Timeline

Attacker compromised a 1-of-3 multisig signer key for StablR's minting contract, minted 8.35M unbacked USDR and 4.5M EURR, and dumped them on DEXes for ~1,115 ETH, realizing ~$2.8M profit.

Suspected exploit on Hedera network moved ~$5.25M in assets from Hedera to Ethereum via the LayerZero bridge; Hedera has not officially confirmed.

Attackers compromised a trusted maintainer's account and pushed a wallet-stealing backdoor into @injectivelabs/sdk-ts v1.20.21 on npm, exfiltrating BIP-39 seed phrases and private keys.

Attacker acquired >99% voting power by buying BONK tokens, submitted BIP #76 to transfer the entire treasury to their wallet, and the proposal executed automatically with a 1% quorum threshold.

Flash-loan-assisted exchange-rate manipulation between GOOGLx and wGOOGLx on Edel's xStock lending market inflated collateral 78x, opening ~$403K of bad debt; routed through Tornado Cash.

Edel was exploited via a flashloan price oracle attack for ~$403K on Ethereum; recovery status unknown.

Native Cardano web wallet generation software flaw drained 178+ user wallets. Formerly known as Yoroi wallet.

Attackers exploited a vulnerability in Taiko's chain state verification, submitting forged message proofs that Ethereum mainnet accepted without corresponding valid MessageSent events from Taiko, draining funds from Taiko's ERC20 Vault on Ethereum.

Ethereum's most notorious MEV sandwich bot was drained for $7.5M after being baited into approving 66 fake token contracts over several weeks.

Aztec Network RollupProcessor escapeHatch() function drained due to missing access controls

An attacker exploited the escapeHatch function on Aztec's Private Rollup Bridge to withdraw $2.21M.

A bug in the ORE staking program allowed attackers to claim excess yield, draining approximately $2,100.

Deprecated DeFi bridge linked to the privacy-focused Aztec ecosystem was exploited after an attacker drained funds via an old contract vulnerability; the bridge was no longer actively maintained.

Thetanuts Finance index vault exploited via component-share accounting flaw

Flash loan governance attack drained $11M treasury through malicious proposal

An attacker drained $4.67M from Secret Network's Axelar bridge by exploiting a contract that minted unbacked wrapped tokens without verifying where deposits came from.

Foundation member private keys compromised, 280+ wallets drained and 100M tokens minted on BNB Chain

DPRK-linked attacker phished a director via email, installed remote-access malware, stole 7 multisig keys from one compromised laptop, seized ProxyAdmin on both chains, upgraded the bridge to a malicious contract, and drained 141M H on Ethereum and 122B+ H on BSC.

NFT floor price manipulation drained $10.5M from lending protocol

An attacker minted ~5 billion unauthorized SYS tokens by exploiting a parsing error in Syscoin bridge proof validation; all unauthorized SYS were returned and burned.

Concentrated liquidity tick manipulation drained $10M from DEX pools

Signature verification flaw in Zodiac Delay module allowed 41 malicious transactions draining $265K

Fluid lost ~$215K through a private key leakage on Ethereum; no recovery reported.

Gravity Bridge lost ~$5.4M through a private key leakage; no recovery reported.

Hidden backdoor in 2021-era liquidity locker drained $7.3M from 1,400+ BNB Chain LPs

GG20 TSS cryptographic flaw allowed malicious node to reconstruct vault key and drain $10.7M across 10 chains

Weak 1-of-3 multisig allowed attacker to mint $10.4M+ in unbacked stablecoins, extracting $2.8M

Admin key compromise of Echo Protocol's eBTC contract on Monad allowed minting of 1,000 eBTC ($76.6M), but shallow liquidity limited realized losses to $816K, laundered through Tornado Cash.

Missing input validation in Verus's bridge verification function allowed a forged cross-chain payload to drain 1,625 ETH, 103.6 tBTC, and 147K USDC ($11.58M), all converted to ~5,402 ETH.

Attacker exploited a logic gap in Verus bridge's cross-chain value validation, submitting a hand-crafted CReserveTransferImport payload with a fabricated Merkle proof that the bridge accepted, releasing 1,625 ETH, 103.57 tBTC, and 147,659 USDC from reserves.

Attackers exploited a GG20 TSS weakness in one of THORChain's six Asgard vaults to drain ~$10.7M; the network paused for 39 days and fully compensated users.

$2.8M drained from TAC Protocol's TON-Ethereum bridge in USDT, BLUM, and tsTON; team plans treasury reimbursement.

A vulnerability in 1inch's TrustedVolumes resolver contract allowed privilege escalation, leading to a $6.7M drain.

A public function in TrustedVolumes' resolver contract let anyone become an authorized order signer, draining $6.7M in 85 rapid transactions via old approvals.

Attackers compromised a Wasabi Protocol deployer key and executed a malicious contract upgrade, draining ~$5.7M before operations were paused.

Attackers forged LayerZero cross-chain messages by compromising RPC infrastructure, releasing 116,500 rsETH ($292M) from Kelp DAO's Ethereum contract.

Grinex exchange hot wallets were breached for ~$15M across Tron and Ethereum; withdrawals were suspended and no recovery reported.

Lazarus Group's 6-month social engineering operation compromised Drift Protocol's Security Council multisig, draining $285M via fake governance token collateral.

North Korean operatives used social engineering and Solana durable nonce multisig abuse to steal $285M from Drift Protocol.

Reentrancy vulnerability in vault withdrawal function drained $13M

SolvBTC was exploited via a mint reserves logic flaw for ~$2.7M on Ethereum; recovery status unknown.

Moonwell Lending lost ~$1.78M through a cbETH collateral exploit on Base; recovery status unknown.

Flash loan + oracle manipulation drained $20M from Solana yield vaults

Matcha was exploited via an unlimited approval mechanism for ~$13.4M across Base and Ethereum; recovery status unknown.

MakinaFi was exploited via a smart contract vulnerability for ~$4.13M on Ethereum; recovery status unknown.

YO Protocol was exploited via a slippage exploit for ~$3.7M on Ethereum; recovery status unknown.

A pricing bug in a Truebit smart contract live for nearly 5 years was exploited to drain ~8,535 ETH (~$26.4M), sending TRU effectively to zero.

USDGambit and TLP were exploited via a deployer account compromise for ~$1.5M on Arbitrum; recovery status unknown.

An attacker minted 235 septillion yETH while depositing only 16 wei by exploiting unsafe math and stale cached values in Yearn's yETH pool, draining ~$9M.

An exploiter crafted arbitrary swapData in Arcadia Finance's Rebalancer contract to drain a victim account of ~$3.6M; the attack was funded via Tornado Cash.

Fake market creation and double-counting exploit drained 3,761 wstETH from vaults

North Korean Lazarus Group compromised Bybit's cold wallet via a sophisticated supply chain attack on Safe{Wallet} multisig infrastructure.

India's largest crypto exchange WazirX lost $235M when Lazarus Group compromised its Safe multisig wallet through social engineering of co-signers.

PlayDapp's PLA token minting function was exploited after a private key compromise, allowing unauthorized minting of 1.79 billion PLA tokens.

KyberSwap's concentrated liquidity pools were drained of $49M via a sophisticated exploit targeting edge cases in the tick-crossing math.

HTX (formerly Huobi), also Justin Sun-backed, lost $113M in a hot wallet compromise linked to Lazarus Group.

CoinEx hot wallet private keys compromised, resulting in $70M drained across multiple blockchains.

A reentrancy vulnerability in Vyper compiler versions 0.2.15-0.3.0 allowed attackers to drain multiple Curve liquidity pools.

Atomic Wallet users lost over $100M to an unknown vulnerability, with Lazarus Group identified as responsible by blockchain investigators.

During FTX's bankruptcy filing, ~$477M was drained from FTX wallets by an insider or external attacker exploiting access during the chaos.

Mirror Protocol was silently drained of $90M over 7 months via an oracle exploit that allowed minting of mAssets with near-zero collateral.

An arbitrary call vulnerability in Transit Swap's contracts allowed attackers to steal $69M from user wallets.

A faulty initialization set a trusted root to 0x00, allowing anyone to spoof any message, leading to a chaotic free-for-all drain.

Rari Capital's Fuse lending pools lost $80M in a reentrancy attack exploiting a callback vulnerability in compound-fork code.

Deus DAO's lending platform was exploited via flash loan price oracle manipulation on Solidly and Spirit Finance DEXes, draining $13.4M.

Elephant Money lost $11.2M when an attacker flash-loaned BNB to manipulate ELEPHANT token prices and exploit the Treasury's convertELEPHANT function.

Infinite mint exploit on Solana stablecoin protocol Cashio drained $52M by exploiting faulty account validation logic.

Both Agave and Hundred Finance on Gnosis Chain were simultaneously exploited via reentrancy on ERC-677 token callbacks, losing $11M combined.

Attacker exploited a signature verification bypass in Wormhole's Solana contract to mint 120,000 wETH without backing.

Crypto.com lost $35M when attackers bypassed 2FA controls and withdrew funds from approximately 483 user accounts.

Attackers compromised private keys for 96 Vulcan Forged user wallets through a breach of the platform's centralized key storage.

BitMart hot wallets on Ethereum and BSC compromised, with stolen tokens immediately swapped for ETH via 1inch.

MonoX Finance was drained of $31M when an attacker exploited a price oracle vulnerability in its single-token pool design to inflate the MONO token price.

Flash loan attack exploiting a price manipulation vulnerability in Cream's lending protocol drained $130M.

A bug in Compound's updated Comptroller contract allowed users to claim excessive COMP rewards beyond what was earned.

Attacker exploited a flaw in Poly Network's cross-chain contract to override keeper role and transfer assets.

PancakeBunny lost $45M when an attacker used a massive BNB flash loan to manipulate BUNNY token prices and mint inflated BUNNY rewards.

Spartan Protocol lost $30M when an attacker used flash loans to manipulate liquidity pool share calculations, inflating collateral value.

EasyFi founder's MetaMask seed phrase was compromised via a targeted attack on his computer, leading to $80M in stolen assets.

Furucombo was drained via a 'evil contract' trick where the attacker registered a malicious Aave V2 implementation, stealing approved tokens from users.

Yearn Finance's DAI v1 vault was exploited via a complex multi-protocol flash loan attack, draining approximately $11M.

Harvest Finance vaults were drained via flash loan price manipulation of Curve's USDC/USDT pools, exploiting the vault's reliance on spot prices.

Lendf.Me lending protocol was drained via ERC-777 reentrancy attack, exploiting the token callback mechanism to repeatedly borrow against the same collateral.

Japanese exchange Bitpoint lost $32M across five cryptocurrencies when its hot wallet system was compromised.

CoinBene denied being hacked despite $105M in suspicious large withdrawals that blockchain analysts confirmed as unauthorized.

Italian exchange BitGrail lost 17M NANO tokens from its hot wallet, with founder Francesco Firano later convicted of fraud.

Cryptocurrency mining marketplace NiceHash had its payment system compromised, losing approximately 4,700 BTC from its Bitcoin hot wallet.

Mt. Gox, once handling 70% of all Bitcoin transactions, lost 850,000 BTC through years of theft and mismanagement.