TradingCrypto Hacks · DefiLlama

Markets by TrueoAll markets

$5M+33%$10M+22%$25M+23%$50M+12%

$5M+ crypto hack this week?

Trade Yes 33%Trade No 66.2%

Quotes fetched just now.

Weeks with a $5m+ hack7of 10 before this market

Since this market opened0

DefiLlama dataOdds history

$5m+

Binance CEX $6.36bBitget $387m

Aug 28, 2026Shaded: from Nov 6, 2026 00:00 UTC, the day this market opened · log scaleNov 13, 2026

Market details

As of Nov 11, 2026, losses in 2026 so far: $8.782b across 341 incidents; largest: Binance CEX ($6.36b, Oct 2026).

.csv

Name	Date	Amount Lost	Chains	Classification	Technique	Language	Description
Arcus Perps	Nov 10, 2026	$2.23m		Protocol Logic	Withdrawal Logic Flaw		On November 10, 2026 (UTC), an attacker exploited an accounting flaw in Arcus Perps on Robinhood Chain that allowed transfers between subaccounts to artificially inflate an account's recorded balance. The attacker used the inflated balance to withdraw 2,234,391 USDG, while an additional $3 million in withdrawal requests was blocked by the bridge's rate limit and later reversed. Arcus patched the vulnerability, restricted the exploiter's accounts, and covered the entire shortfall from its company treasury, leaving user balances unaffected
Across	Nov 10, 2026	—		Frontend & Infrastructure	DNS Hijack		On November 10, 2026, an attacker compromised Across Protocol's domain through a social engineering attack targeting its registrar, Namecheap, redirecting users to a malicious website designed to steal cryptocurrency through fraudulent wallet interactions. Multiple users reported unauthorized withdrawals after interacting with the compromised interface. Across took its frontend and API offline, worked to block access to the malicious domain, and committed to compensating affected users. The total amount stolen remains undisclosed
Initia	Nov 10, 2026	$615,000		Key Compromise	Private Key Compromised		On November 10, 2026, an attacker used compromised rollup infrastructure keys to fabricate IBC transfers and withdraw assets from escrow accounts on Initia's Layer 1 that held funds bridged to multiple rollups. Approximately $615,000 in assets, including 605,000 USDC, was transferred out through Noble before validators halted the Initia network at 06:18 UTC. Additional assets were moved from the affected escrow accounts but remained on the halted blockchain. Initia began investigating the compromise with security teams and exchanges, while the full scope of the incident and recovery status remained undetermined
Ankr Bridge	Nov 9, 2026	$304,500		Bridge & Cross-Chain	Cross-Chain Message Spoofing		On November 9, 2026, an attacker exploited Ankr's cross-chain bridge on Ethereum by submitting five forged withdrawal receipts referencing a single Optimism deposit that had already been redeemed. The attacker modified the recipients, assets, and withdrawal amounts, while presenting valid signatures from the bridge's trusted consensus signer. The bridge accepted the falsified receipts and released approximately $304,500 in assets, including ankrETH, ankrPOL, ANKR, and other staking tokens. The origin of the unauthorized signatures remains under investigation
LNbits	Nov 8, 2026	—		Protocol Logic	Unknown	Python	On November 8, 2026, attackers exploited vulnerabilities in LNbits, an open-source Bitcoin Lightning wallet management platform, to create unauthorized accounts and withdraw funds from affected installations. One confirmed operator reported losing 2,285,545 satoshis, while the aggregate loss across other instances remained undisclosed. LNbits instructed operators to shut down their servers and subsequently released version 1.7.0 on November 10 to address the vulnerabilities. The project also advised operators to rotate wallet keys and funding-source credentials, with the exact attack mechanism pending a full technical report
ACryptoS	Nov 8, 2026	$665,429		Input Validation	Missing Input Validation	Solidity	On November 8, 2026, attackers exploited a missing input validation check in ACryptoS's concentrated-liquidity vaults across Arbitrum, BSC, Polygon, Base, and Optimism, stealing approximately $665,429 from 77 vaults. The vulnerable depositMulti() function accepted an incomplete token-amount array, causing the vault to undervalue its existing assets and mint disproportionately large amounts of shares for minimal deposits
Keplr Wallet (Web3Auth)	Nov 6, 2026	—		Frontend & Infrastructure	Supply Chain Attack		In November 2026, attackers conducted unauthorized transactions from Keplr wallets created using Google or Apple social login, affecting accounts that relied on Web3Auth's third-party authentication and key-management infrastructure. Keplr and Web3Auth launched a joint investigation and suspended affected login services. Wallets created using recovery phrases or hardware wallets were not believed to be affected. The exact vulnerability, total funds stolen, and affected blockchain networks remained undisclosed
TENDRIL	Nov 5, 2026	$550,000		Protocol Logic	Swap Logic Flaw	Solidity	On November 5, 2026, an attacker exploited TENDRIL's token sell logic to drain approximately 550,000 USDT from its PancakeSwap V2 liquidity pool on BSC. Each sell triggered PoolControl.sellToken(), which called TENDRIL.controlburn() to burn tokens directly from the liquidity pair and synchronize its reserves before the seller's remaining tokens arrived. The attacker used flash-loan-funded transactions to exploit the resulting reserve imbalance and withdraw nearly all the pool's USDT liquidity. ExVul estimated the attacker's campaign profit at no more than 181,910 USDT after observed purchases and gas costs, excluding an unresolved LP-position basis
Loopscale Lending	Nov 5, 2026	—		Protocol Logic	Unknown		In late October and early November 2026, Loopscale was targeted by a sustained attack campaign involving more than 30,000 malicious API requests per day, primarily directed at its SOL and USDC Genesis Vaults on Solana. On November 5, the protocol paused operations after detecting an escalation in the activity. Loopscale stated that the affected vaults had been made whole and that no user deposits incurred losses, but did not disclose whether funds had been stolen or explain the attack mechanism. The protocol remained paused pending further investigation and security improvements
Mercado Bitcoin	Nov 2, 2026	$40m		Protocol Logic	Unknown		On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed
BitMart	Nov 2, 2026	$391,000		Protocol Logic	Unknown		On November 2, 2026, attackers breached BitMart and transferred approximately $391,000 in cryptocurrency from exchange-associated wallets on Base, Arbitrum, and Optimism. Blockchain investigators traced portions of the stolen funds to addresses associated with the Mercado Bitcoin exploit, which occurred on the same day. BitMart founder Sheldon Xia confirmed the breach and said the exchange had investigated the incident and strengthened its security measures. The initial access method remains unidentified
BTCPay Server	Nov 1, 2026	—		Frontend & Infrastructure	Key Leaked via Infrastructure		On November 1, 2026, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to compromise self-hosted installations and steal BTC and LTC from their hot wallets. The vulnerability had been patched in version 2.4.2 in August, but outdated installations remained exposed. BTCPay Server urged affected operators to take their servers offline, migrate to fresh installations, replace compromised wallet seeds, and rotate potentially exposed credentials. Wallets whose spending keys were held off-server, including hardware wallets, were unaffected
Sovryn Dex	Nov 1, 2026	$538,749		Protocol Logic	Unknown		On November 1, 2026, an attacker exploited Sovryn's XUSD/WRBTC AMM pool on Rootstock, receiving approximately 541,456 XUSD ($538,749) in an attacker-controlled wallet. Portions of the proceeds were subsequently converted into BTC and ETH, while other assets remained under protocol control. Sovryn implemented emergency fee-control changes, delisted the affected pool on November 2, and began reconciling the impact on liquidity providers. The underlying vulnerability and final realized losses remain under investigation
Premia V3	Nov 1, 2026	$437,000		Protocol Logic	Withdrawal Logic Flaw	Solidity
Sovryn Lend	Oct 31, 2026	$914,000		Protocol Logic	Unknown		On October 31, 2026, attackers exploited Sovryn's lending and margin contracts on Rootstock through three transactions, extracting approximately $914,000 in XUSD and WRBTC. Sovryn paused its core protocol and lending pools after detecting the incident. A 24-hour withdrawal delay enabled the team to block seven additional withdrawals totaling approximately 66,134 XUSD before the funds reached the attackers. The underlying vulnerability remains undisclosed while the team completes security repairs and reconciles affected positions
b14g	Oct 31, 2026	—		Protocol Logic	Unknown		On October 31, 2026, an attacker withdrew approximately 97 million CORE from assets staked through b14g and transferred them to attacker-controlled addresses. The protocol paused the affected contracts and coordinated with security partners and exchanges to trace the stolen funds. Approximately 68 million CORE remained on Core, while exchanges froze another 9 million CORE. BTC staked through b14g was unaffected and remained time-locked on Bitcoin
Troves	Oct 31, 2026	$666,935		Access Control	Improper Access Control		On October 31, an attacker exploited permissions retained by a legacy rebalancing contract after it had been replaced, resulting in approximately 8.6 BTC in losses from Troves' xWBTC/WBTC vault. Troves revoked the legacy contract's permissions and paused three vaults as a precaution. No impact on other vaults has been identified
Polymarket International	Oct 29, 2026	$2.7m		Frontend & Infrastructure	Supply Chain Attack	JavaScript	Attackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committed to reimbursing impacted users
Binance CEX	Oct 29, 2026	$6.36b		Frontend & Infrastructure	Key Leaked via Infrastructure		On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves
zkLink Nova	Oct 28, 2026	$783,100		Bridge & Cross-Chain	Cross-Chain Message Spoofing	Solidity	An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge
Hifi Finance	Oct 28, 2026	—		Governance	Malicious Proposal	Solidity	An attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokens to the attacker. At the time of reporting, the proposal was queued but had not been executed
Fence Finance	Oct 27, 2026	$1.01m		Token & Share Accounting	Incorrect Share Accounting	Solidity	An attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vault
Zilliqa X-Bridge	Oct 27, 2026	—		Key Compromise	Private Key Compromised		Zilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continue