https://swan-hack-tracker.pages.dev/history/feed.xmlCrypto hack history: new incidents2026-10-31T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/htf5fb3feb2c/VergeX: Hack or exploit, $4K2026-10-31T00:00:00ZThe AI trading platform VergeX was attacked. Some users received withdrawal verification emails triggered by the attack. The official confirmed a total of 3,688.58 USDC was affected; risk controls triggered within one minute, all affected funds have been returned, and other users’ funds were unaffected. Services are being restored in stages.https://swan-hack-tracker.pages.dev/history/i/ht84f0479352/Flap: Hack or exploit, undisclosed2026-10-31T00:00:00ZFlap (a modular token launch platform)’s official website flap.sh was hit by a DNS hijacking attack and redirected to a malicious clone site. Attackers gained control at the domain registrar level, pointed DNS to a malicious Dutch server, and deployed the StepDrainer wallet-drainer toolkit. This tricked users who visited and connected wallets into signing malicious transactions (e.g., unlimited aphttps://swan-hack-tracker.pages.dev/history/i/htc68d839941/Binance CEX: Hack or exploit, $6.30B2026-10-29T00:00:00ZOn October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billihttps://swan-hack-tracker.pages.dev/history/i/ht1fa9f01d3c/Polymarket International: Hack or exploit, $2.7M2026-10-29T00:00:00ZAttackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committhttps://swan-hack-tracker.pages.dev/history/i/ht9efb76173c/Hifi Finance: Hack or exploit, $1M2026-10-28T00:00:00ZAn attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokehttps://swan-hack-tracker.pages.dev/history/i/ht8d8d58130d/zkLink Nova: Hack or exploit, $783K2026-10-28T00:00:00ZAn attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drainhttps://swan-hack-tracker.pages.dev/history/i/htf2bb1e2ad0/Predict Fun: Hack or exploit, $400K2026-10-27T00:00:00ZSeveral Predict.fun users experienced unauthorized wallet transfers totaling approximately 400,000 USDT. Preliminary findings suggest a possible compromise of the project’s API documentation website, which was hosted by a third-party provider. Predict.fun took the documentation site offline as a precaution and committed to reimbursing affected usershttps://swan-hack-tracker.pages.dev/history/i/ht8c76cd8632/Fence Finance: Hack or exploit, $1M2026-10-27T00:00:00ZAn attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vaulthttps://swan-hack-tracker.pages.dev/history/i/ht8bedab7fd7/Diamante: Hack or exploit, undisclosed2026-10-27T00:00:00ZThe Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected https://swan-hack-tracker.pages.dev/history/i/ht2e236a34f9/Zilliqa X-Bridge: Hack or exploit, undisclosed2026-10-27T00:00:00ZZilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continuehttps://swan-hack-tracker.pages.dev/history/i/htff7d719ab2/Myriad Markets: Hack or exploit, undisclosed2026-10-26T00:00:00ZAn attacker exploited a previously exposed private key belonging to Myriad’s automated market management wallet. The key had reportedly been leaked through a vulnerability in a third-party library used by a backend service. The attacker used the wallet’s privileges to manipulate positions and force incorrect resolutions across 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permisshttps://swan-hack-tracker.pages.dev/history/i/htd42cada95e/SafeApprovalSquat: Hack or exploit, $7.5M2026-10-26T00:00:00ZA 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.https://swan-hack-tracker.pages.dev/history/i/ht05c73d0422/Bloom Trading Bot: Hack or exploit, $953K2026-10-26T00:00:00ZAn attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds. Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquhttps://swan-hack-tracker.pages.dev/history/i/ht6e7caada6a/Yapeswap: Hack or exploit, $22K2026-10-25T00:00:00ZYapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposihttps://swan-hack-tracker.pages.dev/history/i/htcac16d22ef/X100: Hack or exploit, $4.8M2026-10-24T00:00:00ZX100’s governance system allowed an attacker to obtain two of three Senate seats using flash-loan-funded X tokens. The attacker immediately used this majority to approve and execute a malicious treasury proposal within the same transaction. The proposal forced the Freezer to swap 400,000 X tokens into an attacker-controlled liquidity pool with zero minimum output, allowing the attacker to extract https://swan-hack-tracker.pages.dev/history/i/htf5234ea25e/Initia: Hack or exploit, $2.6M2026-10-23T00:00:00ZInitia suffered a security incident involving the unauthorized minting of multiple assets on its L1. The attacker reportedly transferred and converted some of the minted assets into Ethereum-based holdings. Initia halted its L1 and rollups while investigating the vulnerability and coordinating with validators, exchanges, and security teamshttps://swan-hack-tracker.pages.dev/history/i/ht8ce65aabb4/Kimchi Token: Rug pull, $385K2026-10-23T00:00:00ZThe Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug puhttps://swan-hack-tracker.pages.dev/history/i/ht14bd7bdcce/WAX Multi-Chain Bridge: Hack or exploit, $90K2026-10-22T00:00:00ZWAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereumhttps://swan-hack-tracker.pages.dev/history/i/ht0bc207a000/NEM（NemTokenV2）: Hack or exploit, $822K2026-10-22T00:00:00ZThe NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract aphttps://swan-hack-tracker.pages.dev/history/i/htb837555bf0/Fearless Wallet: Hack or exploit, $20K2026-10-21T00:00:00ZPolkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and mhttps://swan-hack-tracker.pages.dev/history/i/htb04ca7a58f/CoinDCX: Hack or exploit, $16M2026-10-21T00:00:00ZCoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the rhttps://swan-hack-tracker.pages.dev/history/i/ht2690d39711/Swell: Hack or exploit, undisclosed2026-10-21T00:00:00ZAn attacker gained control of approximately 30 Swell operational keys across multiple networks, including the swETH/rswETH oracle bot. The attacker drained wallet balances, artificially increased swETH and rswETH exchange rates by submitting unbacked reserve values, and redirected EigenLayer reward claims. They also deployed malicious upgrade contracts capable of draining approximately 2,513 ETH, https://swan-hack-tracker.pages.dev/history/i/htfdd79667eb/Slice: Hack or exploit, $41K2026-10-20T00:00:00ZSlice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to https://swan-hack-tracker.pages.dev/history/i/ht57f3116438/Argent-style Smart Wallet System: Hack or exploit, $60K2026-10-19T00:00:00ZAn attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 timehttps://swan-hack-tracker.pages.dev/history/i/htd83eeef467/AlpsCon AI Trade Hub: Hack or exploit, $153K2026-10-18T00:00:00ZAlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC. The attack was facilitated by an authorihttps://swan-hack-tracker.pages.dev/history/i/htb157375841/Coffer: Hack or exploit, $12026-10-18T00:00:00ZCoffer’s BTC pool incorrectly rounded tiny deposits to zero while still minting LP tokens, allowing an attacker to repeatedly obtain shares without providing equivalent assets. The attacker submitted thousands of minimal deposits, diluting existing liquidity providers and minting approximately $18 in illegitimate LP tokens. Coffer paused its pools on October 18, preventing further withdrawals, andhttps://swan-hack-tracker.pages.dev/history/i/hteb16412f20/BiFi: Hack or exploit, $166K2026-10-17T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/hta8a6c53ad2/Qubic: Hack or exploit, $1.3M2026-10-17T00:00:00ZAn attacker exploited predictable wallet seeds generated with insufficient randomness in Qubic’s wallet software, compromising 1,404 user wallets and stealing approximately 2.94 trillion QU. The vulnerability affected certain wallets created on Apple devices and Safari browsers. Qubic halted its network at tick 85,371,949, while MEXC froze the account receiving the remaining stolen funds. Seed genhttps://swan-hack-tracker.pages.dev/history/i/ht79e237d448/TIPMine: Hack or exploit, $69K2026-10-17T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/hted59985fee/Affluent: Hack or exploit, $1.1M2026-10-16T00:00:00ZAffluent’s lending vaults reportedly suffered unauthorized share minting that allowed attackers to redeem vault assets without providing corresponding deposits. The supplied analysis identifies suspicious transactions on September 30, October 12, and October 16, 2026, involving multiple wallets. Extracted assets were reportedly transferred through exchanges, swaps, and cross-chain serviceshttps://swan-hack-tracker.pages.dev/history/i/ht9cdaf4fad9/KolanHook: Hack or exploit, $19K2026-10-15T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/ht5452ff2851/Pirate Chain: Hack or exploit, $10.7M2026-10-14T00:00:00ZPirate Chain suffered an exploit in the transparent supply-accounting layer introduced with its Ironwood upgrade. Two transaction-validation failures reportedly allowed an attacker to bypass issuance restrictions and exploit incorrect output-script interpretation, creating approximately 39.8 million unauthorized ARRR. The tokens were transferred into the Sapling shielded pool, obscuring subsequenthttps://swan-hack-tracker.pages.dev/history/i/ht4b4886f0ba/UNCX Network V2: Hack or exploit, $89K2026-10-14T00:00:00ZAn attacker exploited UNCX Vesting V2’s shared token accounting by creating vesting positions, releasing a large position, donating tokens into the pool, and cancelling a topped-up vest. This sequence allowed a small remaining vesting position to withdraw tokens belonging to other users. UNCX confirmed additional affected assets across four chains and introduced emergency fees and restrictions to https://swan-hack-tracker.pages.dev/history/i/ht3b19c8200f/Gamdom: Hack or exploit, $4.2M2026-10-13T00:00:00ZGamdom suffered a multichain hot-wallet compromise following unauthorized access to an automation server. Investigators traced approximately $4.21M in stolen assets across eight networks. The attacker subsequently bridged, swapped, and distributed funds through multiple wallets and services, including Mayan, Hyperliquid, and THORChain. The precise mechanism used to obtain control of the wallets rehttps://swan-hack-tracker.pages.dev/history/i/ht360f5cb34a/Papertrade: Hack or exploit, $1.3M2026-10-10T00:00:00ZPapertrade, a perpetual trading protocol on HyperEVM, reportedly suffered an oracle manipulation attack shortly after launch. The attacker manipulated Hyperliquid’s ETH order-book midpoint through external trades while opening and closing highly leveraged synthetic positions on Papertrade. Because the protocol used the instantaneous BBO midpoint without TWAP, deviation limits, or independent pricehttps://swan-hack-tracker.pages.dev/history/i/htc7d63463d8/Ledger (Supply Chain): Hack or exploit, $93M2026-10-09T00:00:00ZAttackers purchased genuine Ledger hardware wallets, installed concealed components capable of capturing recovery phrases, and redistributed the modified devices through resellers. The implants monitored the wallets’ displays during initialization and transmitted captured recovery phrases through cellular connections. Attackers subsequently derived users’ private keys and drained their cryptocurrehttps://swan-hack-tracker.pages.dev/history/i/ht6d2d93a5c0/BitBay: Hack or exploit, $15K2026-10-09T00:00:00ZBitBay’s vault contained a vulnerability in _withdraw() that transferred the contract’s entire token balance whenever liquidity == 0, without restricting withdrawals to the user’s proportional entitlement. The attacker triggered this condition through reposition() and subsequently redeemed one minimal share unit, receiving approximately 14,838.47 DAI belonging to the vaulthttps://swan-hack-tracker.pages.dev/history/i/htdc8d838bc4/X7 Finance: Hack or exploit, $17K2026-10-08T00:00:00ZAn attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.7https://swan-hack-tracker.pages.dev/history/i/ht15761e9805/X7Finance: Hack or exploit, $17K2026-10-08T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/ht030483d0aa/Ethervista: Hack or exploit, $19K2026-10-08T00:00:00ZEtherVista’s EtherVistaPair.swap() contained an integer overflow vulnerability in its constant-product invariant check. Because the contract multiplied two uint112 reserves without sufficient overflow protection, the calculation could wrap around and incorrectly validate swaps that reduced the pool’s actual reserve product. An attacker registered a malicious contract as an authorized router and exhttps://swan-hack-tracker.pages.dev/history/i/htd00df309c2/79th Vault: Hack or exploit, $12.5M2026-10-07T00:00:00ZAn operator hot-wallet private key of 79th Vault was compromised. Using an OPERATOR_ROLE function, the attacker moved 2.01 million 79AU out of the PancakeSwap 79AU/USDT pair in seven transfers, sold them back in about 95 swaps, cut the pool’s USDT reserves from about $15,200,000 to about $3,900,000, and cashed out 16,249 BNB (about $12,500,000). Forty-one seconds later the same operator key sent 3https://swan-hack-tracker.pages.dev/history/i/htb30c6cef0b/Locus Finance: Hack or exploit, $18K2026-10-07T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/htd40203a5ea/MakerDAO ETH-A Liquidation Keeper Bot: Hack or exploit, $538K2026-10-06T00:00:00ZA dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() https://swan-hack-tracker.pages.dev/history/i/hta77d513164/Set Protocol: Hack or exploit, $22K2026-10-06T00:00:00ZETHMACOAPY’s actualizeFee() rounded redemption backing upward even when no fee was payable. Attackers donated collateral to trigger recalculation, temporarily acquired Set tokens, then redeemed them for more collateral than they contributed, with the difference coming from existing holders’ backing. Two separate EOAs repeated the process across two transactions, draining approximately 8.11 WETHhttps://swan-hack-tracker.pages.dev/history/i/ht61561fd0ad/SetProtocol: Hack or exploit, $14K2026-10-06T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/ht34859c04ae/MakerDAOFlipKeeper: Hack or exploit, $1.1M2026-10-06T00:00:00Zhttps://swan-hack-tracker.pages.dev/history/i/ht7c4d6982ed/Based Visa Card Internal Dashboard: Hack or exploit, undisclosed2026-10-05T00:00:00ZWeb3 financial platform Based discovered that an unauthorized third party had accessed an internal dashboard used to manage the Based Visa Card program and contained the incident shortly after detection. KYC data collected by the card issuer for some cardholders (including name, ID/passport number, date of birth, and address) may have been obtained. Card numbers, CVV, PIN, ID photos, liveness recohttps://swan-hack-tracker.pages.dev/history/i/htaabbaba9df/MALT: Hack or exploit, $72K2026-10-03T00:00:00ZAn attacker exploited a logic flaw in MALT’s swap function. With negligible input they triggered an external rebalanceHook that pulled DAI from the protocol’s Capital Source into the same pool. The swap then checked its invariant against the post-hook balances and treated the treasury-funded DAI as caller-supplied funds, allowing a disproportionate MALT withdrawal and a loss of about $ 72,000.https://swan-hack-tracker.pages.dev/history/i/htcc3002b357/GoldPesa: Hack or exploit, $115K2026-10-02T00:00:00ZGoldPesa’s GPXHooks rebalanced protocol-owned GPX/USDC liquidity through Uniswap v4’s shared PositionManager without ensuring its currency deltas were isolated and settled. An attacker created an unpaid WETH/USDC position within the same PoolManager unlock and then triggered GoldPesa’s hourly rebalance. Because TAKE_PAIR operated on the PositionManager’s net credit, GoldPesa’s legitimate USDC credhttps://swan-hack-tracker.pages.dev/history/i/ht73be6d5c0a/Microsoft’s official X account: Hack or exploit, undisclosed2026-10-02T00:00:00ZMicrosoft’s official X account was accessed without authorization for about 30 minutes. Attackers changed the profile picture to Clippy, followed and reposted an impersonator account, and promoted an unauthorized Clippy meme coin to roughly 13 million followers; a later “apology” post was also unauthorized and deleted. Microsoft told The Verge and others that the account was secured, the posts rem