TradingCrypto Hacks · DefiLlama

Markets by TrueoAll markets

$1M+98%$5M+95%$10M+96%$25M+96%

Will there be a $1M+ hack this week?

Trade Yes 97.6%Trade No 4%

Quotes fetched just now.

Weeks with a $1m+ hack9of 10 before this market

Since this market opened1largest $40m

DefiLlama dataOdds history

$1m+

Binance CEX $6.36bBitget $387m

Aug 22, 2026Shaded: from Oct 30, 2026 00:00 UTC, the day this market opened · log scaleNov 6, 2026

Market details

As of Nov 2, 2026, losses in 2026 so far: $8.776b across 328 incidents; largest: Binance CEX ($6.36b, Oct 2026).

.csv

Name	Date	Amount Lost	Chains	Classification	Technique	Language	Description
Mercado Bitcoin	Nov 2, 2026	$40m		Protocol Logic	Unknown		On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed
BTCPay Server	Nov 1, 2026	—		Frontend & Infrastructure	Key Leaked via Infrastructure		On November 1, 2026, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to compromise self-hosted installations and steal BTC and LTC from their hot wallets. The vulnerability had been patched in version 2.4.2 in August, but outdated installations remained exposed. BTCPay Server urged affected operators to take their servers offline, migrate to fresh installations, replace compromised wallet seeds, and rotate potentially exposed credentials. Wallets whose spending keys were held off-server, including hardware wallets, were unaffected
Premia V3	Nov 1, 2026	$437,000		Protocol Logic	Withdrawal Logic Flaw	Solidity
b14g	Oct 31, 2026	—		Protocol Logic	Unknown		On October 31, 2026, an attacker withdrew approximately 97 million CORE from assets staked through b14g and transferred them to attacker-controlled addresses. The protocol paused the affected contracts and coordinated with security partners and exchanges to trace the stolen funds. Approximately 68 million CORE remained on Core, while exchanges froze another 9 million CORE. BTC staked through b14g was unaffected and remained time-locked on Bitcoin
Troves	Oct 31, 2026	$666,935		Access Control	Improper Access Control		On October 31, an attacker exploited permissions retained by a legacy rebalancing contract after it had been replaced, resulting in approximately 8.6 BTC in losses from Troves' xWBTC/WBTC vault. Troves revoked the legacy contract's permissions and paused three vaults as a precaution. No impact on other vaults has been identified
Polymarket International	Oct 29, 2026	$2.7m		Frontend & Infrastructure	Supply Chain Attack	JavaScript	Attackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committed to reimbursing impacted users
Binance CEX	Oct 29, 2026	$6.36b		Frontend & Infrastructure	Key Leaked via Infrastructure		On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves
zkLink Nova	Oct 28, 2026	$783,100		Bridge & Cross-Chain	Cross-Chain Message Spoofing	Solidity	An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge
Hifi Finance	Oct 28, 2026	—		Governance	Malicious Proposal	Solidity	An attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokens to the attacker. At the time of reporting, the proposal was queued but had not been executed
Fence Finance	Oct 27, 2026	$1.01m		Token & Share Accounting	Incorrect Share Accounting	Solidity	An attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vault
Zilliqa X-Bridge	Oct 27, 2026	—		Key Compromise	Private Key Compromised		Zilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continue
Predict Fun	Oct 27, 2026	$400,000		Frontend & Infrastructure	Frontend Compromise		Several Predict.fun users experienced unauthorized wallet transfers totaling approximately 400,000 USDT. Preliminary findings suggest a possible compromise of the project’s API documentation website, which was hosted by a third-party provider. Predict.fun took the documentation site offline as a precaution and committed to reimbursing affected users
Bloom Trading Bot	Oct 26, 2026	$953,000		Frontend & Infrastructure	Supply Chain Attack		An attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds. Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquery confirmed that the transactions were signed using the affected wallets’ keys
Myriad Markets	Oct 26, 2026	$0		Frontend & Infrastructure	Key Leaked via Infrastructure		An attacker exploited a previously exposed private key belonging to Myriad’s automated market management wallet. The key had reportedly been leaked through a vulnerability in a third-party library used by a backend service. The attacker used the wallet’s privileges to manipulate positions and force incorrect resolutions across 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions, secured the remaining funds, and announced that all affected markets would be voided and users refunded
Yapeswap	Oct 25, 2026	$21,900		Governance	Malicious Proposal	Solidity	YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
X100	Oct 24, 2026	$4.75m		Governance	Flashloan Governance Attack	Solidity	X100’s governance system allowed an attacker to obtain two of three Senate seats using flash-loan-funded X tokens. The attacker immediately used this majority to approve and execute a malicious treasury proposal within the same transaction. The proposal forced the Freezer to swap 400,000 X tokens into an attacker-controlled liquidity pool with zero minimum output, allowing the attacker to extract treasury value through a manipulated trade
Initia	Oct 23, 2026	$2.6m		Token & Share Accounting	Infinite Mint		Initia suffered a security incident involving the unauthorized minting of multiple assets on its L1. The attacker reportedly transferred and converted some of the minted assets into Ethereum-based holdings. Initia halted its L1 and rollups while investigating the vulnerability and coordinating with validators, exchanges, and security teams
WAX Multi-Chain Bridge	Oct 22, 2026	$90,500		Input Validation	Missing Input Validation		WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum
Swell	Oct 21, 2026	—		Key Compromise	Hot Wallet Key Compromised	Solidity	An attacker gained control of approximately 30 Swell operational keys across multiple networks, including the swETH/rswETH oracle bot. The attacker drained wallet balances, artificially increased swETH and rswETH exchange rates by submitting unbacked reserve values, and redirected EigenLayer reward claims. They also deployed malicious upgrade contracts capable of draining approximately 2,513 ETH, although these upgrades had not been approved or executed when the investigation was published
CoinDCX	Oct 21, 2026	$16m		Key Compromise	Hot Wallet Key Compromised		CoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the resulting losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations
Vara Bridge	Oct 19, 2026	$12,776		Bridge & Cross-Chain	Proof Verifier Bug		An attacker reportedly exploited Vara Bridge's cross-chain proof verification process to submit fraudulent Merkle roots representing outbound messages from Vara. These roots allegedly enabled unauthorized messages to be processed on Ethereum, resulting in approximately $12,776 in losses
AlpsCon AI Trade Hub	Oct 19, 2026	$152,809		Token & Share Accounting	Incorrect Share Accounting	Solidity	AlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC. The attack was facilitated by an authorization whitelist containing a publicly known Hardhat test account, which the attacker used through EIP-7702 delegation
Coffer	Oct 18, 2026	$0.70		Token & Share Accounting	Rounding Error		Coffer’s BTC pool incorrectly rounded tiny deposits to zero while still minting LP tokens, allowing an attacker to repeatedly obtain shares without providing equivalent assets. The attacker submitted thousands of minimal deposits, diluting existing liquidity providers and minting approximately $18 in illegitimate LP tokens. Coffer paused its pools on October 18, preventing further withdrawals, and deployed a fix on October 19