One of the most popular <button class="define-target" id="play-to-earn">play-to-earn</button> games, Axie Infinity, suffered an enormous hack to the Ronin network on which it runs. The project announced that a majority of Ronin validator nodes had been compromised — four belonging to the Sky Mavis company that builds Axie Infinity, and one belonging to the Axie <button class="define-target" id="dao">DAO</button>. After gaining control of the validators, they were able to approve malicious withdrawals of 173,600&nbsp;ETH (about $600&nbsp;million) and 25.5M USDC (a <button class="define-target" id="stablecoin">stablecoin</button>, worth $25.5M). The $625&nbsp;million loss was possibly the largest to date in the history of <button class="define-target" id="defi">defi</button> projects.<p>Sky Mavis announced that they had halted the Ronin <button class="define-target" id="bridge">Bridge</button> and Katana DEX, and were making changes to their network to try to guard against future attacks. They also wrote that they were "working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed".</p>

"Community Alert: Ronin Validators Compromised"

"Axie Infinity’s Ronin Network Suffers $625M Exploit"

"The Axie Infinity hack, what happened, and why people keep talking about bridges"

Axie Infinity bridge hack

Popular blockchain game Axie Infinity suffers a $625&nbsp;million exploit, the largest in defi history

Binance Smart Chain, the relatively popular blockchain that Binance is trying to rebrand as "BNB Chain", was halted when an attacker exploited "BSC Token Hub", the <button class="define-target" id="bridge">bridge</button> between the old Binance Beacon Chain and BSC. The attacker successfully moved around $127&nbsp;million of the stolen crypto assets off the chain before it was paused. The attacker's wallet contained 2&nbsp;million&nbsp;BNB, valued at $586&nbsp;million based on the price at the time of the hack, but as a result of the chain halt, they were not able to exfiltrate the entire amount.<p>Binance CEO Changpeng Zhao ("CZ") tweeted that "An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC." A BSC developer later confirmed that "we coordinated with validators to temporarily suspend BSC after having determined an exploit on a cross-chain bridge, BSC Token Hub- which resulted in extra BNB". The value of the $BNB token dropped from $293.10 to $280.40 after the news.</p><p>The chain operators and CZ seemed to feel a little awkward about the ramifications of unilaterally deciding to halt a supposedly decentralized blockchain. CZ claimed he was asleep and that the chain had already been halted by the time he woke up. The BSC team published a blog post saying that "Decentralized chains are not designed to be stopped, but by contacting community validators one by one, we were able to stop the incident from spreading. It was not that easy as BNB Smart Chain has 26 active validators at present and 44 in total in different time zones. This delayed closure, but we were able to minimize the loss." They also promised to try to decentralize the project even further going forward.</p>

"Binance Smart Chain Halts After 'Potential Exploit' Drains Estimated $100M in Crypto"

"Binance is ‘narrowing down’ identity of hacker behind $570 million crypto attack, CEO says"

Binance bridge hack

Binance Smart Chain halts after $570&nbsp;million bridge exploit

Over $370&nbsp;million was mysteriously withdrawn from FTX and FTX US late on November 11, despite the company freezing withdrawals.<p>An FTX account administrator wrote on the FTX support Telegram, "FTX has been hacked. FTX apps are malware. Delete them. Chat is open. Don't go on FTX site as it might download Trojans". The message was pinned by FTX General Counsel Ryne Miller.</p><p>Miller later wrote on Twitter, "Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges - unclear facts as other movements not clear. Will share more info as soon as we have it."</p><p>A Telegram admin subsequently wrote, "Not all hope is lost. Engineers have managed to retrieve substantial amount of funds," but no details were provided beyond that. A later announcement by Miller claimed that FTX had "initiated precautionary steps to move all digital assets to cold storage", suggesting some of the transfers may have been a part of that effort.</p><p>Many speculated that the so-called hack had been coordinated by insiders.</p>

"FTX Faces Potential Hack, Sees Mysterious Outflows Totaling More than $600M"

FTX hack

FTX claims it was hacked as more than $370&nbsp;million is withdrawn

The Wormhole Network is a <button class="define-target" id="bridge">blockchain bridge</button> between Solana and various other blockchains, allowing assets to be traded across the different and not otherwise interoperable chains. After an attacker was able to spoof a guardian account, Wormhole was exploited on February 2 for 120,000&nbsp;<button class="define-target" id="wrapped-token">wETH</button>, or about $326&nbsp;million. The network was taken down for maintenance, and Wormhole promised that "ETH will be added over the next hours to ensure wETH is backed 1:1". The parent company of Wormhole, Jump Trading, replaced the funds that had been drained; meanwhile, Wormhole offered a $10&nbsp;million <button class="define-target" id="bug-bounty">bounty</button> to try to tempt the attacker into returning the funds. The hack was the fourth-largest cryptocurrency theft of all time, trailing behind the $480&nbsp;million Mt. Gox theft in 2014, the $547&nbsp;million Coincheck theft in 2018, and the <a href="https://web3isgoinggreat.com/?id=2021-08-11-0" target="_blank">$611&nbsp;million Poly Network theft</a> (that was later returned) in 2021.

"How $323M in crypto was stolen from a blockchain bridge called Wormhole"

Wormhole bridge hack

Wormhole, a cross-blockchain bridge, is hacked for more than $320&nbsp;million in one of the largest hacks to date

After an attacker began exploiting a vulnerability in the Nomad <button class="define-target" id="bridge">bridge</button>, many people rushed to replicate the attack and steal some of the roughly $190&nbsp;million of various cryptocurrencies in the bridge. Some didn't seem to think through the consequences of using wallets tied to their real-life identities to exploit the vulnerability, which should be interesting to watch.<p>Nomad posted on Discord and tweeted that they were "aware of the incident" and "investigating", but the attack was ongoing over an hour after the acknowledgement.</p><p>Four days before the attack, Nomad announced that they'd raised a $22.4&nbsp;million seed round from investors including Coinbase, OpenSea, and Crypto.com.</p>

Nomad bridge hack

People rush to steal some of the $190&nbsp;million in the Nomad bridge after an exploit is discovered

All my magic beans gone. An attacker successfully used a <button class="define-target" id="flash-loan">flash loan</button> attack to exploit a flaw in Beanstalk Farms' stablecoin protocol, which allowed them to make off with 24,830&nbsp;ETH (almost $76&nbsp;million). The attacker then donated $250,000 to Ukraine before moving the remaining funds to Tornado Cash to <button class="define-target" id="tumbler">tumble</button>.<p>Estimated damages to the project were higher than the amount the hacker was able to take for themselves — around $182&nbsp;million. The $BEAN token, once pegged to $1, dropped to nearly 0. The project creator wrote in the Discord, "We are fucked. This project has not had any venture backing, so it is highly unlikely there is any sort of bail out coming." However, they were later slightly more optimistic, writing, "it may also be the start of something good... there may be a path forward. We don't want to comment on next steps until that path is at least visible to us" while reiterating that a bail-out was "highly unlikely". They also told members of their community that they had contacted the FBI about the theft.</p>

Beanstalk Farms hack

Beanstalk Farms stablecoin project loses $182&nbsp;million to exploit

The algorithmic market maker Wintermute suffered a major hack, according to their CEO. He estimated the loss at around $160&nbsp;million, also writing that the company is "solvent with twice over that amount in equity left".<p>Wintermute hasn't disclosed more about the attack, but it's possible that the hacker may have exploited the <a href="https://web3isgoinggreat.com/?id=vulnerability-discovered-in-vanity-wallet-generator-puts-millions-at-risk" target="_blank">vulnerability in the vanity wallet address generator Profanity</a>, which was disclosed five days prior. The crypto asset vault admin had a wallet address prefixed with <code>0x0000000</code>, a vanity address that would have been susceptible to attack if it was created using the Profanity tool.</p><p>This is the second incident involving Wintermute in the past few months. In June, the group provided the wrong wallet address to the Optimism project, and Optimism sent 20&nbsp;million&nbsp;OP tokens to a non-existent address. Another person noticed the error before they did and was able to take the tokens. They ultimately returned 17&nbsp;million of the tokens to Wintermute, keeping the rest as a "<button class="define-target" id="bug-bounty">bounty</button>". $OP have been trading at around $1 as of mid-September.</p>

"Experts blame a 'vanity address' bug for Wintermute's $160 million hack"

Wintermute hack

Wintermute hacked for $160&nbsp;million

Mango Markets, a Solana-based <button class="define-target" id="defi">defi</button> project offering borrowing, lending, and leverage trading, was exploited for $116&nbsp;million. An attacker manipulated the supposed value of their collateral on the platform, allowing them to take out massive loans from the project treasury that they never repaid. In total, they stole around $116&nbsp;million worth of Solana tokens. However, only a few exchanges have sufficient liquidity to support exchanging or withdrawing that quantity of tokens, and those exchanges (Coinbase, Binance, and Kraken) froze the attacker's wallets.<p>Mango Markets posted on Twitter to urge users not to deposit into the project, and asked the hacker to contact them "to discuss a <button class="define-target" id="bug-bounty">bug bounty</button>". The hacker had their own plans, instead submitting a governance proposal in which they would return $46&nbsp;million of the stolen funds (keeping $70&nbsp;million) in exchange for a promise that the protocol would not try to freeze the assets or pursue criminal charges. The hacker then used their 32&nbsp;million governance tokens to vote in support, but ultimately were not able to get the proposal to pass. A different proposal with largely the same terms, but which left the attacker with only $47&nbsp;million of the stolen funds, passed shortly after.</p>

Mango Markets attack

Mango Markets suffers loss of more than $116&nbsp;million

Hackers were able to discover and exploit a bug in the decentralized exchange Maiar, stealing $113&nbsp;million. Maiar developers took the exchange offline soon after discovering the exploit, but not before the hackers made off with 1.65&nbsp;million EGLD (the native token of the Elrond blockchain, on which Maiar is built). The sale of the pilfered EGLD caused the token to plummet from $76 to $5 on the Maiar exchange.<p>Maiar's founder and CEO has claimed that "most exploited funds have been either recovered in full, or will be covered by the Elrond Foundation", though it's not clear how (or if) any of the funds were recovered.</p>

"Decentralized Crypto Exchange Offline After Hacker Steals $113M"

Maiar exchange hack

Decentralized exchange Maiar exploited for $113&nbsp;million

The Horizon Bridge is a blockchain <button class="define-target" id="bridge">bridge</button> allowing assets to be used across Ethereum, BNB, and Harmony blockchains. The bridge is run by the Harmony blockchain project.<p>On June 23, someone was able to steal assets from the bridge that they then converted to more than 85,800&nbsp;ETH. The stolen funds are notionally valued at almost $100&nbsp;million, assuming the thief can cash them out successfully. Hours after the attack, most of the funds remained in the thief's wallet and had not yet been laundered.</p><p>A June 29 analysis by blockchain research firm Ellipsis claimed that "there are strong indications that North Korea's Lazarus Group may be responsible for this theft". Lazarus was also behind the <a href="https://web3isgoinggreat.com/?id=axie-infinity-suffers-625-million-exploit" target="_blank">$625&nbsp;million bridge hack in March</a>, targeting the Axie Infinity game.</p>

"The $100 Million Horizon Hack: Following the Trail Through Tornado Cash to North Korea"

Horizon Bridge hack

Cryptocurrencies notionally worth $100&nbsp;million stolen from Horizon Bridge

The U.S. Department of Justice announced they had filed charges against Emerson Pires, Flavio Goncalves and Joshua David Nicholas, the two founders and the "head trader" of the EmpiresX cryptocurrency investment platform. The DoJ alleges that the project was a <button class="define-target" id="ponzi">Ponzi scheme</button>, and that they were offering an unregistered security. They also alleged that the duo were misrepresenting a supposed proprietary trading bot, and fraudulently guaranteeing investment returns. The EmpiresX scheme reportedly pulled in $100&nbsp;million from investors, and appears to have run from 2020 until early 2022.<p>All three are facing charges of conspiracy to commit wire fraud and conspiracy to commit securities fraud, and Pires and Goncalves have also been charged with conspiracy to commit international money laundering. If convicted on all counts, Pires and Goncalves face up to 45&nbsp;years in prison and Nicholas faces up to 25&nbsp;years in prison.</p>

"Justice Department Announces Enforcement Action Charging Six Individuals with Cryptocurrency Fraud Offenses in Cases Involving Over $100 Million in Intended Losses"

EmpiresX ponzi scheme

U.S. Department of Justice charges founders of the $100&nbsp;million EmpiresX ponzi scheme

Freeway, a financial scheme where users buy "Superchargers", which are crypto "simulations" that promise to pay out rewards of up to 43% annually, seems to have taken the off-ramp. The project announced to its users that due to "unprecedented volatility in Foreign Exchange and Cryptocurrency markets in recent times", they would be pausing their Supercharger program. The project reportedly halted withdrawals on more than $100&nbsp;million worth of assets.<p>Worryingly, the company also removed all mentions of its team from their website, and reportedly removed an attestation to the company's financial backing as well.</p><p>The day before the project announced the pause, crypto whistleblower and researcher FatMan published a Twitter thread urging people to withdraw funds immediately because he believed they were operating a Ponzi scheme. "In my opinion, it's likely that Freeway will collapse within the next few months and that all depositors will lose everything."</p>

Freeway rug pull

Freeway halts withdrawals, accused of $100&nbsp;million+ rug pull

A crypto researcher who goes by "FatMan" discovered that the Mirror Protocol in the Terra ecosystem contained a serious vulnerability, that was quietly patched with no announcement on May 9. The Mirror Protocol code previously lacked a duplicate check, which meant that attackers could create a short position and then withdraw it repeatedly in the same transaction, taking many times more money than they should have been authorized to withdraw.<p>FatMan discovered one instance where a person deposited $10,000 and later withdrew $4.3&nbsp;million. According to FatMan, they found repeated exploits of this type that earned attackers "well over $30&nbsp;million". Another researcher on Terra forums estimated about $88&nbsp;million had been exfiltrated from the project in this way, over the many months the bug went undiscovered and unpatched by Mirror developers.</p>

"More bad news for Terra as fresh allegations emerge about Mirror Protocol"

Mirror vulnerability

Researcher discovers vulnerability in the Terra Mirror Protocol that allowed attackers to siphon tens of millions from the project

An attacker exploited a bug in Qubit Finance, a decentralized lending platform. The bug allowed them to call the "deposit" function without actually depositing any funds. This enabled the attacker to <button class="define-target" id="mint">mint</button> 77,162&nbsp;xETH collateral, which they exchanged for BNB worth nearly $80&nbsp;million. The platform has said they have tried to contact the exploiter to offer the "maximum bounty", which is apparently $250,000. Tempting, I'm sure.

"Hackers have stolen $80 million in cryptocurrency from the Qubit DeFi platform"

Qubit Finance hack

Attacker exploits a bug in Qubit Finance allowing them to mint unlimited collateral and drain the platform of $80&nbsp;million

A hacker attacked multiple Rari <button class="define-target" id="liquidity-pool">liquidity pools</button> relating to the Fei Protocol, exploiting a known re-entrancy vulnerability that exists on <button class="define-target" id="fork">forks</button> of the Compound protocol. The attacker stole more than $80&nbsp;million from the projects.<p>Fei Protocol tweeted that they had paused borrowing to avoid further thefts, and offered a $10&nbsp;million <button class="define-target" id="bug-bounty">bug bounty</button> if the hacker returned the money.</p>

Fei Protocol hack

$80&nbsp;million stolen from Fei Protocol and Rari

The Pixelmon project promised an ambitious roadmap including a Pokémon-like game where the pixelized Pokémon could be caught and traded, a land project, and rewards to buyers of their "Generation 1" Pixelmon. The 3D pixelized Pokémon on their flashy website and on social media certainly looked promising to the buyers who sunk a total of $70&nbsp;million into the project. Those buyers, who spent 3ETH per mint (~$9,300), were excited to unveil their "fully modeled 3D character[s] that you can interact with". However, when they "hatched" their Pixelmon, buyers were greeted with some truly terrible models, if they were lucky enough to have a model at all — some unveiled just an empty patch of grass, and others found their models appearing partway in the ground.<p>Although the project lead wrote on the Discord that they had "made a horrible mistake" but that they would "completely revamp and redesign" the NFTs, the project appeared to be a cash grab. On the night of the reveal, 1,000&nbsp;ETH ($2.8&nbsp;million) had already been transferred out of the project and split among various addresses. One of the recipients who received 400&nbsp;ETH ($1.1&nbsp;million) immediately went on a shopping spree, buying various big-ticket NFTs with their windfall.</p>

Pixelmon flop

Pixelmon raises $70&nbsp;million only to reveal hilariously bad NFTs

A hacker was able to exploit an infinite mint glitch in the protocol of Cashio, a Solana <button class="define-target" id="stablecoin">stablecoin</button> project. They were able to pull around $50&nbsp;million out of the platform, while also tanking the value of the $CASH token in the process. The attacker left a note in the input data of their Ethereum transactions that "Account with less 100k have been returned. all other money will be donated to charity."<p>Saber, the providers of the Cashio <button class="define-target" id="liquidity-pool">liquidity pool</button>, published a postmortem of the attack in which they wrote that "We do not have the money to pay back depositors." The hack was the second largest in Solana history, behind the <a href="https://web3isgoinggreat.com/?id=2022-02-02-0">February Wormhole hack</a>. Saber entreated the hacker to return the funds, writing, "accounts with over $100k are often users' life savings on leverage, and many of us will seriously be affected financially after this incident."</p><p>On March 28, the attacker sent a message saying that "the intention was only to take money from those who do not need it, not from those who do", and invited users who had over $100,000 to apply to receive their funds back with "an explanation of the source of this money and why you need it back. more detail is better. money will not be refund to rich american and european that don't need it." Somewhat strangely, Cashio themselves began hosting a website to allow affected users to plead with the hacker to return the money.</p>

"Solana Stablecoin Project Cashio Plummets to Zero After Multi-Million Dollar Hack"

Cashio hack

A Robin Hood-esque attacker steals $52&nbsp;million from Cashio, then returns smaller amounts and pledges to donate the rest to charity

The FBI's Cyber Division issued a notification about fraudulent cryptocurrency investment apps that are successfully being used to defraud American investors. The scammers typically claim to offer cryptocurrency investment services to their targets, then convince them to download mobile apps that resemble genuine crypto trading apps (sometimes mimicking actual exchanges). The apps typically show the users' accounts increasing in value, but when users try to withdraw funds they find they're unable. Sometimes the apps defraud their victims even further by claiming they need to pay an additional "tax" before they can withdraw.<p>The FBI stated they had identified 244&nbsp;victims, and estimated the total loss associated with these fraudulent apps to be around $42.7&nbsp;million.</p>

"Cyber Criminals Create Fraudulent Cryptocurrency
Investment Applications to Defraud US Investors"

FBI warns of malicious crypto apps

FBI warns of fraudulent crypto apps that have stolen an estimated $42.7&nbsp;million

Bo Shen, a general partner at Fenbushi Capital and an early adopter of cryptocurrencies, tweeted on November 22 that two weeks prior, someone had stolen $42&nbsp;million in cryptocurrencies from his personal wallet. "The stolen assets are personal funds and do not affect on Fenbushi related entities," he wrote.<p>Analysis by the crypto security firm SlowMist attributed the theft to a compromise of Shen's <button class="define-target" id="seed-phrase">seed phrase</button>. Shen had been using the Trust Wallet software, though the theft does not appear to be related to security issues with the wallet software.</p>

Bo Shen wallet compromise

Early crypto investor loses $42&nbsp;million in wallet compromise

IRA Financial, a platform for managing retirement investments, boasts of being "the first self-directed IRA company to allow their clients to invest in cryptocurrencies, such as Bitcoin, directly via a cryptocurrency exchange". Unfortunately, they were probably also the first to have that feature exploited, when an administrator account was apparently compromised and users' funds were transferred out of their connected Gemini accounts. Two days later, IRA Financial publicly acknowledged "suspicious activity that has affected a limited subset of our customers with accounts on the Gemini cryptocurrency exchange". The stolen funds, taken in a mix of Ethereum and Bitcoin, amounted to around $36&nbsp;million.

IRA Financial hack

$36&nbsp;million taken from retirement accounts of IRA Financial customers investing in crypto

The <button class="define-target" id="defi">defi</button> lending protocol Scream may have taken the "stable" in "stablecoin" a bit too literally when they hardcoded the prices of the Fantom USD (fUSD) and DEI stablecoins. In the past few weeks we've seen many stablecoins wobble, and when fUSD and DEI followed suit, Scream ended up in trouble. Users were able to take advantage of the inaccurately high price to borrow other stablecoins on the cheap, leaving Scream with $35&nbsp;million in <button class="define-target" id="bad-debt">bad debt</button>. The platform's reserves of other stablecoins were completely drained; meanwhile, Scream users holding fUSD or DEI can't withdraw.

"DeFi lender left with $35 million bad debt after quoting depegged stablecoins at $1"

Scream bad debt

Scream lending protocol racks up $35&nbsp;million in bad debt after hardcoding not-so-stablecoin prices to $1

"[I] was a 20-something-year-old kid" said Aiden Pleterski, when asked why he kept his "investment" scheme going when he knew he couldn't repay his existing customers. Although he once described himself as the "Crypto King" in several articles he paid to have run, Pleterski is now undergoing a bankruptcy process and facing multiple lawsuits, where creditors are trying to first <i>find</i> and then recoup the more than $35&nbsp;million they've collectively entrusted to him.<p>So far, the court has seized two McLarens, two BMWs, and a Lamborghini — only a few cars out of the eleven luxury cars Pleterski owned, plus another four he was renting. Investors have also asked about the $45,000-a-month lakefront mansion he was renting in Ontario, watches, and gold bars, hoping they could be liquidated to repay some of his debts.</p><p>Pleterski had promised investors that he would invest on their behalf, taking 30% of any capital gains, with a goal of achieving 10–20% gains <i>biweekly</i>. He also promised that any loss on the initial investment would be paid back in full. Pleterski had made some money in crypto as a teenager, but according to him, he lost most of the money he was given to invest in late 2021 and early 2022 "in a series of margin calls and bad trades". An investor claims that at one point, he was given pictures and videos of financial statements showing an account with $311&nbsp;million, but when he checked with the company supposedly maintaining the account, they said they had no accounts with that kind of funds. So far, the court and investors alike have struggled to untangle Pleterski's mess — according to him, he was unorganized and didn't track his finances or debts.</p>

"Luxury cars seized from 23-year-old 'Crypto King' as investors try to recoup millions"

"Crypto King" scam

Investors seek to recoup around $35&nbsp;million from Canadian "Crypto King" in his early 20s

Popular cryptocurrency <button class="define-target" id="wallet">wallet</button> provider and trading platform Crypto.com briefly suspended trading after acknowledging there had been "unauthorized activity" in user accounts. The platform restored trading later that day after pushing an update to require their users to re-authenticate their sessions and reset two-factor authentication.<p>Although some users reported funds missing from their wallets, including one investor who reported that $16.3&nbsp;million missing, Crypto.com announced that "All funds are safe". Over the next few days this was revealed to be untrue; as of January 20, the total estimated funds stolen from the platform had reached $30&nbsp;million. Large amounts of stolen funds were quickly laundered through Tornado Cash, a popular crypto <button class="define-target" id="tumbler">mixer</button>.</p>

"Crypto.com Suspends Withdrawals After 'Unauthorized Activity'"

"Crypto.com’s Stolen Ether Being Laundered via Tornado Cash"

Crypto.com hack

At least $34&nbsp;million is stolen from users of Crypto.com

The Brazilian crypto lending platform BlueBenx suddenly shut its doors after announcing they had suffered an "extremely aggressive" hack of 160&nbsp;million&nbsp;BRL (US$32&nbsp;million). However, they shared very little in the way of details, leading investors to question the veracity of their story.<p>All 22,000 customers of BlueBenx suddenly found them unable to withdraw funds from the platform. The platform also reportedly laid off the majority of its employees.</p>

"BlueBenx fires employees, halts funds withdrawal citing $32M hack"

BlueBenx hack

Brazilian crypto lender BlueBenx halts customer withdrawals and lays off employees after $32&nbsp;million "hack"

Ichi, a <button class="define-target" id="defi">defi</button> project that allows other projects to create their own <button class="define-target" id="stablecoin">stablecoins</button> suffered cascading liquidations in its Rari pool, leading to a token price crash. Rari is a protocol that allows users earn yields on <button class="define-target" id="liquidity-pool">liquidity pools</button> for various assets. Ichi's liquidity pool on Rari was set up with an extremely high collateral factor (85%) and no supply caps, which allowed borrowers to borrow more $ICHI to use as collateral than actually existed in the liquidity pool, with many borrowing $ICHI to buy more $ICHI. As borrowers did this, the price briefly spiked from the token's early April price of around $70 to $139 before plummeting to below $2.<p>One Rari developer blamed Ichi for the disaster, writing, "Fuse is a permissionless protocol. Pool operators are responsible for following best practices to avoid situations like this one". Rari Capital's official Twitter account also blamed Ichi, stating, "This is a permissionless pool that is owned and operated by Ichi. We hope to see an announcement from Ichi regarding redemption strategies and next steps to make users whole."</p><p>In the FAQ about the incident, Ichi wrote that they had allowed such a high LTV ratio in the pool because they expected "users would make responsible decisions that would benefit the community". There is currently around $30&nbsp;million of <button class="define-target" id="bad-debt">bad debt</button> in the liquidity pool.</p>

"How Ichi Tokens Plunged 90% After Bad Debt Fiasco on Rari"

Ichi hack

Ichi token plummets 90% after Rari liquidity pool is emptied

Major crypto exchange Deribit suffered a <button class="define-target" id="hot-wallet">hot wallet</button> compromise that resulted in a $28&nbsp;million theft. The exchange halted withdrawals to perform security checks, but urged that customer funds were safe and that the loss was covered by company reserves.<p>Deribit is also among the primary creditors of failed crypto hedge fund Three Arrows Capital, which defaulted on an $80&nbsp;million loan from the exchange.</p> 

"Deribit claims crypto hedge fund Three Arrows failed to repay $80mn"

Deribit hack

Crypto exchange Deribit hacked for $28&nbsp;million

A person was able to use a <button class="define-target" id="flash-loan">flash loan</button> attack to drain the Elephant Money project, crashing the token price to 0 while cashing out 27,416&nbsp;BNB ($11&nbsp;million). Losses to the project were likely higher, including the loss of 30 billion $ELEPHANT tokens (~$10&nbsp;million). The project boasted <button class="define-target" id="audit">audits</button> by both CertiK and Solidity Finance on its website, though CertiK later tweeted that the flaw was with the treasury contract, which was unverified and unaudited.<p>Elephant Money is a <button class="define-target" id="defi">defi</button> project with some questionable promises — its Twitter account advertises that people can "earn 672% APY", and a recent tweet encouraged people to use Elephant Money "as your new bank: Your share of ELEPHANT tokens can be compared to your debit account, except that it also generates you money. Stampede Perpetual Bonds is your retirement fund." Hopefully no one took them up on their suggestion to put their debit account balance or retirement money into the project.</p>

Elephant Money hack

Attacker cashes out more than $11&nbsp;million from Elephant Money in a flash loan attack

Earlier today, <a href="https://web3isgoinggreat.com/?id=terra-blockchain-is-halted-after-token-crash-increases-threat-of-governance-attacks" target="_blank">Terra halted their blockchain</a> after a devastating few days. Subsequently, Chainlink's <button class="define-target" id="oracle">oracle</button> paused the price feed, causing it to fall out of sync with the apparent market price of the token. This enabled multiple attacks on various platforms.<p>$13.5&nbsp;million was fraudulently borrowed from the Venus protocol on BSC. Blizz Finance on Avalanche reported their protocol had been entirely drained, amounting to around $8.3&nbsp;million. Blizz subsequently announced in a post-mortem that "Blizz has no treasury or development fund and a significant portion of the stolen assets belonged to our team. As such we regret to announce the protocol has been paused and we do not intend to resume operations."</p>

"Venus Protocol Official Statement regarding LUNA"

Terra oracle attacks

Unexpected oracle data in the wake of Terra blockchain halt enables multiple attacks on other platforms

Many had written off the Bored Bunny NFT project (and its subsequent spin-off NFT collections) as a <button class="define-target" id="rug-pull">rug pull</button>. After releasing several new NFT collections that appeared to be little more than cash grabs, each less popular than the last, the team behind the project grew increasingly distant until going silent for over a month. Meanwhile, the team had pocketed over $21&nbsp;million, largely thanks to the popularity the project had drummed up through influencer promotions from the likes of Jake Paul and Floyd Mayweather (both of whom, incidentally, are facing <a href="https://web3isgoinggreat.com/?id=2022-02-17-1" target="_blank">separate</a> <a href="https://web3isgoinggreat.com/?id=2022-01-07-1" target="_blank">class-action lawsuits</a> alleging impropriety in their promotions of crypto projects).<p>Suddenly, the project creator resurfaced on March 29, with a tweet claiming that he had been absent for a month because he had been... reading emails. The team then announced they would be handing the project reins over to a community member, though there was no mention of the $21.1&nbsp;million that had already been pocketed by the original team.</p><p>The unexpected return came only days after the U.S. Department of Justice <a href="https://web3isgoinggreat.com/?id=2022-03-24-1" target="_blank">announced charges</a> against two perpetrators of a different NFT rug pull, in which they stated unequivocally that "the same rules apply to an investment in an NFT or a real estate development. You can't solicit funds for a business opportunity, abandon that business and abscond with money investors provided you."</p>

Bored Bunny rug puller resurfaces

Creator of apparent $21&nbsp;million Bored Bunny rug pull miraculously resurfaces following DOJ action against a different rug pull

20.8&nbsp;million&nbsp;BUSD, a dollar-pegged stablecoin on BNB Chain, was transferred from Raccoon Network and the Freedom Protocol on July 19. Security firm PeckShield identified the incident as a scam perpetrated by the people running the projects, although Raccoon Network has tried to claim the transfers were the result of a hack.<p>Raccoon Network is a <button class="define-target" id="metaverse">metaverse</button> project. Freedom Protocol invested in the project in late June, and announced they would be working together. Freedom Protocol is a <button class="define-target" id="defi">defi</button> project that advertises an 183,394.2% <button class="define-target" id="apy">APY</button> "compounded by scientific calculations".</p>

Raccoon Network and Freedom Protocol rug pull

$20&nbsp;million taken from Raccoon Network and Freedom Protocol in likely rug pull

As the Ethereum scaling project Optimism worked to create the $OP token, a token they launched in a move towards decentralizing the project's governance, they decided to obtain a loan from a third party, Wintermute, to provide initial liquidity, in exchange for 20 million&nbsp;$OP. However, Wintermute mistakenly provided the wrong multi-sig <button class="define-target" id="wallet">wallet</button> address to Optimism, and the 20&nbsp;million tokens were sent to an address that had not yet been created. The teams attempted to deploy the multi-sig wallet address to retrieve the tokens, but another person noticed the blunder and was able to do so first.<p>Wintermute published a blog post taking responsibility for the error, and announced that they would "proceed to buy OP every time the attacker sells it to make the protocol whole eventually". So far the attacker has sold 1&nbsp;million $OP for about $1&nbsp;million USD.</p><p>Wintermute wrote that they were "open to see this as a white hat exploit", but if the funds were not returned within a week, they were "100% committed to returning all the funds, tracking the person(s) responsible for the exploit, fully <button class="define-target" id="doxxing">doxxing</button> them and delivering them to the corresponding juridical system".</p><p>Remarkably, the attacker returned 17&nbsp;million of the tokens two days later, keeping 2&nbsp;million as a "<button class="define-target" id="bounty">bounty</button>". Wintermute agreed to reimburse the Optimism Foundation for the remaining 2&nbsp;million $OP.</p>

"A Message to the Community from the Optimism Foundation"

"Message to Optimism community from Wintermute"

"Optimism Attacker Returns 17M Stolen OP Tokens"

Optimism tokens sent to wrong address

20 million Optimism tokens sent to nonexistent address, someone else snags them before they can be recovered

The <button class="define-target" id="defi">defi</button> protocol Pando suffered a $20&nbsp;million loss when it was exploited with an <button class="define-target" id="oracle-manipulation">oracle manipulation</button> attack. The protocol suspended several of its projects in response to the hack, and wrote that they hoped to negotiate with the hacker to regain some of the stolen proceeds. Some of the stolen funds were able to be <button class="define-target" id="freezing">locked</button>, although it's not clear if it was the total amount.

Pando attack

Pando exploited for $20&nbsp;million

Helium has two different tokens: HNT, which is paid out to people who run Helium hotspots, and MOBILE, which is paid to those maintaining the new Helium 5G network. However, Binance erroneously treated both tokens as HNT within their exchange. As a result, anyone who sent MOBILE to Binance wound up with that same number of HNT tokens in their wallet — a big benefit, given that HTN has traded between $4 and $7 this past month, and MOBILE is not yet easily tradable.<p>Binance distributed around 4.8&nbsp;million&nbsp;HNT before discovering and patching the bug, valued at around $19&nbsp;million.</p>

"Binance Bungles Accounting for Helium Tokens, Overpays Clients Millions"

Binance makes erroneous payouts due to Helium accounting bug

Binance accounting bug involving Helium tokens results in $19&nbsp;million of erroneous payouts

Animoca Brands' subsidiary Lympo, an NFT platform specifically for sports, experienced a breach of several <button class="define-target" id="hot-wallet">hot wallets</button>. This allowed an attacker to pull 165.2&nbsp;LMT tokens from the platform, equivalent to about $18.7&nbsp;million. The tokens were quickly exchanged for Ether on Uniswap and Sushiswap. The hack caused the value of LMT to drop by 92%, to $0.0093.

"Animoca Brands’ Lympo NFT platform hacked for $18.7 million"

Lympo hack

Sports NFT platform Lympo loses $18.7&nbsp;million to a breach

Exploits and <button class="define-target" id="rug-pull">rug pulls</button> of random tokens on BNB Chain are fairly commonplace, but typically the amount of money lost is fairly minimal. In this case, exploiters or insiders were able to siphon 3.9&nbsp;billion $FLARE from the Flare project, which they swapped for just under $17&nbsp;million.<p>This serves as a good example of how theft amounts shouldn't be naively calculated based on the token price before the theft × the number of tokens stolen. $FLARE was priced at around $18.25 before the attack, and a naive calculation would place the theft amount at $71&nbsp;billion. However, the lack of liquidity caused the token price to plummet to $0.0000018, and the attacker ultimately ended up with around $17&nbsp;million.</p>

Flare token hack

Flare token rug pulls or is exploited for $17&nbsp;million

An attacker targeting the <button class="define-target" id="defi">defi</button> project Inverse Finance was able to manipulate the price oracle of INV/ETH, artificially inflating the apparent price of INV and allowing the attacker to borrow against it. The attacker was ultimately able to turn the borrowed DOLA, ETH, WBTC, and YFI tokens, priced at a total of around $15.6&nbsp;million, into around 4300&nbsp;ETH (priced at around $14.5&nbsp;million). As of early April 2, the attacker had transferred 1,300&nbsp;ETH (around $4.5&nbsp;million) to a <button class="define-target" id="tumbler">tumbler</button> to make it more difficult to trace.

Inverse Finance hack &#35;1

Attack on Inverse Finance results in a $15.6&nbsp;million loss

Attackers were able to take advantage of an <a href="https://web3isgoinggreat.com/?id=ankr-defi-project-exploited" target="_blank">exploit</a> on the Ankr protocol to obtain around 183,000&nbsp;aBNBc tokens for only 10&nbsp;BNB (~$2,900). Before the Ankr exploit, which crashed the price of aBNBc, this many aBNBc tokens would have had a notional value of around $55.5&nbsp;million. An issue with the price <button class="define-target" id="oracle">oracle</button> on the staking platform Helio allowed attackers to borrow 16,444,740&nbsp;HAY, a <button class="define-target" id="stablecoin">stablecoin</button> intended to be pegged to the US dollar. The attackers then swapped those HAY for around $15&nbsp;million in the BUSD stablecoin. Meanwhile, the HAY stablecoin lost its peg, crashing as low as $0.20.

"How Attackers Made $15M From Staking Platform Helio After Ankr Exploit"

Helio attack

Oracle attack on Helio, enabled by a separate hack on Ankr, allows attackers to steal $15&nbsp;million

In October, <a href="https://web3isgoinggreat.com/?id=several-users-report-losing-more-than-a-million-dollars-each-in-3commasftx-theft" target="_blank">several people reported losing more than a million dollars each</a> from accounts that were connected to the 3Commas trading platform. 3Commas vociferously denied that there was any security breach of their crypto trading service, instead claiming that some of their users were at fault for being <button class="define-target" id="phishing">phished</button> and having assets stolen. Now that someone has published the API key database that was exfiltrated from 3Commas, however, the company has finally owned up to the breach. They confirmed the data in the files was legitimate on Twitter, and wrote that they had contacted Binance, Kucoin, and other exchanges with whom they integrate to ask them to revoke all API keys connected to 3Commas.<p>3Commas did not come off looking very good after this incident, after they spent weeks denying any breach and accusing those who were concerned 3Commas had been compromised of spreading misinformation and "<button class="define-target" id="fud">FUD</button>".</p><p>Researcher zachxbt wrote that he had verified 44 victims who had lost a combined $14.8&nbsp;million due to the leak, although he acknowledged that this was only the number of people he could verify and that the total number of people affected was likely much higher.</p>

Tweet thread by 3Commas CEO and founder Yuriy Sorokin

3Commas API key leak

3Commas finally owns up to API key leak

Team Finance is a project that helps projects lock their tokens to be released after a certain period or on a schedule. A hacker exploited a vulnerability in a <button class="define-target" id="smart-contract">smart contract</button> that enabled users of Team Finance to migrate from version two to version three of their project, despite that contract being <button class="define-target" id="audit">audited</button>. The attacker made off with $14.5&nbsp;million thanks to the vulnerability.

Team Finance hack

$14.5&nbsp;million stolen from Team Finance

The <button class="define-target" id="defi">defi</button> project Deus Finance was hit with a <button class="define-target" id="flash-loan">flash loan</button> attack that netted the hacker $13.4&nbsp;million. The loss to the protocol was likely larger than what the hacker was able to withdraw, though Deus announced that no users had been <button class="define-target" id="forced-liquidation">liquidated</button> and that "the loss is on the protocol".<p>Deus had suffered a <a href="https://web3isgoinggreat.com/?id=hackers-make-off-with-over-3-million-from-deus-finance" target="_blank">similar attack</a> in March, with an attacker using a flash loan attack to steal more than $3.1&nbsp;million. Deus reimbursed users who were liquidated in the incident.</p><p>According to Deus' CEO, the exploit in this incident was not the same one used in the previous attack. He wrote on Twitter that the exploit was "the first of its kind, a <a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank">zero-day</a> exploit on Solidly [decentralized crypto exchange] swaps".</p>

"How Deus Finance Was Exploited for $13.4M on Fantom"

Deus Finance hack &#35;2

Deus Finance exploited for $13.4&nbsp;million in the second hack in two months

An attacker using a <button class="define-target" id="flash-loan">flash loan</button> attack targeted two projects on the Gnosis blockchain: Hundred Finance and Agave Finance. Each project paused their smart contracts, but not before the attacker made off with a considerable sum of money. That day, the attacker put the funds through a cryptocurrency <button class="define-target" id="tumbler">tumbler</button>, making it much more difficult to trace the collective 4,479&nbsp;ETH that was stolen in roughly equal amounts from each protocol.<p>Hundred and Agave were the second and third defi protocols targeted by flash loan attacks that same day, with <a href="https://web3isgoinggreat.com/?id=2022-03-15-0" target="_blank">Deus Finance losing more than $3&nbsp;million</a> to hackers using the same class of exploit.</p>

"DeFi protocols Agave and Hundred Finance exploited on Gnosis Chain for $11 million"

Hundred Finance and Agave Finance hacks

Hundred Finance and Agave Finance are both exploited for a collective $12&nbsp;million

An exploiter used a <button class="define-target" id="flash-loan">flash loan</button> attack to pull 3,933&nbsp;ETH (~$11&nbsp;million) from the "decentralized automated market maker" Saddle Finance. Shortly after the attack, the hacker began moving the stolen funds through the Tornado Cash <button class="define-target" id="mixer">tumbler</button> to launder the money.<p>Saddle Finance had lost money once before, right after it launched in January 2021. An individual was able to arbitrage Saddle Finance <button class="define-target" id="liquidity-pool">pools</button> for a profit of around $275,000.</p>

Saddle Finance hack

Saddle Finance loses more than $11&nbsp;million to hack

<i>The Philadelphia Inquirer</i> published a report on VBit Technologies, later Advanced Mining Group, a company that promised investors to buy and operate Bitcoin miners on their behalf and pay them out the returns. Much of the group's operations relied on a system of "affiliates" bringing in more investors — a sort of suspicious triangular-shaped scheme — and executives and top-performing affiliates enjoyed lavish rewards including expensive wines, six-figure sports cars, and fancy vacations.<p>However, customers trying to withdraw their "rewards" saw increasing delays in receiving their payouts — days, then weeks, then an indefinite pause. A COO hired by the group left the company only three weeks later. On June 27, the group sent an email to its customers explaining that there was a "potential pending settlement" with the SEC — the first customers heard of the existence of <i>any</i> investigation — and that they would no longer serve customers in the U.S. On July 15, the company promised to refund customers what they paid to sign up with the program, but no refunds or further updates have materialized.</p><p>The company has faced lawsuits in Washington state and Delaware, and apparently operated for two years after executives had acknowledged they were violating securities laws. The Delaware lawsuit describes the operation as a Ponzi scheme, and alleges that the company sold packages that would have required far more computing power than the company actually had access to.</p>

"Investors fear millions lost in Pennsylvania’s largest cryptocurrency scandal based in South Philly"

VBit Technologies investors face losses

Investors face $11&nbsp;million loss in VBit Technologies/Advanced Mining Group, an alleged crypto Ponzi scheme

<button class="define-target" id="yield-farming">Yield farming</button> platform ArbixFinance was drained of at least $10&nbsp;million, with some reporting amounts up to $32&nbsp;million. Some optimistic users hoped it was a glitch, but the fact that the formerly-active @ArbixFinance Twitter account disappeared along with their website as the funds were being drained points to a <button class="define-target" id="rug-pull">rugpull</button>. The platform had previously been audited and approved by CertiK in November, lending the project credibility in the eyes of prospective users.

ArbixFinance rug pull

ArbixFinance appears to rug pull, making off with at least $10&nbsp;million

Hackers drained more than $10&nbsp;million from the project Dego Finance. This also plunged the value of the project's $DEGO token by about 78%. Dego claims that the hackers compromised the keys to the address providing liquidity on UniSwap and PancakeSwap. Dego, which is a <button class="define-target" id="defi">decentralized finance</button> project, asked the various major exchanges to step in and prevent trading of the token, a type of intervention by centralized exchanges that is precisely what defi is supposed to prevent from happening.

"DeFi Project Dego Finance Hacked: Exploiters Reportedly Drain Over $10M"

Dego Finance

Hackers take more than $10&nbsp;million from defi project Dego Finance 

A vulnerability in the Superfluid crypto streaming protocol allowed an attacker to drain $8.7&nbsp;million, affecting projects including Mai Finance, Stacker Ventures, Stake DAO, and the Museum of Crypto Art.

"Polygon stablecoin Qi Dao exploited for $13M on Superfluid vested contract"

Superfluid hack

Exploit of Superfluid vesting contract nets attacker $8.7&nbsp;million

In a successful, broadly-targeted <button class="define-target" id="phishing">phishing</button> campaign, more than 70,000 addresses connected to Uniswap were <button class="define-target" id="airdrop">airdropped</button> tokens that baited users into approving transactions that allowed attackers to control their wallets. After some initial confusion that there might be a vulnerability in Uniswap itself, it was determined that the thefts were being perpetrated through the airdrop, which also linked users to a website that resembled the authentic Uniswap site. Users were tricked into signing the contract, and cryptocurrency and NFTs were stolen from wallets.<p>One single wallet targeted by the phishing attack lost more than $6.5&nbsp;million worth of Ether and Bitcoin, and another targeted by attackers lost around $1.68&nbsp;million worth of those currencies.</p>

"Someone Lost Millions Trying to Claim $2K Crypto Airdrop"

Uniswap phishing attack

More than $8.17&nbsp;million stolen in phishing attack targeting Uniswap users

BitKeep, a popular cryptocurrency <button class="define-target" id="wallet">wallet</button> in Asia, suffered a hack in which at least $8&nbsp;million in various cryptocurrencies were stolen from user accounts.<p>BitKeep has claimed that attackers were able to compromise a version of their software and introduce malicious code which enabled them to drain user funds. BitKeep recommended their users contact the team behind BNB Chain on social media to plead with them to freeze an address used by the hackers, although the attackers had already begun to <button class="define-target" id="tumbler">tumble</button> the funds.</p><p>This is the second BitKeep-related hack in the last few months. <a href="https://web3isgoinggreat.com/?id=bitkeep-swap-hacked-for-more-than-1-million" target="_blank">In October</a>, hackers stole more than $1&nbsp;million worth of BNB when the Swap feature of the BitKeep wallet was exploited.</p>

BitKeep hack

Millions of dollars of user funds stolen in BitKeep wallet hack

Eight people were arrested in China after being connected to a <button class="define-target" id="rug-pull">rug pull</button>. One investor lost ¥590,000 ($90,000) he had poured into the token in June, when project owners took the website offline and pulled all of the money out. A total of ¥50&nbsp;million (a bit below $7.9&nbsp;million) was lost to the scam.

"Chinese Police Arrest 8 People Related to $7.8M Rug Pull"

Chinese rug pull arrest

Chinese police arrest eight people over a $7.8&nbsp;million rug pull

The Arbitrum-based crypto lending platform Lodestar Finance was attacked by an exploiter who was able to manipulate the price of the plvGLP token, allowing them to "borrow" the entire available liquidity of the Lodestar platform with the inflated token. The attacker made around $6.4&nbsp;million in profit. Some of the stolen tokens were <button class="define-target" id="burn">burned</button>—hence the difference between the attacker profit and the loss to the platform.<p>According to Lodestar, they think they may be able to recover around $2.4&nbsp;million of the stolen funds. Meanwhile, they have attempted to contact the thief to try to negotiate the return of stolen funds. "We will generously reward your collaboration," they wrote on Twitter.</p>

Event	Date	Amount More info
Axie Infinity bridge hack	March 29, 2022	$625,000,000
Binance bridge hack	October 6, 2022	$570,000,000
FTX hack	November 11, 2022	$370,000,000
Wormhole bridge hack	February 2, 2022	$320,000,000
Nomad bridge hack	August 1, 2022	$190,000,000
Beanstalk Farms hack	April 17, 2022	$182,000,000
Wintermute hack	September 20, 2022	$160,000,000
Mango Markets attack	October 11, 2022	$116,777,480
Maiar exchange hack	June 5, 2022	$113,000,000
Horizon Bridge hack	June 23, 2022	$100,000,000
EmpiresX ponzi scheme	June 30, 2022	$100,000,000
Freeway rug pull	October 23, 2022	$100,000,000
Mirror vulnerability	May 26, 2022	$88,000,000
Qubit Finance hack	January 27, 2022	$80,000,000
Fei Protocol hack	April 30, 2022	$80,000,000
Pixelmon flop	February 25, 2022	$70,000,000
Cashio hack	March 23, 2022	$52,000,000
FBI warns of malicious crypto apps	July 18, 2022	$42,700,000
Bo Shen wallet compromise	November 10, 2022	$42,000,000
IRA Financial hack	February 8, 2022	$36,000,000
Scream bad debt	May 16, 2022	$35,000,000
"Crypto King" scam	September 20, 2022	$35,000,000
Crypto.com hack	January 17, 2022	$34,000,000
BlueBenx hack	August 14, 2022	$32,000,000
Ichi hack	April 11, 2022	$30,000,000
Deribit hack	November 1, 2022	$28,000,000
Elephant Money hack	April 12, 2022	$22,000,000
Terra oracle attacks	May 12, 2022	$21,800,000
Bored Bunny rug puller resurfaces	March 29, 2022	$21,100,000
Raccoon Network and Freedom Protocol rug pull	July 19, 2022	$20,816,856
Optimism tokens sent to wrong address	June 8, 2022	$20,000,000
Pando attack	November 6, 2022	$20,000,000
Binance makes erroneous payouts due to Helium accounting bug	September 16, 2022	$19,000,000
Lympo hack	January 10, 2022	$18,700,000
Flare token hack	November 13, 2022	$17,000,000
Inverse Finance hack #1	April 2, 2022	$15,600,000
Helio attack	December 1, 2022	$15,000,000
3Commas API key leak	December 28, 2022	$14,800,000
Team Finance hack	October 27, 2022	$14,500,000
Deus Finance hack #2	April 28, 2022	$13,400,000
Hundred Finance and Agave Finance hacks	March 15, 2022	$12,066,426
Saddle Finance hack	April 30, 2022	$11,078,985
VBit Technologies investors face losses	September 7, 2022	$11,000,000
ArbixFinance rug pull	January 3, 2022	$10,000,000
Dego Finance	February 9, 2022	$10,000,000
Superfluid hack	February 8, 2022	$8,700,000
Uniswap phishing attack	July 11, 2022	$8,167,500
BitKeep hack	December 26, 2022	$8,000,000
Chinese rug pull arrest	January 14, 2022	$7,800,000
Lodestar Finance attack	December 10, 2022	$6,900,000