The two founders of a South Africa-based crypto investment firm called Africrypt claimed they had been hacked, and all assets had been stolen. The duo disappeared as legal action began, and as skepticism grew as to the veracity of that story.

"Africrypt brothers deny involvement in Bitcoin 'heist' "

"Missing Brothers' Lawyers Terminated From South Africa Bitcoin Case"

Africrypt exit scam

Africrypt investors disappear with $3.6 billion of investor funds

Turkish Bitcoin exchange Thodex halted trading and limited customers' access to their investments, claiming it was to investigate suspicious activity and swearing it was not an exit scam. With an international manhunt now underway for the Thodex CEO, and no sign of the approximately $2&nbsp;billion that was invested in the platform, it seems awfully likely it was a <button class="define-target" id="rug-pull">rug pull</button>.

"Thodex CEO Denies Rug-Pull, Discloses Cyberattacks, Says 'Funds Are Safe'"

"For the ruined, Turkey’s crypto crackdown comes too late"

"Billion-Dollar Rug Pull? Turkish Bitcoin Exchange Goes Dark"

Thodex exit scam

CEO of Turkish crypto exchange Thodex apparently makes off with $2 billion in investments

One of the most popular <button class="define-target" id="play-to-earn">play-to-earn</button> games, Axie Infinity, suffered an enormous hack to the Ronin network on which it runs. The project announced that a majority of Ronin validator nodes had been compromised — four belonging to the Sky Mavis company that builds Axie Infinity, and one belonging to the Axie <button class="define-target" id="dao">DAO</button>. After gaining control of the validators, they were able to approve malicious withdrawals of 173,600&nbsp;ETH (about $600&nbsp;million) and 25.5M USDC (a <button class="define-target" id="stablecoin">stablecoin</button>, worth $25.5M). The $625&nbsp;million loss was possibly the largest to date in the history of <button class="define-target" id="defi">defi</button> projects.<p>Sky Mavis announced that they had halted the Ronin <button class="define-target" id="bridge">Bridge</button> and Katana DEX, and were making changes to their network to try to guard against future attacks. They also wrote that they were "working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed".</p>

"Community Alert: Ronin Validators Compromised"

"Axie Infinity’s Ronin Network Suffers $625M Exploit"

"The Axie Infinity hack, what happened, and why people keep talking about bridges"

Axie Infinity bridge hack

Popular blockchain game Axie Infinity suffers a $625&nbsp;million exploit, the largest in defi history

Binance Smart Chain, the relatively popular blockchain that Binance is trying to rebrand as "BNB Chain", was halted when an attacker exploited "BSC Token Hub", the <button class="define-target" id="bridge">bridge</button> between the old Binance Beacon Chain and BSC. The attacker successfully moved around $127&nbsp;million of the stolen crypto assets off the chain before it was paused. The attacker's wallet contained 2&nbsp;million&nbsp;BNB, valued at $586&nbsp;million based on the price at the time of the hack, but as a result of the chain halt, they were not able to exfiltrate the entire amount.<p>Binance CEO Changpeng Zhao ("CZ") tweeted that "An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC." A BSC developer later confirmed that "we coordinated with validators to temporarily suspend BSC after having determined an exploit on a cross-chain bridge, BSC Token Hub- which resulted in extra BNB". The value of the $BNB token dropped from $293.10 to $280.40 after the news.</p><p>The chain operators and CZ seemed to feel a little awkward about the ramifications of unilaterally deciding to halt a supposedly decentralized blockchain. CZ claimed he was asleep and that the chain had already been halted by the time he woke up. The BSC team published a blog post saying that "Decentralized chains are not designed to be stopped, but by contacting community validators one by one, we were able to stop the incident from spreading. It was not that easy as BNB Smart Chain has 26 active validators at present and 44 in total in different time zones. This delayed closure, but we were able to minimize the loss." They also promised to try to decentralize the project even further going forward.</p>

"Binance Smart Chain Halts After 'Potential Exploit' Drains Estimated $100M in Crypto"

"Binance is ‘narrowing down’ identity of hacker behind $570 million crypto attack, CEO says"

Binance bridge hack

Binance Smart Chain halts after $570&nbsp;million bridge exploit

Over $370&nbsp;million was mysteriously withdrawn from FTX and FTX US late on November 11, despite the company freezing withdrawals.<p>An FTX account administrator wrote on the FTX support Telegram, "FTX has been hacked. FTX apps are malware. Delete them. Chat is open. Don't go on FTX site as it might download Trojans". The message was pinned by FTX General Counsel Ryne Miller.</p><p>Miller later wrote on Twitter, "Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges - unclear facts as other movements not clear. Will share more info as soon as we have it."</p><p>A Telegram admin subsequently wrote, "Not all hope is lost. Engineers have managed to retrieve substantial amount of funds," but no details were provided beyond that. A later announcement by Miller claimed that FTX had "initiated precautionary steps to move all digital assets to cold storage", suggesting some of the transfers may have been a part of that effort.</p><p>Many speculated that the so-called hack had been coordinated by insiders.</p>

"FTX Faces Potential Hack, Sees Mysterious Outflows Totaling More than $600M"

FTX hack

FTX claims it was hacked as more than $370&nbsp;million is withdrawn

The Wormhole Network is a <button class="define-target" id="bridge">blockchain bridge</button> between Solana and various other blockchains, allowing assets to be traded across the different and not otherwise interoperable chains. After an attacker was able to spoof a guardian account, Wormhole was exploited on February 2 for 120,000&nbsp;<button class="define-target" id="wrapped-token">wETH</button>, or about $326&nbsp;million. The network was taken down for maintenance, and Wormhole promised that "ETH will be added over the next hours to ensure wETH is backed 1:1". The parent company of Wormhole, Jump Trading, replaced the funds that had been drained; meanwhile, Wormhole offered a $10&nbsp;million <button class="define-target" id="bug-bounty">bounty</button> to try to tempt the attacker into returning the funds. The hack was the fourth-largest cryptocurrency theft of all time, trailing behind the $480&nbsp;million Mt. Gox theft in 2014, the $547&nbsp;million Coincheck theft in 2018, and the <a href="https://web3isgoinggreat.com/?id=2021-08-11-0" target="_blank">$611&nbsp;million Poly Network theft</a> (that was later returned) in 2021.

"How $323M in crypto was stolen from a blockchain bridge called Wormhole"

Wormhole bridge hack

Wormhole, a cross-blockchain bridge, is hacked for more than $320&nbsp;million in one of the largest hacks to date

BitMart, "the most trusted cryptocurrency trading platform", experienced a major breach in which attackers stole approximately $200&nbsp;million of various cryptocurrencies. The CEO attributed the exploit to a stolen <button class="define-target" id="private-key">private key</button>, and promised to compensate users who were impacted.

"Hackers Steal $150M From Crypto Exchange Billed as 'Most Trusted'"

"BitMart says it will compensate victims of $196 million hack and restore trading by Tuesday"

BitMart hack

Hackers steal about $200 million from BitMart

The decentralized lending platform Euler Finance suffered a <button class="define-target" id="flash-loan">flash loan</button> attack in which an exploiter stole $197&nbsp;million from the project. The attacker stole $8.7&nbsp;million in the Dai <button class="define-target" id="stablecoin">stablecoin</button>, $18.5&nbsp;million in <button class="define-target" id="wrapped-token">wrapped</button> Bitcoin, $135.8&nbsp;million in Lido staked Ethereum (stETH), and $33.8&nbsp;million in the USDC stablecoin. Although Euler was well known for its many code <button class="define-target" id="audit">audits</button>, the project had later added a vulnerable function that had not been as heavily audited.<p>Euler announced that they were aware of the exploit, and were "working with security professionals and law enforcement".</p>

"Hackers steal around $200 million from crypto lender Euler Finance"

Euler Finance hack

Euler Finance exploited for almost $200&nbsp;million

After an attacker began exploiting a vulnerability in the Nomad <button class="define-target" id="bridge">bridge</button>, many people rushed to replicate the attack and steal some of the roughly $190&nbsp;million of various cryptocurrencies in the bridge. Some didn't seem to think through the consequences of using wallets tied to their real-life identities to exploit the vulnerability, which should be interesting to watch.<p>Nomad posted on Discord and tweeted that they were "aware of the incident" and "investigating", but the attack was ongoing over an hour after the acknowledgement.</p><p>Four days before the attack, Nomad announced that they'd raised a $22.4&nbsp;million seed round from investors including Coinbase, OpenSea, and Crypto.com.</p>

Nomad bridge hack

People rush to steal some of the $190&nbsp;million in the Nomad bridge after an exploit is discovered

All my magic beans gone. An attacker successfully used a <button class="define-target" id="flash-loan">flash loan</button> attack to exploit a flaw in Beanstalk Farms' stablecoin protocol, which allowed them to make off with 24,830&nbsp;ETH (almost $76&nbsp;million). The attacker then donated $250,000 to Ukraine before moving the remaining funds to Tornado Cash to <button class="define-target" id="tumbler">tumble</button>.<p>Estimated damages to the project were higher than the amount the hacker was able to take for themselves — around $182&nbsp;million. The $BEAN token, once pegged to $1, dropped to nearly 0. The project creator wrote in the Discord, "We are fucked. This project has not had any venture backing, so it is highly unlikely there is any sort of bail out coming." However, they were later slightly more optimistic, writing, "it may also be the start of something good... there may be a path forward. We don't want to comment on next steps until that path is at least visible to us" while reiterating that a bail-out was "highly unlikely". They also told members of their community that they had contacted the FBI about the theft.</p>

Beanstalk Farms hack

Beanstalk Farms stablecoin project loses $182&nbsp;million to exploit

The algorithmic market maker Wintermute suffered a major hack, according to their CEO. He estimated the loss at around $160&nbsp;million, also writing that the company is "solvent with twice over that amount in equity left".<p>Wintermute hasn't disclosed more about the attack, but it's possible that the hacker may have exploited the <a href="https://web3isgoinggreat.com/?id=vulnerability-discovered-in-vanity-wallet-generator-puts-millions-at-risk" target="_blank">vulnerability in the vanity wallet address generator Profanity</a>, which was disclosed five days prior. The crypto asset vault admin had a wallet address prefixed with <code>0x0000000</code>, a vanity address that would have been susceptible to attack if it was created using the Profanity tool.</p><p>This is the second incident involving Wintermute in the past few months. In June, the group provided the wrong wallet address to the Optimism project, and Optimism sent 20&nbsp;million&nbsp;OP tokens to a non-existent address. Another person noticed the error before they did and was able to take the tokens. They ultimately returned 17&nbsp;million of the tokens to Wintermute, keeping the rest as a "<button class="define-target" id="bug-bounty">bounty</button>". $OP have been trading at around $1 as of mid-September.</p>

"Experts blame a 'vanity address' bug for Wintermute's $160 million hack"

Wintermute hack

Wintermute hacked for $160&nbsp;million

Robert Leshner, the founder of Compound Labs, took an unusual approach when trying to recoup funds that were mistakenly distributed through a $160 million bug in the protocol. He tweeted, "Please return [the funds]. Keep 10% as a white-hat. Otherwise, it's being reported as income to the IRS". The threats were not received particularly well, with some questioning what assumptions Leshner was making about his typical user's tax status, and Leshner subsequently apologized for his "bone-headed" tweet.

"Bug puts $162 million up for grabs, says founder of DeFi platform Compound"

"Compound bug leaves $80 million in COMP at risk of being misrewarded"

Compound Finance bug

Founder of DeFi platform Compound threatens users who received mistaken payments with the IRS

The decentralized exchange BXH was exploited for $139&nbsp;million. BXH CEO Neo Wang attributed the exploit to a compromised administrator key, which he said suggested either a staff member's computer was breached, or a staff member themselves was behind the theft. BXH offered a reward to the hacker if they returned the funds, and offered a $1&nbsp;million <button class="define-target" id="bug-bounty">bounty</button> to any person who could help retrieve the funds, but was ultimately not successful in having the money returned.

"$139M BXH Exchange Hack Was the Result of Leaked Admin Key"

BXH exchange hack

BXH exchange exploited for $139&nbsp;million

Stolen <button class="define-target" id="private-key">private keys</button> from the blockchain gaming platform Vulcan Forged enabled attackers to siphon funds out of just shy of 100 user wallets. Rather than users managing their own private keys, this is done by the platform, suggesting the issue was not user error. The project says it plans to reimburse users.

"Hackers Steal $140 Million From Users of Crypto Gaming Company"

"96 private keys stolen from Vulcan Forged in $140 million theft"

Vulcan Forged hack

Vulcan Forged users lose a collective $135 million in hack

Crypto lending service C.R.E.A.M. Finance lost $130&nbsp;million in a <button class="define-target" id="flash-loan">flash loan</button> attack. It was the third hack of the platform this year, following a $37.5&nbsp;million hack in February and an $18.8&nbsp;million attack in August.

"Cryptocurrency Loan Platform Implodes In $130 Million Hack"

"Ethereum DeFi protocol Cream Finance hacked for more than $130 million"

C.R.E.A.M. hack &#35;3

DeFi platform C.R.E.A.M. is hacked for a third time, this time for $130 million

A hacker was able to use a compromised Cloudflare API key to inject malicious code into the BadgerDAO platform via Cloudflare Workers. They then siphoned currency of various kinds, equivalent to approximately $120&nbsp;million, out of user accounts over approximately two weeks before being discovered.

"Hacked Cryptocurrency Platform Begs Hacker to Please Return $119 Million"

"Badger DAO Protocol Suffers $120M Exploit"

BadgerDAO hack

$120 million is stolen from BadgerDAO

Mango Markets, a Solana-based <button class="define-target" id="defi">defi</button> project offering borrowing, lending, and leverage trading, was exploited for $116&nbsp;million. An attacker manipulated the supposed value of their collateral on the platform, allowing them to take out massive loans from the project treasury that they never repaid. In total, they stole around $116&nbsp;million worth of Solana tokens. However, only a few exchanges have sufficient liquidity to support exchanging or withdrawing that quantity of tokens, and those exchanges (Coinbase, Binance, and Kraken) froze the attacker's wallets.<p>Mango Markets posted on Twitter to urge users not to deposit into the project, and asked the hacker to contact them "to discuss a <button class="define-target" id="bug-bounty">bug bounty</button>". The hacker had their own plans, instead submitting a governance proposal in which they would return $46&nbsp;million of the stolen funds (keeping $70&nbsp;million) in exchange for a promise that the protocol would not try to freeze the assets or pursue criminal charges. The hacker then used their 32&nbsp;million governance tokens to vote in support, but ultimately were not able to get the proposal to pass. A different proposal with largely the same terms, but which left the attacker with only $47&nbsp;million of the stolen funds, passed shortly after.</p>

Mango Markets attack

Mango Markets suffers loss of more than $116&nbsp;million

Hackers were able to discover and exploit a bug in the decentralized exchange Maiar, stealing $113&nbsp;million. Maiar developers took the exchange offline soon after discovering the exploit, but not before the hackers made off with 1.65&nbsp;million EGLD (the native token of the Elrond blockchain, on which Maiar is built). The sale of the pilfered EGLD caused the token to plummet from $76 to $5 on the Maiar exchange.<p>Maiar's founder and CEO has claimed that "most exploited funds have been either recovered in full, or will be covered by the Elrond Foundation", though it's not clear how (or if) any of the funds were recovered.</p>

"Decentralized Crypto Exchange Offline After Hacker Steals $113M"

Maiar exchange hack

Decentralized exchange Maiar exploited for $113&nbsp;million

Freeway, a financial scheme where users buy "Superchargers", which are crypto "simulations" that promise to pay out rewards of up to 43% annually, seems to have taken the off-ramp. The project announced to its users that due to "unprecedented volatility in Foreign Exchange and Cryptocurrency markets in recent times", they would be pausing their Supercharger program. The project reportedly halted withdrawals on more than $100&nbsp;million worth of assets.<p>Worryingly, the company also removed all mentions of its team from their website, and reportedly removed an attestation to the company's financial backing as well.</p><p>The day before the project announced the pause, crypto whistleblower and researcher FatMan published a Twitter thread urging people to withdraw funds immediately because he believed they were operating a Ponzi scheme. "In my opinion, it's likely that Freeway will collapse within the next few months and that all depositors will lose everything."</p>

Freeway rug pull

Freeway halts withdrawals, accused of $100&nbsp;million+ rug pull

The U.S. Department of Justice announced they had filed charges against Emerson Pires, Flavio Goncalves and Joshua David Nicholas, the two founders and the "head trader" of the EmpiresX cryptocurrency investment platform. The DoJ alleges that the project was a <button class="define-target" id="ponzi">Ponzi scheme</button>, and that they were offering an unregistered security. They also alleged that the duo were misrepresenting a supposed proprietary trading bot, and fraudulently guaranteeing investment returns. The EmpiresX scheme reportedly pulled in $100&nbsp;million from investors, and appears to have run from 2020 until early 2022.<p>All three are facing charges of conspiracy to commit wire fraud and conspiracy to commit securities fraud, and Pires and Goncalves have also been charged with conspiracy to commit international money laundering. If convicted on all counts, Pires and Goncalves face up to 45&nbsp;years in prison and Nicholas faces up to 25&nbsp;years in prison.</p>

"Justice Department Announces Enforcement Action Charging Six Individuals with Cryptocurrency Fraud Offenses in Cases Involving Over $100 Million in Intended Losses"

EmpiresX ponzi scheme

U.S. Department of Justice charges founders of the $100&nbsp;million EmpiresX ponzi scheme

The Horizon Bridge is a blockchain <button class="define-target" id="bridge">bridge</button> allowing assets to be used across Ethereum, BNB, and Harmony blockchains. The bridge is run by the Harmony blockchain project.<p>On June 23, someone was able to steal assets from the bridge that they then converted to more than 85,800&nbsp;ETH. The stolen funds are notionally valued at almost $100&nbsp;million, assuming the thief can cash them out successfully. Hours after the attack, most of the funds remained in the thief's wallet and had not yet been laundered.</p><p>A June 29 analysis by blockchain research firm Ellipsis claimed that "there are strong indications that North Korea's Lazarus Group may be responsible for this theft". Lazarus was also behind the <a href="https://web3isgoinggreat.com/?id=axie-infinity-suffers-625-million-exploit" target="_blank">$625&nbsp;million bridge hack in March</a>, targeting the Axie Infinity game.</p>

"The $100 Million Horizon Hack: Following the Trail Through Tornado Cash to North Korea"

Horizon Bridge hack

Cryptocurrencies notionally worth $100&nbsp;million stolen from Horizon Bridge

Finiko, a Russian operation that turned out to be a Ponzi scheme, collapsed in July 2021 after defrauding approximately $95 million from people. Investors, facing difficult economic conditions in Russia, were promised they could see returns of up to 30% a month.

"The Biggest Threat to Trust in Cryptocurrency: Rug Pulls Put 2021 Scam Revenue Close to All-time Highs"

"Court Extends Detention of Finiko Pyramid Founder Doronin and His Right-Hand Man"

"Founder of Alleged $95M Ponzi Nabbed in Russia, 3 More Sought"

Finiko Ponzi scheme

Russian Ponzi scheme collapses after defrauding investors of around $95&nbsp;million

Japanese cryptocurrency exchange Liquid Global suffered a hack that saw $90&nbsp;million in various assets stolen. The exchange stated that the attack had targeted the company's MPC wallet.<p>A week after the hack, FTX extended a $120&nbsp;million loan to the platform. In April 2022, FTX formally acquired Liquid for an undisclosed amount.</p>

"Japan's Liquid Global Exchange Hacked; $90M in Crypto Siphoned Off"

"Recently Hacked Exchange Liquid Global Secures $120M Loan From FTX"

"FTX Closed Acquisition of Liquid Exchange a Few Days Late"

Liquid Global hacked

Liquid Global cryptocurrency exchange hacked for $90&nbsp;million

A crypto researcher who goes by "FatMan" discovered that the Mirror Protocol in the Terra ecosystem contained a serious vulnerability, that was quietly patched with no announcement on May 9. The Mirror Protocol code previously lacked a duplicate check, which meant that attackers could create a short position and then withdraw it repeatedly in the same transaction, taking many times more money than they should have been authorized to withdraw.<p>FatMan discovered one instance where a person deposited $10,000 and later withdrew $4.3&nbsp;million. According to FatMan, they found repeated exploits of this type that earned attackers "well over $30&nbsp;million". Another researcher on Terra forums estimated about $88&nbsp;million had been exfiltrated from the project in this way, over the many months the bug went undiscovered and unpatched by Mirror developers.</p>

"More bad news for Terra as fresh allegations emerge about Mirror Protocol"

Mirror vulnerability

Researcher discovers vulnerability in the Terra Mirror Protocol that allowed attackers to siphon tens of millions from the project

A hacker attacked multiple Rari <button class="define-target" id="liquidity-pool">liquidity pools</button> relating to the Fei Protocol, exploiting a known re-entrancy vulnerability that exists on <button class="define-target" id="fork">forks</button> of the Compound protocol. The attacker stole more than $80&nbsp;million from the projects.<p>Fei Protocol tweeted that they had paused borrowing to avoid further thefts, and offered a $10&nbsp;million <button class="define-target" id="bug-bounty">bug bounty</button> if the hacker returned the money.</p>

Fei Protocol hack

$80&nbsp;million stolen from Fei Protocol and Rari

An attacker exploited a bug in Qubit Finance, a decentralized lending platform. The bug allowed them to call the "deposit" function without actually depositing any funds. This enabled the attacker to <button class="define-target" id="mint">mint</button> 77,162&nbsp;xETH collateral, which they exchanged for BNB worth nearly $80&nbsp;million. The platform has said they have tried to contact the exploiter to offer the "maximum bounty", which is apparently $250,000. Tempting, I'm sure.

"Hackers have stolen $80 million in cryptocurrency from the Qubit DeFi platform"

Qubit Finance hack

Attacker exploits a bug in Qubit Finance allowing them to mint unlimited collateral and drain the platform of $80&nbsp;million

Hackers compromised a computer belonging to EasyFi founder Ankitt Gaur, accessing his <button class="define-target" id="private-key">private keys</button> which allowed them to transfer $6&nbsp;million in <button class="define-target" id="stablecoin">stablecoins</button> and $120&nbsp;million worth of EASY. The price of EASY crashed as a result of the low liquidity, limiting the hacker's total payout to around $80&nbsp;million. EasyFi followed the breach with a <button class="define-target" id="fork">hard fork</button> to "EZ 2.0", and compensated users with a mix of stablecoins and "IOU tokens" that could later be redeemed for discounted EZ.

"
Hackers stole over $4 billion in cryptocurrencies this year — Here’s a full list of the biggest crypto heists in 2021"

"Reeling from post-hack price slump, Easyfi reveals community compensation plan"

EasyFi hack

$80&nbsp;million taken from EasyFi lending platform

Ascendex lost $77 million in a hack targeting <button class="define-target" id="hot-wallet">hot wallets</button>. The platform said it would reimburse customers for all of their lost funds.

"Ascendex Hacked — Exchange Loses $77 Million in ERC20, BSC, Polygon Tokens"

"Crypto Exchange AscendEX Hacked, Losses Estimated at $77M"

"AscendEX loses $80M following ERC-20, BSC, Polygon hot wallet compromise"

Ascendex hacked

Cryptocurrency exchange Ascendex hacked for $77 million

The Pixelmon project promised an ambitious roadmap including a Pokémon-like game where the pixelized Pokémon could be caught and traded, a land project, and rewards to buyers of their "Generation 1" Pixelmon. The 3D pixelized Pokémon on their flashy website and on social media certainly looked promising to the buyers who sunk a total of $70&nbsp;million into the project. Those buyers, who spent 3ETH per mint (~$9,300), were excited to unveil their "fully modeled 3D character[s] that you can interact with". However, when they "hatched" their Pixelmon, buyers were greeted with some truly terrible models, if they were lucky enough to have a model at all — some unveiled just an empty patch of grass, and others found their models appearing partway in the ground.<p>Although the project lead wrote on the Discord that they had "made a horrible mistake" but that they would "completely revamp and redesign" the NFTs, the project appeared to be a cash grab. On the night of the reveal, 1,000&nbsp;ETH ($2.8&nbsp;million) had already been transferred out of the project and split among various addresses. One of the recipients who received 400&nbsp;ETH ($1.1&nbsp;million) immediately went on a shopping spree, buying various big-ticket NFTs with their windfall.</p>

Pixelmon flop

Pixelmon raises $70&nbsp;million only to reveal hilariously bad NFTs

A project called AnubisDAO launched a coin called ANKH, and were quickly flooded with cash from investors hoping to find another dog-themed <button class="define-target" id="memecoin">memecoin</button> success like Dogecoin or Shiba Inu. In less than 24 hours, the money vanished from the <button class="define-target" id="liquidity-pool">liquidity pool</button> in what project creators claim was a phishing attack, but more likely was a <button class="define-target" id="rug-pull">rug pull</button>. One investor interviewed by CNBC said he had invested nearly $470,000 in the coin before the money was drained.

"This crypto investor says he just lost $470,000 on a dog-inspired DeFi project"

"Police forces jump into AnubisDAO saga after $60 million 'rug' "

AnubisDAO rug pull

$60 million disappears in AnubisDAO project within a day of its launch

An attacker fooled a developer of the bZx <button class="define-target" id="defi">decentralized finance</button> platform into opening a Word document with a malicious macro, which ran a script that gave the attackers access to the developer's crypto wallet <button class="define-target" id="private-key">private keys</button>. They were able to gain access not only the developer's personal wallet keys, but to two keys to bZx wallets. The attacker made off with approximately $55&nbsp;million. bZx subsequently tried to offer the attacker a bounty to return the funds, though they were not successful.

"Hacker steals $55 million from bZx DeFi platform"

bZx hack

Hacker steals around $55&nbsp;million from bZx

A hacker was able to exploit an infinite mint glitch in the protocol of Cashio, a Solana <button class="define-target" id="stablecoin">stablecoin</button> project. They were able to pull around $50&nbsp;million out of the platform, while also tanking the value of the $CASH token in the process. The attacker left a note in the input data of their Ethereum transactions that "Account with less 100k have been returned. all other money will be donated to charity."<p>Saber, the providers of the Cashio <button class="define-target" id="liquidity-pool">liquidity pool</button>, published a postmortem of the attack in which they wrote that "We do not have the money to pay back depositors." The hack was the second largest in Solana history, behind the <a href="https://web3isgoinggreat.com/?id=2022-02-02-0">February Wormhole hack</a>. Saber entreated the hacker to return the funds, writing, "accounts with over $100k are often users' life savings on leverage, and many of us will seriously be affected financially after this incident."</p><p>On March 28, the attacker sent a message saying that "the intention was only to take money from those who do not need it, not from those who do", and invited users who had over $100,000 to apply to receive their funds back with "an explanation of the source of this money and why you need it back. more detail is better. money will not be refund to rich american and european that don't need it." Somewhat strangely, Cashio themselves began hosting a website to allow affected users to plead with the hacker to return the money.</p>

"Solana Stablecoin Project Cashio Plummets to Zero After Multi-Million Dollar Hack"

Cashio hack

A Robin Hood-esque attacker steals $52&nbsp;million from Cashio, then returns smaller amounts and pledges to donate the rest to charity

A bug in Uranium Finance, a <button class="define-target" id="defi">DeFi</button> exchange based on Binance Smart Chain, allowed an attacker to drain the <button class="define-target" id="liquidity-pool">liquidity pools</button> for multiple token pairs. Uranium had just commissioned an <button class="define-target" id="audit">audit</button> which uncovered the bug, but the attack occured two hours before the patch went live. An apparent member of Uranium's development team wrote that they believed the attack had been the result of leaked information.

"Binance Chain DeFi Exchange Uranium Finance Loses $50M in Exploit"

"Uranium Finance developer suspected of 'leaking' information leading to $50M exploit"

Uranium Finance hack

Uranium Finance is drained of $50 million in hack

A hacker used <button class="define-target" id="flash-loan">flash loans</button> to manipulate the price of other token pools, to then exploit a bug in PancakeBunny logic that calculates how many tokens should be minted. They were able to mint and then sell 7&nbsp;million tokens, making off with $45&nbsp;million and tanking the price of BUNNY tokens from $146 to $0.90. PancakeBunny tweeted shortly after the attack that they would be "working on a reimbursement plan" for those affected.

"Binance Smart Chain's PancakeBunny protocol exploited, $45 million drained"

"PancakeBunny Postmortem Details Attack Compensation Plan"

PancakeBunny hack

$45 million stolen from PancakeBunny Finance

The FBI's Cyber Division issued a notification about fraudulent cryptocurrency investment apps that are successfully being used to defraud American investors. The scammers typically claim to offer cryptocurrency investment services to their targets, then convince them to download mobile apps that resemble genuine crypto trading apps (sometimes mimicking actual exchanges). The apps typically show the users' accounts increasing in value, but when users try to withdraw funds they find they're unable. Sometimes the apps defraud their victims even further by claiming they need to pay an additional "tax" before they can withdraw.<p>The FBI stated they had identified 244&nbsp;victims, and estimated the total loss associated with these fraudulent apps to be around $42.7&nbsp;million.</p>

"Cyber Criminals Create Fraudulent Cryptocurrency
Investment Applications to Defraud US Investors"

FBI warns of malicious crypto apps

FBI warns of fraudulent crypto apps that have stolen an estimated $42.7&nbsp;million

Bo Shen, a general partner at Fenbushi Capital and an early adopter of cryptocurrencies, tweeted on November 22 that two weeks prior, someone had stolen $42&nbsp;million in cryptocurrencies from his personal wallet. "The stolen assets are personal funds and do not affect on Fenbushi related entities," he wrote.<p>Analysis by the crypto security firm SlowMist attributed the theft to a compromise of Shen's <button class="define-target" id="seed-phrase">seed phrase</button>. Shen had been using the Trust Wallet software, though the theft does not appear to be related to security issues with the wallet software.</p>

Bo Shen wallet compromise

Early crypto investor loses $42&nbsp;million in wallet compromise

Contagion from the massive <a href="https://web3isgoinggreat.com/?id=euler-finance-exploited-for-almost-200-million" target="_blank">exploit of the Euler project</a> has spread to around a dozen <button class="define-target" id="defi">defi</button> projects, including Balancer, Angle Protocol, Yearn Finance, InverseFinance, and others. Some are still evaluating if and how they may be affected, and how much they've lost.<p>Around $11.9&nbsp;million of tokens were sent from the Balancer defi liqiuidity project to Euler during the attack, prompting Balancer to pause the project.</p><p>The Angle Protocol decentralized <button class="define-target" id="stablecoin">stablecoin</button> project also disclosed that almost half of the <button class="define-target" id="tvl">total value locked</button> in the project — around $17.6&nbsp;million in the USDC stablecoin — were sent to Euler during the hack.</p>

"Euler attack causes locked tokens, losses in 11 DeFi protocols, including Balancer"

"Angle Protocol - Q&amp;A Regarding Euler Exploit"

Euler contagion

Over $35&nbsp;million lost as contagion from Euler hack spreads throughout defi

A hacker was able to code a <button class="define-target" id="smart-contract">smart contract</button> that tricked C.R.E.A.M. into believing it was from a trusted source. They were then able to make off with $37.5 million worth of Ethereum and stablecoins in what was only the first of several major exploits of the platform in 2021.

"DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack; $37.5M Lost"

C.R.E.A.M. hack &#35;1

$37.5 million stolen from C.R.E.A.M. lending platform

IRA Financial, a platform for managing retirement investments, boasts of being "the first self-directed IRA company to allow their clients to invest in cryptocurrencies, such as Bitcoin, directly via a cryptocurrency exchange". Unfortunately, they were probably also the first to have that feature exploited, when an administrator account was apparently compromised and users' funds were transferred out of their connected Gemini accounts. Two days later, IRA Financial publicly acknowledged "suspicious activity that has affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange". The stolen funds, taken in a mix of Ethereum and Bitcoin, amounted to around $36&nbsp;million.

IRA Financial hack

$36&nbsp;million taken from retirement accounts of IRA Financial customers investing in crypto

"[I] was a 20-something-year-old kid" said Aiden Pleterski, when asked why he kept his "investment" scheme going when he knew he couldn't repay his existing customers. Although he once described himself as the "Crypto King" in several articles he paid to have run, Pleterski is now undergoing a bankruptcy process and facing multiple lawsuits, where creditors are trying to first <i>find</i> and then recoup the more than $35&nbsp;million they've collectively entrusted to him.<p>So far, the court has seized two McLarens, two BMWs, and a Lamborghini — only a few cars out of the eleven luxury cars Pleterski owned, plus another four he was renting. Investors have also asked about the $45,000-a-month lakefront mansion he was renting in Ontario, watches, and gold bars, hoping they could be liquidated to repay some of his debts.</p><p>Pleterski had promised investors that he would invest on their behalf, taking 30% of any capital gains, with a goal of achieving 10–20% gains <i>biweekly</i>. He also promised that any loss on the initial investment would be paid back in full. Pleterski had made some money in crypto as a teenager, but according to him, he lost most of the money he was given to invest in late 2021 and early 2022 "in a series of margin calls and bad trades". An investor claims that at one point, he was given pictures and videos of financial statements showing an account with $311&nbsp;million, but when he checked with the company supposedly maintaining the account, they said they had no accounts with that kind of funds. So far, the court and investors alike have struggled to untangle Pleterski's mess — according to him, he was unorganized and didn't track his finances or debts.</p>

"Luxury cars seized from 23-year-old 'Crypto King' as investors try to recoup millions"

"Crypto King" scam

Investors seek to recoup around $35&nbsp;million from Canadian "Crypto King" in his early 20s

The <button class="define-target" id="defi">defi</button> lending protocol Scream may have taken the "stable" in "stablecoin" a bit too literally when they hardcoded the prices of the Fantom USD (fUSD) and DEI stablecoins. In the past few weeks we've seen many stablecoins wobble, and when fUSD and DEI followed suit, Scream ended up in trouble. Users were able to take advantage of the inaccurately high price to borrow other stablecoins on the cheap, leaving Scream with $35&nbsp;million in <button class="define-target" id="bad-debt">bad debt</button>. The platform's reserves of other stablecoins were completely drained; meanwhile, Scream users holding fUSD or DEI can't withdraw.

"DeFi lender left with $35 million bad debt after quoting depegged stablecoins at $1"

Scream bad debt

Scream lending protocol racks up $35&nbsp;million in bad debt after hardcoding not-so-stablecoin prices to $1

The Vee Finance <button class="define-target" id="defi">decentralized finance</button> platform was hacked for $35&nbsp;million worth of Ethereum and Bitcoin. The platform suspended trading after the hack was discovered, and also tried to tempt the hackers with promises of a bug bounty if they'd just be so kind as to return the funds. The platform had only launched a week earlier, though boasted of having $300&nbsp;million worth of assets <a href="https://coinmarketcap.com/alexandria/glossary/total-value-locked-tvl" rel="noopener" target="_blank">locked</a> on their exchange.

"Avalanche DeFi Platform Vee Finance Suffers $35M Hack"

Vee Finance hack

Vee Finance platform emptied of $35&nbsp;million a week after its launch

Popular cryptocurrency <button class="define-target" id="wallet">wallet</button> provider and trading platform Crypto.com briefly suspended trading after acknowledging there had been "unauthorized activity" in user accounts. The platform restored trading later that day after pushing an update to require their users to re-authenticate their sessions and reset two-factor authentication.<p>Although some users reported funds missing from their wallets, including one investor who reported that $16.3&nbsp;million missing, Crypto.com announced that "All funds are safe". Over the next few days this was revealed to be untrue; as of January 20, the total estimated funds stolen from the platform had reached $30&nbsp;million. Large amounts of stolen funds were quickly laundered through Tornado Cash, a popular crypto <button class="define-target" id="tumbler">mixer</button>.</p>

"Crypto.com Suspends Withdrawals After 'Unauthorized Activity'"

"Crypto.com’s Stolen Ether Being Laundered via Tornado Cash"

Crypto.com hack

At least $34&nbsp;million is stolen from users of Crypto.com

The Brazilian crypto lending platform BlueBenx suddenly shut its doors after announcing they had suffered an "extremely aggressive" hack of 160&nbsp;million&nbsp;BRL (US$32&nbsp;million). However, they shared very little in the way of details, leading investors to question the veracity of their story.<p>All 22,000 customers of BlueBenx suddenly found them unable to withdraw funds from the platform. The platform also reportedly laid off the majority of its employees.</p>

"BlueBenx fires employees, halts funds withdrawal citing $32M hack"

BlueBenx hack

Brazilian crypto lender BlueBenx halts customer withdrawals and lays off employees after $32&nbsp;million "hack"

A hacker stole $31 million from the <button class="define-target" id="liquidity-pool">liquidity pool</button> provider MonoX by exploiting a bug in their <button class="define-target" id="smart-contract">smart contract</button> software that allowed them to exchange a token for itself and artificially inflate the price. MonoX took the classic approach of those burned by crypto issues, and tried to get the cash back by... asking nicely.

"Really stupid “smart contract” bug let hackers steal $31 million in digital coin"

"Another DeFi hack has taken place as the liquidity pool provider MonoX was compromised for over $30 million."

MonoX hack

$31 million stolen from MonoX in smart contract bug

Ichi, a <button class="define-target" id="defi">defi</button> project that allows other projects to create their own <button class="define-target" id="stablecoin">stablecoins</button> suffered cascading liquidations in its Rari pool, leading to a token price crash. Rari is a protocol that allows users earn yields on <button class="define-target" id="liquidity-pool">liquidity pools</button> for various assets. Ichi's liquidity pool on Rari was set up with an extremely high collateral factor (85%) and no supply caps, which allowed borrowers to borrow more $ICHI to use as collateral than actually existed in the liquidity pool, with many borrowing $ICHI to buy more $ICHI. As borrowers did this, the price briefly spiked from the token's early April price of around $70 to $139 before plummeting to below $2.<p>One Rari developer blamed Ichi for the disaster, writing, "Fuse is a permissionless protocol. Pool operators are responsible for following best practices to avoid situations like this one". Rari Capital's official Twitter account also blamed Ichi, stating, "This is a permissionless pool that is owned and operated by Ichi. We hope to see an announcement from Ichi regarding redemption strategies and next steps to make users whole."</p><p>In the FAQ about the incident, Ichi wrote that they had allowed such a high LTV ratio in the pool because they expected "users would make responsible decisions that would benefit the community". There is currently around $30&nbsp;million of <button class="define-target" id="bad-debt">bad debt</button> in the liquidity pool.</p>

"How Ichi Tokens Plunged 90% After Bad Debt Fiasco on Rari"

Ichi hack

Ichi token plummets 90% after Rari liquidity pool is emptied

Grim Finance, the "compounding yield optimizer" <button class="define-target" id="defi">DeFi</button> platform, was hacked. According to them, attackers exploited a bug in the platform to perform a reentrancy attack that netted them $30 million. Grim, indeed. A cryptocurrency watchdog group, RugDoc, opined that the exploit was possible because of very basic mistakes in implementation, and wrote, "Hopefully all projects can draw lessons from this incident that there is much knowledge most experienced solidity devs have at hand. If you haven't acquired this yet, don't build multi-million dollar projects. Don't get audits from companies which everyone knows are useless." This was apparently a dig at Solidity Finance, who had performed an <button class="define-target" id="audit">audit</button> several months prior to the hack and found that "ReentrancyGuard is used in relevant locations to preent[sic] reentrancy attacks."

Event	Date	Amount More info
Africrypt exit scam	April 13, 2021	$3,600,000,000
Thodex exit scam	April 21, 2021	$2,000,000,000
Axie Infinity bridge hack	March 29, 2022	$625,000,000
Binance bridge hack	October 6, 2022	$570,000,000
FTX hack	November 11, 2022	$370,000,000
Wormhole bridge hack	February 2, 2022	$320,000,000
BitMart hack	December 4, 2021	$200,000,000
Euler Finance hack	March 13, 2023	$197,000,000
Nomad bridge hack	August 1, 2022	$190,000,000
Beanstalk Farms hack	April 17, 2022	$182,000,000
Wintermute hack	September 20, 2022	$160,000,000
Compound Finance bug	September 30, 2021	$147,000,000
BXH exchange hack	November 1, 2021	$139,000,000
Vulcan Forged hack	December 13, 2021	$135,000,000
C.R.E.A.M. hack #3	October 27, 2021	$130,000,000
BadgerDAO hack	December 1, 2021	$120,000,000
Mango Markets attack	October 11, 2022	$116,777,480
Maiar exchange hack	June 5, 2022	$113,000,000
Freeway rug pull	October 23, 2022	$100,000,000
EmpiresX ponzi scheme	June 30, 2022	$100,000,000
Horizon Bridge hack	June 23, 2022	$100,000,000
Finiko Ponzi scheme	July 31, 2021	$95,000,000
Liquid Global hacked	August 19, 2021	$90,000,000
Mirror vulnerability	May 26, 2022	$88,000,000
Fei Protocol hack	April 30, 2022	$80,000,000
Qubit Finance hack	January 27, 2022	$80,000,000
EasyFi hack	April 19, 2021	$80,000,000
Ascendex hacked	December 11, 2021	$77,000,000
Pixelmon flop	February 25, 2022	$70,000,000
AnubisDAO rug pull	October 29, 2021	$60,000,000
bZx hack	November 5, 2021	$55,000,000
Cashio hack	March 23, 2022	$52,000,000
Uranium Finance hack	April 28, 2021	$50,000,000
PancakeBunny hack	May 19, 2021	$45,000,000
FBI warns of malicious crypto apps	July 18, 2022	$42,700,000
Bo Shen wallet compromise	November 10, 2022	$42,000,000
Euler contagion	March 13, 2023	$37,600,000
C.R.E.A.M. hack #1	February 13, 2021	$37,500,000
IRA Financial hack	February 8, 2022	$36,000,000
"Crypto King" scam	September 20, 2022	$35,000,000
Scream bad debt	May 16, 2022	$35,000,000
Vee Finance hack	September 21, 2021	$35,000,000
Crypto.com hack	January 17, 2022	$34,000,000
BlueBenx hack	August 14, 2022	$32,000,000
MonoX hack	November 30, 2021	$31,000,000
Ichi hack	April 11, 2022	$30,000,000
Grim Finance hack	December 18, 2021	$30,000,000
SnowdogDAO crash	November 26, 2021	$30,000,000
Spartan Protocol hack	May 1, 2021	$30,000,000
C.R.E.A.M. hack #2	August 30, 2021	$29,000,000