Other attacks in 2026

An attacker gamed an accounting bug in Arcus's subaccount transfers to inflate a balance and withdraw 2,234,391 USDG it never deposited from the Robinhood Chain perps exchange.

A flaw in all pre-1.7.0 versions of the self-hosted LNbits Lightning wallet software let attackers drain Bitcoin from independent installations.

Attackers abused a pre-2.4.2 vulnerability to gain admin access to outdated self-hosted BTCPay Server instances and swept roughly $1.6M in BTC and LTC from merchant hot wallets.

A stale, unrevoked token approval let an attacker drain ~$7.45M from a 2-of-7 Safe multisig on Avalanche, but a MEV bot front-ran the theft and returned most funds.

A remote code execution flaw in a third-party module let an attacker drain roughly $947,000 in SOL from 49 wallets belonging to nine users of the Bloom Trading Telegram bot.

A validation flaw in Pirate Chain's Ironwood upgrade let an attacker mint roughly 39.8 million ARRR — about 20% of supply — and hide it in the shielded pool.

An attacker chained six bugs in MAYAChain's trade-account and outbound logic to fabricate a CACAO subsidy and drain about $1.7 million in Bitcoin and other assets from Maya Protocol.

An attacker exploited a flaw in Harmony's block-production logic to mint roughly 4 billion unauthorized ONE tokens, worth about $3.2 million, and dumped most of them onto exchanges.

A counter-MEV honeypot tricked Ethereum's most active sandwich bot, jaredfromsubway.eth, into approving 66 fake-token contracts, draining about $7.5M in WETH, USDC and USDT.

An attacker drained roughly $480K from AFI Protocol's afiUSD vault on Ethereum, swapping DAI to ETH and routing about 150 ETH through Tornado Cash; the root cause was not immediately disclosed.