":"Ledger","kind":"hack","fam":"keys","tech":"Information Leakage","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach"}],"desc":"On July 25, 2020, there was unauthorized access to Ledger's database, resulting in data leakage. The leaked data includes e-commerce and marketing data, but payment information and encrypted assets are safe. Ledger’s announcement claimed that the API Key was used to achieve unauthorized access to the database. Currently, the API Key has become invalid.","theft":true},{"id":"ht6d2bdfa603","date":"2020-07-16","name":"Twitter","kind":"hack","fam":"keys","tech":"Account Compromise","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.bbc.com/zhongwen/simp/science-53429460"}],"desc":"In the early hours of this morning, many celebrity politicians and some companies' Twitter accounts were attacked by hackers, and these Twitter accounts all published relevant digital currency phishing scam information. However, the phishing information was deleted a few minutes after it was posted. As of now, the scammers have received 12.86 bitcoins in total.","theft":true},{"id":"ht31b9a9ce40","date":"2020-07-11","name":"Cashaa","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":3100000.0,"lo":3100000.0,"hi":3100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/hacker-stole-336-btc-from-crypto-exchange-cashaa"}],"desc":"Attackers deployed malware on an OTC transaction manager's computer at Cashaa. The malware remained dormant until the employee logged into the system, then initiated 8 separate Bitcoin transfers totaling 335.91 BTC to attacker-controlled wallets across two days.","theft":true},{"id":"htcf47781c06","date":"2020-07-10","name":"BitClub","kind":"fraud","fam":"insider","tech":"Ponzi","usd":722000000.0,"lo":722000000.0,"hi":722000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.justice.gov/usao-nj/pr/california-man-admits-securities-and-tax-offenses-related-722-million-bitclub-network"}],"desc":"From April 2014 to December 2019, the BitClub network was a fraudulent scheme that solicited funds from investors in exchange for stakes in so-called cryptocurrency mining pools and rewarded their investments, according to an announcement issued by the U.S. Attorney's Office in New Jersey. to recruit new investors into the program. Over the five-year period of the program, BitClub defrauded investors of at least $722 million in bitcoin.","review":["single source for a loss of $500M or more"]},{"id":"ht037a179621","date":"2020-07-10","name":"Bitcoin Gold","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/07/11/attempted-51-attack-on-bitcoin-gold-was-thwarted-developers-say/"}],"desc":"The team that developed Bitcoin Gold (BTG), a bifurcated project, has announced a 51% attack. According to the official disclosure, THE BTG network has been hit by 51% attacks lasting nearly 10 days. However, on July 2, the BTG team had issued an attack alert to the mine pool and the exchange and issued version 0.17.2, which included checkpoints at 640,650 blocks. The BTG team reminds all BTG Core nodes to upgrade to version 0.17.2.","theft":true},{"id":"ht891538a5f8","date":"2020-07-10","name":"Russian blockchain voting platform","kind":"hack","fam":"keys","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcfans.com/en-us/flash/id-1459"}],"desc":"In the recent referendum on constitutional reform, 1.14 million Russians voted through the blockchain platform, but their data has been made public on the Internet and can be accessed directly from state-owned servers. Election officials Shared a ZIP file containing id card information, passport Numbers and other passport information of people who voted on the blockchain platform, sources said. The ZIP file is stored on a government website. The files are free and can be downloaded by anyone at any given time. In addition, the files are password-protected, though the passwords are not very strong. Meanwhile, there are other problems with the blockchain voting platform, such as a loophole for partial repeat votes.","theft":true},{"id":"ht1bd2954dcb","date":"2020-07-03","name":"Ravencoin","kind":"hack","fam":"code","tech":"Minting Attack","usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://paper.seebug.org/1275/"}],"desc":"Ravencoin's community member CryptoScope team discovered that there are vulnerabilities in the Ravencoin blockchain, which has been cast by unknown people. 1.5% of the total RVN is 21 billion. Tron Black, the developer of Ravencoin, said that these tokens may have been sold to the market after being mined, so the economic losses have been absorbed by the Ravencoin ecosystem. The official reminds all miners, mining pools or exchanges to upgrade the client to the latest version, just use the latest version. The community is also considering various options to reduce the subsequent impact of the incident, such as halving the time in advance to restore the total to the original planned 21 billion.","theft":true},{"id":"ht5ce390cdab","date":"2020-07-01","name":"VETH","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Ethereum"],"usd":900000.0,"lo":900000.0,"hi":900000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/newsflash/p-447988.html"}],"desc":"Coingecko researcher Daryllautk tweeted that VETH suffered a hacker attack on the decentralized exchange Uniswap. The hacker stole 919,299 VETH (worth $900,000) using only 0.9ETH. After the attack, VETH officially stated that the contract was used by the UX improvement it placed in transferForm(), which was their fault. They will redeploy vether4 and will compensate all affected Uniswap pledgers. This attack mainly uses the visibility of the changeExcluded function in the contract to be external and there is no permission restriction. The user can directly make external calls to create the necessary conditions for the attack.","theft":true},{"id":"ht3bfdfdda17","date":"2020-07-01","name":"Vether","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":450000.0,"lo":450000.0,"hi":450000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"An attacker paid a 128 Vether exclusion fee and exploited an access control flaw in the V3 contract to gain control of all remaining Vether. They claimed 900,000 Vether and liquidated 150,000 on Uniswap for approximately 15 ETH.","theft":true},{"id":"ht231a023b45","date":"2020-06-30","name":"Balancer","kind":"hack","fam":"market","tech":"Flash loan attack","chains":["Ethereum"],"usd":2408.0,"lo":2408.0,"hi":2408.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/frenzy_hao/status/1277597671847411712"}],"desc":"According to DeBank Twitter, hackers once again used dYdX's lightning loan to attack the COMP trading pair in Balancer's part of the liquidity pool, and took away the unreceived COMP rewards from the pool to make a profit of 10.8 ETH, which is about $2408.","theft":true},{"id":"htb959e7a9de","date":"2020-06-28","name":"Balancer","kind":"hack","fam":"code","tech":"Incorrect Share Accounting","target":"DeFi Protocol","chains":["Ethereum"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/defi-protocol-balancer-hacked-through-exploit-it-seemingly-knew-about"}],"desc":"Balancer pools holding deflationary tokens (like STA which burns 1% per transfer) were exploited. An attacker used a dYdX flashloan to repeatedly trade between STA and ETH, depleting STA to 1 wei while Balancer's balance tracking failed to account for the fee burns. They extracted ETH, WBTC, LINK and SNX from severely imbalanced pools.","theft":true,"onchain":true},{"id":"hted14ca4089","date":"2020-06-25","name":"Web3 DeFi","kind":"phishing","fam":"social","tech":"Phishing attack","chains":["Ethereum"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.phishfort.com/blog/web3-phishing-has-finally-arrived"}],"desc":"The malicious Web3 applications \"phishing dapps\" were discovered in a recent study, they pretend to be legitimate applications or services to steal cryptocurrencies. For example, since MakerDAO officially closed the single-mortgage Sai system, such phishing tools have begun to appear, and they pretended to need a new tool to help users migrate from SAI to DAI. For example, a domain name provides a simple interface to start the migration from SAI to the new DAI at a 1:1 ratio, it seems like an official channel. However, the actual transaction to be signed simply sends the SAI to an address owned by the attacker. SAI, which has been traced to more than US$100,000, was transferred to the attacker's account.","theft":true},{"id":"ht343a934f0a","date":"2020-06-24","name":"Atomic Loans","kind":"hack","fam":"code","tech":"Unknown","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://atomic.loans/blog/vulnerability-disclosure-and-pause-new-loan-requests/"}],"desc":"Atomic Loans, issued a decision on vulnerability disclosure and suspension of new loan requests. The decision shows that the security researcher samczsun privately disclosed two vulnerabilities in the currently deployed contracts and lender agents.oth vulnerabilities would've allowed a malicious borrower to unlock part/ all of their  BTC collateral without repaying their loan in specific circumstances. Up to now, neither of these vulnerabilities were exploited by any users, and there were no funds impacted on the platform. Additionally the platform has disabled the ability for any borrower or lender to participate in new loans until they launch v2.","theft":true},{"id":"ht5af3abcd49","date":"2020-06-23","name":"DDM","kind":"hack","fam":"other","tech":"Malicious hijacking","chains":["Ethereum"],"usd":40000.0,"lo":40000.0,"hi":40000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://twitter.com/DMMDAO/status/1275244345549938693"}],"desc":"The official DeFi money market agreement DMM Twitter said that during $DMG public sale today, its telegram was unfortunately brigaded by malicious actors who impersonated the DMM Foundation with sole the intent of stealing funds. After digging through the on-chain transactions to find those affected, the official sent a total of $40k worth of DMG to those affected at an exchange rate of $0.40 per DMG, hoping to make sure everyone who lost funds were made whole.","theft":true},{"id":"ht6bc96c3ed5","date":"2020-06-21","name":"Bancor V3","kind":"hack","fam":"code","tech":"Improper Access Control","target":"DeFi Protocol","chains":["Ethereum"],"usd":544885.0,"lo":135229.0,"hi":544885.0,"conf":"B","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/Hex_Capital/status/1273469889622077441"}],"desc":"Bancor Network v0.6 smart contract lacked authentication on the 'from' address parameter, allowing anyone to use stored token approvals to steal user funds. The Bancor team conducted a self-exploit withdrawing $409,656, but front-runners capitalized on the same vulnerability extracting an additional $135,229 before patch deployment.","theft":true,"onchain":true,"review":["sources disagree on the loss"]},{"id":"htf848fd2ffe","date":"2020-06-19","name":"Wirecard","kind":"scam","fam":"social","tech":"Scam","usd":2130000000.0,"lo":2130000000.0,"hi":2130000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/crypto-card-issuer-wirecard-missing-2-1-billion-cash/"}],"desc":"About $2.13 billion worth of cash is missing from one of Wirecard's trust accounts, and the crypto debit card provider cannot as yet account for the money. In a statement, the crypto debit card provider blamed \"spurious\" cash balances provided by a third party with the aim of deceiving the auditor, which discovered the scandal during a routine audit. Wirecard said it is investigating the matter in close cooperation with the auditor. The amount missing equals 25% of the funds on the company's balance sheet.","theft":true,"review":["single source for a loss of $500M or more"]},{"id":"htfe298486b0","date":"2020-06-10","name":"DeversiFi","kind":"hack","fam":"code","tech":"System design defect","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.quadrigainitiative.com/hackfraudscam/deversifilaunchexploit.php"}],"desc":"The new version of DeversiFi encountered a vulnerability in less than a week after it was launched. The official said that it would be fixed as soon as possible. The cause of this vulnerability was that a trader tried to submit an order larger than the limit, and the logic of why the system designed order limit is to avoid user's misoperation. After that, the system still repeatedly submitted the order, but it was continuously rejected by the system, which affected the processing of other orders.","theft":true},{"id":"ht5b6880288f","date":"2020-05-28","name":"Filecoin","kind":"hack","fam":"code","tech":"Contract Vulnerability","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mobile.twitter.com/natalie6block1/status/1266002332808024064"}],"desc":"6Block technical staff found a serious vulnerability in the Filecoin code, through which the unlimited issuance of Filecoin can be achieved. The 6Block stated that, for proving the effectiveness of the vulnerability, the three miner accounts t01043, t027999, and t0234783 of 6Block had completed an additional issuance of 1.6 billion Filecoin using the vulnerability, taking the top three places in the Filecoin rich list. The 6Block team independently discovered and reported the vulnerability to Filecoin official, and is currently actively assisting the Filecoin to complete the vulnerability fixing.","theft":true},{"id":"ht2ac75d1aa3","date":"2020-05-27","name":"LMEX","kind":"hack","fam":"other","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.quadrigainitiative.com/hackfraudscam/lmexstockexchange.php"}],"desc":"The LMEX Stock Exchange's community issued a notice on the adjustment of exchange operations, stating that the platform was hacked and stolen and lost 150,000 USDT, which caused the platform to have a low debt. The deposit and withdrawal have been closed.","theft":true},{"id":"ht3a3115bc4b","date":"2020-05-18","name":"TBTC","kind":"hack","fam":"keys","tech":"Insufficient testing","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.8btc.com/article/599249"}],"desc":"After about 48 hours of testing on both the Ethereum and Bitcoin mainnets, the Keep team decided to trigger the 10-day emergency deposit moratorium allowed by the TBTCSystem contract, the team found that deposits were being blocked when certain types of Bitcoin addresses were used for redemption. The decision to trigger the moratorium came after a major issue with the redemption flow of the contract that put open deposit signer deposits at risk of liquidation. The team summarizes as follows: 1. First, the Keep team failed to conduct more tests after the new commit was proposed. As a result, the team missed the opportunity to catch this issue during development. 2. During the dApp-based manual QA process, the Keep team did not verify whether a successful exchange in the UI resulted in a closed deposit on-chain. As a result, the team missed the opportunity to find issues during the manual QA process. 3. The Keep team did not adequately consider input validation at the entry point of redemption. This is one of the relatively few pieces of data in the system that is completely user-controlled, and should therefore be a top consideration for input validation. 4. The Keep team did not spend enough time generating Bitcoin test vectors for unit tests.","theft":true},{"id":"htb3a7bfd94b","date":"2020-05-07","name":"Loopring","kind":"hack","fam":"keys","tech":"System design defect","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.loopring.io/loopring-exchange-frontend-password-bug-postmortem-cf55ce7e0150"}],"desc":"Loopring has appeared a serious front-end error, the private key material is set within a range of 32-bit integer, you can find all user private key pairs by brute force method, due to the user's EdDSA key pair is actually limited to a space of 32-bit integer, the hacker can find out the EdDSA key pair of all users by brute force method. Affected by this, Loopring Exchange shut down for half a day for maintenance and upgrade.","theft":true},{"id":"hte76d4e07e0","date":"2020-05-06","name":"Youbi","kind":"hack","fam":"keys","tech":"DDoS Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://m.jinse.com/lives/165897.html"}],"desc":"According to the official news from Youbi Exchange, Youbi has encountered heavy network-traffic DDoS attacks for three consecutive days since the platform coin subscription was launched on May 06, which caused the server to be inaccessible in a short time.","theft":true},{"id":"htcd03371335","date":"2020-05-01","name":"BitSG","kind":"hack","fam":"other","tech":"DDoS Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/BLgLqtYkLqmLSdyultsF5Q"}],"desc":"-The official announcement of BitSG Exchange stated that its websites bitsg and app suffered from uninterrupted DDOS continues attacks, resulting in the inability to log in normally during certain periods.","theft":true},{"id":"ht3edf1c977e","date":"2020-04-30","name":"Felix","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mobile.twitter.com/chiachih_wu/status/1258250199459221504"}],"desc":"EOS gambling DApp suffered fake EOS attack","theft":true},{"id":"htbe0022ba12","date":"2020-04-25","name":"Hegic","kind":"hack","fam":"code","tech":"Deposit Logic Flaw","target":"DeFi Protocol","chains":["Ethereum"],"usd":28537.0,"lo":28537.0,"hi":28537.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://twitter.com/HegicOptions/status/1253937104666742787"}],"desc":"Hegic's options contract had a typographical error using options.length instead of optionIDs.length, locking user funds after options expired. The developers ignored security audit warnings from Trail of Bits about critical flaws and rushed the contract to mainnet without fixes. Funds were recovered and users were refunded.","theft":true},{"id":"ht8e87dd88c4","date":"2020-04-19","name":"dForce Lending","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":25000000.0,"lo":24696616.0,"hi":25000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/hackers-steal-25-million-worth-of-cryptocurrency-from-uniswap-and-lendf-me/"}],"desc":"On April 19, 2020, dForce/Lendf.Me was exploited via ERC777 reentrancy; attacker repeatedly supplied and withdrew tokens before balance updates, stealing $25M. Funds were recovered by law enforcement and exchanges within days.","theft":true,"onchain":true},{"id":"ht4a248068db","date":"2020-04-18","name":"Uniswap V1","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":220000.0,"lo":220000.0,"hi":220000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://securityaffairs.co/wordpress/101895/cyber-crime/uniswap-lendf-me-hacked.html"}],"desc":"An attacker exploited a reentrancy vulnerability in Uniswap V1's imBTC liquidity pool using ERC777's callback mechanism. By calling deposit, triggering the ERC777 callback before balance updates, and immediately withdrawing, the attacker could drain tokens from the pool at artificial prices. The Consensys team had discovered the vulnerability in 2019 but no exploitable ERC777 token existed until imBTC launched.","theft":true,"onchain":true},{"id":"ht21bd4f37ae","date":"2020-04-08","name":"Bisq","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"DeFi Protocol","chains":["Bitcoin"],"usd":248000.0,"lo":248000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/hacker-exploits-flaw-in-decentralized-exchange-bisq-to-steal-250k"}],"desc":"Bisq's trade arbitration did not verify that the payout address for time-locked fallback transactions was the legitimate Bisq donation address. Attackers posing as sellers set their own donation address, then let trades time out, causing the platform to send the buyer's deposit, payment, and security deposit to the attacker's wallet instead of the Bisq DAO address. Six traders lost a total of 34.86 BTC on March 28 and April 7.","theft":true},{"id":"ht4a146593bd","date":"2020-04-03","name":"Cocos-BCX","kind":"hack","fam":"other","tech":"Wallet Stolen","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cocosbcx.medium.com/announcement-of-the-cocos-buyback-272be617ae57"}],"desc":"Cocos-BCX has verified with the exchange, conducted internal investigations and concluded that asset loss and malicious selling that occurred are due to the malicious theft of the mapping wallet information. After verifying and confirming with the exchange, the total amount of stolen tokens this time was 1,087,522,819.2 COCOS, and the exchange confirmed that this total amount has been sold.","theft":true},{"id":"ht102c16a7ae","date":"2020-03-25","name":"Ledger Chrome","kind":"phishing","fam":"social","tech":"Phishing attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/fake-ledger-live-chrome-extension-stole-14m-xrp-researchers-claim"}],"desc":"Attacker creates malicious Ledger Chrome extensions and tricks users into downloading malicious Ledger Chrome extensions through Google search ad serving and other methods to steal users' cryptocurrency. So far, it is known that at least 1.4 million XRP are stolen.","theft":true},{"id":"ht6f16327828","date":"2020-03-12","name":"MakerDAO","kind":"hack","fam":"market","tech":"Stale Oracle Price","target":"DeFi Protocol","chains":["Ethereum"],"usd":8320000.0,"lo":7900000.0,"hi":8320000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://coingape.com/was-makerdao-mkr-free-fall-because-of-a-system-exploit-that-saw-8-million-of-eth-stolen/"}],"desc":"During the March 12 ETH crash (43% in one day), the Maker Medianizer oracle failed to update due to network congestion and high gas fees, leaving the system with stale prices. Liquidators exploited this by bidding zero DAI for collateral worth millions, acquiring 62K ETH for free. 36% of liquidations resulted in zero-bid auctions, causing a $6M DAI shortfall and $4M bad debt before governance intervention.","theft":true},{"id":"htcf7c9643c9","date":"2020-03-05","name":"Trident Crypto Fund","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/trident-crypto-fund-data-breach-266-000-passwords-stolen"}],"desc":"The crypto fund Trident Crypto Fund was hacked and the data of 266,000 users was leaked. The database containing email addresses, mobile numbers, encrypted passwords and IP addresses was uploaded to various file-sharing sites on February 20.","theft":true},{"id":"htb656063f61","date":"2020-02-22","name":"Josh Jones","kind":"hack","fam":"other","tech":"SIM  card is hacked","usd":45000000.0,"lo":45000000.0,"hi":45000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.thestar.com/ths/news/crime/2021/11/23/hamilton-cryptocurrency-bitcoin-theft.html"}],"desc":"Josh Jones, founder of Bitcoin Builder and Mt.Gox's second largest creditor, has had $45 million worth of digital currency stolen.","theft":true},{"id":"htab8bb1990a","date":"2020-02-18","name":"Ooki","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":650000.0,"lo":650000.0,"hi":650000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On February 18, 2020 during ETHDenver, bZx was exploited via multi-protocol oracle manipulation across Kyber, Uniswap, dYdX, and Compound in a single transaction. Attacker manipulated sUSD pricing and front-ran liquidations, resulting in ~$645,000 in losses from dependence on unvalidated on-chain price oracles.","theft":true},{"id":"hta5f461c6ff","date":"2020-02-18","name":"bZx","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"usd":645000.0,"lo":645000.0,"hi":645000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptobriefing.com/2388-eth-estimated-lost-bzxs-second-exploit/"}],"desc":"bZx was attacked again with an estimated loss of $645,000 of ETH","theft":true},{"id":"htcb97735fbb","date":"2020-02-17","name":"FCoin","kind":"scam","fam":"social","tech":"Scam","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ishare.ifeng.com/c/s/7uA0gQdOBU0"}],"desc":"The FCoin exchange claimed that due to funding difficulties, the fund reserves could not be redeemed for user withdrawals, and the estimated amount of funds that could not be redeemed was between 7,000-13,000 BTC.","theft":true},{"id":"hta4d67fd5a9","date":"2020-02-17","name":"VBITEX","kind":"hack","fam":"other","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.vbitex.com/Home/Article/detail/id/57"}],"desc":"VBITEX platform was hacked, resulting in malicious manipulation of platform data and theft of virtual assets.","theft":true},{"id":"hte87286db82","date":"2020-02-15","name":"Ooki","kind":"hack","fam":"market","tech":"Spot Price Manipulation","target":"DeFi Protocol","chains":["Ethereum"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Attackers exploited bZx price oracle on February 14-15, 2020, taking flash loans and spreading funds across exchanges to manipulate wrapped bitcoin prices, profiting $350K. Oracle lacked sufficient price source diversity.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht754e86ed3e","date":"2020-02-15","name":"bZx","kind":"hack","fam":"market","tech":"Oracle Attack","chains":["Ethereum"],"usd":350000.0,"lo":350000.0,"hi":350000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://peckshield.medium.com/bzx-hack-full-disclosure-with-detailed-profit-analysis-e6b1fa9b18fc"}],"desc":"DeFi lending protocol bZx exploited, may lose up to $350,000.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht5e49fe9412","date":"2020-02-12","name":"Trinity Wallet","kind":"hack","fam":"keys","tech":"CDN Compromise","target":"Wallet","chains":["IOTA"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Trinity Wallet suffered a DNS hijacking attack on February 12, 2020 when the Cloudflare nameserver was compromised. Malicious code injected starting January 25 stole 8.55M MIOTA (~$2M to $2.35M) from 50+ users by exfiltrating private key seeds.","theft":true},{"id":"ht4f90a36e21","date":"2020-02-12","name":"IOTA","kind":"hack","fam":"code","tech":"Application Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.zdnet.com/google-amp/article/iota-cryptocurrency-shuts-down-entire-network-after-wallet-hack/?__twitter_impression=true"}],"desc":"IOTA has shut down its entire network this week after hackers exploited a vulnerability in the official IOTA wallet app to steal user funds.Estimated loss of 850000 MIOTA (valued at us $2.3 million).","theft":true},{"id":"ht4f7c021fab","date":"2020-02-05","name":"Altsbit","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin","Ethereum"],"usd":70000.0,"lo":70000.0,"hi":70000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2020/02/10/new-crypto-exchange-altsbit-says-it-will-close-following-hack/"}],"desc":"The Italian exchange Altsbit suffered a hot wallet breach on February 5, 2020, losing cryptocurrency including Bitcoin, Ether, Pirate Chain (ARRR), VerusCoin (VRSC), and Komodo (KMD). The attackers accessed hot wallets holding 'almost all funds', forcing the platform to suspend operations and eventually cease operations in May 2020. LulzSec claimed responsibility on Twitter.","theft":true},{"id":"ht7da3bf4ffd","date":"2020-02-03","name":"LuckLambo104","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Tron"],"usd":1500.0,"lo":1500.0,"hi":1500.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.first.vip/kx/peckshield%EF%BC%9A%E6%B3%A2%E5%9C%BAlucklambo104%E7%AB%9E%E7%8C%9C%E6%B8%B8%E6%88%8F%E6%8C%81%E7%BB%AD%E9%81%AD%E9%BB%91%E5%"}],"desc":"A rollback attack exploited the LuckLambo104 smart contract on February 3, 2020, one day after deployment. Attackers created attack contracts that executed transaction rollbacks, causing 6,588 TRX to be improperly redistributed from the contract. The attack highlights the importance of thorough security testing before mainnet deployment.","theft":true},{"id":"ht49aac616fd","date":"2020-01-23","name":"Bitcoin Gold","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"Layer 1","chains":["Bitcoin Gold"],"usd":70000.0,"lo":70000.0,"hi":90000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/bitcoin-gold-blockchain-hit-by-51-attack-leading-to-70k-double-spend"}],"desc":"Bitcoin Gold suffered two 51% attacks on January 23-24, 2020, resulting in 29 blocks being reorganized and deep chain reorgs that enabled double-spending attacks. Attackers rented hash power from NiceHash for ~$1,200 per attack and successfully double-spent approximately 7,167 BTG (~$70K) across two separate attacks. Binance adjusted its confirmation requirements after the incident.","theft":true},{"id":"ht26be81bb65","date":"2020-01-19","name":"Electrum","kind":"phishing","fam":"social","tech":"Phishing attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.8btc.com/article/335983"}],"desc":"Electrum suffers from \"Update Phishing\" theft. (The \"Update Phishing\" attack continues, and the older version (less than 3.3.4) is still under threat.)","theft":true},{"id":"htbaea28dd34","date":"2019-12-23","name":"Nuls","kind":"hack","fam":"code","tech":"Signature Verification Flaw","target":"Layer 1","chains":["NULS"],"usd":480000.0,"lo":480000.0,"hi":480000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/hackers-grab-nearly-480k-from-blockchain-platform-nuls"}],"desc":"NULS blockchain was hacked on December 23, 2019, losing 2M NULS tokens (~$480K) through exploitation of a signature verification vulnerability in NULS V2.2. Attackers compromised a NULS team account and transferred the funds. Of the stolen tokens, 548K NULS entered trading markets while 1.45M were frozen. NULS responded with an emergency hard fork at block 87,800 to permanently destroy the frozen tokens.","theft":true},{"id":"htf53ce76d6a","date":"2019-12-14","name":"VeChain","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Layer 1","chains":["VeChain"],"usd":6500000.0,"lo":6500000.0,"hi":6500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@vechainofficial/vechain-foundation-announcement-8459492ee039"}],"desc":"VeChain's buyback wallet was compromised on December 13, 2019, at 12:27 AM GMT, resulting in theft of 1.1B VET tokens (~$6.5M). Internal misconduct was suspected, with a trojan-infected machine containing keylogging software enabling attacker access to private keys. The VeChain Foundation issued an emergency patch causing Authority Masternodes to vote and freeze the stolen funds. On December 30, the community voted to permanently destroy 727M of the frozen VET.","theft":true},{"id":"htd8ac240d4d","date":"2019-12-06","name":"Tron Lounge","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/135913.htm"}],"desc":"The hacker at the beginning of the TFNsSk address initiated a transaction rollback attack on the Tron Lounge DApp contract beginning with TRON TR3n2D through a self-created contract, and has made a profit of 54,653 TRX so far.","theft":true},{"id":"htf37599f711","date":"2019-12-02","name":"Vertcoin","kind":"hack","fam":"keys","tech":"Validator Key Compromised","target":"Layer 1","chains":["Vertcoin"],"usd":29.0,"lo":29.0,"hi":29.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/135104.htm"}],"desc":"Vertcoin suffered a second 51% attack on December 1, 2019, with 603 VTC blocks replaced by 553 attacker-controlled blocks in a deep blockchain reorganization. Five double-spent outputs worth approximately 125 VTC (~$29) were redirected to the attacker. Attacker rented hash power for 0.5-1 BTC despite the attack being financially unprofitable; Bittrex suspended withdrawals during the attack.","theft":true},{"id":"ht47f74c9a20","date":"2019-11-27","name":"Upbit","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":49300000.0,"lo":49300000.0,"hi":49300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/upbit-hack-stolen-eth-worth-millions-on-the-move-to-unknown-wallets"}],"desc":"Upbit's Ethereum hot wallet was compromised on November 27, 2019, resulting in theft of 342,000 ETH (~$49.3M). The South Korean exchange immediately froze all deposits and withdrawals and transferred remaining hot wallet funds to cold storage. Upbit announced it would cover the loss from its own funds. Lazarus/Andariel hacking groups were later attributed responsibility by authorities.","theft":true},{"id":"htd6af73e14d","date":"2019-11-21","name":"Dice","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocking.net/23972/security-alert-wavefield-dice-contract-is-subject-to-transaction-rollback-attack/"}],"desc":"The hackers launched a trade rollback attack on TRON's Dice contracts through self-created contracts, and have gained 18,808 TRX to date.","theft":true},{"id":"htbb0d0cfcab","date":"2019-11-20","name":"GateHub","kind":"hack","fam":"other","tech":"Information Leakage","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/gatehub-crypto-wallet-data-breach-compromises-passwords-of-14m-users"}],"desc":"Gatehub Crypto Wallet Data Breach Compromises Passwords of 1.4M Users.","theft":true},{"id":"ht1cb98fedea","date":"2019-11-08","name":"VinDAX","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum","Multiple"],"usd":500000.0,"lo":500000.0,"hi":500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/46408/little-known-asian-crypto-exchange-vindax-got-hacked-lost-half-a-million-usd-worth-of-tokens"}],"desc":"VinDAX, a Vietnamese exchange launched in March 2019, was hacked on November 5, 2019, with attackers stealing $500K in digital assets across 23 small-cap cryptocurrencies from insecure hot wallets. After discovery, VinDAX immediately contacted the projects involved and froze or recovered the stolen tokens due to the small-cap nature of the assets. The platform later fully recovered the stolen value through coordination with affected projects.","theft":true},{"id":"ht90b9812794","date":"2019-11-07","name":"BetHash","kind":"hack","fam":"code","tech":"Malicious Code Injection Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cmichel.io/what-really-happened-with-the-eos-play-hack/"}],"desc":"BetHash's betting game mechanism allows players to guess the ratio of the number between 0-100 and the random number given by the system to win the bonus of the corresponding odds. The smaller the bet number, the greater the odds. Every time a player makes a bet, the dicereceipt() function of the BetHash smart contract will be called to notify the player's account. At this point, the hacker can control the malicious program to hijack the notification and embed the inline operation to implement the attack. Although the attacker also needs to pay a certain amount of bet for every attack, as long as it keeps 0.1 EOS and is conservative","theft":true},{"id":"ht0388a032c4","date":"2019-11-01","name":"BitMEX","kind":"hack","fam":"other","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bitcoinmagazine.com/articles/bitmex-compromises-user-data-in-email-gaffe"}],"desc":"BitMEX Compromises User Data in Email Gaffe.","theft":true},{"id":"ht71083652b6","date":"2019-10-12","name":"BitDice","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.fxajax.com/1620051039.html"}],"desc":"Hackers launched a \"fake EOS\" attack on BitDice, a guessing game, earning more than 4,000 EOS and transferring it to EXMO, ChangeNOW and other exchanges.","theft":true},{"id":"ht8af9ffe78e","date":"2019-10-11","name":"Safuwallet","kind":"hack","fam":"code","tech":"Malicious Code Injection Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cryptonews.net/news/security/226480/"}],"desc":"ZenGo co-founder Ouriel Ohayon reported on Twitter that the wallet extension SAFU Wallet apparently steals large amounts of money by injecting malicious code into users. A white hat hacker said that by inspecting the SAFU code, he found that they dynamically injected this script https://safuwallet.tk/inside.js in every page being loaded. At the same time, they use obfuscation tools to make it hard to see. Nonetheless, the white hat hackers explained that they targeted MEW, Index and Binance, using background scripts to send information to 4 different endpoints on the same domain. Therefore, the created wallet is automatically shared with them. Currently, the SAFU Wallet Google Chrome website is not available after a community request to remove the extension.","theft":true},{"id":"ht5b86654e13","date":"2019-10-08","name":"WOTOKEN","kind":"fraud","fam":"insider","tech":"Ponzi","usd":1109800000.0,"lo":1109800000.0,"hi":1109800000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://coingeek.com/operators-of-1b-ponzi-scheme-wotoken-sentenced-to-9-years-in-prison/"}],"desc":"WOTOKEN, involved in a cryptocurrency pyramid selling case involving more than 7.7 billion yuan, has opened court and completed the trail in public and at Binhai County People's Court in Yancheng City, in which six major defendants were tried separately for organizing and leading pyramid selling activity; covering up and concealing income; harboring.","review":["single source for a loss of $500M or more"]},{"id":"ht60f2263a14","date":"2019-09-28","name":"Fusion","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":6400000.0,"lo":6400000.0,"hi":6400000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://fusionprotocol.medium.com/fusion-foundation-update-28-9-6479cd0a982d"}],"desc":"Fusion's swap wallet ([address]) was compromised on September 28, 2019, with attackers stealing 10M native FSN and 3.5M ERC20 FSN tokens (~$6.4M total). Investigation determined the private key was stolen and suggested potential inside involvement. Some stolen tokens were wash-traded across exchanges before being frozen, causing FSN price to crash 50% within hours.","theft":true},{"id":"ht54a5778e31","date":"2019-09-14","name":"Coinhouse","kind":"phishing","fam":"social","tech":"Phishing attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.cryptoglobe.com/latest/2019/09/french-crypto-exchange-coinhouse-suffers-phishing-attack-user-names-and-emails-compromised/"}],"desc":"Coinhouse Suffers Phishing Attack, User Names and Emails Accessed.","theft":true},{"id":"ht4997172015","date":"2019-09-02","name":"skreosladder","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/117430.html"}],"desc":"\"skreosladder\" has been attacked again by hackers, who have earned thousands of EOS. The hacker has attacked the game several times and has been blacklisted by the project side, but the hacker still used the trumpet to circumvent the restrictions.","theft":true},{"id":"ht103766ac22","date":"2019-08-17","name":"CoinTiger (PTT)","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum"],"usd":9200000.0,"lo":9200000.0,"hi":9200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://supportproton.zendesk.com/hc/en-us/articles/360032606571--Aug-17-Notification-on-the-PTT-s-Illegal-Stealing-at-CoinTiger-Exchange"}],"desc":"CoinTiger's cold wallet was breached on July 1, 2019, but the theft was only announced on August 17, 47 days later. Attackers stole 401,981,748 PTT tokens (~$9.2M), which they distributed across markets (120M PTT entered trading, causing the price to crash nearly 100%) while 280M were frozen by the Proton Chain project. CoinTiger's lack of multi-signature security on cold storage enabled the compromise.","theft":true},{"id":"ht369c540d7f","date":"2019-08-13","name":"Bitstamp","kind":"hack","fam":"code","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/113698.htm"}],"desc":"There is a vulnerability in Bitstamp, which can be used by attackers to view a large number of sensitive information such as user IDs and bank CARDS, seriously threatening the information security of users.","theft":true},{"id":"ht86117ea5b8","date":"2019-08-13","name":"SKR EOS","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/9UD5Rf1xYVyS2imHb71_Tw"}],"desc":"SKR EOS games have again been attacked by hackers, who have now earned about 4,000 EOS. After analysis, hackers still use the transaction congestion attack, operating multiple trumpet attacks on the game in turn.","theft":true},{"id":"hte738b80edb","date":"2019-08-10","name":"SKReos","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/113210.htm"}],"desc":"The skreosladder game has been attacked by hackers again, and hackers have now profited thousands of EOS. After preliminary analysis, hackers still use transaction crowding attacks, but the difference is that hackers control a large number of accounts to place bets at the same time, and then multiple accounts are used to push blocks due to the large number of accounts participating in the attack. The connection between accounts is not obvious, and the attack is highly concealed.","theft":true},{"id":"ht1225dba186","date":"2019-08-04","name":"Royale","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/111995.htm"}],"desc":"EOS Royale has been attacked by hackers, who have gained around 18,000 EOS.","theft":true},{"id":"ht8e623ab603","date":"2019-08-02","name":"LuckyClover","kind":"hack","fam":"other","tech":"Hard_fail attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/111644.htm"}],"desc":"Multiple hackers have launched a series of attacks on the EOS game LuckyClover, earning thousands of EOS.","theft":true},{"id":"ht08166c3a39","date":"2019-08-02","name":"UnicornBet","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/111644.htm"}],"desc":"Multiple hackers have launched a series of attacks on the EOS game UnicornBet, earning thousands of EOS.","theft":true},{"id":"htc29a915671","date":"2019-07-27","name":"MULTI.TODAY","kind":"hack","fam":"code","tech":"Rule Exploitation","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/110439.htm"}],"desc":"The attacker adopted a \"card position\" rollback betting method for the game mechanics: the first gameplay investment of the game is profitable early, and the \"player\" deploys the contract to invest at the beginning of each round, thereby making the investment The return is maximized, so far the attacker has made a total of 102,652 TRX.","theft":true},{"id":"htf40446eabf","date":"2019-07-25","name":"7Tron","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/110017.htm"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/110227.htm"}],"desc":"The attackers launched a trade rollback attack on the contracts, which so far has yielded a total of 113,913 TRX.","theft":true},{"id":"ht25121de618","date":"2019-07-25","name":"YouHodler","kind":"hack","fam":"other","tech":"Information Leakage","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bitcoinexchangeguide.com/youhodler-crypto-loan-platform-affected-by-data-leak-of-customers-credit-card-details/"}],"desc":"The cryptocurrency lending company YouHodler was affected by a data leak that contained information about users on its platform. Some of the data that was released to the market includes bank accounts, passport numbers, card numbers and many other things.","theft":true},{"id":"htb9aac06fd3","date":"2019-07-24","name":"QuickBit","kind":"hack","fam":"other","tech":"Information Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://thetradable.com/quickbit-crypto-exchange-user-data-breached/"}],"desc":"According to QuickBit, the breach resulted in data of users such as names, emails, physical addresses and even card information was exposed. The exchange has said it has estimated about 2% user data was left unprotected. The exchange has claimed that although data was bare and accessible to anyone who had the knowledge on how to access it, none of the data has been affected or copied.","theft":true},{"id":"htf6dee49865","date":"2019-07-24","name":"TronCity","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/109824.htm"}],"desc":"There was an unusually large transaction in the game contract of the TronCity project. The total balance of 257,112 TRX in the game contract was emptied at one time.","theft":true},{"id":"ht6a625b9414","date":"2019-07-23","name":"TronChip","kind":"hack","fam":"other","tech":"Random number attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoluo.cn/kuaixun/detail-76270.html"}],"desc":"Hackers launched a series of attacks on TronChip, earning a total of 61,867 TRX.","theft":true},{"id":"ht9e0141b0c0","date":"2019-07-12","name":"BitPoint","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin","Ethereum","Litecoin","XRP"],"usd":27600000.0,"lo":27600000.0,"hi":27610000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/bitpoint-cryptocurrency-exchange-hacked-for-32-million/"}],"desc":"BitPoint, a Tokyo-based exchange, discovered hot wallet breaches on July 11-12, 2019, losing approximately 3.02B yen (~$27.6M) across multiple assets: 1,225 BTC, 1,985 BCH, 11,169 ETH, and 5,108 LTC. Of the loss, $23M belonged to customers and $9.2M to BitPoint itself. The exchange later recovered ~$2.3M in stolen cryptocurrency from overseas exchanges and reimbursed customers before resuming operations.","theft":true},{"id":"htd49719bee3","date":"2019-07-11","name":"My Dash Wallet","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/AoSnsDJa11_3RCzdx1n2rw"}],"desc":"My Dash Wallet has been embedded with a malicious script, the malicious script will upload the user's DASH currency account balance, keystore, private key, seed and other key information to https://api.dashcoinanalytics.com/stats.php.","theft":true},{"id":"htd97d1b0374","date":"2019-07-10","name":"Trezor","kind":"hack","fam":"keys","tech":"Wallet Vulnerability","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ledger-donjon.github.io/Unfixable-Key-Extraction-Attack-on-Trezor/"}],"desc":"An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$. This vulnerability affects Trezor One, Trezor T, Keepkey and all other Trezor clones. Unfortunately, this vulnerability cannot be patched.","theft":true},{"id":"htf630069981","date":"2019-07-08","name":"Bitmarket","kind":"hack","fam":"other","tech":"Insufficient liquidity","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2019/07/09/polish-crypto-exchange-bitmarket-suddenly-shuts-down/"}],"desc":"On July 8, the Polish-based exchange Bitmarket abruptly shut down due to liquidity issues. The shutdown allegedly cost users a total of 2300 bitcoin (approximately $23 million) according to Polish prosecutors. The exchange’s official site was replaced with the following message: “We regret to inform you that due to the loss of liquidity, from 08/07/2019, Bitmarket.pl/net was forced to cease its operations. We will inform you about further steps.” Two weeks later, one of the exchange's co-owners was found shot dead","theft":true},{"id":"htedbe925a86","date":"2019-07-04","name":"Soxex","kind":"rugpull","fam":"insider","tech":"Rug Pull","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coinonpro.com/kuaixun/49935.html"}],"desc":"Soxex exchange has been exposed to abscond with the funds. At present, the website of the exchange has been unable to open, and hundreds of millions of funds of investors have been swept away, involving BTC, ETH, HT, OKB and other mainstream currencies. Over 1 million USDT has been flowing into other exchanges.","theft":true},{"id":"ht8415b769d5","date":"2019-07-04","name":"TKjoHFN","kind":"hack","fam":"other","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/search/Bitpoint"}],"desc":"The hackers launched an attack by rolling back the transaction, and so far, the attack has been profitable.","theft":true},{"id":"ht70e255cb44","date":"2019-07-03","name":"HiGold Game","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/105520.htm"}],"desc":"The hacker launched a continuous attack on the HiGold Game and realized the profit.","theft":true},{"id":"ht5cc6b809a1","date":"2019-07-02","name":"TLGUt5","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/105246.htm"}],"desc":"The attacker launched multiple roll back attacks on the DApp contract address beginning with TLGUt5. So far, it has gained 45,200 TRX, and the contract balance of the attacked contract is almost zero.","theft":true},{"id":"ht9c1e7ceb31","date":"2019-06-30","name":"Waltonchain","kind":"hack","fam":"other","tech":"Coordinated Attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bitcoinexchangeguide.com/waltonchain-blockchain-has-been-attacked-how-is-this-affecting-the-network/"}],"desc":"The mainnet of Waltonchain was suffered coordinated attack, and the problem has been solved through the upgrade of the mainnet.","theft":true},{"id":"ht1ce1916782","date":"2019-06-30","name":"波场超级社区（TRX·μTORRENT SUPER COMMUNITY）","kind":"rugpull","fam":"insider","tech":"Rug Pull","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoluo.cn/article/detail-51738.html"}],"desc":"At 1:00 am on June 30, the App of Torrent super community was shut down. All of the wallet assets were moved out two weeks ago, and investors are currently unable to cash out.","theft":true},{"id":"ht3fd0eb1fdc","date":"2019-06-29","name":"PlusToken","kind":"fraud","fam":"insider","tech":"Ponzi","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/vanuatu-extradicts-six-chinese-citizens-allegedly-involved-in-crypto-scheme"}],"desc":"PlusToken collapsed. Currently, PlusToken wallets can only be transferred in and cannot be withdrawn. Some investors said that 35 hours after the withdrawal of the coin, the account has not yet arrived. It is suspected that the reason given by the PlusToken promotion team is that the recent Bitcoin network transactions are busy, and the time for confirmation of the account has become longer, so you need to wait patiently. The largest MLM project in the currency circle has since collapsed."},{"id":"ht77ef756558","date":"2019-06-28","name":"SPOKpark","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://blocking.net/8691/monitoring-shows-wave-field-spokpark-is-subject-to-transaction-rollback-attack/"}],"desc":"Hackers have made a profit of 50,845 TRX by creating multiple contracts to launch a trade rollback attack on SPOKpark, a Tron DApp game. The SPOKpark website is no longer accessible.","theft":true},{"id":"htbbb856da6c","date":"2019-06-27","name":"Bitrue","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["XRP","Cardano"],"usd":4700000.0,"lo":4700000.0,"hi":4700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/104224.htm"}],"desc":"Hackers exploited a vulnerability in Bitrue's withdrawal risk-control second-review process, bypassing security checks to drain 9.3M XRP and 2.5M ADA from the hot wallet.","theft":true},{"id":"ht75571e53fc","date":"2019-06-27","name":"Bitsane","kind":"scam","fam":"social","tech":"Scam","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/exit-scam-dublin-based-exchange-bitsane-vanishes-with-users-funds"}],"desc":"According to Forbes on June 27, Bitsane, an Irish cryptocurrency exchange, disappeared without a trace last week, had lied to as many as 246000 users.","theft":true},{"id":"htaf621b5562","date":"2019-06-25","name":"Synthetix v1+v2","kind":"hack","fam":"market","tech":"Oracle Misconfiguration","target":"DeFi Protocol","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/tiny/synthetix-suffers-oracle-attack-potentially-looting-37-million-synthetic-ether/"}],"desc":"An oracle price feed reported Korean Won at 1000x higher than actual rate due to API outage reducing redundancy. A trading bot exploited the misconfiguration to generate over 37M sETH in profits within an hour. All funds were recovered through white-hat negotiation and bug bounty.","theft":true},{"id":"ht4ec049e7b5","date":"2019-06-24","name":"yizeslotsbet","kind":"hack","fam":"code","tech":"Transfer error prompt","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.qklw.com/lives/20190624/6774.html"}],"desc":"EOS contract yizeslotsbet suffers transfer error prompt, the attacker has already obtained 1,0000 FB token.","theft":true},{"id":"htf507122f3e","date":"2019-06-14","name":"SKR EOS","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/101608.htm"}],"desc":"Continuous attack by hackers to SKR EOS, earning thousands of EOS.","theft":true},{"id":"htc5c5db0d51","date":"2019-06-12","name":"MGC","kind":"rugpull","fam":"insider","tech":"Rug Pull","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/101217.htm"}],"desc":"MGC wallet is exposed to carry user assets disappear, users' digital assets are aggregated to 0x4f9cxx, 0x2b29xx beginning two addresses in a short time.","theft":true},{"id":"ht5c712992b8","date":"2019-06-12","name":"Roulette","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/101189.htm"}],"desc":"The hacker has gained 27,000 TRX by launching a trade rollback attack on the  DappRoulette contract with a self-created contract.","theft":true},{"id":"ht2e58b37913","date":"2019-06-11","name":"BETX","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/100822.htm"}],"desc":"The 600 million BETX tokens held by BETX managers were stolen by hacker and sold on the Newdex exchange. Preliminary analysis shows that the cause of this attack is that the private key of BETX project is stolen, and the hacker gains the owner privilege and transfers all the existing tokens of the contract. The selloff caused the BETX token to fluctuate sharply and close to zero.","theft":true},{"id":"ht1bcccec901","date":"2019-06-11","name":"TokenStore","kind":"rugpull","fam":"insider","tech":"Rug Pull","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/100910.htm"}],"desc":"The TokenStore wallet was exposed as a \"runaway\", which swept away billions of investors' money, involving BTC, XRP, ETH and other mainstream currencies.","theft":true},{"id":"htf6528a6b4a","date":"2019-06-06","name":"GateHub","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["XRP"],"usd":9500000.0,"lo":9500000.0,"hi":9500000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/100522.htm"}],"desc":"GateHub wallets were compromised via API tokens authorized with valid credentials, allowing attackers to steal 23.2M XRP from approximately 100 user accounts. Of this, 13.1M XRP was laundered through exchanges before recovery efforts.","theft":true},{"id":"htc3e3faf30b","date":"2019-06-03","name":"Coinroom","kind":"fraud","fam":"insider","tech":"Scam","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/report-polish-exchange-shuts-down-and-disappears-with-customers-funds"}],"desc":"Polish cryptocurrency exchange Coinroom suddenly shut down its service in April, suspected of defrauding customers and running away with funds. Although the exact amount involved in the fraud is unclear."},{"id":"htcdca829217","date":"2019-06-02","name":"Kraken","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Bitcoin"],"usd":10450000.0,"lo":10450000.0,"hi":10450000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blockonomi.com/bitcoin-flash-crash-kraken/"}],"desc":"A hacker compromised a whale account holding 1,200 BTC, placed orders to purchase BTC at artificially low prices, then dumped the stolen BTC to trigger execution and pocket $10.45M from liquidations of other users' positions.","theft":true},{"id":"hte5712f9b94","date":"2019-05-29","name":"Remitano","kind":"hack","fam":"other","tech":"False XRP deposits","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/98502.htm"}],"desc":"Due to the failure to take effective measures against user complaints, XRP buyers have suffered a lot of losses. The cryptocurrency exchange Remitano has announced that it has suspended all XRP deposits and withdrawals to solve the problem of false XRP deposits.","theft":true},{"id":"hta53db5425f","date":"2019-05-24","name":"Poker EOS","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["EOS"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/97365.htm"}],"desc":"Poker EOS game's private key was compromised and disclosed publicly, allowing attackers to drain the game's funds. Over 26,992 EOS were extracted and transferred to exchanges.","theft":true},{"id":"ht7c810c06c9","date":"2019-05-22","name":"Coinbase","kind":"hack","fam":"other","tech":"SIM Card Attack","target":"CEX","usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/hackers-steal-100-000-worth-of-btc-from-engineering-manager-at-crypto-custodian-bitgo"}],"desc":"Hackers steal $100,000+ worth of BTC from engineering manager at Crypto Custodian BitGo. Sean Coonce, engineering manager at cryptocurrency custodian BitGo. According to the post, Coonce had over $100,000 siphoned out of his account on cryptocurrency exchange Coinbase in under 24 hours. Coone details SIM swapping, a practice that sees the attacker maliciously requesting a telecommunications carrier to redirect the traffic of a mobile phone number to a device over which they have control.","theft":true},{"id":"ht896d872079","date":"2019-05-13","name":"DiceGame","kind":"hack","fam":"other","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/95033.htm"}],"desc":"The DiceGame game suffered a roll back attack, and the hackers at the TYUcGmi address gained a total of 5,150 TRX.","theft":true},{"id":"ht798f54174c","date":"2019-05-07","name":"Binance","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":40000000.0,"lo":40000000.0,"hi":40000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://binance.zendesk.com/hc/en-us/articles/360028031711-Binance-Security-Breach-Update"}],"desc":"On May 7, 2019, Binance's hot wallet private keys were compromised, resulting in theft of 7,000 bitcoin (~$40 million). The exchange halted transactions for one week and reimbursed all affected customers from its insurance fund.","theft":true},{"id":"ht5d5016b3e1","date":"2019-05-03","name":"TronBank","kind":"hack","fam":"insider","tech":"Backdoor Contract","target":"DeFi Protocol","chains":["Tron"],"usd":4270000.0,"lo":4270000.0,"hi":4270000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/aInEaYdS9X7HP7FbzWl6AQ"}],"desc":"A backdoor was injected into TronBank's compiled bytecode during deployment via TronSmartContract.space. The hacker exploited the backdoor in the withdraw() function to extract 26.73M TRX from the contract.","theft":true},{"id":"htb62f7cf55e","date":"2019-05-02","name":"BitoPro","kind":"hack","fam":"other","tech":"False top-up","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/93091.htm"}],"desc":"Taiwan exchange BitoPro's XRP suffered an attack that caused a price crash and is thought to have lost about 7m XRPS.","theft":true},{"id":"hta1bed6ab1d","date":"2019-05-02","name":"Wheel Of Fortune","kind":"hack","fam":"code","tech":"Roll back attack","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.tuoniaox.com/newsflash/p-345662.html"}],"desc":"The TRON Wheel Of Fortune DApp is being attacked by a transaction rollback, with a total loss of 7,856 TRX, and the attack is still ongoing. Previously, security personnel found that the hacker continued to conduct transaction rollback attacks on multiple DAPP contract addresses through the same method.","theft":true},{"id":"ht74fb7c6236","date":"2019-04-29","name":"eosblue.one","kind":"hack","fam":"keys","tech":"Memo attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.longkuicj.com/27528.html"}],"desc":"The attacker constructed the malicious memo, which caused the eosblue.one server parsing exceptions, thus continuously winning prizes or leading to unusually large refunds.","theft":true},{"id":"hted001d418c","date":"2019-04-26","name":"Bitfinex","kind":"scam","fam":"social","tech":"Scam","target":"CEX","usd":851000000.0,"lo":851000000.0,"hi":851000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.reuters.com/article/us-new-york-ifinex-settlement-idUSKBN2AN1NM"}],"desc":"Bitfinex is accused of sending 850 million U.S. dollars to Crypto Capital Corp, a payment processor believed to be located in Panama, without informing customers, and withdrawing at least 700 million U.S. dollars from Tether's reserves after the funds were lost.","theft":true,"review":["single source for a loss of $500M or more"]},{"id":"ht1f12f8f70f","date":"2019-04-11","name":"TronBank","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Tron"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://coingape.com/tronbank-dapp-attack-tron-dapp-vulnerabilities/"}],"desc":"TronBank's invest() function did not validate that msg.tokenId was the legitimate BTT token, allowing attackers to use counterfeit tokens and artificially inflate their BTT balance. Nearly 200M counterfeit BTTs were minted.","theft":true},{"id":"htaa886be6c4","date":"2019-04-11","name":"TronWow","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["Tron"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/89296.htm"}],"desc":"TronWow gambling game's random number generation was exploitable, allowing attackers to predict game outcomes. Attackers launched 1,203 attacks and extracted 2,167,377 TRX in profits.","theft":true},{"id":"hte148ac1aae","date":"2019-04-10","name":"IseriCoin","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/89100.htm"}],"desc":"Hacker has used contract vulnerabilities to send a huge amount of IseriCoin tokens to his account.","theft":true},{"id":"ht0731ecc3c6","date":"2019-04-03","name":"DEOS Games","kind":"hack","fam":"code","tech":"Automatically attack lucky draw system","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.8btc.com/article/385671"}],"desc":"Attackers continue to make continuous profits by creating new accounts and calling the luckydraw method of the EOS quiz game DEOS Games contract. Currently, over 300 accounts have been created and thousands of EOS have been accumulated. Different from the known attack characteristics in the past, it is preliminarily judged that this attack is a new type of attack. The attacker creates new accounts in batches, and then places small bets in exchange for a larger return. The return rate of betting is abnormally high, resembling \"wool wool\".","theft":true},{"id":"htf4f72d4bd9","date":"2019-04-03","name":"EOSlots","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.longkuicj.com/18119.html"}],"desc":"The attacker launched continuously attacks and profit from the EOSlots, and the game has been suspended operations.","theft":true},{"id":"ht463fe8add5","date":"2019-04-01","name":"EosNow","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.seldenfrance.com/wen/redian/54227.html"}],"desc":"The attacker once again launched an attack on the EOS quiz game eosnowbetext. After preliminary analysis, the attacker still manipulated multiple trumpets to attack the game through transaction squeeze, and has already made a profit.","theft":true},{"id":"ht7269a177b2","date":"2019-03-29","name":"Bithumb","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum","XRP"],"usd":19000000.0,"lo":19000000.0,"hi":19000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@imeosone/%E8%BF%99%E4%BA%9B%E5%B9%B4%E9%BB%91%E5%AE%A2%E6%98%AF%E5%A6%82%E4%BD%95%E8%8A%B1%E5%BC%8F%E6%94%B6%E5%89%B2%E4%BA%A4%E6%"}],"desc":"Bithumb hot wallet was compromised by insiders with access to private keys, resulting in theft of 12.5M EOS and 6.2M XRP. All stolen funds were company assets as user funds were stored in cold storage.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht4a8381b3e6","date":"2019-03-29","name":"TronCrush","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["Tron"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blocking.net/1638/dapp-trend-list-all-vulnerability-wave-fields-on-eos-may-be-reproduced/"}],"desc":"TronCrush's transfer function did not validate that the 'to' and 'from' addresses must be different, allowing an attacker to create tokens without foundation through self-transfers. Over 20 smart contracts and dapps were vulnerable to this same pattern.","theft":true},{"id":"ht13188b0ecb","date":"2019-03-29","name":"Bithumb","kind":"hack","fam":"other","tech":"Wallet Stolen","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcsearch.com/t/1298307"}],"desc":"According to a report from CoinDesk Korea, Bithumb may have also lost 20.2 million XRP in the recent breach. The XRP was moved from Bithumb’s wallet on March 29 in transactions that can be seen on XRPSCAN.","theft":true},{"id":"ht11c54056ec","date":"2019-03-28","name":"ZION","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.doubanfx.com/news/11367.html"}],"desc":"ZION.games sustained attack by malicious users ggggggggggxx, profits of more than 2849 EOS, and transferred to the Binance Exchange. The attack is similar to the attack on TGON, suspected to be the same group.","theft":true},{"id":"ht49a65cbb29","date":"2019-03-27","name":"TGON","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcsearch.com/t/1297890"}],"desc":"The attacker controlled multiple accounts to launch continuously attacks on the TGON, made thousands of EOS in profit from the TGON, and transferred to the Binance Exchange.","theft":true},{"id":"htd1de542a03","date":"2019-03-26","name":"BiKi","kind":"hack","fam":"other","tech":"unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcsearch.com/t/1269668"}],"desc":"BiKi.com announced that at 0:08:23 on March 26, the BiKi.com community received a user feedback that his password has been tampered with and need to bind the new Google verification code.At around 5 in the morning, 28 users had the same problem, and the risk control system received an alarm. After investigation, it is because some users are not bound to Google verification code and third-party verification code service provider SMS is hijacked and caused. At present, the number of of accounts that have been tampered with passwords is 37,  and the account involved in asset transfer is 18, and the loss amount is 12.33 million USDT, the BiKi.com will bear the full amount of the loss.","theft":true},{"id":"htdbba181f11","date":"2019-03-25","name":"Coinbene","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Ethereum"],"usd":40000000.0,"lo":40000000.0,"hi":45000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/cryptocurrency-platforms-dragonex-and-coinbene-disclose-hacks/"}],"desc":"Coinbene hot wallet was compromised and all ERC-20 tokens were drained to unknown addresses. The exchange downplayed the incident as routine 'maintenance' while customer assets were transferred out.","theft":true},{"id":"ht3edece4453","date":"2019-03-24","name":"DragonEx","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin","Ethereum","EOS","XRP","NEM","ETC"],"usd":7000000.0,"lo":6028283.0,"hi":7000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.bishijie.com/kuaixun_253776"}],"desc":"Lazarus Group compromised DragonEx infrastructure through phishing attacks using a fake Worldbit-bot trading software, obtaining private keys and API access to drain 20 cryptocurrency wallets including 135 BTC, 2,738 ETH, and other assets.","theft":true},{"id":"htbbfaea2822","date":"2019-03-24","name":"Etbox","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin","Ethereum"],"usd":132000.0,"lo":132000.0,"hi":132000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://finance.yahoo.com/news/lazarus-hacker-group-continues-target-185426186.html"}],"desc":"Lazarus Group targeted Etbox exchange infrastructure using Worldbit-bot phishing tactics to obtain exchange wallet private keys and API credentials, resulting in theft of cryptocurrency assets.","theft":true},{"id":"hte2792ea67a","date":"2019-03-20","name":"dBet Games","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.chainnews.com/news/072202672656.htm"}],"desc":"The attacker launch continuously attacks and profit from the dBet Games.","theft":true},{"id":"ht047f0eb1de","date":"2019-03-18","name":"EOS Cube","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/85405.htm"}],"desc":"The attacker justjiezhan1 launched an attack on the EOS game \"cubecontract\" and has already made a profit. Prior to this, the attacker justjiezhan1 started deploying the attack contract at around 12:00:41 on the same day. The analysts preliminary analyzed that the attacker was, still the same as the previous attack mean, transaction congestion attack.","theft":true},{"id":"ht2e66706630","date":"2019-03-18","name":"EOSVegas","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.fxtank.com/qukuailian/11258.html"}],"desc":"The attacker launched continuously attacks and profit from the EOSVegas. The analysis found that the attack mean used by the attacker was transaction congestion attack. The account is extremely active. It just attacked the quiz game EOS Cube and its related account has been marked as high risk.","theft":true},{"id":"htf6549d339b","date":"2019-03-15","name":"Mercatox","kind":"hack","fam":"other","tech":"Hard_fail attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/85139.htm"}],"desc":"The attacker launched a hard_fail attack on the exchange and profited thousands of EOS.","theft":true},{"id":"ht50e9ec0946","date":"2019-03-15","name":"YUM.games","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/85098.htm"}],"desc":"The attacker justjiezhan1 launched an attack on the EOS game \"YUM.games\" and has already made a profit. After analysis,  it is suspected that the attacker calls \"gamestart\" and draws the prize directly without betting the game.","theft":true},{"id":"ht930f4f75ee","date":"2019-03-14","name":"LuckyGo","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/84915.htm"}],"desc":"The attacker launched continuously attacks on the LuckyGo, profiting hundreds of EOS.","theft":true},{"id":"htd42efeb153","date":"2019-03-12","name":"dBet Games","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.seldenfrance.com/wen/gushi/53783.html"}],"desc":"The attacker launched continuously attacks on the dBet Games, profiting hundreds of EUSD which stablecoins issued on EOS. And has sold through the decentralized exchange Newdex.","theft":true},{"id":"ht3288f47e07","date":"2019-03-11","name":"nkpaymentcap","kind":"hack","fam":"code","tech":"Transfer error prompt","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cloud.tencent.com/developer/article/1419237"}],"desc":"The attacker launched continuous attacks on EOS DApp nkpaymentcap and successfully profited 50,000 EOS. After analysis, it was found that the attacker used a fake transfer notification attack to obtain a large number of contract tokens, and then exchanged the tokens into real EOS for cash out through the DApp contract.","theft":true},{"id":"htc75429e318","date":"2019-03-10","name":"Vegas Town","kind":"hack","fam":"keys","tech":"Hard_fail attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://developer.aliyun.com/article/693323"}],"desc":"The attacker launched a continuous attack on the EOS quiz game Vegas Town, profited thousands of EOS, and has been transferred to the ZB exchange. Preliminary analysis found that hackers used the failed (hard_fail) transfer transaction to cheat the game server, resulting in continued awards.","theft":true},{"id":"ht8dfd72a83b","date":"2019-03-09","name":"Gamble EOS","kind":"hack","fam":"other","tech":"Transfer error prompt","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.btcsearch.com/t/1244139"}],"desc":"The attacker launched a continuous attack on the EOS quiz game Gamble EOS, successfully profited thousands of EOS, and has been transferred to the Huobi exchange. After analysis, it was found that the attack method used by the attacker was a false transfer notification.","theft":true},{"id":"hta61de50b43","date":"2019-03-08","name":"Fishing Joy","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.longkuicj.com/22045.html"}],"desc":"The attacker launched a series of attacks on the EOS quiz game Fishing Joy, profiting hundreds of EOS. According to analysis, the attacker used the transaction crowding attack to trigger the game's refund mechanism, resulting in 100% profit.","theft":true},{"id":"hta5f82827ef","date":"2019-03-06","name":"ExtremeLoto","kind":"hack","fam":"code","tech":"Logic Vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/83611.htm"}],"desc":"The attacker co****op launched continuous attacks on the EOS quiz game contract xlo*****io and has already profited hundreds of EOS. After preliminary analysis, the attacker used the logic defect of the game contract by directly invoking the transfer method, and multiple accounts coordinated to carry out the attack.","theft":true},{"id":"hte485b11fe4","date":"2019-03-05","name":"OnePlay","kind":"hack","fam":"code","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.longkuicj.com/21649.html"}],"desc":"The attacker launched continuously attacks on the OnePlay, getting almost all EOS of the game contract. And use the same attack mean to bet the game token ONE, profit nearly one million game tokens, and then transfer to the newdex exchange for sale.","theft":true},{"id":"ht714a5e79ab","date":"2019-03-04","name":"EOS 欢乐谷(Happy Pool)","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/83229.htm"}],"desc":"Hackers launched continuous attacks on the EOS quiz game EOS Happy Valley, and they have profited hundreds of EOS. The game party has transferred the account balance away. Attackers still use transaction crowding out attacks. To completely fix this vulnerability, DApp developers should remove controllable variables such as account balance or time factors to participate in random number generation.","theft":true},{"id":"htf0adf16889","date":"2019-02-22","name":"超级节点(BP)games.eos","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/81695.htm"}],"desc":"Tracking the blacklist account gm3dcnqgenes found that its associated account newdexmobapp received 2.09 million EOS, and has now transferred 50,000 EOS to its associated account guagddoefdqu. And in batches of hundreds to thousands of EOS each time, transferred to the stock exchange account (huobideposit), and the remaining 2.04 million EOS, has been dispersed to ftsqfgjoscma, hpbcc4k42nxy, 3qyty1khhkhv, xzr2fbvxwtgt, myqdqdj4qbge, Shprzailrazt, qkwrmqowelyu, lmfsopxpr324, lhjuy3gdkpq4, lcxunh51a1gt, geydddsfkk5e, pnsdiia1pcuy, kwmvzswquqpb, etc., there is the possibility of further turning to the exchange.","theft":true},{"id":"hta16e6fb4e6","date":"2019-02-20","name":"Coinbin","kind":"hack","fam":"insider","tech":"Admin Drain","target":"CEX","chains":["Ethereum"],"usd":26000000.0,"lo":26000000.0,"hi":26000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://cointelegraph.com/news/south-koreas-coinbin-files-for-bankruptcy-with-26-mln-loss-cites-employee-embezzlement"}],"desc":"Coinbin's former CEO (previously from acquired exchange Youbit) used his new position to steal over 100 ETH from an Ethereum wallet, claiming the key had been lost. The employee embezzlement forced the exchange into bankruptcy.","theft":true},{"id":"ht64dac520f6","date":"2019-02-15","name":"Gameboy","kind":"hack","fam":"keys","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/80574.htm"}],"desc":"Gameboy, a EOS game was attacked. Attacker cont****inop deployed a contract and attacked by calling launch function. According to the analysis of SlowMist security team and confirmed with project side by communication.The project side wrongly add a controlled seed in random algorithm which lead the attack.","theft":true},{"id":"hte9190de7ff","date":"2019-02-05","name":"EOSPlaystation","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/79416.htm"}],"desc":"The attacker launched an attack on the EOS game EOSPlaystation.","theft":true},{"id":"htf5c0e78d0d","date":"2019-02-04","name":"EOSreel","kind":"hack","fam":"code","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/79323.htm"}],"desc":"The attacker deploys the attack contract con******nop and combines multiple accounts to attack the project contract eosreeladmin.","theft":true},{"id":"ht6d35403628","date":"2019-02-04","name":"QuadrigaCX","kind":"hack","fam":"other","tech":"Founder and CEO suddenly died","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.cbc.ca/news/business/quadrigacx-cryptocurrency-1.5005236"}],"desc":"Canada's largest cryptocurrency exchange is seeking creditor protection after losing about $190 million worth of cryptocurrency after the sudden death of its founder and chief executive in December.","theft":true},{"id":"htdc50757d26","date":"2019-02-04","name":"WinDice","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/79342.htm"}],"desc":"The attacker deploys the attack contract rep******net to attack the project party contract windiceadmin.","theft":true},{"id":"ht5477d346d0","date":"2019-01-31","name":"EOSlots","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78811.htm"}],"desc":"The attacker launched continuous attacks on the EOS game EOSlots.","theft":true},{"id":"ht329ccda210","date":"2019-01-31","name":"FASTWIN","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78835.htm"}],"desc":"The attacker deployed multiple attack contracts to attack the EOS game FASTWIN.","theft":true,"review":["possible duplicate within one source"]},{"id":"htd9ffe91a97","date":"2019-01-31","name":"Fastwin","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78765.htm"}],"desc":"The attacker is the same batch of accounts that previously attacked BETX.","theft":true},{"id":"ht036041ccf1","date":"2019-01-30","name":"EOSABC","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78682.htm"}],"desc":"This is the third attack on the contract, not a transaction congestion attack, but the real purpose of the attack is the transaction rollback attack.","theft":true},{"id":"htb8eb0d3717","date":"2019-01-28","name":"BETX","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78270.htm"}],"desc":"The attacker launched continuously attacks on the TGON.","theft":true},{"id":"ht68ac24a4e8","date":"2019-01-28","name":"EOSABC","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78358.htm"}],"desc":"Similar to the way EOSABC was attacked two days ago, the problem has not been fixed.","theft":true},{"id":"ht1cef291487","date":"2019-01-27","name":"EOSlots","kind":"hack","fam":"other","tech":"Replay attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78220.htm"}],"desc":"The attacker controlled multiple accounts to launch continuously attacks on the EOSlots.","theft":true},{"id":"ht4c99e997a5","date":"2019-01-26","name":"LocalBitcoins","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":27000.0,"lo":27000.0,"hi":27000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.reddit.com/r/localbitcoins/comments/ak1u8m/localbitcoins_report_on_the_security/?ref=share&ref_source=twitter"}],"desc":"A third-party discussion forum platform running on LocalBitcoins was compromised and used to phish user credentials including 2FA codes. Attackers gained access to six user accounts and transferred 7.9 BTC before the forum was disabled.","theft":true},{"id":"htf45c99f1ed","date":"2019-01-26","name":"EOSABC","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/78055.htm"}],"desc":"It is consistent with the previous principles of attacking EOS.Win, FarmEOS, etc., but the technique has changed.","theft":true},{"id":"ht960e5dde18","date":"2019-01-23","name":"Crazy Dice","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/77473.htm"}],"desc":"It is consistent with the previous principles of attacking EOS.Win, FarmEOS, etc., but the method has changed. The attacker controls multiple accounts to cooperate to complete the transaction congestion attack.","theft":true},{"id":"ht0bec6415cb","date":"2019-01-22","name":"EOSLuck","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/77278.htm"}],"desc":"The attacker is targeting the game's random number algorithm, and his winning percentage is much higher than other ordinary players.","theft":true},{"id":"ht353b029906","date":"2019-01-21","name":"idicefungame","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/77095.htm"}],"desc":"The attacker launched continuously attacks on idicefungame and has already made a profit, and transferred to the bitfinex exchange.","theft":true},{"id":"ht3a1c6db7a1","date":"2019-01-17","name":"21Dice","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76440.htm"}],"desc":"The attacker used the transaction congestion attack to attack the game contract and ultimately profit.","theft":true},{"id":"htccd2b02ec2","date":"2019-01-17","name":"SuperMonopoly","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76440.htm"}],"desc":"The attacker uses the trade crowding attack to attack the game contract and ultimately profit.","theft":true},{"id":"ht2f2ea630f9","date":"2019-01-16","name":"LuckBet","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76287.htm"}],"desc":"The attacker uses the trade crowding attack to attack the game contract and ultimately profit.","theft":true},{"id":"hteb0a00a878","date":"2019-01-16","name":"idice(影骰)","kind":"hack","fam":"keys","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76239.htm"}],"desc":"The attacker useed the transaction congestion attack to attack the game contract and ultimately profit.","theft":true},{"id":"ht427cd7efa2","date":"2019-01-16","name":"playgames","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76371.htm"}],"desc":"The game playgames has been continuously attacked by malicious user niyoubudou33. It has been attacked 295 times as of press time, which is consistent with the previous attacks on EOS.Win, FarmEOS, idice, LuckBet, GameBet, EOSDice, STACK DICE and many other games.","theft":true},{"id":"ht9c97b797e3","date":"2019-01-15","name":"FarmEOS","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76160.htm"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/76137.htm"}],"desc":"This time the attacker is the same person as the last time. Both flo******now and sil******day are the account of the hacker. The two attack methods are also the same. The attacker points to FarmEOS. After placing a bet, and when the attacking contract receives a transfer notification, a large number of defer transactions are initiated, which delays the subsequent lottery draw of FarmEOS, which is the \"transaction crowding attack\".","theft":true},{"id":"ht2f53d49a3c","date":"2019-01-14","name":"Cryptopia","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Ethereum"],"usd":16000000.0,"lo":16000000.0,"hi":16000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://thespinoff.co.nz/business/28-05-2019/how-new-zealand-company-cryptopia-lost-over-20-million-from-a-hack"}],"desc":"On January 14, 2019, Cryptopia's hot wallet private keys were compromised, enabling theft of approximately 10 percent of platform holdings in ERC-20 tokens across 17,000 customer accounts.","theft":true,"review":["possible duplicate within one source"]},{"id":"htd31c02f1da","date":"2019-01-14","name":"GameBet","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75816.htm"}],"desc":"The attacker used transaction congestion attack to exploit  vulnerability in the old-version BP nodeos.","theft":true},{"id":"hted963090bc","date":"2019-01-13","name":"Cryptopia","kind":"hack","fam":"keys","tech":"Private Key Leakage","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.theblockcrypto.com/post/110495/ex-employee-pleads-guilty-to-stealing-over-170000-from-cryptopia"}],"desc":"A former employee of the now-defunct Cryptopia exchange allegedly stole more than 250,000 New Zealand dollars (US$182,300) of cryptocurrency and customer data from Cryptopia. However, the New Zealand authorities managed to recover the stolen funds and return them to Cryptopia's liquidator Grant Thornton. The man explained in detail how he stole the funds. He said that he unauthorizedly copied the private keys belonging to Cryptopia's many wallets and saved the data on a USB storage device. Then he uploaded the data to his personal computer at home. This allows him to use thousands of wallets and more than 100 million U.S. dollars in various cryptocurrencies.","theft":true},{"id":"ht961ef5a89a","date":"2019-01-13","name":"FarmEOS","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75739.htm"}],"desc":"After the attack contract sil******day places a bet on FarmEOS, and when the attack contract receives a transfer notification, it initiates a large number of defer transactions, which delays the subsequent lottery draw of FarmEOS. The SlowMist security team first two days (1 November 11) disclosed EOS.WIN was attacked in the same way","theft":true},{"id":"htee46e6ff52","date":"2019-01-13","name":"Fishing","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75813.htm"}],"desc":"The attacker used transaction congestion attack to exploit vulnerability in the old-version BP nodeos.","theft":true},{"id":"htf5a2cdb731","date":"2019-01-13","name":"STACK DICE","kind":"hack","fam":"code","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75813.htm"}],"desc":"The attacker used deferBomb to exploit vulnerability in the old-version BP nodeos.","theft":true},{"id":"hte2b30c96a3","date":"2019-01-12","name":"BetDoge","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75693.htm"}],"desc":"The attacker launched continuous attacks on the EOS game BetDoge and has successfully profited hundreds of EOS.","theft":true},{"id":"ht568088f273","date":"2019-01-12","name":"EOS.WIN","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75547.htm"}],"desc":"The attacker loveforlover launched an attack on EOS.WIN and has already made a profit.","theft":true},{"id":"ht23cf33c599","date":"2019-01-10","name":"uugame","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/75378.htm"}],"desc":"The random number was cracked.","theft":true},{"id":"ht9152456113","date":"2019-01-06","name":"Ethereum Classic","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Chain","chains":["Ethereum Classic"],"usd":219500.0,"lo":219500.0,"hi":219500.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"A 51% attack on Ethereum Classic's Proof of Work chain allowed attackers to reorg the blockchain and double-spend 219,500 ETC on two separate occasions. Low mining hashrate and cheap rental hashpower via services like NiceHash enabled the attack.","theft":true},{"id":"ht3bd4197e67","date":"2019-01-06","name":"ETC","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://medium.com/@slowmist/the-analysis-of-etc-51-attack-from-slowmist-team-728596d76ead"}],"desc":"The attacker launched a 51% attack through the rental power, and the exchanges such as Gate.io, Yobit, and Bitrue were affected, and after a week, the attacker returned all the ETC.","theft":true},{"id":"ht3998b44636","date":"2019-01-04","name":"HotDice","kind":"hack","fam":"code","tech":"transaction congestion attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/74290.htm"}],"desc":"Developers have not been able to effectively detect, block, and isolate accounts which is contract high risk or marked as blacklisted.","theft":true},{"id":"ht3c20ecc03b","date":"2019-01-01","name":"EOS BUFF","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/q0YsUGllFJnsRszfLFy84A"}],"desc":"The attacker launched continuous attacks on the EOS BUFF and has successfully profited hundreds of EOS.","theft":true},{"id":"ht73a2f111b1","date":"2019-01-01","name":"ggeos","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/73908.htm"}],"desc":"The contract was attacked by a transaction rollback.","theft":true},{"id":"htce4de473f8","date":"2018-12-31","name":"Tronwin","kind":"hack","fam":"code","tech":"Overflow","chains":["Tron"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bcsec.org/index/detail/id/435/tag/0"}],"desc":"Tron DApp Tronwin is hacked because of overflow and 2 million TRX were stolen.","theft":true},{"id":"ht0c716ff6f0","date":"2018-12-29","name":"LuckBet","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/search/LuckBet"}],"desc":"The random number was attacked by the attacker for the second time.","theft":true},{"id":"htd41a128f10","date":"2018-12-28","name":"GameBet","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/73416.htm"}],"desc":"The attacker launched an attack on the GameBet game contract gamebetdices, and transfer most of the acquired EOS to the FreeWallet wallet account.","theft":true},{"id":"ht5611acef7c","date":"2018-12-28","name":"LuckyMe","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/73410.htm"}],"desc":"The attacker continued to attack the LuckyMe game contract luckymedice1 and had benefited thousands of EOS.","theft":true},{"id":"htaff0b334e1","date":"2018-12-27","name":"Fountain(FTN)","kind":"hack","fam":"code","tech":"Overflow","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.blockcircles.cn/newsflash/21926.html"}],"desc":"Fountain (FTN) has an overflow vulnerability, the attacker performs an overflow attack by calling\r\n batchTransfers.","theft":true},{"id":"ht5bc2482f70","date":"2018-12-26","name":"Lucky Nuts","kind":"hack","fam":"code","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/73116.htm"}],"desc":"The attacker continued to attack the Lucky Nuts game contract nutsgambling and continues to profit from it. Eventually most of the stolen EOS was transferred to the Binance exchange account binancecleos.","theft":true},{"id":"ht2638637c4c","date":"2018-12-25","name":"FastWin","kind":"hack","fam":"code","tech":"Minting Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/72989.htm"}],"desc":"The hacker mastered and modified FAST's token contract, deliberately created a vulnerability that can be used for multiple \"additional\" tokens for free.","theft":true},{"id":"ht7364b9707a","date":"2018-12-23","name":"Pickown","kind":"hack","fam":"code","tech":"Transfer error prompt","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/search/FastWin"}],"desc":"\"Transfer Error Prompt\", as the game contract does not filter the false notifications provided by the game player.","theft":true},{"id":"ht952b6f4ac6","date":"2018-12-22","name":"LuckBet","kind":"hack","fam":"code","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/72463.htm"}],"desc":"The attacker snowredgreen attacked the LuckBet game contract luckbetadmin and transfers most of the acquired EOS to the Huobi exchange account huobideposit","theft":true},{"id":"ht93a05cc29f","date":"2018-12-21","name":"EosDice","kind":"hack","fam":"code","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/72348.htm"}],"desc":"The attacker binaryfunxxx attacked the EosDice's game contract bocai.game and transfers most of the acquired EOS to the Binance exchange account binancecleos.","theft":true},{"id":"ht5af2a9df7f","date":"2018-12-19","name":"EOS Max","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/71741.htm"}],"desc":"EOS Max gambling DApp was exploited via a rollback attack on December 19, 2018, where attackers used EOS's blacklist functionality to revert blockchain transactions after betting outcomes were determined. The attack allowed players to recover bets even after losing. Multiple EOS gambling DApps were targeted simultaneously via this vector.","theft":true},{"id":"htd565efb10c","date":"2018-12-19","name":"ToBet","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/71877.htm"}],"desc":"ToBet gambling platform was exploited on December 19, 2018 via a rollback attack using EOS's blacklist feature. Attackers rolled back losing wagers to their original states, extracting value from the platform. This was part of a coordinated attack against multiple EOS DApps.","theft":true},{"id":"ht3b8520d786","date":"2018-12-19","name":"BetDice","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/71797.htm"}],"desc":"Rollback transaction attack.","theft":true},{"id":"ht43886589f0","date":"2018-12-19","name":"Big.game","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/71765.htm"}],"desc":"Big.game is suspected of being attacked by hacker eykkxszdrnnc. Big.game officially stated that the actual loss was about 8,000 EOS, and the balance of the dice prize pool has been transferred to a secure account.","theft":true},{"id":"ht4e71d17ba8","date":"2018-12-19","name":"TRUSTBET","kind":"hack","fam":"code","tech":"Replay attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/71724.htm"}],"desc":"The attacker (panming12345) launched an attack on the EOS quiz game TRUSTBET game contract (trustbetgame), profiting a total of 11,501 EOS, and then transferred the EOS obtained from the attack to the Huobideposit account in two times. The attacker took advantage of the replay attack vulnerability. This is a form of attack that first appeared in the early days of the EOS DApp ecosystem. Due to the serious flaws in the random lottery algorithm designed by the developer, the attacker can use the contract vulnerabilities to draw the lottery repeatedly. Lower-level errors.","theft":true},{"id":"htf4a3273653","date":"2018-12-12","name":"Vertcoin","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"Layer 1","chains":["Vertcoin"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/coinmonks/vertcoin-vtc-is-currently-being-51-attacked-53ab633c08a4"}],"desc":"Vertcoin suffered a 51% attack on December 10-12, 2018 when an attacker gained majority hashpower using the Nicehash rental service. The attacker executed 22 deep chain reorganizations, 15 of which included double-spend transactions with the largest reorg exceeding 300 blocks. Estimated losses exceeded $100,000.","theft":true},{"id":"htec47080a21","date":"2018-12-12","name":"kittyfishing","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/70394.htm"}],"desc":"The attacker helookitiqas launched attacks on the EOS game kittyfishing, which launched a total of 91 attacks in two hours.","theft":true},{"id":"ht52ec41b0cc","date":"2018-12-05","name":"Fastwin","kind":"hack","fam":"code","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/68797.htm"}],"desc":"The attacker ha4tsojigyge launched 124 attacks on the Fastwin game contract fastwindice3.","theft":true},{"id":"ht3e7ddf46da","date":"2018-12-03","name":"Dice3D","kind":"hack","fam":"code","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/68308.htm"}],"desc":"Similar to the previous attack on EOS.WIN on November 11, multiple contract accounts were used to send transaction requests at the same time, and the front feint account was used to implement small bets. After ensuring a higher probability for the main attack account, increase the betting amount. And then get high bonuses.","theft":true},{"id":"ht2574144075","date":"2018-12-01","name":"Dice3D","kind":"hack","fam":"other","tech":"Transaction Rollback Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/q0YsUGllFJnsRszfLFy84A"}],"desc":"Use multiple accounts to simultaneously send transaction requests for attack, so that the last attacker account gets the highest winning rate.","theft":true},{"id":"htf01f4bf6c2","date":"2018-11-30","name":"Atidium","kind":"hack","fam":"keys","tech":"Private Key Leakage","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/67820.htm"}],"desc":"EOS Atidium's official account wwwatidiumio was abnormal.  A total of 6 tokens including ATD tokens 337,759,004 were transferred to account b4jmqvvktgjx. The account then transferred 130 million ATD tokens to Newdex Exchange for cash, a total of 3,183.8564 EOS were profitable..","theft":true},{"id":"ht76b4f4da44","date":"2018-11-28","name":"nutsgambling","kind":"hack","fam":"other","tech":"Roll back attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/67268.htm"}],"desc":"Hacker ybdzmtgouwxn launched an attack on nutsgambling, an EOS quiz game. In less than an hour, a total of 144 attacks were launched, and a total of 1,141.71 EOS was obtained. In order to prevent the flow of funds from being tracked, the hacker used multiple sub-accounts to sequentially transfer the acquired assets to the account kcbtvwtxeabc, which has not been withdrawn to the exchange yet.","theft":true},{"id":"ht5622e9cbff","date":"2018-11-27","name":"BitPay Copay","kind":"hack","fam":"keys","tech":"Malicious Code Injection Attack","target":"Wallet","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://www.bitcoin86.com/exchange/32259.html"}],"desc":"American Bitcoin payment processor BitPay stated that the company's Copay wallet was attacked by hackers. Bitpay announced on Monday that it learned of this issue from a report on Copay GitHub. The report showed that third-party JavaScript libraries used by these applications were modified and malicious code was loaded. The malware was inserted into versions 5.0.2 to 5.1.0 of the Copay and BitPay wallet applications and may be used to obtain private keys for stealing Bitcoin and Bitcoin Cash. According to reports, the attack appeared to be carried out by a developer named Right9ctrl, who took over the maintenance of the NodeJS library from the left manager. About three months ago, when Right9ctrl was granted access to the repository, he inserted malware at this time.","theft":true},{"id":"ht92cbc078be","date":"2018-11-21","name":"vegasgame111","kind":"hack","fam":"code","tech":"Fake EOS Vulnerability Attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/65894.htm"}],"desc":"The attacker (kuybupeykieh) launched an attack on the EOS quiz game contract (vegasgame111), making a total of hundreds of EOS. The data on the tracking chain found that, in order to prevent the flow of funds from being tracked, the hacker used dozens of operations to create sub-accounts. In order to transfer the acquired assets sequentially, the attacker used the \"fake EOS\" vulnerability to carry out the attack.","theft":true},{"id":"ht061818450a","date":"2018-11-19","name":"EOS Lelego","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/65284.htm"}],"desc":"EOS Lelego gambling DApp was exploited via a randomness vulnerability in November 2018. Attackers predicted the random number generation algorithm by using information from previous blockchain blocks. Lelego was one of eight EOS gambling platforms targeted in coordinated attacks using the same vector.","theft":true},{"id":"ht89496358e7","date":"2018-11-15","name":"LuckyGo","kind":"hack","fam":"code","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/64543.htm"}],"desc":"EOS game contract LuckyGo has been off the line and the attacker iloveloveeos (malicious contract) was exposed in September because of attack on FairDice.","theft":true},{"id":"ht9d7806291f","date":"2018-11-12","name":"AurumCoin","kind":"hack","fam":"market","tech":"Risk Parameter Abuse","target":"Layer 1","chains":["AurumCoin"],"usd":500000.0,"lo":11362.0,"hi":500000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://nulltx.com/aurumcoin-claims-cryptopia-refutes-a-51-attack-resulting-in-lost-funds/"}],"desc":"AurumCoin suffered a 51% attack in November 2018 where an attacker gained majority network hashpower. The attacker performed a double-spend attack, sending 15,752.26 AU to the Cryptopia exchange worth approximately $500,000, selling them for other cryptocurrencies, then rolling back the transaction. The attack rendered the blockchain inactive as of November 29, 2018.","theft":true,"review":["sources disagree on the loss"]},{"id":"ht3fd152afa8","date":"2018-11-12","name":"HireVibes AirDropsDAC","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"DeFi Protocol","chains":["EOS"],"usd":13600.0,"lo":13600.0,"hi":13600.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"EOSIO.SG testing account sym111111add was compromised and used on November 12, 2018 to attack the AirDropsDAC contract. The attacker misappropriated HireVibes tokens (HVT) and other airdrop tokens, selling portions of the stolen HVT on Newdex and transferring profits to controlled accounts.","theft":true},{"id":"ht18526d4f16","date":"2018-11-11","name":"EOS.WIN","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"usd":9180.0,"lo":9180.0,"hi":9180.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/63433.htm"}],"desc":"EOS.WIN gambling DApp was exploited on November 12, 2018 via a randomness prediction attack. An attacker conducted 165 test transactions the day prior, then executed 10 successful attacks in one minute gaining 9,180 EOS. The attacker predicted the random number by controlling the ref block num parameter.","theft":true},{"id":"ht76eb1a63cc","date":"2018-11-10","name":"EOSDice","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"usd":25100.0,"lo":25100.0,"hi":25100.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/62050.htm"}],"desc":"EOSDice gambling platform was attacked in November 2018 via exploitation of its controlled-seed randomness flaw. Attackers predicted the random number generation by analyzing blockchain state information. EOSDice was one of eight EOS DApps targeted simultaneously in coordinated randomness attacks.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht156b4162e2","date":"2018-11-10","name":"EOSDice","kind":"hack","fam":"keys","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/63312.htm"}],"desc":"The well-known DApp EOSDice was hacked again due to random number issues. The attacker was a hacker who previously attacked EOSDice and FFGame DApp. The project side wrongly add a controlled seed in random algorithm which lead the attack.","theft":true},{"id":"htb2331bc268","date":"2018-11-10","name":"MyEosVegas","kind":"hack","fam":"code","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/63359.htm"}],"desc":"The hacker has launched a total of 700 attacks on the MyEosVegas game contract eosvegasjack.","theft":true},{"id":"ht13d55b2afe","date":"2018-11-08","name":"FFGame","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"usd":7200.0,"lo":7200.0,"hi":7200.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/62867.htm"}],"desc":"FFGame gambling DApp suffered exploitation via mirrored-randomness vulnerability in November 2018. Attackers predicted the random outcome by leveraging information from earlier blockchain blocks. The attack was part of a coordinated assault on eight EOS gambling platforms using randomness prediction vectors.","theft":true},{"id":"ht01b3845e4e","date":"2018-11-07","name":"Gate","kind":"hack","fam":"keys","tech":"Supply Chain Attack","target":"CEX","chains":["Bitcoin","Ethereum"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/62664.htm"}],"desc":"The StatCounter analytics service was compromised on November 3, 2018 and weaponized to target Gate.io users. Attackers injected malicious JavaScript that specifically targeted the Bitcoin withdrawal page (myaccount/withdraw/BTC), replacing withdrawal addresses with attacker-controlled wallets. The script automatically submitted forms when amounts exceeded 10 BTC or the user's daily limit.","theft":true},{"id":"htc99228937d","date":"2018-11-07","name":"CaseGo","kind":"hack","fam":"other","tech":"Unknown","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/q0YsUGllFJnsRszfLFy84A"}],"desc":"Attacked by the attacker, the specific content is unknown.","theft":true},{"id":"ht6526a620b0","date":"2018-11-04","name":"EOSeven","kind":"hack","fam":"insider","tech":"Insider Manipulation","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"EOSeven was transferred 600 million SVN from eosevendice2 to account tuningfinish,  then back 450 million to eosevendice2. After that, tuningfinish sold the SVN token on Newdex and finally transferred the resulting EOS to Binance Exchange.","theft":true},{"id":"htd5fdcbd0ef","date":"2018-10-31","name":"EOSCast","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["EOS"],"usd":72912.0,"lo":72912.0,"hi":72912.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/61261.htm"}],"desc":"EOSCast gaming contract was exploited via a fake EOS token attack. The attacker created a malicious token contract named 'EOS' and launched 17 transfer attacks of varying amounts (100, 1,000, and 10,000 counterfeit tokens). The contract failed to verify the token issuer, allowing the hacker to extract 72,912 real EOS from the bonus pool.","theft":true},{"id":"htda9244f8b1","date":"2018-10-28","name":"EOS Poker","kind":"hack","fam":"keys","tech":"Operational Mistake","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"The official forgot to put the seed into the database when expanding the server, and no longer record the seed after the 868590 game.","theft":true},{"id":"hte4f0b47ae4","date":"2018-10-28","name":"MapleChange","kind":"hack","fam":"keys","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.ibtimes.com/cryptocurrency-exchange-maplechange-hacked-exit-scam-allegations-surface-2728232"}],"desc":"MapleChange, based in Canada, announced on Twitter the exchange \"sustained a hack\" and was investigating the issue. The post also said the exchange had turned off users' accounts temporarily. About refunding its customers, it opened a Discord server (a platform for users to chat) so customers could post there about their missing funds, based on which it would initiate refunds. The exchange's website was down.","theft":true},{"id":"htb8906f641f","date":"2018-10-26","name":"EosRoyale","kind":"hack","fam":"code","tech":"Unknown","target":"DeFi Protocol","chains":["EOS"],"usd":60000.0,"lo":60000.0,"hi":60000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/61280.htm"}],"desc":"EosRoyale gambling platform was exploited via a prior-block randomness vulnerability on October 26, 2018. Attackers calculated future random numbers by analyzing information from previous blocks, predicting game outcomes. 11,000 EOS were stolen from the operational wallet, valued at approximately $60,000 at the time.","theft":true},{"id":"htfd5ead2a4e","date":"2018-10-20","name":"TRADE.IO","kind":"hack","fam":"other","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/59325.htm"}],"desc":"Trade.io confirmed via their Medium blog that someone or some entity gained access to the assets, resulting in over 50 million in Trade (TIO) tokens being stolen from the firm’s cold storage wallets. The 50 million tokens are valued at $7.5 million at the current $0.15 price per TIO. The ongoing investigation has revealed that some of the TIO tokens had made their way to cryptocurrency exchanges Bancor and Kucoin. Kucoin has suspended TIO transactions, while Bancor has permanently removed TIO.","theft":true},{"id":"ht1ce5c14991","date":"2018-10-16","name":"WORLD CONQUEST","kind":"hack","fam":"code","tech":"Rule Exploitation","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/58271.htm"}],"desc":"RatingToken, a third-party big data platform owned by Cheetah, has detected that DAPP World Conquest developed based on EOS was hacked. Subsequently, the official issued an announcement on its Discord to confirm the fact of the attack. The hacker used the tax payment rules of the game to reject subsequent buyers, which led to the abnormal end of the game. The hacker took all the EOS in the fund pool, and only 0.0155 EOS was left in the contract.","theft":true},{"id":"ht67b5636b46","date":"2018-10-15","name":"EOSBet","kind":"hack","fam":"code","tech":"Donation Attack","target":"DeFi Protocol","chains":["EOS"],"usd":338000.0,"lo":338000.0,"hi":338000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/57970.htm"}],"desc":"EOSBet gaming platform was attacked on October 15, 2018 using a forged transfer notification exploit. Attackers leveraged the fake transfer notification vulnerability to drain funds from the contract. This was the second major hack of EOSBet within a month, with this incident resulting in losses of approximately $338,000.","theft":true},{"id":"ht0af0d1763a","date":"2018-10-07","name":"SpankChain","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":38000.0,"lo":38000.0,"hi":38000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"http://dy.163.com/v2/article/detail/DTN9R2MA0519U3I5.html"}],"desc":"SpankChain payment channel hub was exploited via a reentrancy vulnerability on October 6, 2018. An attacker created a malicious token contract masquerading as an ERC20, with a transfer function that called back into the payment channel contract multiple times, draining approximately 165.38 ETH (~$38,000). The attacker returned the stolen funds after negotiation.","theft":true,"onchain":true},{"id":"htc7f85e2fdb","date":"2018-10-05","name":"EOSBank","kind":"hack","fam":"code","tech":"Permission Stolen","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"The owner permission of the contract account had been modified, after that, 18,000 EOS was transferred to the EOS account fuzl4ta23d1a.","theft":true},{"id":"ht656d1d72a4","date":"2018-09-14","name":"Zaif","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":60000000.0,"lo":59000000.0,"hi":60000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://prtimes.jp/main/html/rd/p/000000093.000012906.html"}],"desc":"Zaif cryptocurrency exchange suffered a hot wallet breach on September 14, 2018 when attackers gained access to private keys storing customer funds. Approximately 5,966 Bitcoin, unspecified Bitcoin Cash, and MonaCoin totaling 6.7 billion yen (~$60 million) were stolen from the exchange's operational wallets. Discovery occurred three days after the theft.","theft":true},{"id":"ht51cf07c223","date":"2018-09-14","name":"Newdex","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["EOS"],"usd":58000.0,"lo":58000.0,"hi":58000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/53145.htm"}],"desc":"Newdex decentralized exchange was exploited on September 14, 2018 when hackers created one billion fake EOS tokens named 'EOS'. The platform's lack of smart contract validation and reliance on personal accounts for settlement allowed attackers to purchase real EOS (4,028) and other tokens (BLACK, IQ, ADD) using the counterfeit tokens. The exchange compensated all users.","theft":true},{"id":"ht09383cb061","date":"2018-09-14","name":"EOS.Win","kind":"hack","fam":"code","tech":"Code Vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://hacked.slowmist.io/"}],"desc":"The attacker exchanged true EOS token with fake token within the vulnerability in the code,winning without betting","theft":true},{"id":"ht56f428588d","date":"2018-09-14","name":"EOSBet","kind":"hack","fam":"code","tech":"Contract Vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/52227.htm"}],"desc":"The game contract does not check the transfer action must initiated by eosio.token or token contract of the game itself.","theft":true},{"id":"ht46b3855ec7","date":"2018-09-12","name":"DEOSBET","kind":"hack","fam":"code","tech":"Infinite Mint","target":"DeFi Protocol","chains":["EOS"],"usd":200000.0,"lo":200000.0,"hi":200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/51212.htm"}],"desc":"EOSBet gambling platform was exploited on September 14, 2018 via a smart contract vulnerability. Hackers created a malicious contract that generated fake transfer notifications, tricking EOSBet's verification into sending 44,427 EOS (~$200,000) to attacker accounts. This was discovered when a Reddit user published the exploit code.","theft":true,"review":["possible duplicate within one source"]},{"id":"ht119f1119db","date":"2018-09-12","name":"EOS Happy Slot","kind":"hack","fam":"other","tech":"Replay attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"The attacker uses the replay attack to obtain multiple winnings in one go.","theft":true},{"id":"htf2f9c50103","date":"2018-09-12","name":"EOSBet","kind":"hack","fam":"code","tech":"Code Vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/q0YsUGllFJnsRszfLFy84A"}],"desc":"the attacker exchanged true EOS token with fake token within the vulnerability in the code, winning without betting.","theft":true},{"id":"htda0d1426ee","date":"2018-09-12","name":"FairDice","kind":"hack","fam":"other","tech":"Replay attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"Because of its random algorithm associated with the time, the same bet will yield different results at different times. Hackers use this feature to reject failed lottery results.","theft":true},{"id":"ht49ffb87517","date":"2018-09-02","name":"EOS.Win","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"On September 2, 2018, the EOS WIN random number was cracked and 2000 EOS was lost, this attack was not disclosed to the public.","theft":true},{"id":"ht6be2a1332c","date":"2018-08-27","name":"Luckyos","kind":"hack","fam":"other","tech":"Random number attack","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"The law of the random number generated by Lucky's rock-paper-scissors game was cracked by hackers, and the attacker won the prize by continuing to use rock at the specified time, which has a 38% chance of winning.","theft":true},{"id":"htb5e57e8fe0","date":"2018-08-26","name":"EOSBET","kind":"hack","fam":"code","tech":"Fake Transfer Notification","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/lives/48517.htm"}],"desc":"RAM was swallowed up by the malicious contract, and the game party failed to check the caller of transfer action, which led to the exchange of real token with fake token and \"Transfer Error Prompt\" vulnerability","theft":true},{"id":"ht08dd6dbe61","date":"2018-08-01","name":"Fomo 3D","kind":"hack","fam":"other","tech":"Transaction congestion attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/MCuGJepXr_f18xrXZsImBQ"}],"desc":"Ethereum Fomo 3D was hacked and hacker used special attack techniques to take the bonus.","theft":true},{"id":"ht239a286fb4","date":"2018-07-31","name":"Fomo 3D","kind":"hack","fam":"other","tech":"DDoS Attack","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.jinse.com/bitcoin/221557.html"}],"desc":"Ethereum Fomo 3D was hacked, Fomo 3D website 24-hour access reduced 21.95 percent, 24-hour flow decreased 38.32%","theft":true,"review":["possible duplicate within one source"]},{"id":"ht40fec6973b","date":"2018-07-26","name":"KICKICO","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":7700000.0,"lo":7700000.0,"hi":7700000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://medium.com/@kickico/kickico-security-breach-issue-under-control-all-kickcoins-will-be-returned-ebe65a491dec"}],"desc":"KICKICO ICO platform was exploited on July 26, 2018 when attackers gained access to the private key managing the KICK token contract. The attacker destroyed KICK tokens at 40 addresses and recreated them at 40 attacker-controlled wallets, stealing over 70 million KICK tokens worth $7.7 million. KICKICO regained control by switching to a cold-storage key.","theft":true},{"id":"htc46b90ed22","date":"2018-07-25","name":"狼人游戏(EOS Fomo3D)","kind":"hack","fam":"code","tech":"Overflow vulnerability","chains":["EOS"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/DnhtzdWeRziK030FSolDbA"}],"desc":"The EOS Fomo3D game contract suffered an overflow attack and the cash pooling became negative.","theft":true},{"id":"ht55d8776bab","date":"2018-07-09","name":"Bancor V3","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"DeFi Protocol","chains":["Ethereum"],"usd":23500000.0,"lo":23500000.0,"hi":23500000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://zhuanlan.zhihu.com/p/39758950"}],"desc":"Bancor decentralized exchange platform suffered a security breach on July 9, 2018 where attackers gained unauthorized access to the platform's wallet containing BNT tokens, ETH, and other ERC-20 tokens. The attacker drained approximately $23.5 million in assets. Bancor identified the breach, secured affected accounts, and announced recovery and user compensation measures.","theft":true},{"id":"ht2d3a949683","date":"2018-06-21","name":"Bithumb","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Ethereum"],"usd":31000000.0,"lo":31000000.0,"hi":31000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cnbc.com/2018/06/19/south-korea-crypto-exchange-bithumb-says-it-was-hacked-coins-stolen.html"}],"desc":"On June 19-20, 2018, attackers compromised Bithumb's hot wallet and stole approximately 35,000 ETH and various other tokens worth ~$31M at the time. The attacker's method exploited infrastructure vulnerabilities to gain access to the exchange's online wallet system. Bithumb attributed the attack to Lazarus, the North Korea-linked hacker group.","theft":true},{"id":"ht40776cbaa7","date":"2018-06-10","name":"Coinrail","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Ethereum"],"usd":37200000.0,"lo":37200000.0,"hi":37200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2018/06/11/coinrail-exchange-hacked-loses-possibly-40-million-in-cryptos/"}],"desc":"On June 10, 2018, South Korean exchange Coinrail suffered an intrusion that resulted in the theft of over $40M in altcoins. The attack compromised approximately 30% of assets held on the platform, including ~$20M in NPXS tokens, $14M in Aston X, and $6M in other tokens. Two-thirds of stolen assets were recovered through partner exchanges.","theft":true},{"id":"htbf60983a9b","date":"2018-06-08","name":"Litecoin Cash","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://ambcrypto.com/litecoin-cash-under-51-attack-inhibition-of-small-pow-coins/"}],"desc":"According to the official news of Litecoin Cash (LCC), LCC has been attacked by 51% recently. The LCC team has contacted the exchange and increased the number of confirmed blocks to 100 to prevent attacks.","theft":true},{"id":"ht951f2d8b72","date":"2018-06-02","name":"ZenCash","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Chain","chains":["ZenCash"],"usd":550000.0,"lo":550000.0,"hi":550000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.zencash.com/zencash-statement-on-double-spend-attack/"}],"desc":"On June 2, 2018, ZenCash (now Horizen) suffered a 51% attack resulting in double-spend losses of over $500K. The attacker gained majority hashrate control and reorganized 38 blocks, executing double-spends of 13,000 and 6,600 ZEN across exchanges. The attack likely involved rented hashpower from NiceHash.","theft":true},{"id":"htc3212b337d","date":"2018-05-29","name":"Verge","kind":"hack","fam":"other","tech":"51% attack","usd":4820000.0,"lo":4820000.0,"hi":4820000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://cloud.tencent.com/developer/article/1197040"}],"desc":"The last repair was bypassed, resulting in another 51% attack and a loss of approximately US$4.82 million.","theft":true},{"id":"ht66f476a9a5","date":"2018-05-24","name":"BAI Token","kind":"hack","fam":"code","tech":"Logic Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://wx.zsxq.com/mweb/views/topicdetail/topicdetail.html?topic_id=28281145515811&user_id=5812841144&share_from=ShareToWechat"}],"desc":"According to the SlowMist Zone disclosure, the BAI smart contract has the same vulnerabilities as the EDU, and can transfer the BAI Token in any account. There are also a large number of robbery.","theft":true},{"id":"ht52f073719b","date":"2018-05-24","name":"EDU Token","kind":"hack","fam":"code","tech":"Logic Vulnerability","chains":["Ethereum"],"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.leiphone.com/news/201805/Wv4XBygPe2A4o3LR.html"}],"desc":"EDU smart contract has critical vulnerability , and can transfer the EDU Token in any account.","theft":true},{"id":"ht55756ed551","date":"2018-05-22","name":"Verge","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"Chain","chains":["Verge"],"usd":1750000.0,"lo":1750000.0,"hi":1750000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://paper.seebug.org/609/"}],"desc":"Between April and May 2018, attackers exploited Verge's timestamp validation mechanism by mining blocks with spoofed timestamps set one hour in the past, forcing rapid difficulty adjustments. This allowed mining at inflated rates, generating counterfeit coins valued at ~$1.75M. The attackers manipulated multiple mining algorithms to maximize coin generation.","theft":true},{"id":"htf5958e0bec","date":"2018-05-21","name":"TAYLOR","kind":"hack","fam":"code","tech":"1Password file stolen","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://archive.is/Rp5Gl"}],"desc":"TAYLOR’ve been hacked and all of our funds have been stolen. Not only the balance in ETH (2,578.98 ETH), but also the TAY tokens from the Team and Bounty pools. The only tokens that were not stolen are the ones from the Founders’ and Advisors’ pools, because there’s a vesting contract making them inaccessible for now.","theft":true},{"id":"htc6b326b8cb","date":"2018-05-18","name":"Monacoin","kind":"hack","fam":"other","tech":"51% attack","usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.reddit.com/r/monacoin/comments/8k7640/51_attack_on_monacoin/"}],"desc":"On May 18, a Reddit netizen posted that Monacoin suffered a 51% computing power attack, a selfish mining attack, and a time stamp attack. The exact time occurred from May 13 to May 15. Some exchanges that support Monacoin trading, such as Bittrex, Livecoin have closed Monacoin recharge.","theft":true},{"id":"ht077a2196a7","date":"2018-05-16","name":"Bitcoin Gold","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Chain","chains":["Bitcoin Gold"],"usd":18000000.0,"lo":18000000.0,"hi":18000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.ccn.com/bitcoin-gold-hit-by-double-spend-attack-exchanges-lose-millions"}],"desc":"On May 16-24, 2018, Bitcoin Gold suffered a 51% attack in which attackers stole approximately 388,000 BTG (~$18M) through double-spend transactions targeting cryptocurrency exchanges. The attacker sent coins to exchanges, sold them for other assets, then reversed the initial transactions to reclaim funds.","theft":true},{"id":"htf561272749","date":"2018-05-13","name":"MonaCoin","kind":"hack","fam":"bridge","tech":"Forged Proof","target":"Chain","chains":["MonaCoin"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Between May 13-15, 2018, MonaCoin suffered a selfish mining attack where the attacker commanded up to 57% of hashrate. By mining blocks secretly and releasing them strategically, the attacker invalidated legitimate blocks and stole approximately $90K in MONA coins through exchange manipulation.","theft":true},{"id":"htdc0daf77c5","date":"2018-04-25","name":"MyEtherWallet","kind":"hack","fam":"keys","tech":"DNS hijacking","target":"Wallet","usd":13000000.0,"lo":13000000.0,"hi":13000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.freebuf.com/articles/blockchain-articles/169773.html"}],"desc":"After logging in to the website for 10s, the user's wallet is emptied, the hacker hijacks the DNS server, and the user logs in to MyEtherWallet to force a redirect to the malicious website. The user was forced to redirect to a malicious website when logging in to MyEtherWallet.","theft":true},{"id":"htece458381d","date":"2018-04-24","name":"SmartMesh","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Token","chains":["Ethereum"],"usd":140000000.0,"lo":140000000.0,"hi":140000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.blockvalue.com/p/381584.html"}],"desc":"On April 25, 2018, SmartMesh token suffered an integer overflow in the transferProxy function, allowing attackers to generate massive quantities of counterfeit tokens (~65.3 trillion). Though no direct USD loss is documented, ~16.6M counterfeit tokens were actually traded on exchanges before being halted.","theft":true,"onchain":true},{"id":"htf3e3bd4612","date":"2018-04-22","name":"BeautyChain","kind":"hack","fam":"code","tech":"Infinite Mint","target":"Token","chains":["Ethereum"],"usd":1000000000.0,"lo":1000000000.0,"hi":1000000000.0,"conf":"A","n":3,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://blog.csdn.net/ffzhihua/article/details/81137233"}],"desc":"On April 22, 2018, BeautyChain token suffered an integer overflow in the batchTransfer function, allowing attackers to generate 10^58 BEC tokens. Though face value was astronomical, the actual loss was limited by exchanges halting BEC/SMT trading on April 25 in response to the vulnerability.","theft":true,"onchain":true},{"id":"htcda954401d","date":"2018-04-21","name":"Gate","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","usd":235000000.0,"lo":235000000.0,"hi":235000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Gate.io lost ~$230M on April 21, 2018 when North Korean hackers compromised exchange private keys. Attacker drained ~10.8K BTC, ~219K ETH, ~100M DOGE and other tokens. Gate concealed the breach until ZachXBT revealed it in 2024.","theft":true},{"id":"ht60e6d54b63","date":"2018-04-12","name":"Coinsecure","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":3300000.0,"lo":3300000.0,"hi":3300000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"http://archive.is/AZnGe"}],"desc":"In April 2018, Coinsecure's chief security officer Dr. Amitabh Saxena exposed the exchange's private keys while attempting to distribute Bitcoin Gold to customers. The keys were exposed online for over 12 hours, allowing attackers to steal 438 BTC (~$3.3M). Saxena was arrested as a prime suspect.","theft":true},{"id":"htb24d77d2f5","date":"2018-04-04","name":"Verge","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.freebuf.com/column/169210.html"}],"desc":"The Verge network was attacked by 51% for the first time. According to Bitcointalk forum user ocminer, a malicious miner can use forged timestamps to mine blocks, thereby tricking the network into thinking that the new block was mined one hour ago, so that when the next mined block is immediately added to the network, it also added to the blockchain. This allowed the attacker to mine one block per second, which is said to have mined 250,000 XVG.","theft":true},{"id":"htb9d4add4f9","date":"2018-04-02","name":"Electroneum","kind":"hack","fam":"other","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://steemit.com/electroneum/@samdman/electroneum-under-51-attack"}],"desc":"The attacker has a large amount of computing power to launch 51% attack","theft":true},{"id":"ht465b94852a","date":"2018-03-07","name":"Binance","kind":"hack","fam":"keys","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://bihu.com/article/1870950340?i=17K9&c=1&s=22CjEo&from=groupmessage&isappinstalled=0"}],"desc":"Binance security incident occurred in March 2018 when a phishing campaign impacted a large number of Binance users. At the time, Binance offered a $250,000 reward for any information that would have led to the arrest of those involved in the phishing campaign.","theft":true},{"id":"htfd1b0cd4b9","date":"2018-02-19","name":"Blockchain.info","kind":"phishing","fam":"social","tech":"Phishing attack","target":"Wallet","usd":50000000.0,"lo":50000000.0,"hi":50000000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"http://tech.sina.com.cn/i/2018-02-18/doc-ifyrswmt9681885.shtml"}],"desc":"A hacking organization in Ukraine has stolen cryptocurrencies worth more than $50 million from the Blockchain.info by purchasing keyword advertisements related to cryptocurrencies in the Google search engine and masquerading as malicious websites of legitimate websites.","theft":true},{"id":"ht7ab821f17a","date":"2018-02-12","name":"BitGrail","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Nano"],"usd":170000000.0,"lo":170000000.0,"hi":170000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://coinmarketcap.com/alexandria/article/bitgrail-hack-one-of-the-largest-crypto-hacks-in-history"}],"desc":"On February 9-12, 2018, BitGrail exchange suffered a massive breach affecting 17M Nano coins (~$170M). The exploit involved a flaw in the withdrawal mechanism that allowed repeated withdrawals of the same funds. Attackers gradually stole 2.5M Nano from hot wallets, with abuse continuing over months for a total of 7.5M+ Nano.","theft":true},{"id":"ht041aa7885c","date":"2018-01-26","name":"Coincheck","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["NEM"],"usd":534000000.0,"lo":534000000.0,"hi":534000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://fortune.com/2018/01/31/coincheck-hack-how/"}],"desc":"On January 26, 2018, Coincheck announced hackers stole 523 million NEM coins from its internet-connected hot wallet, which lacked adequate security controls. The exchange began reimbursing approximately 260,000 affected users.","theft":true},{"id":"htbbffac08d2","date":"2018-01-13","name":"BlackWallet","kind":"hack","fam":"keys","tech":"DNS hijacking","target":"Wallet","usd":400000.0,"lo":400000.0,"hi":400000.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.reddit.com/r/Stellar/comments/7q9g31/statement_blackwallet_hacks_update/?ref_source=embed&ref=share"}],"desc":"User orbit84 posted on Reddit that a hacker entered his hosting provider account and changed the DNS settings to his own hosted version of BlackWallet. The attacker's wallet seems to have accumulated about $400,000 worth of cryptocurrency, and its market value has almost tripled in the past month. In a statement, the founder of BlackWallet claimed that the open source online \"star wallet\" BlackWallet had been hacked.","theft":true},{"id":"htff8947527a","date":"2017-12-20","name":"EtherDelta","kind":"hack","fam":"keys","tech":"DNS Hijack","target":"CEX","chains":["Ethereum"],"usd":1400000.0,"lo":1400000.0,"hi":1400000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Between December 19-26, 2017, EtherDelta suffered DNS hijacking attacks by Anthony Nashatka and Elliott Gunton. Users were redirected to a phishing site where credentials were captured. The attackers stole ~$600K from Dec 19-21 and an additional $800K from a single user on Dec 26, totaling ~$1.4M.","theft":true},{"id":"htb70a048f39","date":"2017-12-19","name":"Youbit","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://themerkle.com/youbit-hacked-again-closes-its-doors/"}],"desc":"On December 19, 2017, South Korean exchange Youbit suffered its second breach of the year, losing 17% of total assets (~3,831 BTC equivalent from the first hack in April). Attackers compromised the hot wallet; cold storage remained secure. Korean authorities attributed the attack to BlueNoroff, a Lazarus subgroup. The exchange permanently closed after this incident.","theft":true},{"id":"ht103a3d01cc","date":"2017-12-08","name":"NiceHash","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":64000000.0,"lo":64000000.0,"hi":64000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"http://archive.is/pWTbH"}],"desc":"On December 6-7, 2017, NiceHash's payment wallet was compromised after attackers obtained employee credentials via phishing. The attacker accessed the wallet and stole 4,700+ BTC (~$64M). NiceHash eventually repaid all affected users by December 16, 2020.","theft":true},{"id":"htdb987f1225","date":"2017-11-19","name":"Tether","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"Token","chains":["Bitcoin"],"usd":30950010.0,"lo":30950010.0,"hi":30950010.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.cnbc.com/2017/11/21/tether-hack-attacker-reportedly-steals-30-million-of-digital-tokens.html"}],"desc":"On November 19, 2017, $30.95M USDT was removed from Tether's Treasury wallet and sent to an unauthorized address. Tether blocked the tokens and marked them as non-redeemable, preventing their circulation. Tether worked with the Omni Foundation to implement protocol upgrades allowing eventual token reclamation.","theft":true},{"id":"ht94a0190669","date":"2017-11-09","name":"Parity Multisig","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"DeFi Protocol","chains":["Ethereum"],"usd":150000000.0,"lo":150000000.0,"hi":150000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On November 8, 2017, a user called 'devops199' accidentally exploited a vulnerability in Parity's multi-sig wallet library contract by calling initWallet then kill(), permanently disabling over 500 multi-sig wallets containing approximately 500,000 ETH. The library lacked protection against reinitialization and destruction by non-owners.","theft":true},{"id":"htbd165faf2c","date":"2017-11-06","name":"Parity","kind":"hack","fam":"other","tech":"'Accidentally Killed It'","chains":["Ethereum"],"conf":"C","n":1,"theft":true,"onchain":true},{"id":"htd6f7bfa0af","date":"2017-09-10","name":"Control-Finance","kind":"fraud","fam":"insider","tech":"Scam","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://financefeeds.com/cftc-launches-action-uk-based-crypto-scheme-control-finance/"}],"desc":"On June 18,2019, the US Commodity Futures Trading Commission (CFTC) announced it had initiated a civil enforcement action against a now-defunct cryptocurrency trading and investment company for misappropriating $147 million worth of Bitcoin. The Complaint charges the defendants—Control-Finance Limited and its principal, Benjamin Reynolds—with exploiting public enthusiasm for crypto assets by fraudulently obtaining and misappropriating at least 22,858.822 Bitcoin from more than 1,000 customers through a classic (HYIP) Ponzi scheme called the Control-Finance Affiliate Program."},{"id":"ht3f1a5fd1c0","date":"2017-07-26","name":"BTC-e","kind":"hack","fam":"other","tech":"Unknown","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/BTC-e"}],"desc":"According to internet rumors, 66,000 bitcoins were suspected to have been stolen from the BTC-e exchange. The user inquired on the blockchain that the block with a block height of 477472 was transferred out of 66163.40004136 bitcoins. It is suspected that the BTC-e user was stolen by hackers of a huge amount of bitcoins.","theft":true},{"id":"ht161edd5f5f","date":"2017-07-19","name":"Coindash","kind":"hack","fam":"other","tech":"Malicious Code Injection Attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.zdnet.com/article/hacker-steals-7-4m-in-ethereum-during-coindash-ico-launch/"}],"desc":"Hacker steals $7.4 million in ethereum during CoinDash ICO launch. At the time of the ICO, in which CoinDash posted a string of characters which represented its wallet address for investors to send funds to, it appears that the hacker compromised the website and changed this text to a wallet they control. It was a matter of minutes before the platform realized the security breach had taken place and warned investors, but it was too late -- and now the stolen funds intended for CoinDash are simply sitting in a wallet awaiting collection.","theft":true},{"id":"hta655774bdd","date":"2017-07-19","name":"Parity","kind":"hack","fam":"code","tech":"Unauthorized operation","chains":["Ethereum"],"conf":"A","n":2,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/30-million-ether-reported-stolen-parity-wallet-breach"}],"desc":"On July 29, 2017, the Ethereum multi-signature wallet company Parity issued a security alert, notifying users of serious vulnerabilities in its wallet v1.5 or later. That day, a black hat hacker used the vulnerability to exhaust the Parity wallets of three Ethereum projects, stealing a total of 153,037 ETH from Swarm City, Edgeless, and Aeternity.","theft":true,"onchain":true},{"id":"hta50b53ee1d","date":"2017-07-18","name":"CoinDash","kind":"hack","fam":"keys","tech":"Frontend Compromise","target":"ICO","chains":["Ethereum"],"usd":7700000.0,"lo":7700000.0,"hi":7700000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"CoinDash's ICO website was compromised on July 17-18, 2017 within 13 minutes of launch. Attacker replaced the deposit address with their own; 2,000+ investors sent 37K ETH (~$7M) to the attacker before the ICO was pulled. Hacker retained ~13.4K ETH (~$11.7M).","theft":true},{"id":"ht301908f2b6","date":"2017-07-01","name":"Parity","kind":"hack","fam":"code","tech":"Uninitialized Proxy","target":"Wallet","chains":["Ethereum"],"usd":30000000.0,"lo":30000000.0,"hi":30000000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On July 19, 2017, a vulnerability in Parity's multisig wallet library allowed an attacker to reset ownership of wallets and drain them. The attacker stole 153,037 ETH (~$30M) from Swarm City, Edgeless, and Aeternity. A white-hat group subsequently used the same exploit to rescue ~$166M in additional vulnerable wallets.","theft":true},{"id":"hta827302d0e","date":"2017-06-21","name":"Bithumb","kind":"phishing","fam":"social","tech":"Phishing attack","target":"CEX","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/-south-korean-cryptocurrency-exchange-bithumb-hacked/"}],"desc":"Bithumb is one of the five largest bitcoin exchanges in the world. Hackers succeeded in grabbing the personal information of 31,800 Bithumb website users, including their names, mobile phone numbers and email addresses. The exchange claims that this number represents approximately three percent of customers. And the exchange further claims that the breach was made to a personal computer belonging to an employee, and not the exchange’s internal network, servers nor digital currency wallets. Attackers appear to have stolen enough credentials to begin a process of “voice phishing,” where the scammers call up victims one at a time and pose as representatives of Bithumb.","theft":true},{"id":"htbf1bd4702b","date":"2017-04-27","name":"Yapizon","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":4800000.0,"lo":4800000.0,"hi":4800000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://news.bitcoin.com/hacked-korean-bitcoin-exchange-yapizon-offers-ious/"}],"desc":"On April 22, 2017, Yapizon suffered an attack where hackers compromised four hot wallets and stole 3,816 BTC (~$5M), representing 37% of user funds. South Korean authorities later alleged the breach was perpetrated by North Korea. Yapizon replaced lost balances with Fei tokens representing IOUs.","theft":true},{"id":"ht45cf6e710f","date":"2017-04-01","name":"Stellar","kind":"hack","fam":"code","tech":"Inflation","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.sohu.com/a/304276429_100217347"}],"desc":"Messari, a cryptocurrency research organization, announced on the 27th that Stellar's blockchain protocol had an inflation loophole in April 2017. An attacker used the loophole to create 2.25 million XLM (worth about 10 million US dollars). This bug was discovered by the Stellar Development Foundation (SDF) and patched after the accident.","theft":true},{"id":"ht43c25a181c","date":"2016-10-13","name":"Bitcurex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":1500000.0,"lo":1500000.0,"hi":1500000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"On October 13, 2016, Poland's largest Bitcoin exchange Bitcurex shut down after losing 2,300 BTC (~$1.5M) to attackers. The platform cited 'external interference in automated data collection' but later investigation revealed security compromises. The exchange attempted to restart but permanently closed weeks later.","theft":true},{"id":"htaa2087e996","date":"2016-08-02","name":"Bitfinex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":72000000.0,"lo":72000000.0,"hi":900000000.0,"conf":"B","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.justice.gov/opa/press-release/file/1470186/download"}],"desc":"Bitfinex suffered a security breach when an attacker compromised hot wallet private keys, stealing 119,756 bitcoins (~$72 million). The exchange halted trading and withdrawals while investigating.","theft":true,"review":["sources disagree on the loss"]},{"id":"htbff7b99587","date":"2016-06-17","name":"The DAO","kind":"hack","fam":"code","tech":"Reentrancy","target":"DeFi Protocol","chains":["Ethereum"],"usd":60000000.0,"lo":60000000.0,"hi":60000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/The_DAO_(organization)"}],"desc":"The DAO hack of June 17, 2016 was the first major Ethereum reentrancy attack. Attacker recursively called splitDAO before balance updates, extracting 3.6M ETH (~$60M).","theft":true},{"id":"htbf324fea87","date":"2016-05-14","name":"Gatecoin","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Ethereum"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/gatecoin-2-million-bitcoin-ether-security-breach"}],"desc":"Between May 9-12, 2016, Hong Kong-based Gatecoin suffered a breach where attackers exploited a server reboot disruption to reroute deposits from cold multi-signature wallets to a vulnerable hot wallet. Approximately 250 BTC and 185,000 ETH (~$2M) were stolen, representing 15% of exchange assets.","theft":true},{"id":"htaed54cbd1a","date":"2016-04-07","name":"ShapeShift","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":230000.0,"lo":230000.0,"hi":230000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Between March-April 2016, ShapeShift suffered three separate thefts totaling ~$230K. An employee stole $130K in mid-March, then after dismissal sold security credentials to external hackers who stole an additional $100K (154 BTC, 5,800 ETH, 1,900 LTC). No customer funds were lost as ShapeShift used a non-custodial architecture.","theft":true},{"id":"ht04b45e5133","date":"2015-08-15","name":"BTER","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":1650000.0,"lo":1650000.0,"hi":1650000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"BTER's servers were compromised and 50 million NXT tokens (valued at ~$1.65M) were stolen from the exchange's hot wallets. The exchange suspended operations and implemented security partnerships to prevent further losses.","theft":true},{"id":"ht15cdeeb5bc","date":"2015-05-22","name":"Bitfinex","kind":"hack","fam":"keys","tech":"Hot Wallet Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":329000.0,"lo":329000.0,"hi":329000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Bitfinex's hot wallets were compromised in a breach attributed to security gaps and operational errors. Approximately 1,460 BTC were stolen from the exchange's online storage systems.","theft":true},{"id":"ht09f73298f4","date":"2015-02-18","name":"KipCoin","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":728000.0,"lo":728000.0,"hi":728000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.newsbtc.com/news/chinese-bitcoin-exchange-kipcoin-shuts-claims-losing-3000-btc-hackers/"}],"desc":"KipCoin's Linode-hosted servers were compromised when attackers gained access to the wallet.dat file in May 2014. The attacker remained dormant until December 2014, when they began moving the 3,000+ stolen BTC.","theft":true},{"id":"htea74cc3b6f","date":"2015-02-17","name":"BTER","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":1750000.0,"lo":1750000.0,"hi":1750000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.securityweek.com/7170-btc-stolen-chinese-bitcoin-exchange-bter"}],"desc":"BTER's cold wallet storage system was breached, resulting in the theft of 7,170 BTC. The fact that offline cold storage was compromised suggested a possible insider threat, though the full mechanism was never disclosed. The exchange suspended operations immediately.","theft":true},{"id":"ht9bc90f6571","date":"2015-01-27","name":"796","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Bitcoin"],"usd":270000.0,"lo":270000.0,"hi":270000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"The 796 exchange suffered from a vulnerability in its withdrawal system that allowed attackers to modify withdrawal addresses. A hacker exploited this by submitting a withdrawal with a modified address that the exchange staff failed to notice, routing 1,000 BTC to the attacker instead of the legitimate customer.","theft":true},{"id":"hte9f21884c0","date":"2015-01-05","name":"Bitstamp","kind":"hack","fam":"social","tech":"Phishing","target":"CEX","chains":["Bitcoin"],"usd":5200000.0,"lo":5200000.0,"hi":5200000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2015/01/05/bitstamp-claims-5-million-lost-in-hot-wallet-hack/"}],"desc":"Six Bitstamp employees were targeted in a sophisticated weeks-long phishing campaign starting in November 2014. The attacker sent social engineering emails to the CTO and system administrator, culminating in malware installation that gave the attacker access to the exchange's hot wallet infrastructure.","theft":true},{"id":"ht5219a3814e","date":"2014-07-29","name":"Cryptsy","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin","Litecoin"],"usd":9580000.0,"lo":9580000.0,"hi":9580000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Cryptsy announced on July 29, 2014 that an attacker under the nickname Lucky7Coin had inserted Trojan code into the exchange's systems, stealing 13,000 BTC and 300,000 LTC. Though later evidence suggested CEO Paul Vernon may have conducted internal theft and misattributed it, the reported mechanism involved compromised private keys.","theft":true},{"id":"ht8d3a783071","date":"2014-07-13","name":"Mintpal","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Bitcoin"],"usd":2000000.0,"lo":2000000.0,"hi":2000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/markets/2014/07/14/8-million-vericoin-hack-prompts-hard-fork-to-recover-funds/"}],"desc":"Mintpal's exchange was compromised and attackers gained control of internal features that allowed them to withdraw 8 million VeriCoin (30% of circulating supply at the time). VeriCoin developers executed a soft fork to roll back the blockchain, returning the stolen tokens to the exchange.","theft":true},{"id":"ht83617a7073","date":"2014-03-04","name":"Poloniex","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"CEX","chains":["Bitcoin"],"usd":50000.0,"lo":50000.0,"hi":50000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.coindesk.com/poloniex-loses-12-3-bitcoins-latest-bitcoin-exchange-hack"}],"desc":"An attacker discovered a race condition in Poloniex's withdrawal processing logic. By submitting multiple concurrent withdrawal requests, the attacker could deplete accounts to negative balances before the system updated withdrawal state, extracting 97 BTC without having that balance.","theft":true},{"id":"ht8b9a9b622b","date":"2014-03-02","name":"Flexcoin","kind":"hack","fam":"code","tech":"Withdrawal Logic Flaw","target":"CEX","chains":["Bitcoin"],"usd":600000.0,"lo":600000.0,"hi":600000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Flexcoin's exchange had a race condition in its transfer code. An attacker sent thousands of simultaneous transfer requests between user accounts, moving coins from one account to another until the sending account was overdrawn before balances were updated, stealing 896 BTC.","theft":true},{"id":"ht39770323dd","date":"2014-02-17","name":"Picostocks","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":4430000.0,"lo":4430000.0,"hi":4430000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Picostocks lost 5,896 BTC from both hot and cold wallets. Because the offline cold storage was somehow accessed, the theft was suspected to be an inside job or the result of compromised key storage, suggesting an internal actor or breach of key management.","theft":true},{"id":"htbd619b03c2","date":"2014-02-07","name":"Mt. Gox","kind":"hack","fam":"keys","tech":"Private Key Compromised","target":"CEX","chains":["Bitcoin"],"usd":470000000.0,"lo":470000000.0,"hi":470000000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://en.wikipedia.org/wiki/Mt._Gox"}],"desc":"Mt. Gox, the world's largest Bitcoin exchange, collapsed when it revealed that 850,000 BTC belonging to customers and the company were missing. The exchange had been incrementally hacked since at least 2011 when attackers gained access to the hot wallet, with hackers siphoning BTC over several years.","theft":true},{"id":"ht63d39942ba","date":"2013-11-11","name":"Bitcash","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Bitcoin"],"usd":100000.0,"lo":100000.0,"hi":100000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Bitcash.cz was compromised and bitcoins from up to 4,000 customer wallets were stolen. The attack appeared to use phishing emails sent from compromised Bitcash staff accounts to lure victims into sending BTC for supposed recovery.","theft":true},{"id":"htef3cd48845","date":"2013-10-23","name":"Inputs.io","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":1200000.0,"lo":1200000.0,"hi":1200000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Inputs.io was hacked twice in 2013. Attackers compromised email accounts used for password reset and bypassed two-factor authentication due to a flaw on the server hosting side. The attacker stole 4,100+ BTC across the two separate hacks.","theft":true},{"id":"htc7fef9e5bf","date":"2013-06-08","name":"Feathercoin","kind":"hack","fam":"other","tech":"51% attack","usd":63800.0,"lo":63800.0,"hi":63800.0,"conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://www.coindesk.com/feathercoin-hit-by-massive-attack"}],"desc":"On June 8, Feathercoin was attacked by 51%. Before the attack, Feathercoin's total computing power was 0.2GH/s, and during the time of the attack, the computing power doubled 7 times to 1.5GH/s. Thirty-one hours later, an investigation revealed that the attacker took away 580,000 Feathercoin through a double-spending attack on the exchange, at a current price of $63,800.","theft":true},{"id":"ht30a0df56bb","date":"2012-09-05","name":"Bitfloor","kind":"hack","fam":"keys","tech":"Key Stored Publicly","target":"CEX","chains":["Bitcoin"],"usd":250000.0,"lo":250000.0,"hi":250000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://www.tl80.cn/article/69040"}],"desc":"Bitfloor's servers were breached and hackers accessed an unencrypted backup of Bitcoin wallet keys. The founder, Roman Shtylman, had failed to encrypt the digital wallet containing encryption keys during a system upgrade, leaving the backup in unencrypted form on disk.","theft":true},{"id":"ht607b31d95b","date":"2012-05-11","name":"Bitcoinica","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":90000.0,"lo":90000.0,"hi":90000.0,"conf":"A","n":2,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"},{"s":"SlowMist Hacked","u":"https://bitcoinmagazine.com/articles/bitcoinica_an_obituary-1336979566"}],"desc":"Bitcoinica's production servers were compromised, allowing attackers to steal 18,547 BTC from the exchange's online wallet. The attacker gained access to the wallet infrastructure through a breach of the hosting provider.","theft":true},{"id":"htb1897bbd71","date":"2012-03-01","name":"Bitcoinica","kind":"hack","fam":"keys","tech":"Key Leaked via Infrastructure","target":"CEX","chains":["Bitcoin"],"usd":228000.0,"lo":228000.0,"hi":228000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Bitcoinica suffered its first major hack when attackers breached Linode web hosting and stole 43,000 BTC from the exchange. The compromise of the hosting provider gave attackers direct access to Bitcoinica's wallet infrastructure.","theft":true},{"id":"hta2edfd399d","date":"2012-01-06","name":"Coiledcoin","kind":"hack","fam":"code","tech":"51% attack","conf":"C","n":1,"src":[{"s":"SlowMist Hacked","u":"https://mp.weixin.qq.com/s/JIpys8Nbb3IT3f8pRIhzMQ"}],"desc":"The attacker has a lot of computing power to launch a 51% attack. The interesting thing about the Coiledcoin attack is that it is not economically driven, but purely political. Although this move has caused some protests in the community, it shows how vulnerable the SHA-256 cryptocurrency with low hashing power is to attack.","theft":true},{"id":"ht9374a9f385","date":"2011-06-19","name":"Mt. Gox","kind":"hack","fam":"code","tech":"Improper Access Control","target":"CEX","chains":["Bitcoin"],"usd":8750000.0,"lo":8750000.0,"hi":8750000.0,"conf":"C","n":1,"src":[{"s":"DefiLlama","u":"https://defillama.com/hacks"}],"desc":"Mt. Gox's auditor's computer was compromised, giving attackers access to the exchange's admin credentials. Attackers manipulated the exchange price to $0.01 BTC and used the access to drain customer accounts, transferring approximately 2,000 BTC while 650 more were purchased at the artificially low price.","theft":true}]}