Incidents by year
Crypto hacks and exploits in 2024
90 incidents in 2024.
December 2024 (5)
- Crypto hacks and exploits in December 2024
- @solana/web3.js npm supply-chain compromise — Solana — 2024-12-03 — 2024-12-03 · loss $190K · OAK-T11.002 Wallet-Software Distribution Compromise
- Organization-Targeted Phishing hack (Dec 2024): $500K — loss $500K · OAK-T15.005 Operator-Communication-Channel Takeover (Discord / X / Telegram)
- Pudgy Penguins Google-Ads NFT-drainer phishing campaign — multi-chain (Ethereum-NFT-centric) — 2024-12 — OAK-T12.002 Fake-Mint / Counterfeit Collection
- Movement Network ($MOVE) market-maker insider dump — Binance / Coinbase — 2024-12 — loss $38M · OAK-T1.004 Blacklist / Pausable Transfer Weaponization
- $HAWK / Hawk Tuah celebrity-memecoin sniper-distribution pump-and-dump — Solana — 2024-12 — loss $3.3M · OAK-T1.004 Blacklist / Pausable Transfer Weaponization
November 2024 (2)
- Crypto hacks and exploits in November 2024
- Thala Labs farming-contract Move-language flaw — Aptos — 2024-11-15 — 2024-11-15 · loss $25.5M · OAK-T9.004 Access-Control Misconfiguration
- MakerDAO / Sky brand-retention poll exploit (Nov 2024) — OAK-T16.004 Snapshot / Off-chain Voting Exploitation
October 2024 (5)
- Crypto hacks and exploits in October 2024
- $SHAR / Sharpei Solana memecoin funnel-collapse rug — Solana — 2024-10-23/24 — 2024-10-23 · loss $3.4M · OAK-T2.001 Single-Sided Liquidity Plant
- Tapioca DAO DSO logic flaw + key compromise — Arbitrum — 2024-10-18 — 2024-10-18 · loss $4.7M · OAK-T11.014 Operator Privileged-Key Compromise
- Radiant Capital cross-chain lending compromise — Arbitrum / BNB Chain — 2024-10-16 — 2024-10-16 · loss $50–58M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Operation Token Mirrors hack (Oct 2024): $25M — 2024-10-09 · loss $25M · OAK-T3.002 Wash-Trade Volume Inflation
- Inferno Drainer service ecosystem (Oct 2024) — OAK-T4.001 Permit2 Signature-Based Authority Misuse
September 2024 (9)
- Crypto hacks and exploits in September 2024
- Onyx Protocol empty-market rounding exploit — Ethereum — 2024-09-26 — 2024-09-26 · loss $3.8M · OAK-T7.001 Mixer-Routed Hop
- BingX hot-wallet drain (Sep 2024): $44–52M — 2024-09-20 · loss $44–52M · OAK-T11
- Banana Gun oracle-messenger information leak — Ethereum — 2024-09-19 — 2024-09-19 · loss $3M · OAK-T9.004 Access-Control Misconfiguration
- DeltaPrime admin-key compromise + malicious upgrade — Arbitrum + Avalanche — 2024-09-16/17 — 2024-09-16 · loss $5.98M · OAK-T11.014 Operator Privileged-Key Compromise
- Indodax hot-wallet drain (Sep 2024): $22M — 2024-09-11 · loss $22M · OAK-T11
- Penpie Finance reward-claim exploit (Sep 2024): $27M — 2024-09-03 · loss $27M · OAK-T7.001 Mixer-Routed Hop
- WalletConnect-impersonating Google Play mobile drainer — Android/multi-chain — 2024-03 to 2024-09 — loss $70,000 · OAK-T4.004 Allowance / Approve-Pattern Drainer
- Polymarket account takeover via third-party auth — Polygon — 2024-09 — OAK-T11.008 Embedded-Wallet Identity-Provider Compromise
- ENS DAO delegation-concentration governance dynamics — delegate voting-weight accumulation and proposal-outcome influence — Ethereum — 2023–2024 — OAK-T16.003 Delegation-Cluster Vote Takeover
August 2024 (6)
- Crypto hacks and exploits in August 2024
- Penpie Finance yield-optimizer reward-accounting exploit — Ethereum + Arbitrum — 2024-09-03 — 2024-09-03 · loss $27M · OAK-T9.001 Oracle Price Manipulation
- Genesis Creditor hack (Aug 2024): $243M — 2024-08-19 · loss $243M · OAK-T4.007 Native-app Social Phishing on Engagement-Weighted Platforms
- Ronin Bridge upgrade initialization failure — Ronin / Ethereum — 2024-08-06 — 2024-08-06 · loss $12M · OAK-T9.004 Access-Control Misconfiguration
- Nexera NXRA proxy-admin compromise (Aug 2024): $1.5M — 2024-08-06 · loss $1.5M · OAK-T11.014 Operator Privileged-Key Compromise
- ERC-4337 paymaster validation-bypass disclosure cohort — EVM — 2024 — OAK-T13.001 Paymaster Compromise
- DPRK IT Worker Crypto Team Infiltration hack (Aug 2024): $1.3M — loss $1.3M · OAK-T11.007 Hardware-wallet Supply-chain / Physical-access Compromise
July 2024 (7)
- Crypto hacks and exploits in July 2024
- Compound DAO Proposal 289 attempted governance takeover — Ethereum — 2024-07-28 — 2024-07-28 · loss $0 · OAK-T16.002 Hostile-Vote Treasury Drain
- $NEIRO Solana memecoin bundled-launch concentration rug — Solana — 2024-07-27 — 2024-07-27 · loss $4.5M · OAK-T2.001 Single-Sided Liquidity Plant
- WazirX hack (Jul 2024): $234.9M — 2024-07-18 · loss $234.9M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Li.Fi cross-chain aggregator facet exploit — multi-chain — 2024-07-16 — 2024-07-16 · loss $11.6M · OAK-T4.004 Allowance / Approve-Pattern Drainer
- Puffer pufETH LRT depeg (Jul 2024) — OAK-T14.004 Liquid Restaking Token Pricing Manipulation
- Gurvinder Bhangu hack (Jul 2024): $530K — loss $530K · OAK-T15.006 Impersonation via Verified Social-Account Compromise
- Compound cross-chain governance relay misconfiguration — Ethereum / multi-chain — 2023–2024 (audit-finding class) — loss $0 · OAK-T10.006 Cross-Chain Governance Relay Attack
June 2024 (12)
- Crypto hacks and exploits in June 2024
- Bittensor bittensor PyPI supply-chain coldkey-exfiltration compromise — Bittensor / TAO — 2024-07-02 — 2024-07-02 · loss $8M · OAK-T11.002 Wallet-Software Distribution Compromise
- CoinStats MetaMask-Snap-related compromise — Ethereum + multi-chain — 2024-06-22 — 2024-06-22 · loss $1M · OAK-T11.002 Wallet-Software Distribution Compromise
- BtcTurk hot-wallet drain (Jun 2024): $55M — 2024-06-22 · loss $55M · OAK-T11
- Holograph deployer-key compromise unlimited-mint-and-dump — Ethereum — 2024-06-13 — 2024-06-13 · loss $14.4M · OAK-T11.014 Operator Privileged-Key Compromise
- UwU Lend sUSDe oracle thin-input manipulation — Ethereum — 2024-06-10 — 2024-06-10 · loss $20M · OAK-T7.001 Mixer-Routed Hop
- Loopring Smart Wallet guardian-recovery exploit — Ethereum — 2024-06-09 — 2024-06-09 · loss $5M · OAK-T11.008 Embedded-Wallet Identity-Provider Compromise
- Velocore CPMM fee-rate underflow exploit (Jun 2024): $6.8M — 2024-06-02 · loss $6.8M · OAK-T7.001 Mixer-Routed Hop
- Polymarket Barron Trump / DJT memecoin oracle-override dispute — 2024 — OAK-T9.006.005 Platform-Override of Oracle Outcome
- OpenSea creator-royalty enforcement sunset — EVM NFT marketplaces — 2024-06 to 2025-01 — loss $0 · OAK-T13
- Mark Cuban (Jun 2024) — OAK-T8.005 Operational Security Procedural Failure (Non-Technical OpSec)
- Kelp rsETH liquid-restaking-token depeg (Jun 2024) — OAK-T14.003.001 LST/LRT Depeg-Cascade as Constrained-Primitive Sub-class
- ERC-4337 bundler MEV extraction on Polygon — specific operator-level bundler front-running incident — 2024-06 — loss $800K · OAK-T13.002 Bundler MEV
May 2024 (8)
- Crypto hacks and exploits in May 2024
- DMM Bitcoin exchange hack (May 2024): $305M — 2024-05-31 · loss $305M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Gala Games admin-key compromise emergency-recovery — Ethereum — 2024-05-20 — 2024-05-20 · loss $200M · OAK-T11.014 Operator Privileged-Key Compromise
- Sonne Finance empty-market rounding-error exploit — Optimism — 2024-05-14 — 2024-05-14 · loss $20M · OAK-T7.001 Mixer-Routed Hop
- Address Poisoning hack (May 2024): $68M — 2024-05-03 · loss $68M · OAK-T4.003 Address Poisoning
- Uniswap DAO delegation governance concentration — delegate voting-weight accumulation and community governance dynamics — Ethereum — 2023–2025 — OAK-T16.003 Delegation-Cluster Vote Takeover
- Ether.fi weETH liquid-restaking-token discount-to-NAV event — Ethereum L1 — 2024-05 — OAK-T14.003 Restaking Cascading Risk
- EigenLayer restaking airdrop dispute and AVS slashing-condition cohort — Ethereum L1 — 2024-05 onward — loss $1B · OAK-T14.001 Slashing-Condition Exploit
- Cypher Protocol Hoak insider theft from redemption fund — Solana — 2024-05 — loss $317K · OAK-T11
April 2024 (5)
- Crypto hacks and exploits in April 2024
- Pike Finance Wormhole-NTT cross-chain message-handling exploit — multi-chain — 2024-04-30 / 2024-05-05 — 2024-05-05 · loss $1.7M · OAK-T10.002 Message-Verification Bypass
- Renzo ezETH liquid-restaking-token depeg and looped-leverage liquidation cascade — Ethereum L1 + multi-chain — 2024-04-24 — 2024-04-24 · loss $56–60M · OAK-T14.003 Restaking Cascading Risk
- ZKasino gambling-platform bridge-exit hack (Apr 2024): $33M — 2024-04-20 · loss $33M · OAK-T11.005 Operator-side Fake-Platform Fraud
- Hedgey Finance claim-function input-validation exploit — multi-chain — 2024-04-19 — 2024-04-19 · loss $44.5M · OAK-T7.001 Mixer-Routed Hop
- Change Healthcare data-leak re-extortion hack (Apr 2024) — OAK-T5.008 Ransomware Extortion Payment
March 2024 (9)
- Crypto hacks and exploits in March 2024
- Prisma Finance MigrateTroveZap delegatecall exploit — Ethereum — 2024-03-28 — 2024-03-28 · loss $11.6M · OAK-T9.002 Flash-Loan-Enabled Exploit
- Munchables (Mar 2024): $62.5M — 2024-03-26 · loss $62.5M · OAK-T11
- Curio DAO governance attack (Mar 2024): $16M — 2024-03-23 · loss $16M · OAK-T16.001 Vote Takeover via Flash-Loan
- Arbitrum ARB team-and-investor vesting-cliff unlock and coordinated sell-pressure — Ethereum — 2024-03-16 — 2024-03-16 · loss $2.2B · OAK-T16
- WOOFi Pro sPMM curve flash-loan manipulation — Arbitrum — 2024-03-05 — 2024-03-05 · loss $8.5M · OAK-T7.001 Mixer-Routed Hop
- Kyle DeGods hack (Mar 2024) — OAK-T5.005 Treasury-Management Exit
- Jolan Lacroix (Mar 2024): $900K — loss $900K
- Coinbase Smart Wallet pre-launch audit disclosure (H-01 ownership-recovery loss-of-funds) — Base — 2024-03 — loss $0 · OAK-T11
- @blknoiz06 Impersonation (Mar 2024): $2.6M — loss $2.6M
February 2024 (8)
- Crypto hacks and exploits in February 2024
- Change Healthcare ransom payment hack (Mar 2024): $22M — 2024-03-05 · loss $22M · OAK-T5.008 Ransomware Extortion Payment
- BitForex hot-wallet drain (Feb 2024): $57M — 2024-02-23 · loss $57M · OAK-T11
- LockBit Operation Cronos disruption hack (Feb 2024) — 2024-02-20 · OAK-T5.008 Ransomware Extortion Payment
- FixedFloat instant-swap hot-wallet drain (Feb 2024): $26M — 2024-02-16 · loss $26M · OAK-T11
- Stader ETHx LST secondary-market discount to ETH NAV — DEX liquidity pool pricing divergence during LRT-season liquidity migration — Ethereum — 2024-02 — OAK-T14.003.001 LST/LRT Depeg-Cascade as Constrained-Primitive Sub-class
- PlayDapp $290M Private Key Compromise (Feb 2024): $290M — loss $290M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- MINER exploit (Feb 2024): $460,000–470,000 — loss $460,000–470,000 · OAK-T9.005 Reentrancy
- Blur points-farming wash-trading ring (Feb 2024) — OAK-T12.001 NFT Wash-Trade Volume Inflation
January 2024 (14)
- Crypto hacks and exploits in January 2024
- Ripple (Jan 2024): $112.5M — 2024-01-31 · loss $112.5M · OAK-T7.002 CEX Deposit-Address Layering
- Concentric Finance multisig signing-key social-engineering compromise — Arbitrum — 2024-01-22 — 2024-01-22 · loss $1.7M · OAK-T11.002 Wallet-Software Distribution Compromise
- Socket/Bungee bridge exploit (Jan 2024): $3.3M — 2024-01-16 · loss $3.3M · OAK-T9.004 Access-Control Misconfiguration
- U.S. SEC verified X-account compromise and fake Bitcoin ETF approval — chain-agnostic — 2024-01-09 — 2024-01-09 · OAK-T15.006 Impersonation via Verified Social-Account Compromise
- Orbit Bridge exploit (Jan 2024): $81.5M — 2024-01-01 · loss $81.5M · OAK-T10.001 Validator / Signer Key Compromise
- Post-Tornado-Cash DeFi yield-protocol laundering shift — cross-chain — 2024 onward — OAK-T7.001 Mixer-Routed Hop
- NFT marketplace royalty-enforcement sunset and creator-revenue bypass — multi-chain (Ethereum, Solana, Bitcoin ordinals) — 2024 — OAK-T12.003 Royalty Bypass / Marketplace Manipulation
- KK Park compound-operated investment-fraud takedown — Myanmar/Thailand border — 2024 — OAK-T11.005.003 Compound-Operated Investment-Fraud Platforms
- HyperVerse / HyperFund hack (Jan 2024): $1.7B — loss $1.7B · OAK-T11.005.002 Fake-Custodian / Fake-Asset-Manager Fraud
- Gamma Strategies $3.4M Flash Loan Price Manipulation — 2024-01 — loss $3.4M · OAK-T9.001 Oracle Price Manipulation
- DPRK-attributed multi-stage chain-hop laundering via privacy-chain conversions — cross-chain — 2024 — OAK-T7.001 Mixer-Routed Hop
- Blue-chip DeFi yield-protocol laundering via LST and lending-market cover — Ethereum — 2024 — OAK-T7.001 Mixer-Routed Hop
- Email Impersonation Phishing Wave (Jan 2024): $580K — loss $580K
- CoinsPaid $37M Lazarus Group Attack (Jan 2024): $37M — loss $37M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise