Hack Database
54 ARTICLESEvery major crypto hack, exploit, and heist. The biggest thefts in digital history, dissected.
Mt. Gox 2011: The Hack Nobody Noticed
The first major crypto exchange hack. $8.75M stolen. BTC crashed to one cent. Nobody learned a thing.
Mt. Gox 2014: 850,000 Bitcoin Vanish Forever
850,000 Bitcoin vanished. The biggest heist in crypto history.
The DAO: The $60M Hack That Split Ethereum in Two
The exploit that split Ethereum in two
Coincheck: Japan's $530 Million Wake-Up Call
$530 million stolen from a hot wallet. In Japan. Again.
Poly Network: The $611M Hack With a Plot Twist
Stole $611 million. Then gave it all back.
Ronin Bridge: North Korea's $625M Payday
North Korea stole $625M from a video game. Nobody noticed for six days.
Wormhole: $320M Stolen, Then Counter-Exploited Back
120,000 ETH minted from thin air. Jump Crypto bailed it out the next day. Then they hacked the hacker to get it back.
The FTX Hack: $477M Vanishes as the Empire Falls
$400-477M stolen from FTX the night it filed for bankruptcy, via a SIM swap on one employee's phone
Mixin Network: The $200M Cloud Heist
The cloud provider got hacked. $200M walked out the door.
They Made Themselves a Minter, Came Back Three Days Later, and Did It Again
An access control flaw let an attacker add their own address as an authorized minter on PlayDapp's token contract. They printed 200 million tokens. PlayDapp offered a million dollars to give it back. The attacker returned three days later and printed 1.59 billion more.
A Dormant Key Nobody Had Used in Six Months Minted $216 Million
Gala Games did the hard part right. The mint function had access controls. The problem was who was still on the list: a deployer account nobody had touched in six months, whose key somebody else now had.
Japan Lost 4,502 Bitcoin in a Day and the Exchange Never Recovered
The largest crypto theft of 2024 took 4,502.9 Bitcoin from a Japanese exchange in a single afternoon. The FBI later attributed it to North Korea. DMM Bitcoin announced it was shutting down seven months after.
Four Signers Approved a Transaction That Was Not What They Saw
India's largest crypto exchange required four of six signatures to move funds. It got them. The signers were looking at a custody interface that displayed one transaction while the blockchain received another, and the fake contract had been sitting there for eight days.
Radiant Capital Got Hacked in January, Fixed Everything, and Got Hacked Again in October
Eleven signers controlled Radiant Capital's multisig. The attacker only needed three, and they got them by compromising developer machines so cleanly that the malicious transactions passed every review the team ran.
Bybit: The $1.5 Billion Heist That Shook Crypto
The largest crypto hack ever. $1.5 billion. One transaction.
MEV Sandwich Attacks: The Invisible Tax on Every Trade
$220,764 in USDC became $5,271 of USDT in eight seconds. The trader thought stablecoins were safe. The bot knew better.
EIP-7702: Ethereum's Feature That Drains Wallets
Ethereum's Pectra upgrade gave users batch transactions. It gave attackers a way to drain 15,000+ wallets for $12 million in two months.
Bithumb: The $44 Billion Typo That Almost Broke an Exchange
One employee typed 'BTC' instead of 'KRW.' 620,000 ghost Bitcoins appeared. Chaos followed.
Resolv: The $25 Million Stablecoin That Minted Itself to Death
One compromised private key. 80 million unbacked stablecoins minted. $25 million drained. The code worked perfectly. The humans did not.
Drift Protocol: $285M Solana DeFi Exploit
Solana's biggest perps exchange lost $285M in minutes through compromised admin keys.
Drift Protocol Update: North Korea Confirmed, Circle's Six-Hour Silence Exposed
Lazarus Group stole $285M in 12 minutes. Bridged $230M through Circle's CCTP during business hours. Circle did nothing for six hours.
Kelp DAO: The $292M Hack That Broke Restaking
Lazarus Group spoofed a LayerZero message and walked off with 18% of all rsETH. Aave triggered a $9B panic withdrawal. Circle got sued.
Grinex: The 'Hack' That Looked Like an Exit
$13.74M drained across 54 wallets. Grinex blamed hostile foreign intelligence. Chainalysis hinted at a false flag exit scam.
TrustedVolumes: The $6.7M Function Anyone Could Call
A custom RFQ swap proxy let anyone whitelist themselves as an authorized signer. The hacker drained $6.7M, swapped to ETH, and walked.
Echo Protocol: The $77M Admin Key That Minted eBTC
A compromised admin key let an attacker mint 1,000 eBTC worth $77 million on Monad. The hacker borrowed $3.45M in WBTC and laundered $822K through Tornado Cash before Echo burned the rest.
THORChain: The $10.8M Key Leak That Broke the Vault
A freshly churned validator node exploited a flaw in THORChain’s GG20 threshold signature scheme, reconstructing a vault private key and draining $10.8M across Bitcoin, Ethereum, BNB Chain, and Base. 12,847 wallets got hit.
Volo Protocol: The $3.5M Hack That Ended With $60K Lost
Someone stole $3.5 million from Volo Protocol. Volo got almost all of it back. In DeFi, that almost never happens.
Wasabi Protocol: One Key, No Multisig, $5.9M Gone in Three Minutes
Wasabi Protocol had one admin key controlling every vault across four blockchains. No backup. No delay. No protection. Someone got the key.
New Market Trading: The Missing Check That Drained 86 Wallets
86 crypto wallets. Two hours. $3.2 million gone. The code that made it possible was publicly readable on the blockchain the whole time.
StakeDAO: Someone Minted 5.4 Trillion Tokens and Got $91K
On paper, the attacker had $763 billion worth of tokens. In practice, they extracted $91,000. The gap between those two numbers is the whole story.
Rhea Finance: 423 Fake Wallets, Two Days of Prep, $18.4 Million Gone
Someone spent two days building 423 fake wallets before robbing NEAR's biggest DeFi protocol. $18.4 million gone. Half came back. The person who took the other half has never been caught.
Hyperbridge: They Said It Could Not Be Hacked. It Got Hacked.
Hyperbridge joked about being unhackable on April Fools Day. Twelve days later someone minted $1.19 billion in fake tokens on their bridge. The attacker walked away with $237,000. The jokes were deleted. Nobody has been caught.
Zcash: Claude Opus Found in Hours What Auditors Missed for Four Years
A four-year-old bug in Zcash's privacy pool. Found by an AI the day after it launched. Patched in five days. Disclosed on day seven. By then the insiders knew, the exchanges had frozen withdrawals, and retail was rotating in while BTC dumped. The Holy Trinity is dead.
TesseraDAO: Someone Printed 99 Million Tokens and Walked Away With $2.5 Million
On BNB Chain, someone with admin key access minted 99 million TSR tokens from nothing, sold all of them, bridged $2.5 million to Ethereum, and laundered 1,285 ETH through Tornado Cash. TesseraDAO has not said a word.
Humanity Protocol: ZachXBT Doesn't Buy the Story. $32 Million Is Gone Either Way.
H token hit $0.85 on June 2. Seven days later 17 wallets were drained, 100 million tokens minted from nothing, and $32 million converted to ETH. ZachXBT called it possibly staged. The team blamed one compromised laptop. Neither story is complete.
SwapNet: Someone Turned Off the Safety Setting and Lost $13.34 Million
18 Matcha Meta users turned off a safety setting to speed up their trades. An attacker exploited SwapNet's smart contract to drain everything those 18 wallets had approved. One user lost $13.34 million. The other 17 split $90,000. PeckShield called it the largest approval attack in DeFi history.
Aztec: They Threw Away the Keys. Then Someone Robbed the Building Twice.
Aztec shut down two privacy bridges years ago and renounced the admin keys to prove they were decentralized. In June 2026, an attacker drained both of them - $4.35 million total - and nobody could lift a finger to stop it. That was the whole point of the design.
Aptos: A $3,000 Server Found the Bug That Could Have Broken $70 Billion
Two ethical hackers rented $3,000 worth of servers and found a flaw in the Aptos blockchain that could have minted counterfeit stablecoins, seized bridges, and forged assets across the entire ecosystem. Estimated damage: up to $70 billion. Actual damage: zero, because they reported it first.
He Spent $4.4 Million to Vote Himself $20 Million, and It Was Legal
No smart contract was hacked. No key was stolen. No website was spoofed. An attacker spent $4.4 million buying votes, submitted a proposal to send themselves the treasury, and won the election 99.9% to nothing. Seven wallets voted. This is what on-chain democracy looks like.
A Privacy Chain Got Robbed for $4.67M and Didn't Notice for Seven Days
Secret Network encrypts every balance by default. That is the entire product. So when an attacker minted $4.67 million in tokens backed by nothing, the missing money did not show up anywhere. The chain hid the theft from its own team for a full week. The privacy worked perfectly. That was the problem.
They Reset a Hardware Wallet's Password With a Laser, and It Can Never Be Fixed
Tangem built its wallet cards with no firmware updates and called it a security feature - nothing can be changed, so nothing can be tampered with. Then Ledger's researchers pointed a laser at the chip, flipped one bit, and reset the password without knowing the old one. The flaw is now permanent on every card ever sold.
Some Wallets Have Been Guessable Since 2018, and Someone Finally Started Guessing
A recovery phrase is supposed to be one of trillions of trillions of possibilities. Some software wallets built theirs with a broken random number generator, quietly making them guessable. On May 27, 2026, someone guessed 431 of them at once and drained $3.14 million. The wallets had been sitting ducks since 2018.
A North Korean Operative Wrote Code Inside MetaMask for a Month Before Anyone Noticed
He called himself Tyler Knapp. He came recommended through a trusted contractor. For about a month he wrote core code for MetaMask - the wallet 30 million people use - including the features that move money between crypto and cash. Then Consensys realized who he actually worked for: North Korea.
They Got Robbed the Exact Same Way in 2023, Fixed It, Then Got Robbed Again
In 2023 an attacker used a flash loan to manipulate Allbridge's pools and drained $570K. The team recovered most of it, rewrote the code, promised it could never happen again, and named the exact fix. On July 19, 2026, someone did it again for $1.65 million.
Ostium Excluded Its Oracle From the Bug Bounty. It Cost Them $24 Million
An attacker got hold of one private key and faked a Bitcoin price for five minutes. The gap between fake and real cost Ostium's liquidity providers up to $24 million, and the security hole was explicitly outside the scope of anyone getting paid to find it.
AFX Trade Had a 200-Second Fraud Window. Nobody Filed a Challenge
Five compromised validator keys hit the exact two-thirds quorum needed to empty AFX Trade's Arbitrum bridge. The dispute window was open for 200 seconds. Nobody challenged the withdrawal, and $24.15 million in USDC walked out clean.
The Same Bug Robbed Verus Twice in Two Months. This Time for $7.54M
In May, an attacker drained $11.5 million from the Verus-Ethereum bridge through one unverified function. In July, a completely different attacker used the exact same path to take $7.54 million more.
They Hacked Robinhood's CEO and Had a Fake Coin Trading in Minutes
Attackers took over Vlad Tenev's verified X account, launched a fake memecoin claiming to be Robinhood Chain's official mascot, and cashed out before most of the 175,000 people who saw the post knew it wasn't real.
Their Bitcoin Was in a Safe. The Thief Never Needed to Go Near It
A firmware bug shipped in March 2021 quietly stopped Coldcard devices from using their own randomness chip. For five years the wallets generated seed phrases a computer could guess. On July 30 somebody guessed thousands of them at once.
In 2021 Coldcard Described the Exact Way It Would Be Robbed. Then It Was
Coinkite's own account defined a retirement attack as a bug in entropy generation left there for later retrieval. Five years later its firmware produced precisely that, somebody swept 1,816 BTC, and the company has not answered the questions researchers are now asking about who wrote the code.
Ravencoin's Developers Asked for a Softer Rollback. The Mining Pools Told Them No
A flaw let blocks lie about their own height and skip the proof-of-work check entirely. Then two mining pools that control most of the hashrate decided which four days of history would be deleted, overruled the project's own developers, and wrote the patch themselves.
Harmony Deleted 109,000 Real Transactions to Undo One Attacker's Work
An attacker forged three trillion ONE tokens through a cross-shard flaw, moved 2.385 trillion of them in a hundred seconds, and Harmony's own supply endpoint reported nothing was wrong. The only fix left was deleting a day of everybody else's history.
The Transfer Failed. Maya Logged the Error and Kept the Money Anyway
Six small bugs in a row credited a liquidity pool with nearly 50 million tokens that were never funded. When the funding transfer failed, the system wrote an error message and left the fake balance sitting there. The attacker only had to notice.
Sixteen Hacks in Nineteen Days, and August Was Not Even the Worst Month
2026 has produced more separate crypto hacks than any year on record and less stolen money than 2025. Sixteen of them landed in the first nineteen days of August. The attacks got smaller, more frequent, and almost entirely stopped bothering with smart contract bugs.