TradingCrypto Hacks · DefiLlama

Markets by TrueoAll markets

$5M+58%$10M+64%$25M+25%$50M+27%

$5M+ crypto hack this week?

Trade Yes 57.7%Trade No 41.4%

Quotes fetched just now.

Weeks with a $5m+ hack7of 10 before this market

Since this market opened0

DefiLlama dataOdds history

$5m+

Binance CEX $6.36bBitget $387m

Aug 28, 2026Shaded: from Nov 6, 2026 00:00 UTC, the day this market opened · log scaleNov 13, 2026

Market details

As of Nov 6, 2026, losses in 2026 so far: $8.776b across 332 incidents; largest: Binance CEX ($6.36b, Oct 2026).

.csv

Name	Date	Amount Lost	Chains	Classification	Technique	Language	Description
TENDRIL	Nov 5, 2026	$550,000		Protocol Logic	Swap Logic Flaw	Solidity	On November 5, 2026, an attacker exploited TENDRIL's token sell logic to drain approximately 550,000 USDT from its PancakeSwap V2 liquidity pool on BSC. Each sell triggered PoolControl.sellToken(), which called TENDRIL.controlburn() to burn tokens directly from the liquidity pair and synchronize its reserves before the seller's remaining tokens arrived. The attacker used flash-loan-funded transactions to exploit the resulting reserve imbalance and withdraw nearly all the pool's USDT liquidity. ExVul estimated the attacker's campaign profit at no more than 181,910 USDT after observed purchases and gas costs, excluding an unresolved LP-position basis
Loopscale Lending	Nov 5, 2026	—		Protocol Logic	Unknown		In late October and early November 2026, Loopscale was targeted by a sustained attack campaign involving more than 30,000 malicious API requests per day, primarily directed at its SOL and USDC Genesis Vaults on Solana. On November 5, the protocol paused operations after detecting an escalation in the activity. Loopscale stated that the affected vaults had been made whole and that no user deposits incurred losses, but did not disclose whether funds had been stolen or explain the attack mechanism. The protocol remained paused pending further investigation and security improvements
Mercado Bitcoin	Nov 2, 2026	$40m		Protocol Logic	Unknown		On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed
BitMart	Nov 2, 2026	$391,000		Protocol Logic	Unknown		On November 2, 2026, attackers breached BitMart and transferred approximately $391,000 in cryptocurrency from exchange-associated wallets on Base, Arbitrum, and Optimism. Blockchain investigators traced portions of the stolen funds to addresses associated with the Mercado Bitcoin exploit, which occurred on the same day. BitMart founder Sheldon Xia confirmed the breach and said the exchange had investigated the incident and strengthened its security measures. The initial access method remains unidentified
BTCPay Server	Nov 1, 2026	—		Frontend & Infrastructure	Key Leaked via Infrastructure		On November 1, 2026, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to compromise self-hosted installations and steal BTC and LTC from their hot wallets. The vulnerability had been patched in version 2.4.2 in August, but outdated installations remained exposed. BTCPay Server urged affected operators to take their servers offline, migrate to fresh installations, replace compromised wallet seeds, and rotate potentially exposed credentials. Wallets whose spending keys were held off-server, including hardware wallets, were unaffected
Premia V3	Nov 1, 2026	$437,000		Protocol Logic	Withdrawal Logic Flaw	Solidity
b14g	Oct 31, 2026	—		Protocol Logic	Unknown		On October 31, 2026, an attacker withdrew approximately 97 million CORE from assets staked through b14g and transferred them to attacker-controlled addresses. The protocol paused the affected contracts and coordinated with security partners and exchanges to trace the stolen funds. Approximately 68 million CORE remained on Core, while exchanges froze another 9 million CORE. BTC staked through b14g was unaffected and remained time-locked on Bitcoin
Troves	Oct 31, 2026	$666,935		Access Control	Improper Access Control		On October 31, an attacker exploited permissions retained by a legacy rebalancing contract after it had been replaced, resulting in approximately 8.6 BTC in losses from Troves' xWBTC/WBTC vault. Troves revoked the legacy contract's permissions and paused three vaults as a precaution. No impact on other vaults has been identified
Polymarket International	Oct 29, 2026	$2.7m		Frontend & Infrastructure	Supply Chain Attack	JavaScript	Attackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committed to reimbursing impacted users
Binance CEX	Oct 29, 2026	$6.36b		Frontend & Infrastructure	Key Leaked via Infrastructure		On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves
zkLink Nova	Oct 28, 2026	$783,100		Bridge & Cross-Chain	Cross-Chain Message Spoofing	Solidity	An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge
Hifi Finance	Oct 28, 2026	—		Governance	Malicious Proposal	Solidity	An attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokens to the attacker. At the time of reporting, the proposal was queued but had not been executed
Fence Finance	Oct 27, 2026	$1.01m		Token & Share Accounting	Incorrect Share Accounting	Solidity	An attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vault
Zilliqa X-Bridge	Oct 27, 2026	—		Key Compromise	Private Key Compromised		Zilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continue
Predict Fun	Oct 27, 2026	$400,000		Frontend & Infrastructure	Frontend Compromise		Several Predict.fun users experienced unauthorized wallet transfers totaling approximately 400,000 USDT. Preliminary findings suggest a possible compromise of the project’s API documentation website, which was hosted by a third-party provider. Predict.fun took the documentation site offline as a precaution and committed to reimbursing affected users
Bloom Trading Bot	Oct 26, 2026	$953,000		Frontend & Infrastructure	Supply Chain Attack		An attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds. Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquery confirmed that the transactions were signed using the affected wallets’ keys
Myriad Markets	Oct 26, 2026	$0		Frontend & Infrastructure	Key Leaked via Infrastructure		An attacker exploited a previously exposed private key belonging to Myriad’s automated market management wallet. The key had reportedly been leaked through a vulnerability in a third-party library used by a backend service. The attacker used the wallet’s privileges to manipulate positions and force incorrect resolutions across 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions, secured the remaining funds, and announced that all affected markets would be voided and users refunded
Yapeswap	Oct 25, 2026	$21,900		Governance	Malicious Proposal	Solidity	YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
X100	Oct 24, 2026	$4.75m		Governance	Flashloan Governance Attack	Solidity	X100’s governance system allowed an attacker to obtain two of three Senate seats using flash-loan-funded X tokens. The attacker immediately used this majority to approve and execute a malicious treasury proposal within the same transaction. The proposal forced the Freezer to swap 400,000 X tokens into an attacker-controlled liquidity pool with zero minimum output, allowing the attacker to extract treasury value through a manipulated trade
Initia	Oct 23, 2026	$2.6m		Token & Share Accounting	Infinite Mint		Initia suffered a security incident involving the unauthorized minting of multiple assets on its L1. The attacker reportedly transferred and converted some of the minted assets into Ethereum-based holdings. Initia halted its L1 and rollups while investigating the vulnerability and coordinating with validators, exchanges, and security teams
WAX Multi-Chain Bridge	Oct 22, 2026	$90,500		Input Validation	Missing Input Validation		WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum
Swell	Oct 21, 2026	—		Key Compromise	Hot Wallet Key Compromised	Solidity	An attacker gained control of approximately 30 Swell operational keys across multiple networks, including the swETH/rswETH oracle bot. The attacker drained wallet balances, artificially increased swETH and rswETH exchange rates by submitting unbacked reserve values, and redirected EigenLayer reward claims. They also deployed malicious upgrade contracts capable of draining approximately 2,513 ETH, although these upgrades had not been approved or executed when the investigation was published
CoinDCX	Oct 21, 2026	$16m		Key Compromise	Hot Wallet Key Compromised		CoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the resulting losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations