Hack Database
Every major crypto hack, exploit, and heist. The biggest thefts in digital history, dissected.
Latest from Hack Database
Pirate Chain: A Bug Printed 39.8M ARRR, and the Coins Vanished Into the Privacy Pool
Eleven days after an upgrade, a bug let someone create 39.8M ARRR, a fifth of the supply. The coins went where nobody can follow them.
Gamdom: Crypto Casino Loses Over $3M From Its Hot Wallets, Three Weeks After Duelbits
Crypto casino Gamdom lost just over $3M, by its own count, when hackers drained its hot wallets on 13 Oct 2026. An on-chain count says $4.2M.
Ledger: $86M Reportedly Drained From Wallets Sold by a Southeast Asian Reseller
Buyers of Ledger wallets from Malaysian reseller CryptoBilis lost an estimated $72M to $102M to a hidden implant that copied their recovery words.
XRP Ledger: A Bug Hidden Since 2015 Could Have Printed XRP Beyond the 100 Billion Cap
A flaw in the XRP Ledger since about 2015 could have created XRP from nothing. An AI firm found it first and was paid $250,000. Nothing was lost.
79thVault: A $12.5M Drain Through Its Own Master Key, Then 92% Came Back
A staff master key emptied 79thVault's trading pool of $12.5M in an hour. Two days later 15,000 BNB came back. Nobody has said who held the key.
NEAR Intents: $3.87M Drained, Then Handed Back After a 48-Hour Ultimatum
A bug let someone drain $3.87M in digital dollars from NEAR Intents. An AI alarm shut it down, and a 48-hour ultimatum got all of it back.
MetaMask: Hackers Took Under $1,000, So It Pulled $1.4B of Ether Offline
An intruder in MetaMask's staking business redirected 0.36 ETH of tips. MetaMask answered by retiring about 17,000 validators holding roughly $1.4B.
Bitget: Hackers Took $387.5 Million by Faking the Exchange's Own Paperwork
Suspected North Korean hackers took $387.5 million from Bitget by feeding its own security system fake paperwork. No password or key was stolen.
Live DeFi agents
Watch four AI agents manage money in public.
Stablecoins across Base, Arbitrum, Optimism, Polygon and Avalanche. Every decision is on-chain.
Subscription opening soon. Not financial advice.
- BASE
- ARB
- OP
- POL
- AVAX
Also in Hack Database
Duelbits: Crypto Casino Loses $7M to Hackers, Its Second Raid in Three Years
Neutron: The $9.3M Takeover That Lost a Vote, Then Won One
SingularityNET: The $16.77M Bridge Hack That Paid the Thief $2.29M
WaterPlum: North Korea's Fake Recruiters Infected 30,000 Computers and Sent $10.7M Home
D'CENT: $16M in XRP Drained From 6,678 Wallets by a Bug Fixed Ten Months Earlier
More from Hack Database
Liquid Network: Blockstream's Sidechain Paid Out 4,000 Bitcoin That Never Existed
A flaw in Blockstream's software let an attacker create 4,000 Bitcoin from nothing on Liquid and withdraw them in 36 minutes. About 85% came back.
Tectonic: Its Own Token Went Up 100x, Then Cronos Stopped the Chain
An attacker pumped Tectonic's thin TONIC token 100-fold in twenty minutes, borrowed about $74M against it, and Cronos halted its whole chain.
Term Finance: $951 Bought the Vote That Drained $8.5M
An attacker spent about $951 to win 91% of the vote over Term Finance's vaults, voted the safety delays away, and took $8.5 million.
Cosmos EVM: One Bug Hit Four Blockchains, and the '$50M' Hacker Kept $60,000
One flaw in shared Cosmos code let attackers drain MANTRA, TAC, KiiChain and Nesa in five days. About $5.7M was cashed out. One '$50M' haul netted $60,000.
August 2026 Hacks: From Coldcard to Tectonic, 50 Attacks and $136M Gone
August 2026 brought 50 crypto hacks, three blockchains rewriting their own history and $136M stolen. The attacks got smaller and more frequent.
Coldcard: In 2021 It Described the Exact Way It Would Be Robbed. Then It Was
In 2021 Coldcard's own account described a planted randomness bug as a way to rob users. Five years later its firmware had one, and 1,816 BTC was swept.
Maya Protocol: The Transfer Failed, It Logged the Error and Kept the Money Anyway
Six chained bugs credited a Maya Protocol pool with almost 50 million tokens nobody paid for. The failed transfer was logged, not undone. About $1.7M left.
Trezor: Nobody Broke In. They Hit the Company That Mailed the Boxes
A flaw at Trezor's shipping partner exposed the names, home addresses and phone numbers of 13,689 wallet owners. No seed was stolen. Something else was.
Harmony ONE: 109,000 Real Transactions Deleted to Undo One Attacker's Forgery
An attacker forged three trillion ONE tokens and moved 2.385 trillion in 100 seconds. Harmony's only fix was deleting a day of everyone else's history.
Ravencoin: Developers Asked for a Softer Rollback. The Mining Pools Told Them No
A flaw let Ravencoin blocks skip the proof-of-work check. Two mining pools then overruled the developers and chose which four days of history to delete.
Coldcard: The $116M Bitcoin Theft That Never Touched a Device
A 2021 software bug made Coldcard wallets create guessable keys. In July 2026 thieves guessed thousands and took about $116M without touching a device.
Verus: Its Ethereum Bridge Was Robbed Twice in 66 Days, $7.54M the Second Time
Verus got most of its $11.5M back after a May raid on its Ethereum bridge, put money back in, and lost $7.54M to a new thief in July.
Robinhood: Hackers Took CEO Vlad Tenev's X Account and Had a Fake Coin Trading in Minutes
Attackers hijacked Robinhood CEO Vlad Tenev's X account, pushed a fake memecoin to 175,000 viewers, and cashed out before most knew it was fake.
AFX Trade: A Fake Job Offer and Five Stolen Keys Took $24.15M
A fake recruiter got into an AFX Trade developer's computer. Two weeks later, five hijacked signers emptied the exchange's $24.15 million bridge.
Allbridge: The Flash-Loan Trick It Fixed in 2023 Took $1.65M in 2026
In 2023 Allbridge promised a flash-loan attack could never happen again. In July 2026 the same trick drained $1.65 million from its Solana pools.
MetaMask: A North Korean Operative Wrote Its Code for a Month Before Anyone Noticed
Posing as Tyler Knapp, a North Korean operative wrote core code for MetaMask, the wallet 30 million people use, for a month before Consensys caught on.
Ostium: A Stolen Price-Feed Key Faked a $5,000 Bitcoin and Drained $23.75M
With one stolen signing key, an attacker told Ostium that Bitcoin cost $5,000. Six minutes later, 3,666 depositors had lost $23.75 million.
Tangem: Ledger Researchers Reset Its Wallet Password With a Laser, and It Can Never Be Fixed
Tangem's wallet cards take no software updates. Ledger's researchers reset a card's password with a laser, so the flaw is permanent on every card sold.
BonkDAO: $4.4M Bought the Vote That Paid Out $20M, All by the Rules
An attacker bought just over 1% of BONK, outvoted a DAO that did not turn up, and paid itself $20 million from the treasury. Nothing was hacked.
Ill Bloom: A Wallet Bug Made Keys Guessable, and Thieves Took $5.7M
Five little-known crypto wallets made keys from a flawed 2014 code library. In 2026 thieves guessed hundreds of them and took at least $5.69 million.
Aptos: A $3,000 Server Found the Bug That Could Have Broken $70 Billion
Two ethical hackers rented $3,000 of servers and found an Aptos flaw that put up to $70 billion at risk. Damage: zero, because they reported it first.
Aztec: They Threw Away the Keys. Then Someone Robbed the Building Twice.
Aztec renounced the admin keys to two closed privacy bridges to prove they were decentralized. In June 2026 an attacker drained both for $4.35M.
Secret Network: $4.67M Stolen, and Nobody Noticed for Seven Days
A missing check let a thief print fake tokens on privacy chain Secret Network and swap them for $4.67M of real ones. Nobody noticed for a week.
Humanity Protocol: One Infected Laptop, Seven Keys, $36M Gone
A fake Bithumb email put malware on a director's laptop. It held seven admin keys, and attackers used them to take about $36 million in H tokens.
Zcash: Claude Opus Found in Hours What Auditors Missed for Four Years
A four-year-old bug in Zcash's privacy pool was found by an AI in hours. Insiders knew for seven days before disclosure, and ZEC fell 31% when it came out.
TesseraDAO: Someone Printed 99 Million Tokens and Walked Away With $2.5 Million
One admin key let someone print 99 million TSR tokens, sell them for $2.5M and wash the money through Tornado Cash. TesseraDAO never mentioned it.
StakeDAO: Someone Minted 5.4 Trillion Tokens and Got $91K
A forgotten key let a thief print 5.4 trillion StakeDAO tokens, worth $763 billion on paper. The market was so thin they left with $91,000.
New Market Trading: A Gnosis Safe Add-On With an Open Door Cost 88 Clients $3.8M
A wealth app that sold security to its clients built an add-on for their Gnosis Safe wallets that let anyone in. A thief took about $3.8M in minutes.
Echo Protocol: A Stolen Admin Key Printed $77M of Fake Bitcoin, and the Thief Got $822K
A stolen admin key let a hacker print 1,000 fake bitcoin tokens on Monad. Markets were too thin to sell them, so the thief got away with about $822K.
THORChain: The $10.7M Key Leak That Broke the Vault
A new THORChain validator broke 864 signing rounds on purpose, rebuilt a vault's secret key from the leaks and took $10.7M. Trading stopped for 39 days.
TrustedVolumes: The $6.7M Function Anyone Could Call
A custom RFQ swap proxy let anyone whitelist themselves as an authorized signer. The hacker drained $6.7M, swapped to ETH, and walked.
Wasabi Protocol: One Key, No Multisig, $5.9M Gone in Three Minutes
One admin key controlled every Wasabi vault on four blockchains. A thief got it through a careless server and emptied them in minutes.
Volo Protocol: The $3.5M Hack That Ended With $60K Lost
A leaked admin key let a thief take $3.5 million from Volo on Sui. Within a week Volo had clawed back all but about $60,000 and paid that itself.
Kelp DAO: The $292M Bridge Exploit
A forged message emptied Kelp DAO's bridge of $292M, sent Aave into a run and ended in rival lawsuits over who left the door open.
Rhea Finance: $18.4M Drained by 423 Fake Wallets, Then Nearly All of It Came Back
An attacker spent two days building fake wallets and tokens, then drained $18.4 million from Rhea Finance on NEAR. Most of it came back within days.
Grinex: The 'Hack' That Looked Like an Exit
$13.74M drained across 54 wallets. Grinex blamed hostile foreign intelligence. Chainalysis hinted at a false flag exit scam.
Hyperbridge: They Said It Could Not Be Hacked. It Got Hacked.
Hyperbridge joked on April Fools Day that it could not be hacked. Twelve days later an attacker minted 1 billion fake DOT and took about $2.5M.
Drift Hack: How North Korea Moved $230M Through Circle, and the Lawsuit That Followed
Drift's thieves moved $230M of USDC across Circle's own bridge in US office hours. Circle froze nothing. Now Drift users are suing it.
Drift Protocol: The $295M Hack That Began With a Fake Trading Firm
A fake trading firm spent six months befriending Drift's team, then emptied the Solana exchange of $295M. Victims were offered one cent per dollar.
Resolv: The $25 Million Stablecoin That Minted Itself to Death
A hacker paid $200,000, minted 80 million unbacked digital dollars and left with $25M. The way in was a contractor's old GitHub login.
Bithumb: The $44 Billion Typo That Almost Broke an Exchange
One employee typed 'BTC' instead of 'KRW.' 620,000 ghost Bitcoins appeared. Chaos followed.
SwapNet: Someone Turned Off the Safety Setting and Lost $13.34 Million
18 Matcha Meta users turned off a safety setting to speed up trades, and an attacker drained what they had approved. One user lost $13.34 million.
Fake Trezor Support: One Recovery Phrase, $282 Million Gone
Someone posing as Trezor support talked a holder into revealing a wallet recovery phrase, then took $282 million in bitcoin and litecoin.
Ethereum: The 2025 Wallet Upgrade Thieves Turned Into a One-Signature Drain
Ethereum's 2025 upgrade let ordinary wallets run code. Within weeks thieves used it to empty accounts with a single signature, taking $1.54M in one case.
MEV Sandwich Attacks: The Invisible Tax on Every Trade
A trader swapped $220,764 of one digital dollar for another and got back $5,271. A bot that saw the order coming took the rest in one block.
Bybit: The $1.5 Billion Heist That Shook Crypto
North Korean hackers took about $1.5 billion of ether from Bybit in one approved transfer. Twenty months on, under 5% has come back.
Radiant Capital: Hacked in January, Fixed Everything, Then Hacked Again for $53M in October
North Korean hackers took three of Radiant Capital's eleven signing keys with one booby-trapped PDF and stole about $53M. The lender never recovered.
WazirX: Four Signers Approved a $235M Theft Without Seeing It
Four approvals moved $234.9M out of India's biggest crypto exchange in 2024. Its users waited 15 months and got back about 85 percent.
DMM Bitcoin: Japan's Exchange Lost 4,502 Bitcoin in a Day and Never Recovered
The FBI blamed North Korea for taking 4,502.9 Bitcoin, about $305 million, from Japan's DMM Bitcoin in May 2024. Seven months later it said it would close.
Gala Games: A Dormant Key Minted $216M of GALA Tokens
An unused account printed 5 billion GALA worth $216M. Gala froze most of it, and the thief handed back the $22M they had cashed out.
PlayDapp: Hacker Ignored a $1M Bounty and Minted $290M of Tokens
A thief printed 200 million PlayDapp tokens, was offered $1 million to stop, and came back three days later to print 1.59 billion more.
Mixin Network: The $200M Cloud Heist
Hackers emptied Mixin through its cloud provider in 2023. Three years on, Mixin says it has repaid the $23M dollar debt. The rest is still owed.
The FTX Hack: $477M Vanishes as the Empire Falls
$400-477M stolen from FTX the night it filed for bankruptcy, via a SIM swap on one employee's phone
Ronin Bridge: North Korea's $625M Payday
North Korean hackers used a fake job offer to steal $625M from the bridge behind Axie Infinity. Nobody noticed for six days.
Wormhole: $320M Stolen, Then Counter-Exploited Back
A hacker printed 120,000 ether out of nothing in 2022. Jump Crypto paid it back, then a year later used a court order to hack the hacker.
Poly Network: The $611M Hack With a Plot Twist
In August 2021 a hacker took $611M from Poly Network, the biggest crypto theft yet, then handed every coin back within two weeks.
Coincheck: Japan's $530 Million Wake-Up Call
Hackers took $530M in NEM from a Tokyo exchange in 2018. Coincheck repaid 260,000 customers from its own cash, then got a Nasdaq listing.
The DAO: The $60M Hack That Split Ethereum in Two
In 2016 a bug let one attacker drain $60M from The DAO. Ethereum rewrote its own history to undo it, and split in two.
Mt. Gox 2014: 850,000 Bitcoin Vanish Forever
850,000 Bitcoin vanished. The biggest heist in crypto history.
Mt. Gox 2011: The Hack Nobody Noticed
The first major crypto exchange hack. $8.75M stolen. BTC crashed to one cent. Nobody learned a thing.