https://onchainattack.org/incidents/ Newly documented crypto hacks, exploits and on-chain attacks: mechanism, timeline, attacker addresses and fund flow. en https://onchainattack.org/document/examples/2026-10-zklink-nova-arbitrator-transient-hash-reuse-forged-logs-root/ https://onchainattack.org/document/examples/2026-10-zklink-nova-arbitrator-transient-hash-reuse-forged-logs-root/ Fri, 30 Oct 2026 12:00:00 GMT October 29, 2026 · loss $783K. SlowMist flagged the exploit on 2026-10-29 with two Ethereum transactions. Attacker addresses… https://onchainattack.org/document/examples/2026-10-polymarket-debugbear-rum-script-session-hijack-position-drain/ https://onchainattack.org/document/examples/2026-10-polymarket-debugbear-rum-script-session-hijack-position-drain/ Fri, 30 Oct 2026 12:00:00 GMT October 29, 2026 · loss $2.5–2.7M. Between 13:50 and 13:56 ET on 2026-10-29 the attacker wallet made many transactions against Polymarket's outcome-token… https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/ https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/ Fri, 30 Oct 2026 12:00:00 GMT October 29, 2026 · loss $6.3B. Preparation is visible on-chain. The initiator was funded by three 0.1 ETH Tornado Cash withdrawals from 07:39 UTC on… https://onchainattack.org/document/examples/2026-10-tranchepool-day-rollover-scheduled-payment-counted-received-redraw/ https://onchainattack.org/document/examples/2026-10-tranchepool-day-rollover-scheduled-payment-counted-received-redraw/ Fri, 30 Oct 2026 12:00:00 GMT October 28, 2026. Two Avalanche transactions on 2026-10-28 drew 1.013M USDC each against vulnerable contract 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a. https://onchainattack.org/document/examples/2026-10-hifi-finance-last-minute-vote-takeover-mint-collateral-sweep/ https://onchainattack.org/document/examples/2026-10-hifi-finance-last-minute-vote-takeover-mint-collateral-sweep/ Fri, 30 Oct 2026 12:00:00 GMT October 28, 2026 · loss $1M. Reported on 2026-10-28 as "another small DAO governance takeover". No Hifi statement yet. https://onchainattack.org/document/examples/2026-10-predict-fun-third-party-api-docs-site-compromise-wallet-drain/ https://onchainattack.org/document/examples/2026-10-predict-fun-third-party-api-docs-site-compromise-wallet-drain/ Fri, 30 Oct 2026 12:00:00 GMT October 27, 2026. The docs site was taken offline on 2026-10-27. Predict.fun is a prediction market integrated in Binance Wallet. https://onchainattack.org/document/examples/2026-10-bloom-trading-third-party-module-rce-bot-wallet-drain/ https://onchainattack.org/document/examples/2026-10-bloom-trading-third-party-module-rce-bot-wallet-drain/ Fri, 30 Oct 2026 12:00:00 GMT October 26, 2026 · loss $947K. Bloom's statement is the only source, and it gives no clock times, transaction hashes or addresses. Stages that it does not… https://onchainattack.org/document/examples/2026-10-avalanche-safe-unlimited-approval-undeployed-createcall-address/ https://onchainattack.org/document/examples/2026-10-avalanche-safe-unlimited-approval-undeployed-createcall-address/ Fri, 30 Oct 2026 12:00:00 GMT October 26, 2026 · loss $7.45M. Defimon detected the attack on 2026-10-26 at 13:00 UTC. The approvals had been live for seven months. https://onchainattack.org/document/examples/2026-10-yapeswap-zero-quorum-proposal-feetosetter-fake-registry/ https://onchainattack.org/document/examples/2026-10-yapeswap-zero-quorum-proposal-feetosetter-fake-registry/ Fri, 30 Oct 2026 12:00:00 GMT October 25, 2026 · loss $21.9K. Read it as three stages. Get in: a governance contract with zero quorum. Prepare: not published. Take: a proposal, then a fake… https://onchainattack.org/document/examples/2026-10-x100-senate-flash-loan-seat-capture-treasury-swap/ https://onchainattack.org/document/examples/2026-10-x100-senate-flash-loan-seat-capture-treasury-swap/ Fri, 30 Oct 2026 12:00:00 GMT October 24, 2026 · loss $4.85M. Blockaid, Defimon and Phalcon flagged the exploit on 2026-10-24. RektRadar described the proceeds (~2,023 ETH) as not moved by… https://onchainattack.org/document/examples/2026-10-kimchi-influencer-post-pump-and-dump/ https://onchainattack.org/document/examples/2026-10-kimchi-influencer-post-pump-and-dump/ Fri, 30 Oct 2026 12:00:00 GMT October 23, 2026 · loss $385K. Lookonchain reported the sequence on 2026-10-23 with Solscan links to the selling wallets. https://onchainattack.org/document/examples/2026-10-initia-movevm-script-cache-unbacked-credit-bridge-exit/ https://onchainattack.org/document/examples/2026-10-initia-movevm-script-cache-unbacked-credit-bridge-exit/ Fri, 30 Oct 2026 12:00:00 GMT October 23, 2026 · loss $2.7M. At 14:59 UTC on 2026-10-23 one signed transaction produced the unbacked balances; ~$2.65M was back on Ethereum within 7 m 21 s.… https://onchainattack.org/document/examples/2026-10-wax-bridge-eth-token-withdraw-negative-max-fee/ https://onchainattack.org/document/examples/2026-10-wax-bridge-eth-token-withdraw-negative-max-fee/ Fri, 30 Oct 2026 12:00:00 GMT October 22, 2026 · loss $90.5K. Read it as three stages. Flaw: the WAX eth.token::withdraw action did not check the sign of max_fee. Take: withdrawals with a… https://onchainattack.org/document/examples/2026-10-nemtokenv2-lp-sell-credit-skim-reserve-burn/ https://onchainattack.org/document/examples/2026-10-nemtokenv2-lp-sell-credit-skim-reserve-burn/ Fri, 30 Oct 2026 12:00:00 GMT October 21, 2026 · loss $821,920. The exploit ran on 2026-10-21 at 03:28 UTC (on-chain time, traced by OAK); SlowMist flagged it on 2026-10-22; victim pair… https://onchainattack.org/document/examples/2026-10-fearless-wallet-browser-extension-private-key-exfiltration/ https://onchainattack.org/document/examples/2026-10-fearless-wallet-browser-extension-private-key-exfiltration/ Fri, 30 Oct 2026 12:00:00 GMT October 21, 2026. Polkadot published the warning on 2026-10-21 and told users to create new keys in another wallet. https://onchainattack.org/document/examples/2026-10-slice-fundsmodule-unverified-release-amounts/ https://onchainattack.org/document/examples/2026-10-slice-fundsmodule-unverified-release-amounts/ Fri, 30 Oct 2026 12:00:00 GMT October 20, 2026 · loss $41K. The exploit ran on 2026-10-20 at 18:39 UTC (on-chain time, traced by OAK); SlowMist flagged it on 2026-10-21. https://onchainattack.org/document/examples/2026-10-argent-style-wallet-recovery-deadline-wrap-signed-payload-replay/ https://onchainattack.org/document/examples/2026-10-argent-style-wallet-recovery-deadline-wrap-signed-payload-replay/ Fri, 30 Oct 2026 12:00:00 GMT October 19, 2026 · loss $59.8K. SlowMist flagged two Ethereum transactions on 2026-10-19 against wallets 0xe545b9a69bff1bf0ed2e922551dda4afc8ee8f66 and… https://onchainattack.org/document/examples/2026-10-alpscon-hardhat-default-account-whitelisted-eip7702-reward-replay/ https://onchainattack.org/document/examples/2026-10-alpscon-hardhat-default-account-whitelisted-eip7702-reward-replay/ Fri, 30 Oct 2026 12:00:00 GMT October 18, 2026 · loss $355K. The attack ran early on 2026-10-18; the deployer removed the Hardhat address at 11:40 UTC, about five hours later. https://onchainattack.org/document/examples/2026-10-qubic-weak-wallet-seed-generation-1404-wallet-drain/ https://onchainattack.org/document/examples/2026-10-qubic-weak-wallet-seed-generation-1404-wallet-drain/ Fri, 30 Oct 2026 12:00:00 GMT October 17, 2026 · loss $1.3–1.4M. Qubic halted the chain at tick 85,371,949, published an update on 2026-10-18 and restarted around 2026-10-20 with a claims… https://onchainattack.org/document/examples/2026-10-bifi-lending-idle-market-interest-delta-live-utilization/ https://onchainattack.org/document/examples/2026-10-bifi-lending-idle-market-interest-delta-live-utilization/ Fri, 30 Oct 2026 12:00:00 GMT October 17, 2026 · loss $165.4K. The exploit ran on 2026-10-17 at 05:43 UTC (blocks 26210255–26210256, on-chain time traced by OAK); Defimon reported it about… https://onchainattack.org/document/examples/2026-10-kolan-uniswap-v4-hook-expired-window-buyback-spot-price/ https://onchainattack.org/document/examples/2026-10-kolan-uniswap-v4-hook-expired-window-buyback-spot-price/ Fri, 30 Oct 2026 12:00:00 GMT October 15, 2026 · loss $3K. Read it as three stages. Flaw: settlement of an expired window is open to anyone and buys back at the spot price. Take: one… https://onchainattack.org/document/examples/2026-10-uncx-vestingmanager-release-double-counted-share-reduction/ https://onchainattack.org/document/examples/2026-10-uncx-vestingmanager-release-double-counted-share-reduction/ Sat, 17 Oct 2026 12:00:00 GMT October 14, 2026 · loss $1.49M. On 2026-10-14 an attacker created vesting positions in UNCX's shared VestingManager, released a large one, donated tokens into… https://onchainattack.org/document/examples/2026-10-pirate-chain-ironwood-issuance-check-bypass-unauthorised-mint/ https://onchainattack.org/document/examples/2026-10-pirate-chain-ironwood-issuance-check-bypass-unauthorised-mint/ Sat, 17 Oct 2026 12:00:00 GMT October 14, 2026. On 2026-10-14 developers found the unauthorised issuance and announced a rollback to 20:00 UTC that day, asking exchanges to suspend ARRR… https://onchainattack.org/document/examples/2026-10-gamdom-automation-server-intrusion-multi-chain-hot-wallet-drain/ https://onchainattack.org/document/examples/2026-10-gamdom-automation-server-intrusion-multi-chain-hot-wallet-drain/ Sat, 17 Oct 2026 12:00:00 GMT October 13, 2026 · loss $3M. On 2026-10-13 Gamdom took its site offline, initially citing a possible disk failure. On 2026-10-14 it said it had found an… https://onchainattack.org/document/examples/2026-10-autheo-theo-hyperlane-trusted-relayer-ism-unbacked-mint/ https://onchainattack.org/document/examples/2026-10-autheo-theo-hyperlane-trusted-relayer-ism-unbacked-mint/ Fri, 30 Oct 2026 12:00:00 GMT October 12, 2026 · loss $1.76M. Defimon dated the mint to 2026-10-12 and PeckShield reported the cash-out on 2026-10-13. Autheo told users not to buy, sell or… https://onchainattack.org/document/examples/2026-10-coldcard-x-account-compromise-fake-firmware-vulnerability-alert/ https://onchainattack.org/document/examples/2026-10-coldcard-x-account-compromise-fake-firmware-vulnerability-alert/ Sat, 17 Oct 2026 12:00:00 GMT October 11, 2026. On 2026-10-11 Coldcard's official X account posted a warning of a critical firmware vulnerability affecting the Mk4, Mk5 and Q, pointing to… https://onchainattack.org/document/examples/2026-10-papertrade-hyperliquid-bbo-midpoint-reference-price-push/ https://onchainattack.org/document/examples/2026-10-papertrade-hyperliquid-bbo-midpoint-reference-price-push/ Sat, 17 Oct 2026 12:00:00 GMT October 10, 2026 · loss $1.28M. Papertrade, a HyperEVM perpetuals exchange offering up to 1,000x, launched at 10:00 ET on 2026-10-10. Within hours one wallet… https://onchainattack.org/document/examples/2026-10-ledger-cryptobilis-reseller-supply-chain-seed-drain/ https://onchainattack.org/document/examples/2026-10-ledger-cryptobilis-reseller-supply-chain-seed-drain/ Sun, 11 Oct 2026 12:00:00 GMT October 9, 2026 · loss $72M. From the morning of 2026-10-09 (UTC), Ledger users in Southeast Asia reported emptied wallets. At 13:32 UTC Ledger said it was… https://onchainattack.org/document/examples/2026-10-ethervista-pair-uint112-k-invariant-overflow-swap-drain/ https://onchainattack.org/document/examples/2026-10-ethervista-pair-uint112-k-invariant-overflow-swap-drain/ Sun, 11 Oct 2026 12:00:00 GMT October 9, 2026 · loss $18.6K. On 2026-10-09 an attacker registered its own contract as an EtherVista router and executed two crafted swaps whose overflowing… https://onchainattack.org/document/examples/2026-10-bitbay-stablevault-zero-liquidity-withdraw-full-balance/ https://onchainattack.org/document/examples/2026-10-bitbay-stablevault-zero-liquidity-withdraw-full-balance/ Sun, 11 Oct 2026 12:00:00 GMT October 9, 2026 · loss $14K. On 2026-10-09 an attacker called reposition() on BitBay's UsdcDaiV4Vault on Polygon to drive its liquidity to zero, then redeemed… https://onchainattack.org/document/examples/2026-10-x7-finance-claimrewards-empty-array-reward-delta-recount/ https://onchainattack.org/document/examples/2026-10-x7-finance-claimrewards-empty-array-reward-delta-recount/ Sat, 17 Oct 2026 12:00:00 GMT October 8, 2026 · loss $16.5K. On 2026-10-08 an attacker repeatedly called claimRewards() on X7Pioneer (0x70000299ee8910ccacd97b1bb560e34f49c9e4f7) with an… https://onchainattack.org/document/examples/2026-10-set-protocol-actualizefee-unitshares-round-up-issue-redeem/ https://onchainattack.org/document/examples/2026-10-set-protocol-actualizefee-unitshares-round-up-issue-redeem/ Sat, 17 Oct 2026 12:00:00 GMT October 6, 2026 · loss $13.7K. On 2026-10-06 an attack contract issued into a Set Protocol vault (0x5b67871c3a857de81a1ca0f9f7945e5670d986dc), triggered the… https://onchainattack.org/document/examples/2026-10-makerdao-legacy-auction-keeper-unauthenticated-adapter-black-thursday-collateral/ https://onchainattack.org/document/examples/2026-10-makerdao-legacy-auction-keeper-unauthenticated-adapter-black-thursday-collateral/ Sun, 11 Oct 2026 12:00:00 GMT October 6, 2026 · loss $543K. On 2026-10-06 at 06:13 UTC an attacker passed a self-deployed module to an unauthenticated function of a 2020 MakerDAO… https://onchainattack.org/document/examples/2026-10-based-visa-card-internal-dashboard-kyc-data-exposure/ https://onchainattack.org/document/examples/2026-10-based-visa-card-internal-dashboard-kyc-data-exposure/ Sat, 17 Oct 2026 12:00:00 GMT October 5, 2026. Based says it was alerted on 2026-10-05 to unauthorised access to the internal dashboard of its Visa card program, and that the access was… https://onchainattack.org/document/examples/2026-10-base-anonymous-vault-safe-rewhitelist-aave-borrow-drain/ https://onchainattack.org/document/examples/2026-10-base-anonymous-vault-safe-rewhitelist-aave-borrow-drain/ Sun, 11 Oct 2026 12:00:00 GMT October 4, 2026 · loss $6M. On 2026-10-04 an unidentified vault on Base (TransparentUpgradeableProxy 0xD1895f2019c2152FC2b9022D57f19198c4CFCABC) lost ~1,783… https://onchainattack.org/document/examples/2026-10-malt-swap-rebalance-treasury-dai-counted-as-trader-input/ https://onchainattack.org/document/examples/2026-10-malt-swap-rebalance-treasury-dai-counted-as-trader-input/ Sun, 11 Oct 2026 12:00:00 GMT October 3, 2026 · loss $72K. On 2026-10-03 an attacker made small-input swaps on MALT that triggered rebalancing from the Capital Source; the treasury DAI… https://onchainattack.org/document/examples/2026-10-goldpesa-gpxhooks-rebalance-unvalidated-currency-delta/ https://onchainattack.org/document/examples/2026-10-goldpesa-gpxhooks-rebalance-unvalidated-currency-delta/ Sun, 11 Oct 2026 12:00:00 GMT October 2, 2026 · loss $114.9K. On 2026-10-02 an attacker used GoldPesa's GPXHooks.reBalance() to mint positions without settling the matching currency deltas… https://onchainattack.org/document/examples/2026-10-near-intents-omni-deposit-withdraw-handoff-treasury-drain/ https://onchainattack.org/document/examples/2026-10-near-intents-omni-deposit-withdraw-handoff-treasury-drain/ Sun, 11 Oct 2026 12:00:00 GMT October 1, 2026 · loss $3.8M. On 2026-10-01 an attacker exploited a flaw in the handoff between NEAR Intents' Omni deposit/withdrawal infrastructure and its… https://onchainattack.org/document/examples/2026-10-microsoft-x-account-compromise-clippy-token-promotion/ https://onchainattack.org/document/examples/2026-10-microsoft-x-account-compromise-clippy-token-promotion/ Sun, 11 Oct 2026 12:00:00 GMT October 1, 2026 · loss $200,000. On 2026-10-01 Microsoft's official X account posted promotions for CLIPPY, an unofficial meme coin playing on Clippy and the… https://onchainattack.org/document/examples/2026-10-flashloopadapter-safe-module-fake-safe-ismoduleenabled-bypass/ https://onchainattack.org/document/examples/2026-10-flashloopadapter-safe-module-fake-safe-ismoduleenabled-bypass/ Sun, 11 Oct 2026 12:00:00 GMT October 1, 2026 · loss $305K. On 2026-10-01 an attacker deployed a contract that impersonated a Safe, called FlashLoopAdapter's open()/close() paths, and… https://onchainattack.org/document/examples/2026-09-metamask-staking-node-operator-compromise-fee-recipient-redirect/ https://onchainattack.org/document/examples/2026-09-metamask-staking-node-operator-compromise-fee-recipient-redirect/ Fri, 30 Oct 2026 12:00:00 GMT September 30, 2026. MetaMask announced the incident at 23:38 UTC on 2026-09-30 and updated on 2026-10-01. No root-cause analysis has been published. https://onchainattack.org/document/examples/2026-09-fake-giwa-chain-id-cloned-l2-bridge-drain/ https://onchainattack.org/document/examples/2026-09-fake-giwa-chain-id-cloned-l2-bridge-drain/ Sun, 11 Oct 2026 12:00:00 GMT September 26, 2026 · loss $2.08M. On 2026-09-26 two funded wallets deployed a bridge contract on Ethereum (0xbA9938C0b96A70E6479661B915e7E481fE435ab2) into a… https://onchainattack.org/document/examples/2026-09-limit-break-payment-processor-v2-standing-approval-zero-price-drain/ https://onchainattack.org/document/examples/2026-09-limit-break-payment-processor-v2-standing-approval-zero-price-drain/ Sun, 27 Sep 2026 12:00:00 GMT September 25, 2026. Explicitly not OAK-T4.005 (setApprovalForAll NFT drainer): the approvals were granted to a legitimate contract for legitimate use; nobody… https://onchainattack.org/document/examples/2026-09-demex-bridge-forged-deployment-report-weth-pairing/ https://onchainattack.org/document/examples/2026-09-demex-bridge-forged-deployment-report-weth-pairing/ Sat, 17 Oct 2026 12:00:00 GMT September 25, 2026 · loss $191,929. On 2026-09-25 an attacker bought ~95 nLEND on Demex's order book, deployed a helper contract on Ethereum and, after four… https://onchainattack.org/document/examples/2026-09-payy-rollup-bridge-forged-withdrawal-in-proven-batch/ https://onchainattack.org/document/examples/2026-09-payy-rollup-bridge-forged-withdrawal-in-proven-batch/ Sun, 27 Sep 2026 12:00:00 GMT September 24, 2026 · loss $1.92M. At 04:21 UTC on 2026-09-24 Payy's Ethereum bridge paid its entire USDC balance — users' non-custodial deposits — to an… https://onchainattack.org/document/examples/2026-09-meter-passport-bnb-unbacked-wmtrg-mint-second-incident/ https://onchainattack.org/document/examples/2026-09-meter-passport-bnb-unbacked-wmtrg-mint-second-incident/ Sun, 27 Sep 2026 12:00:00 GMT September 24, 2026 · loss $2.3M. On 2026-09-24 Blockaid detected an attacker minting wrapped MTRG on BNB Chain through Meter Passport without any underlying… https://onchainattack.org/document/examples/2026-09-duelbits-multi-chain-hot-wallet-key-compromise/ https://onchainattack.org/document/examples/2026-09-duelbits-multi-chain-hot-wallet-key-compromise/ Sun, 27 Sep 2026 12:00:00 GMT September 24, 2026 · loss $7M. On 2026-09-24 Duelbits' hot wallets on Ethereum, BNB Chain and Tron sent their balances to newly created addresses within… https://onchainattack.org/document/examples/2026-09-bitget-wallet-backend-spoofed-transfer-data-hot-warm-drain/ https://onchainattack.org/document/examples/2026-09-bitget-wallet-backend-spoofed-transfer-data-hot-warm-drain/ Sun, 27 Sep 2026 12:00:00 GMT September 24, 2026 · loss $351.6M. Explicitly not OAK-T10.001-style key theft. Bitget's CEO states no private keys were stolen and no signers were bribed; the… https://onchainattack.org/document/examples/2026-09-neutron-governance-proposal-contract-admin-takeover-astroport-drop/ https://onchainattack.org/document/examples/2026-09-neutron-governance-proposal-contract-admin-takeover-astroport-drop/ Sun, 27 Sep 2026 12:00:00 GMT September 22, 2026 · loss $9.4M. Proposal-text-vs-payload divergence is load-bearing: proposal 9 was titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin… https://onchainattack.org/document/examples/2026-09-doingud-dormant-diamond-acceptbid-bid-reuse-drain/ https://onchainattack.org/document/examples/2026-09-doingud-dormant-diamond-acceptbid-bid-reuse-drain/ Sun, 27 Sep 2026 12:00:00 GMT September 21, 2026 · loss $35,486. DoinGud's Diamond bidding contract on Polygon, still funded after the platform went dormant, let an accepted bid be…