Arbitrum hacks in 2026

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

Attackers social-engineered an AFX Trade developer, seized 5 of 7 bridge validator keys, and drained $24.15M in USDC from the Arbitrum perp DEX.

An attacker drained about $1.34 million in USDC from the CLS liquidity vault of Cascade, a pre-launch Polychain-backed perpetuals protocol on Arbitrum, hitting locked pre-deposit user funds.

An attacker seized Ostium's price-feed infrastructure and fed future-dated oracle prices to open and close trades at will, draining a confirmed $23.75 million from the OLP vault on Arbitrum.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A confused-deputy access-control flaw in New Market Trading's third-party SquidRouterModule let an attacker drain roughly $3.8 million from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.

1B bridged DOT minted on Hyperbridge after a missing bounds check in VerifyProof let an attacker forge MMR proofs; realised loss ~$2.5M.