Incidents by year
Crypto hacks and exploits in 2020
23 incidents in 2020.
December 2020 (4)
- Crypto hacks and exploits in December 2020
- Cover Protocol Blacksmith infinite-mint exploit — Ethereum — 2020-12-28 — 2020-12-28 · loss $4M · OAK-T5.003 Hidden-Mint Dilution
- Livecoin exchange infrastructure seizure and rate manipulation — multi-asset (CEX) — 2020-12-23 — 2020-12-23 · loss $3.3M · OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- Warp Finance flash-loan oracle exploit (Dec 2020): $7.8M — 2020-12-17 · loss $7.8M · OAK-T9.001 Oracle Price Manipulation
- Compounder Finance strategy-swap LP drain — Ethereum — 2020-11-30 to 2020-12-02 — 2020-12-02 · loss $10.8–12.5M · OAK-T1.001 Modifiable Tax Function
November 2020 (4)
- Crypto hacks and exploits in November 2020
- Pickle Finance "Evil Jar" exploit (Nov 2020): $19.76M — 2020-11-21 · loss $19.76M · OAK-T5.001 Hard LP Drain
- Origin Dollar (OUSD) flash-loan-funded reentrancy — Ethereum — 2020-11-17 — 2020-11-17 · loss $7M · OAK-T7.001 Mixer-Routed Hop
- Akropolis Delphi flash-loan-funded reentrancy — Ethereum — 2020-11-12 — 2020-11-12 · loss $2M · OAK-T9.002 Flash-Loan-Enabled Exploit
- Cred Inc. custodial-fraud / counterparty-risk insolvency — multi-chain (custodial) — 2020-11-07 — 2020-11-07 · loss $140M · OAK-T11.010 Off-chain Counterparty-Risk Insolvency
October 2020 (2)
- Crypto hacks and exploits in October 2020
- Harvest Finance flash-loan-funded oracle manipulation — Ethereum — 2020-10-26 — 2020-10-26 · loss $24M · OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
- UniCats yield-farm approval backdoor exploit (Oct 2020): $140,000–200,000 — 2020-10-05 · loss $140,000–200,000 · OAK-T1.003 Renounced-But-Not-Really (Proxy-Upgrade Backdoor)
September 2020 (4)
- Crypto hacks and exploits in September 2020
- Eminence DeFi flash-loan exploit (Sep 2020): $15M — 2020-09-29 · loss $15M · OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
- KuCoin exchange hot-wallet theft (Sep 2020): $281M — 2020-09-25 · loss $281M · OAK-T15.001 Social Engineering of Operator Personnel
- SushiSwap dev-fund T5.005 + vampire-attack launch — Ethereum — 2020-08-26 to 2020-09-11 — 2020-09-11 · loss $14M · OAK-T1.004 Blacklist / Pausable Transfer Weaponization
- Yfdexf.Finance liquidity-mining exit scam — Ethereum — 2020-09-08 to 2020-09-09 — 2020-09-09 · loss $20M · OAK-T1.003 Renounced-But-Not-Really (Proxy-Upgrade Backdoor)
August 2020 (1)
- Crypto hacks and exploits in August 2020
- Yam Finance rebase-bug governance lockup exploit (Aug 2020): $750K — 2020-08-13 · loss $750K · OAK-T16.001 Vote Takeover via Flash-Loan
July 2020 (3)
- Crypto hacks and exploits in July 2020
- Twitter internal-tool compromise and Bitcoin scam campaign — 2020-07-15 — 2020-07-15 · loss $118,000 · OAK-T15.001 Social Engineering of Operator Personnel
- Ledger customer-data breach and follow-on phishing campaign — e-commerce / multi-chain — 2020-06 (disclosed 2020-07, dumped 2020-12) — OAK-T15.004 Operator-Side Credential Compromise (SSO / Cloud / Registrar / DNS / Package Registry)
- Evil Corp WastedLocker ransomware hack (Jul 2020): $10M — loss $10M · OAK-T5.008 Ransomware Extortion Payment
June 2020 (1)
- Crypto hacks and exploits in June 2020
- Bancor v0.6 BancorNetwork exposed-approval vulnerability — Ethereum — 2020-06-18 — 2020-06-18 · loss $455K · OAK-T16.006 Timelock-Free Governance Execution
April 2020 (1)
- Crypto hacks and exploits in April 2020
- Lendf.me reentrancy via ERC-777 callback chain — Ethereum — 2020-04-19 — 2020-04-19 · loss $25M · OAK-T1.007 Token-2022 Transfer-Hook Abuse
March 2020 (1)
- Crypto hacks and exploits in March 2020
- MakerDAO Black Thursday liquidation-cascade zero-bid auctions — Ethereum — 2020-03-12 — 2020-03-12 · OAK-T17.002 Liquidation-Cascade Engineering
February 2020 (1)
- Crypto hacks and exploits in February 2020
- bZx Protocol flash-loan-funded exploits (Feb 2020): $350K — 2020-02-18 · loss $350K · OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
January 2020 (1)
- Crypto hacks and exploits in January 2020
- Trezor One / Model T RDP-downgrade voltage-glitch seed extraction (Kraken Security Labs disclosure) — hardware wallets — 2020-01-31 — 2020-01-31 · loss $0 · OAK-T11.007 Hardware-wallet Supply-chain / Physical-access Compromise