BNB Chain hacks in 2026

An attacker abused Cysic's bridge to mint 10 million unbacked CYS on BNB Chain, dumping most of it for about $727,000 in ETH before the token could be blacklisted.

An accounting flaw in UNCX Network's shared Vesting V2 contracts let an attacker and copycats drain roughly $1.49 million in locked tokens across four chains.

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

An estimated $86 million was drained from Ledger users who bought devices from reseller CryptoBilis, in a suspected supply-chain attack that captured their seed phrases.

An attacker abused a bug in NEAR Intents' Omni cross-chain deposit and withdrawal system to drain roughly $3.8 million in USDT from a BNB Chain hot wallet.

Attackers drained about $7 million from crypto casino Duelbits's hot wallets across five chains in a suspected private-key compromise, forcing the platform offline.

An attacker abused a block-validation flaw in Meter to mint unbacked wrapped MTRG through the Meter Passport bridge, dumping about $2.3 million of it on PancakeSwap and crashing both MTR and MTRG.

An attacker exploited Symbiosis's BridgeV2 contract to mint about 46.1 billion unbacked synthetic Bitcoin tokens and cash out a slice for roughly $0.77 million.

An attacker seized the upgrade authority of B² Network's staking contract on BNB Chain and drained 8.591M B2 tokens (~$3.86M), swapping them into ~1,128 ETH.

A deflationary-burn flaw in the OLPC token created a reserve mismatch on a PancakeSwap V2 pool, letting an attacker buy out LABUBU at a distorted price and drain about $1.1M.

A zero-value transferFrom bypassed an allowance check and triggered an unauthorized reward mint into the PancakeSwap pair, letting an attacker drain about $378,000 from Little Boy Plus.

A missing return statement in the DIP token's _transfer function let an attacker desync its PancakeSwap reserves with skim/sync and drain roughly $111,000 in USDC.

A compromised Humanity Foundation key let an attacker drain wallets and mint 100M H tokens on BNB Chain, netting about $32M and crashing $H nearly 90%.

An attacker with control of privileged minting rights created 99 million TSR tokens on BNB Chain and dumped them for roughly $2.5 million, crashing the token nearly 99%.

An attacker submitted forged guardian VAAs to Alephium's Wormhole-fork TokenBridge, draining about $815,000 of custody assets from Ethereum and BNB Chain in roughly seven minutes.

An attacker controlling a legacy DxSale liquidity-locker contract on BNB Chain drained roughly $7.3 million of BNB from more than 1,400 locked pools, amid strong suspicions of insider involvement.

~$10.8M drained from THORChain Asgard vaults across nine chains via a suspected GG20 threshold-signature flaw exploited by a malicious node operator.

1B bridged DOT minted on Hyperbridge after a missing bounds check in VerifyProof let an attacker forge MMR proofs; realised loss ~$2.5M.

A Venus Protocol user was phished into delegating account control, losing ~$3.7M from their supplied position. Venus contracts were never compromised.

TMXTribe, a staking/rewards protocol, lost ~$1.4M when a distribution accounting flaw let an attacker repeatedly over-claim, draining the reward reserve.