2026The year in breaches

An attacker emptied 1,404 Qubic wallets created with predictable seeds, taking about 2.94 trillion QU worth roughly $1.4 million before validators halted the chain.

An attacker abused Cysic's bridge to mint 10 million unbacked CYS on BNB Chain, dumping most of it for about $727,000 in ETH before the token could be blacklisted.

A validation flaw in Pirate Chain's Ironwood upgrade let an attacker mint roughly 39.8 million ARRR — about 20% of supply — and hide it in the shielded pool.

An accounting flaw in UNCX Network's shared Vesting V2 contracts let an attacker and copycats drain roughly $1.49 million in locked tokens across four chains.

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

An attacker minted 19 million unbacked THEO on Base through Autheo's Hyperlane cross-chain route and swapped them for about 700 ETH, crashing the token roughly 92%.

A trader moved Hyperliquid's ETH reference price while holding leveraged Papertrade positions, netting about $1.28 million from the platform's shared USDC pool on launch day.

An estimated $86 million was drained from Ledger users who bought devices from reseller CryptoBilis, in a suspected supply-chain attack that captured their seed phrases.

A dormant MakerDAO ETH-A liquidation keeper lost 200 WETH (about $538,000) when an attacker exploited an unprotected withdrawal function to drain collateral stranded since Black Thursday 2020.

An attacker whitelisted a fresh contract on an unidentified Base vault and borrowed against its Aave V3 position to drain about 1,783 wstETH, roughly $6 million.

A shared-unlock accounting flaw in GoldPesa's Uniswap v4 hook let an attacker net a phantom USDC debt against the protocol's rebalancing withdrawal and drain about $114,900 on Base.

A caller-authentication flaw in FlashLoopAdapter, a third-party Safe module that manages Aave v3 leveraged loops, let an attacker forge a Safe and drain roughly $305,000 from two Ethereum wallets.

An attacker abused a bug in NEAR Intents' Omni cross-chain deposit and withdrawal system to drain roughly $3.8 million in USDT from a BNB Chain hot wallet.

Scammers spun up a counterfeit GIWA Layer-2 network with the real chain ID, tricked a DEX into listing it as the mainnet, and drained about $2 million in ETH from 1,335 wallets through a fake bridge.

Attackers compromised Bitget's wallet backend to spoof withdrawals and drain roughly $387.5 million across eight blockchains, in 2026's largest crypto theft.

Attackers drained about $7 million from crypto casino Duelbits's hot wallets across five chains in a suspected private-key compromise, forcing the platform offline.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

An attacker exploited Payy Network's Ethereum rollup contract with a malicious verifyRollup transaction, draining roughly $1.83 million in USDC and forcing the payments platform offline.

An attacker abused a block-validation flaw in Meter to mint unbacked wrapped MTRG through the Meter Passport bridge, dumping about $2.3 million of it on PancakeSwap and crashing both MTR and MTRG.

An attacker bought cheap voting power to pass a malicious Neutron governance proposal, seizing admin rights over ten Astroport and Drop contracts and draining about $9.4 million in 24 minutes.

A compromised bridge signing key let an attacker drain FET and mint AGIX, NTX and WMTx across the ASI Alliance's Ethereum token-conversion contracts, amassing roughly $16.77 million in tokens.

An attacker wash-traded NSTR through a fake pool to pump its price roughly 8,000x, then borrowed about $3.5 million against the inflated collateral on Nostra's Starknet money market.

Attackers used compromised recovery phrases to sweep roughly 11.7 million XRP — about $18 million — from over 6,600 D'CENT App Wallet accounts across five chains.

An attacker abused Chainflip's Tron settlement path, appending a memo to an already-signed deposit to trigger duplicate payouts and drain 736,442 USDT.

An attacker exploited Symbiosis's BridgeV2 contract to mint about 46.1 billion unbacked synthetic Bitcoin tokens and cash out a slice for roughly $0.77 million.

An attacker abused a double-spend flaw in Nomic's Bitcoin bridge to mint about 39.84 unbacked nBTC, leaving roughly 36% of Osmosis's alloyed Bitcoin without reserves.

An attacker exploited a range-proof caching bug in Liquid's Elements software to mint about 4,000 unbacked L-BTC and peg them out for roughly $319 million in real bitcoin.

An attacker abused a permissionless asset-registration function and a Balancer flash loan to double-count collateral in Reddio's RedSonic Vault, draining 9.25 ETH (about $23,000) on Ethereum.

An attacker exploited an unchecked integer-overflow cast in Notional Finance's deprecated V1 Escrow contract to bypass collateral checks and drain about $1.7 million in USDC and DAI on Ethereum.

A flaw in XRP Healthcare's XRPH Wallet app exposed users' seed phrases, letting an attacker drain 4,011 wallets of roughly 267,664 XRP and XRPH tokens worth about $452,000 on the XRP Ledger.

An attacker abused Injective's permissionless binary-options markets and a market-ID collision in settlement logic to drain about $4.9 million before the chain halted.

An attacker inflated Tectonic's TONIC token 100x to borrow ~$74M from the Cronos lending protocol, but a chain rollback limited the permanent loss to ~$6M.

An attacker inflated the price of the illiquid MAMO token to borrow real assets from Moonwell's lending markets on Base, draining about $8.7 million.

An attacker spent about $951 to buy a controlling share of Term Labs' thinly traded governance token, then voted through proposals that drained roughly $8.5 million from its vaults.

An attacker fed Allbridge's Base router a forged Circle CCTP message and padded it with an Aave flash loan to drain about $190,000 in USDC that a real deposit had just credited.

An attacker chained six bugs in MAYAChain's trade-account and outbound logic to fabricate a CACAO subsidy and drain about $1.7 million in Bitcoin and other assets from Maya Protocol.

An attacker exploited a flaw in Harmony's block-production logic to mint roughly 4 billion unauthorized ONE tokens, worth about $3.2 million, and dumped most of them onto exchanges.

An anonymous crypto whale lost about $25.6 million to a phishing drain on Ethereum — the same wallet that had already been phished for roughly $24 million in 2023.

Attackers drained roughly $7.9M in USDT and ETH from crypto payment processor Coinsbuy across Tron and Ethereum in a coordinated hot-wallet key compromise.

A 2021 Coldcard firmware build flag disabled the hardware RNG, weakening wallet seeds enough to brute-force offline. Attackers drained ~1,816 BTC (~$116M) from 5,200+ addresses.

Just over two months after a May hack, the Verus-Ethereum bridge was drained again for ~$7.54M through the same unpatched import-verification path.

Attackers social-engineered an AFX Trade developer, seized 5 of 7 bridge validator keys, and drained $24.15M in USDC from the Arbitrum perp DEX.

An attacker seized the upgrade authority of B² Network's staking contract on BNB Chain and drained 8.591M B2 tokens (~$3.86M), swapping them into ~1,128 ETH.

A flash-loan attack skewed Allbridge Core's stablecoin pool ratio on Solana, letting the attacker withdraw liquidity at manipulated rates for about $1.65 million.

Cross-chain bridge Across Protocol was attacked on its Solana deployment; the team said user funds were safe with only Risk Labs operating funds potentially hit and no loss disclosed.

An attacker drained about $1.34 million in USDC from the CLS liquidity vault of Cascade, a pre-launch Polychain-backed perpetuals protocol on Arbitrum, hitting locked pre-deposit user funds.

An attacker drained about $580,000 in USDC from DeFiTuna's lending pools on Solana by abusing the protocol's lending logic, leaving the USDC pool in deficit.

An attacker seized Ostium's price-feed infrastructure and fed future-dated oracle prices to open and close trades at will, draining a confirmed $23.75 million from the OLP vault on Arbitrum.

An attacker exploited a signature-verification flaw in a third-party Supra oracle to manipulate the SAUCE price and drain about $9 million from Bonzo Lend, Hedera's largest lending protocol.

Coinspect disclosed 'Ill Bloom,' a weak-randomness flaw in some wallets' seed-phrase generation that let attackers brute-force keys and drain over $5 million.

An attacker spent about $4M quietly buying BONK to capture BonkDAO's vote, then pushed a malicious Realms proposal that drained roughly $20M from the treasury.

A flash-loan attacker manipulated share accounting in Summer.fi's Lazy Summer USDC vault, redeeming inflated assets to drain about $6 million on Ethereum.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A flash-loan-funded attacker inflated Edel Finance's internal wGOOGLx exchange rate ~78x, borrowing against phantom tokenized-Google-stock collateral to leave about $403,000 in bad debt.

A compromised third-party vendor injected a malicious script into Polymarket's frontend, phishing approvals that drained about $2.94M in PUSD from user wallets.

A predictable-randomness flaw in SecondFi's Cardano wallet-generation software let attackers drain about $2.4M in ADA from 178 wallets, with up to $20M more potentially at risk.

A leaked SGX signing key in Taiko's public GitHub let an attacker forge bridge proofs and drain about $1.7M from the L1 Bridge and ERC20Vault on Ethereum.

A deflationary-burn flaw in the OLPC token created a reserve mismatch on a PancakeSwap V2 pool, letting an attacker buy out LABUBU at a distorted price and drain about $1.1M.

A counter-MEV honeypot tricked Ethereum's most active sandwich bot, jaredfromsubway.eth, into approving 66 fake-token contracts, draining about $7.5M in WETH, USDC and USDT.

An attacker minted a worthless EVIL token to distort mySwap's concentrated-liquidity pool accounting on Starknet and drained about $305K of residual LP funds.

An IBC transfer-logic flaw let an attacker sweep roughly $600,000 of shielded assets from Namada's Multi-Asset Shielded Pool, briefly masked by a stale indexer.

A zero-value transferFrom bypassed an allowance check and triggered an unauthorized reward mint into the PancakeSwap pair, letting an attacker drain about $378,000 from Little Boy Plus.

An attacker drained roughly $2.16M from Aztec's deprecated Private Rollup Bridge via an unguarded escapeHatch and spoofed proof data — Aztec's second hack in a week.

A missing return statement in the DIP token's _transfer function let an attacker desync its PancakeSwap reserves with skim/sync and drain roughly $111,000 in USDC.

An integer-division rounding bug in a long-deprecated Thetanuts Finance vault let an attacker mint option tokens for free and drain about $2.1M on Ethereum; white-hats clawed back roughly $2M.

An attacker drained roughly $2.1M from the deprecated Aztec Connect bridge by exploiting incomplete proof validation, withdrawing unbacked balances from immutable contracts.

An attacker drained roughly $1.34M from five dormant Raydium AMM V3 pools on Solana by minting a fake LP token that bypassed the deprecated program's withdrawal checks.

A flawed Secret Network bridge contract let an attacker forge IBC packets and mint unbacked saTokens, draining roughly $4.67M of Axelar-bridged assets.

A compromised Humanity Foundation key let an attacker drain wallets and mint 100M H tokens on BNB Chain, netting about $32M and crashing $H nearly 90%.

An attacker acquired a majority of TOP supply, then created, voted and executed an Aragon governance proposal in one transaction to mint ~10 billion tokens and drain 944 WETH from a Balancer V1 pool.

A proof-validation flaw in Syscoin's cross-chain bridge let an attacker mint roughly 5 billion unauthorized SYS — over five times the supply — worth just under $10M.

A signature-verification flaw in the Zodiac Delay Module let an attacker bypass Gnosis Pay's time-delay and drain roughly $1.5 million from 5,281 user Safes; Gnosis restored 100% of funds.

An attacker with control of privileged minting rights created 99 million TSR tokens on BNB Chain and dumped them for roughly $2.5 million, crashing the token nearly 99%.

An attacker drained roughly $480K from AFI Protocol's afiUSD vault on Ethereum, swapping DAI to ETH and routing about 150 ETH through Tornado Cash; the root cause was not immediately disclosed.

An attacker submitted forged guardian VAAs to Alephium's Wormhole-fork TokenBridge, draining about $815,000 of custody assets from Ethereum and BNB Chain in roughly seven minutes.

Gravity Bridge, the Cosmos-Ethereum cross-chain bridge, was drained of roughly $5.4 million after attackers apparently compromised validator signing keys and forged unauthorized withdrawals.

An attacker controlling a legacy DxSale liquidity-locker contract on BNB Chain drained roughly $7.3 million of BNB from more than 1,400 locked pools, amid strong suspicions of insider involvement.

A confused-deputy access-control flaw in New Market Trading's third-party SquidRouterModule let an attacker drain roughly $3.8 million from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.

An attacker minted 1,000 unbacked eBTC (~$76.7M nominal) on Echo Protocol via an admin-key compromise, used it as Curvance collateral, and extracted ~$821K through Tornado Cash before containment.

Verus-Ethereum bridge paid out $11.58M after an attacker submitted a 0.02 VRSC export — no source/destination value-binding check on either side.

~$10.8M drained from THORChain Asgard vaults across nine chains via a suspected GG20 threshold-signature flaw exploited by a malicious node operator.

Cross-chain aggregator Transit Finance lost ~$1.88M in DAI on May 13, 2026 — a second multi-million-dollar incident after its October 2022 proxy-approval breach.

Wasabi Protocol's perp vaults across Ethereum, Base, Berachain and Blast lost $5M when a compromised deployer EOA with sole ADMIN_ROLE allowed UUPS upgrades.

Volo Protocol's Sui vaults lost $3.5M after social engineering compromised the admin key. The team froze $500K in 30 minutes and blocked a $2.1M WBTC bridge.

$292M unbacked rsETH minted after attackers exploited KelpDAO's 1-of-1 LayerZero DVN setup; the largest DeFi hack of 2026, with TVL falling $13B after.

Rhea Finance on NEAR lost $18.4M after a two-day setup of fake tokens, 423 wallets and 8 Ref pools exploited a slippage-summing flaw in margin trading.

1B bridged DOT minted on Hyperbridge after a missing bounds check in VerifyProof let an attacker forge MMR proofs; realised loss ~$2.5M.

DPRK social-engineers tricked Drift Security Council members into blind-signing durable-nonce txs that handed over admin control, draining $285M on Solana.

Resolv Labs lost $25M after attackers compromised its AWS KMS keys; a $100K USDC deposit minted 50M USR and depegged the stablecoin 74% in 17 minutes.

Solv Protocol's BRO vault lost $2.73M when an ERC-3525 double-mint bug let the attacker turn 135 BRO into ~567M BRO over 22 deposits, then swap for 38 SolvBTC.

A Venus Protocol user was phished into delegating account control, losing ~$3.7M from their supplied position. Venus contracts were never compromised.

$4.3M drained from IoTeX's ioTube bridge via a validator key compromise; attacker also minted 111M CIOTX and 9.3M CCS. IoTeX pledged full user compensation.

~$1.78M drained from Moonwell on Base after a newly listed market used a price feed with a decimals mismatch, mis-valuing collateral so attackers borrowed out.

YieldBlox's Stellar lending pool lost $10.2M after a single USTRY-for-USDC sell at 501x market rate defined the Reflector oracle price in a quiet 15-min window.

Step Finance lost 261,854 SOL ($27M) from treasury and fee wallets to a 'sophisticated' actor. STEP fell 96%; Step, SolanaFloor and Remora all shut down.

$4.13M extracted from Makina's DUSD/USDC Curve pool via flash-loan oracle manipulation against MachineShareOracle; white-hat talks recovered 89% in a week.

SagaEVM lost $7M in 11 minutes when an Ethermint bug let crafted messages bypass validation, minting Saga Dollar (D) without collateral and bridging to ETH.

TMXTribe, a staking/rewards protocol, lost ~$1.4M when a distribution accounting flaw let an attacker repeatedly over-claim, draining the reward reserve.

Truebit lost $26.4M when an integer overflow in TRU's five-year-old bonding-curve contract let the attacker mint TRU near-free and sell back for 8,500 ETH.