Private Key Compromise attacks in 2021

148 Vulcan Forged user wallets lost 4.5M PYR ($140M) after attackers compromised Venly custody holding their private keys. Refunded in full from treasury.

Attacker drained $77.7M across 78 ERC-20 tokens from AscendEX hot wallets on Ethereum, BSC and Polygon, tied to a third-party hardware-level vulnerability.

Single private-key compromise drained $196M from two Bitmart hot wallets on Ethereum and BNB Chain; CEO Sheldon Xia compensated users from reserves.

An admin private-key compromise let the attacker withdraw $139M of pooled DEX liquidity from BXH on BSC, one of 2021's largest yet under-remembered losses.

~$97M drained from Japan-based Liquid Global's warm wallets across ETH, XRP, BTC and stablecoins; FTX extended a $120M emergency loan, then acquired it.

~$1.5M drained from Levyathan Finance on Fantom after the team's deployer key was leaked (reportedly to a public repo), letting an attacker mint unlimited LEV.

Compromised deployer key let an attacker mint ~373M BONDLY (~$5.9M) and dump into liquidity, collapsing the token before the team migrated contracts.

Attackers compromised the CEO's machine, pulled keys from his MetaMask admin wallet, then minted EASY and drained $80M+ from liquidity pools on Polygon.

$5.7M drained from Roll's hot wallet, collapsing dozens of independent 'social money' creator tokens at once via a single private-key compromise.

PAID Network had $27M+ minted after a compromised deployer key re-minted ~59M PAID; the attacker dumped ~2.5M for $3M before the team paused. PAID fell ~85%.