TradingCrypto Hacks · DefiLlama

Markets by TrueoAll markets

$5M+27%$10M+6%$25M+12%$50M+8%

$5M+ crypto hack this week?

Trade Yes 26.9%Trade No 73.9%

Quotes fetched just now.

Weeks with a $5m+ hack7of 10 before this market

Since this market opened0

DefiLlama dataOdds history

$5m+

Binance CEX $6.36bBitget $387m

Aug 28, 2026Shaded: from Nov 6, 2026 00:00 UTC, the day this market opened · log scaleNov 13, 2026

Market details

As of Nov 12, 2026, losses in 2026 so far: $8.782b across 343 incidents; largest: Binance CEX ($6.36b, Oct 2026).

.csv

Name	Date	Amount Lost	Chains	Classification	Technique	Language	Description
Edel	Nov 12, 2026	$300,000		Protocol Logic	Unknown		In November 2026, Edel Finance reported that approximately $300,000 worth of EDEL tokens had been stolen and sold on the market. The team began investigating the theft and coordinating with authorities and cryptocurrency exchanges to trace the stolen assets and block the attackers. The source of the stolen tokens, initial attack method, affected blockchain and recovery status remain undisclosed.
Rujira AMM Strategies	Nov 11, 2026	$200,000		Protocol Logic	Swap Logic Flaw		On November 10, 2026, an attacker exploited a flaw in the skew calculations of Rujira's Custom Concentrated Liquidity (CCL) strategy on THORChain, manipulating trading activity in the BTC/USDC orderbook and imbalancing existing liquidity positions. The exploit caused approximately $200,000 in losses, including $175,000 from Liquidy Finance's positions and $25,000 from other users. Rujira halted the CosmWasm application layer and announced plans to remove the vulnerable skew parameter and fully reimburse affected users before resuming operations
Arcus Perps	Nov 10, 2026	$2.23m		Protocol Logic	Withdrawal Logic Flaw		On November 10, 2026 (UTC), an attacker exploited an accounting flaw in Arcus Perps on Robinhood Chain that allowed transfers between subaccounts to artificially inflate an account's recorded balance. The attacker used the inflated balance to withdraw 2,234,391 USDG, while an additional $3 million in withdrawal requests was blocked by the bridge's rate limit and later reversed. Arcus patched the vulnerability, restricted the exploiter's accounts, and covered the entire shortfall from its company treasury, leaving user balances unaffected
Across	Nov 10, 2026	—		Frontend & Infrastructure	DNS Hijack		On November 10, 2026, an attacker compromised Across Protocol's domain through a social engineering attack targeting its registrar, Namecheap, redirecting users to a malicious website designed to steal cryptocurrency through fraudulent wallet interactions. Multiple users reported unauthorized withdrawals after interacting with the compromised interface. Across took its frontend and API offline, worked to block access to the malicious domain, and committed to compensating affected users. The total amount stolen remains undisclosed
Initia	Nov 10, 2026	$615,000		Key Compromise	Private Key Compromised		On November 10, 2026, an attacker used compromised rollup infrastructure keys to fabricate IBC transfers and withdraw assets from escrow accounts on Initia's Layer 1 that held funds bridged to multiple rollups. Approximately $615,000 in assets, including 605,000 USDC, was transferred out through Noble before validators halted the Initia network at 06:18 UTC. Additional assets were moved from the affected escrow accounts but remained on the halted blockchain. Initia began investigating the compromise with security teams and exchanges, while the full scope of the incident and recovery status remained undetermined
Ankr Bridge	Nov 9, 2026	$304,500		Bridge & Cross-Chain	Cross-Chain Message Spoofing		On November 9, 2026, an attacker exploited Ankr's cross-chain bridge on Ethereum by submitting five forged withdrawal receipts referencing a single Optimism deposit that had already been redeemed. The attacker modified the recipients, assets, and withdrawal amounts, while presenting valid signatures from the bridge's trusted consensus signer. The bridge accepted the falsified receipts and released approximately $304,500 in assets, including ankrETH, ankrPOL, ANKR, and other staking tokens. The origin of the unauthorized signatures remains under investigation
LNbits	Nov 8, 2026	—		Protocol Logic	Unknown	Python	On November 8, 2026, attackers exploited vulnerabilities in LNbits, an open-source Bitcoin Lightning wallet management platform, to create unauthorized accounts and withdraw funds from affected installations. One confirmed operator reported losing 2,285,545 satoshis, while the aggregate loss across other instances remained undisclosed. LNbits instructed operators to shut down their servers and subsequently released version 1.7.0 on November 10 to address the vulnerabilities. The project also advised operators to rotate wallet keys and funding-source credentials, with the exact attack mechanism pending a full technical report
ACryptoS	Nov 8, 2026	$665,429		Input Validation	Missing Input Validation	Solidity	On November 8, 2026, attackers exploited a missing input validation check in ACryptoS's concentrated-liquidity vaults across Arbitrum, BSC, Polygon, Base, and Optimism, stealing approximately $665,429 from 77 vaults. The vulnerable depositMulti() function accepted an incomplete token-amount array, causing the vault to undervalue its existing assets and mint disproportionately large amounts of shares for minimal deposits
Keplr Wallet (Web3Auth)	Nov 6, 2026	—		Frontend & Infrastructure	Key Leaked via Infrastructure		In November 2026, attackers exploited a vulnerability in Web3Auth's infrastructure that exposed private keys belonging to Keplr wallets created using Google or Apple login, allowing unauthorized transactions from affected accounts. Web3Auth and Keplr suspended the affected services and initiated a recovery operation using the same vulnerability to transfer approximately $5.6 million from exposed wallets into secure addresses before attackers could steal the funds. The total amount stolen before the recovery operation remains undisclosed, and the teams are working to return the secured assets to their owners
TENDRIL	Nov 5, 2026	$550,000		Protocol Logic	Swap Logic Flaw	Solidity	On November 5, 2026, an attacker exploited TENDRIL's token sell logic to drain approximately 550,000 USDT from its PancakeSwap V2 liquidity pool on BSC. Each sell triggered PoolControl.sellToken(), which called TENDRIL.controlburn() to burn tokens directly from the liquidity pair and synchronize its reserves before the seller's remaining tokens arrived. The attacker used flash-loan-funded transactions to exploit the resulting reserve imbalance and withdraw nearly all the pool's USDT liquidity. ExVul estimated the attacker's campaign profit at no more than 181,910 USDT after observed purchases and gas costs, excluding an unresolved LP-position basis
Loopscale Lending	Nov 5, 2026	—		Protocol Logic	Unknown		In late October and early November 2026, Loopscale was targeted by a sustained attack campaign involving more than 30,000 malicious API requests per day, primarily directed at its SOL and USDC Genesis Vaults on Solana. On November 5, the protocol paused operations after detecting an escalation in the activity. Loopscale stated that the affected vaults had been made whole and that no user deposits incurred losses, but did not disclose whether funds had been stolen or explain the attack mechanism. The protocol remained paused pending further investigation and security improvements
Mercado Bitcoin	Nov 2, 2026	$40m		Protocol Logic	Unknown		On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed
BitMart	Nov 2, 2026	$391,000		Protocol Logic	Unknown		On November 2, 2026, attackers breached BitMart and transferred approximately $391,000 in cryptocurrency from exchange-associated wallets on Base, Arbitrum, and Optimism. Blockchain investigators traced portions of the stolen funds to addresses associated with the Mercado Bitcoin exploit, which occurred on the same day. BitMart founder Sheldon Xia confirmed the breach and said the exchange had investigated the incident and strengthened its security measures. The initial access method remains unidentified
BTCPay Server	Nov 1, 2026	—		Frontend & Infrastructure	Key Leaked via Infrastructure		On November 1, 2026, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to compromise self-hosted installations and steal BTC and LTC from their hot wallets. The vulnerability had been patched in version 2.4.2 in August, but outdated installations remained exposed. BTCPay Server urged affected operators to take their servers offline, migrate to fresh installations, replace compromised wallet seeds, and rotate potentially exposed credentials. Wallets whose spending keys were held off-server, including hardware wallets, were unaffected
Sovryn Dex	Nov 1, 2026	$538,749		Protocol Logic	Unknown		On November 1, 2026, an attacker exploited Sovryn's XUSD/WRBTC AMM pool on Rootstock, receiving approximately 541,456 XUSD ($538,749) in an attacker-controlled wallet. Portions of the proceeds were subsequently converted into BTC and ETH, while other assets remained under protocol control. Sovryn implemented emergency fee-control changes, delisted the affected pool on November 2, and began reconciling the impact on liquidity providers. The underlying vulnerability and final realized losses remain under investigation
Premia V3	Nov 1, 2026	$437,000		Protocol Logic	Withdrawal Logic Flaw	Solidity
Sovryn Lend	Oct 31, 2026	$914,000		Protocol Logic	Unknown		On October 31, 2026, attackers exploited Sovryn's lending and margin contracts on Rootstock through three transactions, extracting approximately $914,000 in XUSD and WRBTC. Sovryn paused its core protocol and lending pools after detecting the incident. A 24-hour withdrawal delay enabled the team to block seven additional withdrawals totaling approximately 66,134 XUSD before the funds reached the attackers. The underlying vulnerability remains undisclosed while the team completes security repairs and reconciles affected positions
b14g	Oct 31, 2026	—		Protocol Logic	Unknown		On October 31, 2026, an attacker withdrew approximately 97 million CORE from assets staked through b14g and transferred them to attacker-controlled addresses. The protocol paused the affected contracts and coordinated with security partners and exchanges to trace the stolen funds. Approximately 68 million CORE remained on Core, while exchanges froze another 9 million CORE. BTC staked through b14g was unaffected and remained time-locked on Bitcoin
Troves	Oct 31, 2026	$666,935		Access Control	Improper Access Control		On October 31, an attacker exploited permissions retained by a legacy rebalancing contract after it had been replaced, resulting in approximately 8.6 BTC in losses from Troves' xWBTC/WBTC vault. Troves revoked the legacy contract's permissions and paused three vaults as a precaution. No impact on other vaults has been identified
Polymarket International	Oct 29, 2026	$2.7m		Frontend & Infrastructure	Supply Chain Attack	JavaScript	Attackers reportedly compromised a third-party website monitoring service used by Polymarket, allowing malicious JavaScript to execute on its international trading platform. The script hijacked authenticated trading sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets. Polymarket temporarily suspended trading, removed the affected integration, and committed to reimbursing impacted users
Binance CEX	Oct 29, 2026	$6.36b		Frontend & Infrastructure	Key Leaked via Infrastructure		On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves
zkLink Nova	Oct 28, 2026	$783,100		Bridge & Cross-Chain	Cross-Chain Message Spoofing	Solidity	An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root. The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge
Hifi Finance	Oct 28, 2026	—		Governance	Malicious Proposal	Solidity	An attacker acquired HIFI governance tokens and used four coordinated votes shortly before voting closed to pass a malicious governance proposal. Proposal 21 would upgrade Hifi’s BalanceSheet contract to introduce a function that incorrectly treats existing collateral as untracked funds, allowing it to be transferred to an attacker-controlled Safe. The proposal would also mint 25 million HIFI tokens to the attacker. At the time of reporting, the proposal was queued but had not been executed
Fence Finance	Oct 27, 2026	$1.01m		Token & Share Accounting	Incorrect Share Accounting	Solidity	An attacker exploited a tranche vault associated with Fence Finance and Valinor Digital by using a flash loan to obtain an inflated allocation of vault shares. The attacker subsequently redeemed those shares to withdraw approximately $1.01 million in USDC from the vault
Zilliqa X-Bridge	Oct 27, 2026	—		Key Compromise	Private Key Compromised		Zilliqa confirmed a security incident affecting its X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap. The affected assets include zUSDT, SEED, kUSD, and Zoge, while native ZIL and the Zilliqa EVM network reportedly remain unaffected. X-Bridge remains paused while operational keys are rotated and investigations continue
Predict Fun	Oct 27, 2026	$400,000		Frontend & Infrastructure	Frontend Compromise		Several Predict.fun users experienced unauthorized wallet transfers totaling approximately 400,000 USDT. Preliminary findings suggest a possible compromise of the project’s API documentation website, which was hosted by a third-party provider. Predict.fun took the documentation site offline as a precaution and committed to reimbursing affected users
Bloom Trading Bot	Oct 26, 2026	$953,000		Frontend & Infrastructure	Supply Chain Attack		An attacker exploited a reported remote code execution vulnerability in a third-party software module used by Bloom’s trading infrastructure, enabling unauthorized transfers from user wallets. Approximately 9,408 SOL was drained from 48 wallets belonging to nine traders within 94 seconds. Bloom attributed the incident to the third-party module and denied that private keys were exposed, while Bitquery confirmed that the transactions were signed using the affected wallets’ keys
Myriad Markets	Oct 26, 2026	$0		Frontend & Infrastructure	Key Leaked via Infrastructure		An attacker exploited a previously exposed private key belonging to Myriad’s automated market management wallet. The key had reportedly been leaked through a vulnerability in a third-party library used by a backend service. The attacker used the wallet’s privileges to manipulate positions and force incorrect resolutions across 10 prediction markets on BNB Chain. Myriad revoked the wallet’s permissions, secured the remaining funds, and announced that all affected markets would be voided and users refunded
Yapeswap	Oct 25, 2026	$21,900		Governance	Malicious Proposal	Solidity	YapeSwap’s WorkersUnion governance contract allowed proposals to pass with zero quorum, enabling an attacker controlling approximately 0.000055% of voting power to transfer YapeFactory’s feeToSetter role to themselves. The attacker then installed a malicious Registry that returned fake vault addresses through latestVault(), while vaults() continued listing legitimate vaults. This redirected deposits into attacker-controlled destinations while YapePair incorrectly accounted for them as farming assets, resulting in approximately $21,900 in losses
X100	Oct 24, 2026	$4.75m		Governance	Flashloan Governance Attack	Solidity	X100’s governance system allowed an attacker to obtain two of three Senate seats using flash-loan-funded X tokens. The attacker immediately used this majority to approve and execute a malicious treasury proposal within the same transaction. The proposal forced the Freezer to swap 400,000 X tokens into an attacker-controlled liquidity pool with zero minimum output, allowing the attacker to extract treasury value through a manipulated trade
Initia	Oct 23, 2026	$2.6m		Token & Share Accounting	Infinite Mint		Initia suffered a security incident involving the unauthorized minting of multiple assets on its L1. The attacker reportedly transferred and converted some of the minted assets into Ethereum-based holdings. Initia halted its L1 and rollups while investigating the vulnerability and coordinating with validators, exchanges, and security teams
WAX Multi-Chain Bridge	Oct 22, 2026	$90,500		Input Validation	Missing Input Validation		WAX’s eth.token::withdraw function failed to validate that max_fee was nonnegative. By setting max_fee = -quantity, the attacker reduced the total account debit to zero while retaining the full withdrawal amount. Because the configured withdrawal fee was zero, the fee check did not reject the transaction. The resulting withdrawal logs triggered real payouts from the bridge on Solana and Ethereum
Swell	Oct 21, 2026	—		Key Compromise	Hot Wallet Key Compromised	Solidity	An attacker gained control of approximately 30 Swell operational keys across multiple networks, including the swETH/rswETH oracle bot. The attacker drained wallet balances, artificially increased swETH and rswETH exchange rates by submitting unbacked reserve values, and redirected EigenLayer reward claims. They also deployed malicious upgrade contracts capable of draining approximately 2,513 ETH, although these upgrades had not been approved or executed when the investigation was published
CoinDCX	Oct 21, 2026	$16m		Key Compromise	Hot Wallet Key Compromised		CoinDCX experienced approximately $16 million in suspicious outflows from TRON addresses associated with its exchange infrastructure. The exchange attributed the incident to addresses compromised during its July 2025 security breach, which continued receiving deposits after being deprecated. CoinDCX acknowledged that its deposit-sweeping process failed temporarily and stated that it absorbed the resulting losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations
GarudaDefi	Oct 20, 2026	—		Key Compromise	Private Key Compromised	Rust	Between October 20 and 31, 2026, Garuda DeFi suffered multiple security breaches affecting its NFT staking, cross-staking, governance, treasury, frontend and CW20 staking systems on Terra Classic. Attackers migrated staking contracts to malicious code, transferred user assets and rewards, compromised developer wallets to obtain administrative privileges, and injected malicious wallet approval prompts into the protocol's website. The incidents affected 1,114 NFTs and numerous staking tokens, while the total financial loss remains undisclosed. Garuda restored parts of its infrastructure, introduced multisignature administration and began preparing a recovery plan for affected users
Vara Bridge	Oct 19, 2026	$12,776		Bridge & Cross-Chain	Proof Verifier Bug		An attacker reportedly exploited Vara Bridge's cross-chain proof verification process to submit fraudulent Merkle roots representing outbound messages from Vara. These roots allegedly enabled unauthorized messages to be processed on Ethereum, resulting in approximately $12,776 in losses
AlpsCon AI Trade Hub	Oct 19, 2026	$152,809		Token & Share Accounting	Incorrect Share Accounting	Solidity	AlpsCon AI Trade Hub’s V7–V9 contracts incorrectly applied accumulated historical profit-per-share values to balances imported from preceding versions, allowing newly deposited funds to claim rewards accrued before the deposits existed. The attacker used a flash loan to create temporary ALPS service credits and exploited the accounting flaw to extract USDC. The attack was facilitated by an authorization whitelist containing a publicly known Hardhat test account, which the attacker used through EIP-7702 delegation
Coffer	Oct 18, 2026	$0.70		Token & Share Accounting	Rounding Error		Coffer’s BTC pool incorrectly rounded tiny deposits to zero while still minting LP tokens, allowing an attacker to repeatedly obtain shares without providing equivalent assets. The attacker submitted thousands of minimal deposits, diluting existing liquidity providers and minting approximately $18 in illegitimate LP tokens. Coffer paused its pools on October 18, preventing further withdrawals, and deployed a fix on October 19
Qubic	Oct 17, 2026	$1.3m		Key Compromise	Weak Key Generation	JavaScript	An attacker exploited predictable wallet seeds generated with insufficient randomness in Qubic’s wallet software, compromising 1,404 user wallets and stealing approximately 2.94 trillion QU. The vulnerability affected certain wallets created on Apple devices and Safari browsers. Qubic halted its network at tick 85,371,949, while MEXC froze the account receiving the remaining stolen funds. Seed generation was corrected in wallet version 4.26.4
Pirate Chain	Oct 16, 2026	—		Token & Share Accounting	Unbacked Mint		Pirate Chain suffered an exploit in the transparent supply-accounting layer introduced with its Ironwood upgrade. Two transaction-validation failures reportedly allowed an attacker to bypass issuance restrictions and exploit incorrect output-script interpretation, creating approximately 39.8 million unauthorized ARRR. The tokens were transferred into the Sapling shielded pool, obscuring subsequent transfers. The team initially proposed a blockchain rollback but later confirmed that it could not execute one unilaterally
Affluent	Oct 16, 2026	$1.05m		Token & Share Accounting	Unbacked Mint		Affluent’s lending vaults reportedly suffered unauthorized share minting that allowed attackers to redeem vault assets without providing corresponding deposits. The supplied analysis identifies suspicious transactions on September 30, October 12, and October 16, 2026, involving multiple wallets. Extracted assets were reportedly transferred through exchanges, swaps, and cross-chain services
UNCX Network V2	Oct 14, 2026	$86,000		Token & Share Accounting	Incorrect Share Accounting	Solidity	An attacker exploited UNCX Vesting V2’s shared token accounting by creating vesting positions, releasing a large position, donating tokens into the pool, and cancelling a topped-up vest. This sequence allowed a small remaining vesting position to withdraw tokens belonging to other users. UNCX confirmed additional affected assets across four chains and introduced emergency fees and restrictions to contain the exploit
Gamdom	Oct 13, 2026	$4.21m		Frontend & Infrastructure	Key Leaked via Infrastructure		Gamdom suffered a multichain hot-wallet compromise following unauthorized access to an automation server. Investigators traced approximately $4.21M in stolen assets across eight networks. The attacker subsequently bridged, swapped, and distributed funds through multiple wallets and services, including Mayan, Hyperliquid, and THORChain. The precise mechanism used to obtain control of the wallets remains unconfirmed
Papertrade	Oct 10, 2026	$1.28m		Oracle Manipulation	Spot Price Manipulation	Solidity	Papertrade, a perpetual trading protocol on HyperEVM, reportedly suffered an oracle manipulation attack shortly after launch. The attacker manipulated Hyperliquid’s ETH order-book midpoint through external trades while opening and closing highly leveraged synthetic positions on Papertrade. Because the protocol used the instantaneous BBO midpoint without TWAP, deviation limits, or independent price validation, manipulated prices were accepted for execution and PnL settlement, transferring approximately $1.28M from the Martingaler LP
Ledger (Supply Chain)	Oct 9, 2026	$93m		Frontend & Infrastructure	Supply Chain Attack		Attackers purchased genuine Ledger hardware wallets, installed concealed components capable of capturing recovery phrases, and redistributed the modified devices through resellers. The implants monitored the wallets’ displays during initialization and transmitted captured recovery phrases through cellular connections. Attackers subsequently derived users’ private keys and drained their cryptocurrency holdings. Ledger confirmed that its Secure Element, operating system, and internal infrastructure were not compromised
BitBay	Oct 8, 2026	$14,838		Protocol Logic	Withdrawal Logic Flaw	Solidity	BitBay’s vault contained a vulnerability in _withdraw() that transferred the contract’s entire token balance whenever liquidity == 0, without restricting withdrawals to the user’s proportional entitlement. The attacker triggered this condition through reposition() and subsequently redeemed one minimal share unit, receiving approximately 14,838.47 DAI belonging to the vault
Ethervista	Oct 8, 2026	$18,600		Token & Share Accounting	Arithmetic Error	Solidity	EtherVista’s EtherVistaPair.swap() contained an integer overflow vulnerability in its constant-product invariant check. Because the contract multiplied two uint112 reserves without sufficient overflow protection, the calculation could wrap around and incorrectly validate swaps that reduced the pool’s actual reserve product. An attacker registered a malicious contract as an authorized router and executed two crafted swaps to withdraw WETH and VISTA from the pool
Locus Finance	Oct 7, 2026	$18,000				Solidity
Set Protocol	Oct 6, 2026	$21,873		Token & Share Accounting	Rounding Error	Solidity	ETHMACOAPY’s actualizeFee() rounded redemption backing upward even when no fee was payable. Attackers donated collateral to trigger recalculation, temporarily acquired Set tokens, then redeemed them for more collateral than they contributed, with the difference coming from existing holders’ backing. Two separate EOAs repeated the process across two transactions, draining approximately 8.11 WETH
MakerDAO ETH-A Liquidation Keeper Bot	Oct 6, 2026	$538,000		Access Control	Improper Access Control	Solidity	A dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() to send it to an attacker-controlled recipient and unwrap it to ETH. MakerDAO’s core contracts behaved as designed; the vulnerability was in the third-party keeper