Ethereum hacks in 2026

An attacker abused Cysic's bridge to mint 10 million unbacked CYS on BNB Chain, dumping most of it for about $727,000 in ETH before the token could be blacklisted.

An accounting flaw in UNCX Network's shared Vesting V2 contracts let an attacker and copycats drain roughly $1.49 million in locked tokens across four chains.

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

An attacker minted 19 million unbacked THEO on Base through Autheo's Hyperlane cross-chain route and swapped them for about 700 ETH, crashing the token roughly 92%.

An estimated $86 million was drained from Ledger users who bought devices from reseller CryptoBilis, in a suspected supply-chain attack that captured their seed phrases.

A dormant MakerDAO ETH-A liquidation keeper lost 200 WETH (about $538,000) when an attacker exploited an unprotected withdrawal function to drain collateral stranded since Black Thursday 2020.

A caller-authentication flaw in FlashLoopAdapter, a third-party Safe module that manages Aave v3 leveraged loops, let an attacker forge a Safe and drain roughly $305,000 from two Ethereum wallets.

Scammers spun up a counterfeit GIWA Layer-2 network with the real chain ID, tricked a DEX into listing it as the mainnet, and drained about $2 million in ETH from 1,335 wallets through a fake bridge.

Attackers compromised Bitget's wallet backend to spoof withdrawals and drain roughly $387.5 million across eight blockchains, in 2026's largest crypto theft.

Attackers drained about $7 million from crypto casino Duelbits's hot wallets across five chains in a suspected private-key compromise, forcing the platform offline.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

An attacker exploited Payy Network's Ethereum rollup contract with a malicious verifyRollup transaction, draining roughly $1.83 million in USDC and forcing the payments platform offline.

A compromised bridge signing key let an attacker drain FET and mint AGIX, NTX and WMTx across the ASI Alliance's Ethereum token-conversion contracts, amassing roughly $16.77 million in tokens.

Attackers used compromised recovery phrases to sweep roughly 11.7 million XRP — about $18 million — from over 6,600 D'CENT App Wallet accounts across five chains.

An attacker exploited Symbiosis's BridgeV2 contract to mint about 46.1 billion unbacked synthetic Bitcoin tokens and cash out a slice for roughly $0.77 million.

An attacker abused a permissionless asset-registration function and a Balancer flash loan to double-count collateral in Reddio's RedSonic Vault, draining 9.25 ETH (about $23,000) on Ethereum.

An attacker exploited an unchecked integer-overflow cast in Notional Finance's deprecated V1 Escrow contract to bypass collateral checks and drain about $1.7 million in USDC and DAI on Ethereum.

A flaw in XRP Healthcare's XRPH Wallet app exposed users' seed phrases, letting an attacker drain 4,011 wallets of roughly 267,664 XRP and XRPH tokens worth about $452,000 on the XRP Ledger.

An attacker abused Injective's permissionless binary-options markets and a market-ID collision in settlement logic to drain about $4.9 million before the chain halted.

An attacker inflated Tectonic's TONIC token 100x to borrow ~$74M from the Cronos lending protocol, but a chain rollback limited the permanent loss to ~$6M.

An attacker spent about $951 to buy a controlling share of Term Labs' thinly traded governance token, then voted through proposals that drained roughly $8.5 million from its vaults.

An attacker chained six bugs in MAYAChain's trade-account and outbound logic to fabricate a CACAO subsidy and drain about $1.7 million in Bitcoin and other assets from Maya Protocol.

An anonymous crypto whale lost about $25.6 million to a phishing drain on Ethereum — the same wallet that had already been phished for roughly $24 million in 2023.

Attackers drained roughly $7.9M in USDT and ETH from crypto payment processor Coinsbuy across Tron and Ethereum in a coordinated hot-wallet key compromise.

Just over two months after a May hack, the Verus-Ethereum bridge was drained again for ~$7.54M through the same unpatched import-verification path.

Attackers social-engineered an AFX Trade developer, seized 5 of 7 bridge validator keys, and drained $24.15M in USDC from the Arbitrum perp DEX.

A flash-loan attack skewed Allbridge Core's stablecoin pool ratio on Solana, letting the attacker withdraw liquidity at manipulated rates for about $1.65 million.

An attacker exploited a signature-verification flaw in a third-party Supra oracle to manipulate the SAUCE price and drain about $9 million from Bonzo Lend, Hedera's largest lending protocol.

Coinspect disclosed 'Ill Bloom,' a weak-randomness flaw in some wallets' seed-phrase generation that let attackers brute-force keys and drain over $5 million.

A flash-loan attacker manipulated share accounting in Summer.fi's Lazy Summer USDC vault, redeeming inflated assets to drain about $6 million on Ethereum.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A flash-loan-funded attacker inflated Edel Finance's internal wGOOGLx exchange rate ~78x, borrowing against phantom tokenized-Google-stock collateral to leave about $403,000 in bad debt.

A compromised third-party vendor injected a malicious script into Polymarket's frontend, phishing approvals that drained about $2.94M in PUSD from user wallets.

A leaked SGX signing key in Taiko's public GitHub let an attacker forge bridge proofs and drain about $1.7M from the L1 Bridge and ERC20Vault on Ethereum.

A counter-MEV honeypot tricked Ethereum's most active sandwich bot, jaredfromsubway.eth, into approving 66 fake-token contracts, draining about $7.5M in WETH, USDC and USDT.

An attacker drained roughly $2.16M from Aztec's deprecated Private Rollup Bridge via an unguarded escapeHatch and spoofed proof data — Aztec's second hack in a week.

An integer-division rounding bug in a long-deprecated Thetanuts Finance vault let an attacker mint option tokens for free and drain about $2.1M on Ethereum; white-hats clawed back roughly $2M.

An attacker drained roughly $2.1M from the deprecated Aztec Connect bridge by exploiting incomplete proof validation, withdrawing unbacked balances from immutable contracts.

A flawed Secret Network bridge contract let an attacker forge IBC packets and mint unbacked saTokens, draining roughly $4.67M of Axelar-bridged assets.

A compromised Humanity Foundation key let an attacker drain wallets and mint 100M H tokens on BNB Chain, netting about $32M and crashing $H nearly 90%.

An attacker acquired a majority of TOP supply, then created, voted and executed an Aragon governance proposal in one transaction to mint ~10 billion tokens and drain 944 WETH from a Balancer V1 pool.

An attacker drained roughly $480K from AFI Protocol's afiUSD vault on Ethereum, swapping DAI to ETH and routing about 150 ETH through Tornado Cash; the root cause was not immediately disclosed.

An attacker submitted forged guardian VAAs to Alephium's Wormhole-fork TokenBridge, draining about $815,000 of custody assets from Ethereum and BNB Chain in roughly seven minutes.

Gravity Bridge, the Cosmos-Ethereum cross-chain bridge, was drained of roughly $5.4 million after attackers apparently compromised validator signing keys and forged unauthorized withdrawals.

A confused-deputy access-control flaw in New Market Trading's third-party SquidRouterModule let an attacker drain roughly $3.8 million from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.

An attacker minted 1,000 unbacked eBTC (~$76.7M nominal) on Echo Protocol via an admin-key compromise, used it as Curvance collateral, and extracted ~$821K through Tornado Cash before containment.

Verus-Ethereum bridge paid out $11.58M after an attacker submitted a 0.02 VRSC export — no source/destination value-binding check on either side.

~$10.8M drained from THORChain Asgard vaults across nine chains via a suspected GG20 threshold-signature flaw exploited by a malicious node operator.

Cross-chain aggregator Transit Finance lost ~$1.88M in DAI on May 13, 2026 — a second multi-million-dollar incident after its October 2022 proxy-approval breach.

Wasabi Protocol's perp vaults across Ethereum, Base, Berachain and Blast lost $5M when a compromised deployer EOA with sole ADMIN_ROLE allowed UUPS upgrades.

$292M unbacked rsETH minted after attackers exploited KelpDAO's 1-of-1 LayerZero DVN setup; the largest DeFi hack of 2026, with TVL falling $13B after.

1B bridged DOT minted on Hyperbridge after a missing bounds check in VerifyProof let an attacker forge MMR proofs; realised loss ~$2.5M.

Resolv Labs lost $25M after attackers compromised its AWS KMS keys; a $100K USDC deposit minted 50M USR and depegged the stablecoin 74% in 17 minutes.

Solv Protocol's BRO vault lost $2.73M when an ERC-3525 double-mint bug let the attacker turn 135 BRO into ~567M BRO over 22 deposits, then swap for 38 SolvBTC.

$4.3M drained from IoTeX's ioTube bridge via a validator key compromise; attacker also minted 111M CIOTX and 9.3M CCS. IoTeX pledged full user compensation.

$4.13M extracted from Makina's DUSD/USDC Curve pool via flash-loan oracle manipulation against MachineShareOracle; white-hat talks recovered 89% in a week.

SagaEVM lost $7M in 11 minutes when an Ethermint bug let crafted messages bypass validation, minting Saga Dollar (D) without collateral and bridging to ETH.

Truebit lost $26.4M when an integer overflow in TRU's five-year-old bonding-curve contract let the attacker mint TRU near-free and sell back for 8,500 ETH.