The users of more than 300&nbsp;Ledger cryptocurrency wallets have suffered an estimated $86&nbsp;million to $93&nbsp;million in losses after thieves drained assets across blockchains including bitcoin, Ethereum, and Tron. Ledger is a popular manufacturer of <button class="define-target" id="hardware-wallet">hardware wallets</button> — a type of physical, offline device used to store cryptocurrency keys in an attempt to be more secure than storing keys on Internet-connected devices.<p>Ledger has claimed that the targeted wallets appear to have been sold via CryptoBilis, a Southeast Asian reseller that operates in Indonesia, Malaysia, and the Philippines. Ledger said that at least one affected device "contained an unauthorized hardware implant". Several third party researchers disassembled affected hardware devices, finding that a chip and antenna had been added to capture crypto wallet seed phrases and transmit the data to the attacker using a cellular connection.</p>

"Ledger confirms spy chip implant behind wallet crypto thefts"

"Ledger says unauthorized implant found in at least one device sold by CryptoBilis"

CryptoBilis hardware wallet tampering

At least $86&nbsp;million stolen via tampered Ledger hardware wallets resold by CryptoBilis

Exploiters took advantage of a legacy approvals bug in an old payment processor called Limit Break, which the platform had stopped using in late 2024. The bug affected listings on Magic Eden's EVM marketplace, which the company had shut down earlier this year. The attackers were able to steal numerous NFTs, including 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate Apewives. Attackers also subsequently stole 660&nbsp;<button class="define-target" id="wrapped-token">w</button>ETH (~$1.78&nbsp;million).<p>A whitehat rescue spearheaded by blockchain researcher 0xQuit took control of 23,155 NFTs he estimated to be worth "north of $5.7M&nbsp;USD", which he said would be returned to their owners after they revoked the permissions that made the assets vulnerable to theft.</p>

Magic Eden NFT exploited for $1.8&nbsp;million

Magic Eden users lose NFTs and  $1.8&nbsp;million in wETH to legacy approvals exploit

Attackers stole $387.5&nbsp;million in crypto assets from Bitget, a cryptocurrency exchange originally founded in Singapore and headquartered out of the Seychelles. Centralized stablecoin issuers Circle and Tether (issuers of USDC and USDT) froze $318,000 in stolen assets, but the vast majority were swapped to decentralized cryptocurrencies and have not been frozen.<p>Bitget CEO Gracy Chen has said the company believes that a North Korean cybercrime group may be behind the theft. Bitget halted withdrawals shortly after the theft was noticed, citing the need to prevent attackers from stealing more assets. Bitget has said they have sufficient assets to cover the stolen funds.</p>

"Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program"

Bitget hack

Bitget crypto exchange hacked for $388&nbsp;million, pauses withdrawals

The Duelbits crypto gambling site lost around $7&nbsp;million to an apparent <button class="define-target" id="hot-wallet">hot wallet</button> compromise. The site went offline shortly after the attack, and the company has said the site will stay offline "until we have clarity". The Curaçao-based platform offers casino games and sportsbetting.

Duelbits hack

Duelbits crypto casino goes offline after $7&nbsp;million theft

The Payy Network, a stablecoin infrastructure company, disclosed that a <button class="define-target" id="bridge">bridge</button> <button class="define-target" id="smart-contract">contract</button> had been fully drained of funds, netting attackers $1.8&nbsp;million. They later stated that the theft was "NOT a compromised key, social engineering or exploit of our off-chain infrastructure," but has not disclosed what it was. They also announced that the stolen funds were "users' non-custodial deposits to Payy Network / Payy Wallet", which is somewhat of an oxymoron.<p>Payy Network has halted all activity following the attack.</p>

Payy Network bridge exploit

Payy Network bridge fully drained of $1.8&nbsp;million

An exploiter was able to <button class="define-target" id="mint">mint</button> unbacked <button class="define-target" id="wrapped-token">wrapped</button> MTR and MTRG tokens, notionally priced at more than $2.3&nbsp;million. They sold some of the tokens on a decentralized exchange, crashing the MTRG price by more than 88%. The price of the project's MTR token — which is supposed to maintain a stable price based on the cost to produce 10 kWh of electricity — also plummeted by approximately the same percentage. Meter has attributed the exploit to a "block validation flaw".<p>Meter paused the blockchain and bridge, and has urged people not to trade the token. They have warned that "Transactions after block 100731417 may not be honored", suggesting they are considering a blockchain rollback.</p><p>Meter suffered another <a href="https://www.web3isgoinggreat.com/?id=meter-passport-bridge-exploited" target="_blank">bridge attack in February 2022</a>, which amounted to $4.3&nbsp;million.</p>

Meter unauthorized mint

Meter token prices crash after unauthorized mint

Neutron, a blockchain in the Cosmos ecosystem that entered maintenance mode in June, suffered a governance attack when someone spent $20,200 to acquire enough NTRN governance tokens to pass a vote allowing them to take control of the Neutron-based Astroport and Drop applications, whose contracts contained a combined $9.5&nbsp;million in assets.<p>Neutron was paused shortly after the attack, and validators subsequently paused the entire Cosmos Hub network. Together, the pauses prevented the attacker from cashing out the entire amount, though they successfully made off with $1.8&nbsp;million that they were able to bridge to Ethereum prior to the pause. Cosmos Hub remained paused for approximately 24 hours. During the pause, validators coordinated to move approximately 1.73&nbsp;million ATOM from the attacker's wallet to a multi-signature wallet controlled by a group of companies operating network validators.</p>

"Neutron Governance Attack: Cosmos Hub Response and Recovery Update"

"Neutron is Transitioning to Long Term Support"

"Cosmos hub halts for 24 hours after Neutron governance attack"

Neutron governance attack

Projects on the defunct Neutron chain lose $1.8&nbsp;million to governance attack, Cosmos Hub halts chain

One attacker stole crypto tokens from three cryptocurrency projects that are part of what's called the "Artificial Superintelligence Alliance" — a group of crypto projects "dedicated to decentralized Artificial General Intelligence". The attack occurred within just one day, netting around $2.25&nbsp;million in actual profits, though the stolen tokens were notionally priced considerably higher.<p>Most of the profits came from stolen FET tokens, which are linked to Fetch.ai. The attacker was also able to perform unauthorized mints of various tokens, crashing their prices but earning the attacker little in the way of profits. Security researchers noticed that attackers stole assets from sixteen wallets spanning the three companies, suggesting they had significant access to all three companies' systems. Almost $290,000 was taken from a contract used for company payroll.</p>

"$2M stolen in triple attack on Fetch.ai, NuNet, and SingularityNET"

Fetch.ai, NuNet, and SingularityNET theft

Single attacker steals $2.25&nbsp;million from three crypto projects in the "Artificial Superintelligence Alliance"

An unauthorized withdrawal of 3,998.5&nbsp;BTC (~$320&nbsp;million) from the Liquid Network, a bitcoin <button class="define-target" id="sidechain">sidechain</button>, prompted a network halt. By disabling nodes that <button class="define-target" id="bridge">bridge</button> between Liquid and the bitcoin mainchain, attackers are limited in their ability to cash out via bridge. Blockstream, the developers of Liquid Network, also said they had contacted exchanges to ask them to pause LBTC deposits and withdrawals, cutting off another avenue.<p>The unauthorized transaction included a message reading "we are <button class="define-target" id="whitehat">whitehats</button>. contact us on chain", suggesting the possibility that the withdrawal was in fact well-intentioned security researchers aiming to "rescue" funds after discovering they were vulnerable and then return them to a secure wallet. After some back and forth, the attacker returned 3,400&nbsp;BTC (~$272&nbsp;million) keeping 600&nbsp;BTC (~$48&nbsp;million), likely as a "<button class="define-target" id="bug-bounty">bounty</button>".</p>

Liquid Network exploit

4,000&nbsp;BTC (~$320&nbsp;million) stolen from Liquid Network by claimed whitehats, 90% returned 

Defi lending project More Markets lost $9.3&nbsp;million after an attacker was able to trick the lending protocol logic and empty the project's reserve. The attack was noticed by blockchain security researchers at Blockaid; More Labs later announced they were investigating. Oddly, while acknowledging that funds had been stolen, they wrote, "Our initial investigation reveals that MORE was not exploited. MORE's contracts are secure. MORE is solvent. The protocol is paused." They claimed that only 5% of the assets were bridged out of the Flow blockchain, though did not explain how they planned to prevent the attacker from moving more tokens or collapsing the token price entirely.

More Markets exploit

More Markets exploited for $9.3&nbsp;million

The ostensibly decentralized Cronos blockchain was halted after a price manipulation attack allowed an attacker to borrow around $120&nbsp;million against nearly worthless collateral from the Tectonic lending platform. The attacker pumped the price of the thinly traded TONIC token, the native token of Tectonic, then borrowed against it. The attacker cashed out approximately $9.19&nbsp;million by bridging it to Ethereum before the Cronos chain was halted, limiting their profits. The blockchain was offline for almost 24 hours, during which time it was rolled back to a block prior to the hack — essentially undoing all the transactions that occurred after that block.<p>Cronos was launched by the exchange Crypto.com in 2021, and although the two entities are technically separate, they remain very closely linked. Because the Cronos chain is maintained by a relatively small number of validators, many controlled by Crypto.com, it was relatively easy to halt the chain — though the move was criticized by some who felt that it only illustrated Cronos' lack of decentralization and immutability. Some criticized the decision to halt the chain for nearly 24 hours over an exploit of a third-party protocol.</p>

"Cronos halts blockchain after $75 million lending exploit hits lending app Tectonic"

"Cronos Erased Two Hours of Transactions to Reverse $111 Million DeFi Exploit"

Tectonic theft

Crypto.com-affiliated Cronos blockchain halted after Tectonic theft

A vulnerability in a smart contract belonging to Rain, a crypto payments infrastructure provider, resulted in $1.1&nbsp;million in losses to various firms. Customers of the Avici cryptocurrency neobank, which offers a Visa credit card through which customers can spend crypto, suffered roughly $500,000 in losses. Customers of another neobank, Tria, lost more than $430,000.<p>The losses are somewhat unusual because the neobanks describe themselves as self-custodial, which normally means that customers have total control over their crypto assets rather than storing them on a third-party platform. Normally, self-custody is more resilient to exploits like this, given that assets remain in user wallets. However, because these neobanks require customers to load funds they want to be able to spend into a third-party contract, they were vulnerable to the theft.</p>

"A $1.1 million crypto card hack crashed a neobank's token 49%"

Avici exploit

Exploit on Rain crypto payments infrastructure provider causes losses for "self-custodial" neobanks

An attacker stole around $8.7&nbsp;million from the Moonwell defi lending protocol after manipulating the price of an illiquid token called MAMO. After pumping the MAMO token price, they "borrowed" various assets and abandoned the overinflated collateral.<p>This theft is the fourth Moonwell exploit in less than a year, following a <a href="https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction" target="_blank">$3.7&nbsp;million oracle manipulation attack</a> in November 2025, another <a href="https://www.web3isgoinggreat.com/?id=moonwell-exploit" target="_blank">oracle attack</a> in February 2026 amounting to $1.78&nbsp;million, and a <a href="https://www.web3isgoinggreat.com/?id=moonwell-governance-attack" target="_blank">$1&nbsp;million governance attack</a> in March.</p>

"Moonwell investigates lending market issue on Base as security firms flag multimillion-dollar exploit"

Moonwell price manipulation attack

Moonwell loses $8.7&nbsp;million to fourth exploit in less than a year

Ethereum lending protocol Term Finance lost around $8.5&nbsp;million when an attacker purchased the majority of the project's governance token — which was not widely held — and then voted themselves to be the controller of the project's vaults. Although the project has governance safeguard, including a timelock and veto procedure, neither went into effect for reasons the project has yet to explain.<p>The attacker withdrew around 2,843&nbsp;ETH (~$6.9&nbsp;millon) and $1.68&nbsp;million in the USDC stablecoin, amounting to about 68% of assets on the platform.</p><p>Term Finance previously lost $1.65&nbsp;million to an oracle misconfiguration error in April 2025, but recovered $1&nbsp;million of the funds.</p>

"Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power"

Term Finance governance attack

Term Finance loses $8.5&nbsp;million to governance attack

Multiple blockchains based on the Cosmos chain suffered exploits after Cosmos Labs publicly disclosed a vulnerability in the Cosmos EVM. Some have criticized Cosmos for "negligence" in their vulnerability management. KiiChain, one of the affected chains, wrote in their postmortem, "This loss was avoidable. ... Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit. Standard responsible disclosure exists precisely to prevent this. Cosmos Labs gave no advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains that a public release had happened until Friday 21 August, two days later."<p>KiiChain was exploited for around 148&nbsp;million KII, which the attacker was able to cash out for around $1.6&nbsp;million. TAC, a Telegram-focused blockchain, was exploited for about 3&nbsp;billion&nbsp;TAC (~$7.5&nbsp;million). Nesa Chain was exploited, and though an attacker was able to steal tokens nominally worth $50&nbsp;million, lack of liquidity limited their profits to around $60,000. A blockchain called MANTRA also halted due to an exploit, but the network said that no user funds were impacted.</p>

"Cosmos Labs under fire over disclosure of bug affecting four blockchains"

Cosmos-based blockchain exploits

KiiChain, TAC, and other Cosmos-based blockchains exploited after "negligent" vulnerability disclosure

An attacker took advantage of a bug in the authorization logic for the BounceBit layer-1 blockchain, allowing them to transfer around 286.5&nbsp;million&nbsp;BB (~$3&nbsp;million) from nine wallets. BounceBit halted the blockchain shortly after, then later announced they would be permanently shutting down the chain and reissuing tokens on Binance's BNB Chain. "Maintaining a standalone Layer 1 is no longer the most effective way to serve our users," they said. They explained that it would be challenging to patch the underlying flaw because the chain was based on Evmos, an Ethereum blockchain implementation that was shut down in May.<p>BounceBit, a bitcoin <button class="define-target" id="restaking">restaking</button> protocol, raised $6&nbsp;million in seed funding in 2024 from Blockchain Capital, Breyer Capital, Bankless Ventures, OKX Ventures, HTX Ventures, and others.</p>

"Bitcoin restaking protocol BounceBit raises $6 million in seed funding; already boasts over $545 million in TVL"

BounceBit exploit

BounceBit exploited for $3&nbsp;million, announces shutdown and migration

The Maya Protocol announced that an attacker had stolen 20&nbsp;BTC (~$1.4&nbsp;million) and various other assets totaling $1.76&nbsp;million. A postmortem disclosed that the "sophisticated attacker exploited six chained bugs" to steal the assets. "The bugs exploited were not caught by Halborn <button class="define-target" id="audit">audit</button>, nor Fable 5 audit", wrote Maya founder on Twitter. Halborn is a blockchain security firm; Fable 5 is an AI model developed by Anthropic.

MAYAChain exploit

$1.76&nbsp;million stolen from MAYAChain in attack exploiting six bugs

The Coinsbuy crypto platform was exploited for around $8&nbsp;million across both the Ethereum and Tron blockchains. The attacker was able to steal the funds from eight <button class="define-target" id="wallet">wallets</button> belonging to the exchange. The wallets were later replenished by Coinsbuy, suggesting that the attack vector did not involve compromising the wallets themselves.<p>Coinsbuy has said that the vulnerability has been addressed, and offered a $100,000 "<button class="define-target" id="bug-bounty">bounty</button>" for the returned funds.</p>

"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains"

Coinsbuy exploit

Coinsbuy exploited for $8&nbsp;milllion

Thousands of users of a <button class="define-target" id="hardware-wallet">hardware wallet</button> called Coldcard, a physical device developed by the Canadian Coinkite firm to allow bitcoin holders to store their bitcoin on a device that's not connected to the internet, have suffered at least 2,055&nbsp;BTC (~$130&nbsp;million) in combined losses after thieves began exploiting a flaw with the wallet firmware's <button class="define-target" id="seed-phrase">seed phrase</button> generation. A 2021 version of the device firmware, which affects a wide range of Coldcard devices, skipped the device's more secure hardware randomness generator and instead fell back to generating seed phrases with random numbers <a href="https://en.wikipedia.org/wiki/Random_seed" target="_blank">seeded</a> from the device's serial number and clock registers. The resulting seed phrases are relatively trivially guessed, and hackers have been methodically draining vulnerable wallets as researchers warn that all vulnerable Coldcard devices will be drained soon if their owners do not move assets to secure wallets.<p>An estimated 2,055&nbsp;BTC (~$130 million) and counting has been drained in the days following the discovery of the attack, which began with an attack that saw 594&nbsp;BTC ($38&nbsp;million) drained from about 500 separate wallets. The first attack seemed to intentionally target higher-value wallets, with only wallets containing 0.15&nbsp;BTC (~$9,500) or more impacted. Attacks have come from an estimated 15 unique groups, according to Galaxy Research.</p><p>Hardware wallets are often used by more security conscious users, or those with more significant sums of money at risk, because the lack of internet connection makes the devices less vulnerable to phishing or malware-based attacks. However, if a wallet seed phrase can be obtained by an attacker, the lack of internet connection is no barrier to theft. Coldcard describes itself as "ultra-secure", and its website is filled with reviews describing the product as "one of the most secure Bitcoin hardware wallets ever built".</p>

"Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets"

"Major bitcoin wallet flaw drains $38 million worth of BTC in 25-minute sweep"

Coldcard hardware wallet flaw

Coldcard hardware wallet flaw sees more than 2,000&nbsp;BTC (~$130 million) drained across thousands of wallets

South Korean police say scammers running a fake <button class="define-target" id="staking">staking</button> website under the name of the real Flare Network took 3.4&nbsp;million XRP (~$8.5&nbsp;million) from 71 investors. It's possible the scammers stole closer to $19&nbsp;million. Victims were promised guaranteed returns of 1.5% to 1.8% a month; the site was only live for about a week in October 2025 before the operators disappeared with the deposits.<p>Two men were arrested on fraud charges, and Korean police are seeking a third. They reportedly advertised the scam project via YouTube and online articles.</p>

"12.3 Billion Won Crypto Scam Group Arrested"

Fake Flare Network staking site

Two arrested after Flare Network staking site scammed users out of 3.4 million XRP (~$8.5 million)

Singapore-based stablecoin payments company Triple-A confirmed that an attacker stole $11.8&nbsp;million in company funds from its treasury wallets. The company briefly took some services offline while they investigated the hack.<p>Triple-A did not say how much was taken or how the wallets were compromised, and said the impact was limited to "specific operational accounts" and able to be covered by treasury reserves. Blockchain analyst Specter estimated the loss at $11.8&nbsp;million, stolen across the bitcoin and Tron networks.</p>

"Official Statement Regarding Recent Wallet Activity"

Triple-A hack

Triple-A hacked for $11.8&nbsp;million

Balance Coin, a small <button class="define-target" id="algorithmic-stablecoin">algorithmic stablecoin</button> built on BNB Chain, lost its dollar <button class="define-target" id="peg">peg</button> and crashed to fractions of a cent after an attacker successfully exploited a flaw in its pricing logic. The attacker was able to trick the system into accepting an incorrectly low bitcoin price, which they then used to drain multiple vaults used by the project's lending protocol.<p>The attacker ultimately profited by about $912,000, consisting of funds stolen from 42DAO, the entity that runs the Balance protocol.</p>

"Balance stablecoin collapses 99% after $1 million exploit drains its bitcoin vaults"

Balance Coin algorithmic stablecoin crashes

42DAO's Balance Coin algorithmic stablecoin crashes after $912,000 theft

An attacker exploited the Wanchain <button class="define-target" id="bridge">bridge</button>, stealing 515&nbsp;million NIGHT tokens that had been bridged from Cardano to BNB. The NIGHT token belongs to Midnight, a privacy-focused blockchain linked to Cardano. The stolen tokens were priced at $9&nbsp;million to $10&nbsp;million at the time of the theft, although the massive outflow of tokens briefly caused the NIGHT token price to drop by about 43%.

Cardano Midnight bridge exploit

Wanchain bridge on Cardano exploited for more than $9&nbsp;million

The Allbridge blockchain <button class="define-target" id="bridge">bridge</button> was exploited for $1.66&nbsp;million in a <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, after discovering that the same would happen even when borrowing an asset against collateral denominated in the same token. They were able to manipulate the project's internal pricing logic so that the asset's actual price diverged away from reality, pocketing $1.66&nbsp;million in proceeds.

Allbridge exploit

Allbridge exploited for $1.66&nbsp;million

The Solana deployment of the Across <button class="define-target" id="bridge">bridge</button> was hacked for around $3.35&nbsp;million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge.

Across Protocol exploit

Across Protocol exploited for $3.35&nbsp;million

Decentralized <button class="define-target" id="perps">perpetual futures</button> exchange Ostium was drained of at least $24&nbsp;million after an attacker manipulated its <button class="define-target" id="oracle">oracle</button> system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.<p>The attacker siphoned at least $24&nbsp;million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.</p>

"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack"

Ostium exploit

Ostium loses at least $24&nbsp;million to oracle exploit

The Hedera-based decentralized lending platform Bozno Lend was exploited for just over $9&nbsp;million after an attacker took advantage of a flaw in the project's <button class="define-target" id="oracle">oracle</button> system. The attacker was able to deposit tokens worth only a few dollars, then manipulate the project's oracle to reflect a dramatically higher price. They then borrowed $6.63&nbsp;million in USDC and 34.5&nbsp;million <button class="define-target" id="wrapped-token">wrapped</button> HBAR (~$2.4&nbsp;million).<p>Bonzo has announced they will reimburse users affected by the exploit, with support from the Hedera Foundation.</p>

"Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update"

Bonzo Lend exploit

Bonzo Lend exploited for $9&nbsp;million in oracle attack

Summer Finance, a defi platform that provides "institutional defi vault infrastructure", was exploited for $6&nbsp;million in an apparent <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker used a flash loan to deposit $64.8&nbsp;million and then withdraw $70.9&nbsp;million, taking advantage of a price manipulation bug that allowed them to withdraw more than they deposited.<p>Shortly after the exploit, Summer Finance announced it had "no viable path forward other than to wind down operations". They added, "a meaningful portion of the team's own capital was held in the affected vaults, removing the runway we needed to rebuild."</p>

"Lazy Summer USDC Vault Exploit Post-Mortem: What Happened and What Comes Next"

"Sunsetting Summer.fi and the Labs Company"

Summer Finance exploit

Summer Finance exploited for $6&nbsp;million, shuts down

The Dutch cryptocurrency platform Knaken (not to be confused with the American Kraken platform) abruptly went offline in early June, leaving roughly 30,000 customers unable to access their funds. The company was unable to secure a license under the EU's <a href="https://en.wikipedia.org/wiki/Markets_in_Crypto-Assets" target="_blank">MiCA</a> regulations, which it said forced them to shut down. Though they claimed to be winding down the company in an orderly fashion, they reportedly stopped paying customer withdrawals, and asked customers to stop filing claims.<p>Dutch prosecutors asked courts to declare the platform bankrupt and install a court-appointed trustee to oversee the process of extracting assets from the company to return to customers, who are missing around €7&nbsp;million (~$8&nbsp;million). The request was approved. The country's Fiscal Information and Investigation Service has also opened a criminal investigation into the platform.</p>

"Dutch Prosecutors Seek to Bankrupt Crypto Platform Knaken After Funds Frozen"

Knaken crypto platform collapses

Dutch Knaken crypto platform collapses with $8&nbsp;million in customer funds missing

Polymarket customers have lost around $2.97&nbsp;million to an attacker who then swapped stolen Polymarket USD (pUSD) to ETH.<p>Polymarket, a crypto-based prediction markets platform, quickly made an announcement to claim that a third-party vendor had been compromised to allow an attacker to inject a malicious script into the website frontend. Polymarket has said it will refund affected customers.</p>

Polymarket vendor exploit

Polymarket customers lose $2.97&nbsp;million, company blames third-party vendor

Users of the Cardano wallet SecondFi (formerly Yoroi) have lost a cumulative 16&nbsp;million ADA (~$2.4&nbsp;million) across three attacks targeting a vulnerability in the project's wallet generation code.<p>After the attacks commenced, SecondFi "rescued" another 129&nbsp;million ADA (~$19.4&nbsp;million) by moving the assets to a third party entity. They announced that an external accounting firm would verify the funds and process user claims.</p><p>About a month after the hack, SecondFi announced it would shut down operations.</p>

"SecondFi loses $2.4 million in Cardano wallet exploit"

SecondFi exploit

Users of the SecondFi Cardano wallet lose $2.4&nbsp;million in series of hacks

The Taiko <button class="define-target" id="bridge">bridge</button>, which allows assets to be transferred between the Ethereum mainnet and the Taiko Ethereum <button class="define-target" id="layer-2">layer-2</button> chain, was exploited for at least $1.7&nbsp;million before the network was halted, limiting losses. An attacker was able to forge withdrawal requests to appear as though they matched real deposits. Crypto security firm BlockSec said that the attacker may have gained access to a signing key that had been exposed on GitHub.

Taiko bridge exploit

Taiko bridge exploited

Three days after Aztec Labs' deprecated Aztec Connect blockchain <button class="define-target" id="bridge">bridge</button> was <a href="https://www.web3isgoinggreat.com/?id=aztec-connect-exploit" target="_blank">exploited</a> for $2.1&nbsp;million, the project has been hacked again for the same amount. Aztec Labs confirmed the second exploit, again trying to emphasize that the code was deprecated four years ago.<p>The hacks are part of a <a href="https://www.web3isgoinggreat.com/?collection=legacy-exploit" target="_blank">spate of exploits</a> targeting legacy smart contracts belonging to projects including <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a>. Although some projects have developed techniques to circumvent the immutable nature of blockchains and allow smart contracts to be upgraded or retired, many legacy contracts cannot be changed or shut down, leaving them vulnerable to attack indefinitely.</p>

Aztec hack #2

Aztec Connect hacked for a second time in less than a week

Aztec Connect, an abandoned defi privacy bridge from Aztec Labs, was drained of $2.1&nbsp;million after an attacker exploited a bug in the project's smart contracts. Although the project was deprecated three years ago, funds remained in the legacy system. "Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us," the project posted on social media.<p>The theft is only the latest in a string of attacks targeting vulnerable legacy smart contracts, many of which cannot be deleted, paused, or changed due to blockchains' immutable nature. <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a> are two other platforms that have recently suffered losses due to old, insecure code.</p>

"Aztec Connect’s abandoned smart contract exploited for $2.1M"

Aztec Connect exploit

Deprecated project Aztec Connect exploited for $2.1&nbsp;million

An attacker exploited a legacy <button class="define-target" id="smart-contract">smart contract</button> that had been used by the Raydium Solana <button class="define-target" id="dex">DEX</button> before it was deprecated in 2021. Though the contract was unused, there were still funds in the <button class="define-target" id="liquidity-pool">liquidity pools</button> affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.<p>Raydium has said it will compensate users who lost funds in the exploit.</p>

"Raydium Confirms $1.34M Drain on Deprecated AMM V3, Pledges Treasury Compensation"

Raydium legacy smart contract exploit

Raydium users lose $1.34&nbsp;million after legacy smart contract exploited

The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite <button class="define-target" id="mint">mint</button> bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of <button class="define-target" id="wrapped-token">wrapped</button> Axelar tokens on the Secret network, which they then redeeemed for around $4.67&nbsp;million.<p>The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in.</p><p>Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."</p>

"Secret Network bridge exploited for $4.7M with 'infinite mint' bug"

Secret bridge exploit

Secret bridge exploited for $4.67&nbsp;million a week before anyone notices

Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36&nbsp;million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven <button class="define-target" id="private-key">private keys</button> that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy <button class="define-target" id="multisig">multisignature</button> requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like <button class="define-target" id="bridge">bridges</button>. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.<p>With the keys, the attacker stole more than 6&nbsp;million of Humanity's H token, then used other keys to upgrade a bridge and drain 141&nbsp;million more tokens. With the bridge access, they also <button class="define-target" id="mint">minted</button> 300&nbsp;million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%.</p><p>Humanity Protocol markets itself as a competitor to Sam Altman's <a href="https://www.web3isgoinggreat.com/?collection=worldcoin" target="_blank">World</a> (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20&nbsp;million in 2025 from Pantera Capital and Jump Crypto.</p>

"Explained: The Humanity Protocol Hack (June 2026)"

"Humanity's $36 million exploit tied to compromised laptop hosting a 'multisig' wallet"

Humanity Protocol theft

Humanity Protocol loses $36&nbsp;million to employee laptop compromise

Gravity Bridge, a bridge between the Cosmos and Ethereum blockchains, suffered $5.4&nbsp;million in losses likely due compromised private keys. The developers of the protocol urged validators to halt while the theft was investigated, and the bridge was indeed halted shortly after. Two weeks after the hack, the Gravity Bridge interface remained unavailable.

Gravity Bridge theft

Gravity Bridge drained of $5.4&nbsp;million 

DxSale, a project that was popular in 2021 for launching new tokens and creating <button class="define-target" id="liquidity-pool">liquidity pools</button>, suffered a $7.3&nbsp;million exploit after ownership of a locker contract was transferred to a new address. Nine months later, the contract ownership was repeatedly moved between many new wallets&nbsp;— likely in an attempt to cover tracks&nbsp;— before $7.3&nbsp;million was taken from old liquidity pools. The stolen assets were then swapped to BNB and routed through <button class="define-target" id="bridge">bridges</button> and <button class="define-target" id="tumbler">mixers</button> to obscure the trail.

"Old DxSale Lockers Drained for $7.3M Across 1,400 BNB Chain Pools as Owner-Privilege Exploits Pile Up"

DxSale exploit

DxSale exploited for $7.3&nbsp;million

A third-party Gnosis Safe smart contract called SquidRouterModule was exploited for $3.2&nbsp;million. The smart contract included a set string that could be passed to identify a "safe" message; however, the string was visible in the public smart contract code and used by an attacker to impersonate Gnosis Safe users and then drain their wallets. 86 wallets had used the module, and lost a combined $3.2&nbsp;million.<p>The name led to some confusion due to the similarly named Squid Router, which is not related. It's not clear if the users who installed the module were aware that the two projects were separate.</p>

"Explained: The SquidRouterModule Hack (May 2026)"

SquidRouterModule exploit

SquidRouterModule, unrelated to Squid Router, exploited for $3.2&nbsp;million

Crypto sleuth zachxbt identified that "A Polymarket admin address appears to have been compromised on Polygon", writing that $520,000 had been drained as of the time of his post. The theft ultimately amounted to around $700,000, and Polymarket confirmed that a "wallet used for internal top-up operations" had been compromised. They did not provide further details as to how the compromise happened, though the company's VP of Engineering later said that the private key was six years old and that all private keys would be replaced with a managed key going forward.

Polymarket private key compromise

Polymarket loses $700,000 to private key compromise

The RetoSwap decentralized exchange for trading the Monero <button class="define-target" id="privacycoin">privacycoin</button> was exploited after an attacker exploited a vulnerability in the Haveno Monero exchange protocol used by the project. Users lost an estimated $2.7&nbsp;million when their transactions were routed to the attacker's wallet.<p>Because Monero is a privacycoin, a type of cryptocurrency that obscures transaction details including sender and receiver wallets, it is not feasible to trace the stolen assets.</p>

RetoSwap theft

RetoSwap users lose $2.7&nbsp;million to Haveno vulnerability

An attacker stole $11.6&nbsp;million in various crypto assets from the Verus–Ethereum <button class="define-target" id="bridge">bridge</button>, which allows users to use tokens from the Verus network on the Ethereum chain and vice versa. The attacker then swapped the tokens for ETH, limiting the ability for issuers of more centralized tokens to freeze the stolen assets.<p>Verus halted the entire Verus network after the exploit was detected in hopes of limiting further damage.</p><p>The exploiter later accepted a <button class="define-target" id="bug-bounty">bounty</button> offer by Verus, returning 4,052&nbsp;ETH (~$8.5&nbsp;million) while keeping the remaining ~25% as a "bounty".</p>

"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid"

Verus bridge hack

Verus bridge hacked for $11.6&nbsp;million

The THORchain cross-chain liquidity protocol was exploited for around $10.8&nbsp;million across several blockchains: Bitcoin, Ethereum, BNB Chain, and Base. The protocol paused trading after observing the suspicious transactions. News of the hack caused the protocol's RUNE token to drop in price by more than 10%.

Thorchain exploit

THORchain exploited for $10.8&nbsp;million

Transit Finance was exploited for $1.88&nbsp;million after an attacker exploited a "legacy contract" on the TRON blockchain that the project said was deprecated in 2022. "Historical vulnerabilities within it" were exploited, the project explained, allowing the attacker to steal $1.88&nbsp;million.<p>Transit was <a href="https://www.web3isgoinggreat.com/?id=transit-swap-hacked-for-21-million-hacker-returns-large-portion" target="_blank">previously exploited in 2022</a> for $21&nbsp;million, although around 70% of the stolen assets were later returned.</p>

Transit Finance hack

Transit Finance hacked for $1.88&nbsp;million

The TAC bridge, which bridges assets from the Ethereum blockchain to the Telegram-linked TON chain, was exploited for $2.8&nbsp;million. The project paused the bridge and announced they were investigating.<p>The project has announced they intend to "restor[e] bridge liquidity through a legally structured sale of Foundation's TAC token treasury reserves."</p>

TAC bridge exploit

TAC bridge exploited for $2.8&nbsp;million

TrustedVolumes, a resolver and market maker used by 1inch and other defi platforms, suffered a $6.7&nbsp;million exploit after an attacker was able to steal funds without proper validation. The thief then swapped the stolen <button class="define-target" id="wrapped-token">w</button>ETH, USDT, wBTC, and USDC through ChangeNow and converted them to ETH to evade <button class="define-target" id="freezing">freezes</button>.<p>Blockchain research firm Blockaid has linked the attacker to a <a href="https://www.web3isgoinggreat.com/?id=1inch-loses-5-million-to-smart-contract-bug" target="_blank">similar exploit in March 2025</a> that saw $5&nbsp;million drained from 1inch. This time, 1inch has asserted that although they use TrustedVolumes as a resolver, the exploit did not involve any of their systems.</p>

"DeFi Platform TrustedVolumes Hit by $6.7M Exploit"

TrustedVolumes exploit

TrustedVolumes suffers $6.7&nbsp;million exploit

The Ekubo automated market maker infrastructure project experienced a $1.4&nbsp;million theft after attackers were able to take advantage of a <button class="define-target" id="smart-contract">smart contract</button> that improperly verified permissions. They stole 17&nbsp;<button class="define-target" id="wrapped-token">w</button>BTC ($1.4&nbsp;million), which they swapped for ETH and laundered via Tornado Cash.

"Attackers drain $1.4M in wrapped bitcoin from DeFi protocol Ekubo in approval-based exploit"

Ekubo exploit

Ekubo exploited for $1.4&nbsp;million

The Wasabi Protocol defi derivatives platform has been exploited for more than $5&nbsp;million across multiple blockchains. The attack has been attributed by blockchain security firms to a compromised admin <button class="define-target" id="private-key">key</button>, which allowed the attacker to upgrade contracts to steal assets.

"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say"

Wasabi Protocol exploit

Wasabi Protocol exploited for more than $5&nbsp;million

The Polish cryptocurrency exchange Zondacrypto faced complaints that withdrawals were not being processed as far back as December 2025, but the crisis seems to have escalated. CEO Przemysław Kral attempted to assuage insolvency fears by pointing to a cryptocurrency wallet containing around 4,500&nbsp;BTC (~$330&nbsp;million) as proof of assets, but he also admitted that the keys to the wallet were known only to the exchange's previous CEO and not transferred during the company's 2021 sale. The former CEO has been missing for four years.<p>Polish authorities have launched investigations into the apparent collapse. Losses have been estimated at 350&nbsp;million&nbsp;zł (~$96&nbsp;million).</p><p>Poland's Prime Minister Donald Tusk has also recently accused Zondacrypto of sponsoring conservative and right-wing politicians, including Polish President Karol Nawrocki. Nawrocki has repeatedly vetoed legislation aiming to regulate the crypto sector, describing it as overly burdensome to crypto businesses. Tusk has also alleged that Zondacrypto was funded by the Russian mafia and Russian intelligence services. These allegations are also being investigated by Polish authorities, and one report citing the country's Internal Security Agency claims that the Kremlin-linked <a href="https://en.wikipedia.org/wiki/Tambovskaya_Bratva" target="_blank">Tambovskaya Bratva</a> Russian mafia group took over the exchange as far back as 2018.</p>

"UOKiK zbada sprawę Zondacrypto. 'Znacznie poważniejsze nieprawidłowości'"

Polish leader Tusk claims Russia-linked crypto firm backed Nawrocki’s presidential bid"

"Powerful Russian mafia 'took control' of crisis-hit Polish firm Zondacrypto"

Event	Date	Amount More info	Recovered More info
CryptoBilis hardware wallet tampering	October 9, 2026	$86,000,000 – $93,000,000
Magic Eden NFT exploited for $1.8 million	September 25, 2026	$1,775,000
Bitget hack	September 24, 2026	$351,600,000
Duelbits hack	September 24, 2026	$7,000,000
Payy Network bridge exploit	September 24, 2026	$1,800,000
Meter unauthorized mint	September 24, 2026	$2,300,000
Neutron governance attack	September 22, 2026	$9,500,000	$7,700,000
Fetch.ai, NuNet, and SingularityNET theft	September 20, 2026	$2,250,000
Liquid Network exploit	September 6, 2026	$320,000,000	$272,000,000
More Markets exploit	August 31, 2026	$9,300,000
Tectonic theft	August 30, 2026	$120,390,000	$111,200,000
Avici exploit	August 28, 2026	$1,100,000
Moonwell price manipulation attack	August 27, 2026	$8,700,000
Term Finance governance attack	August 23, 2026	$8,500,000
Cosmos-based blockchain exploits	August 22, 2026	$9,160,000
BounceBit exploit	August 20, 2026	$3,000,000
MAYAChain exploit	August 18, 2026	$1,700,000
Coinsbuy exploit	August 9, 2026	$8,000,000
Coldcard hardware wallet flaw	July 31, 2026	at least $130 million
Fake Flare Network staking site	July 30, 2026	$8,500,000 – $19,000,000
Triple-A hack	July 25, 2026	$11,800,000
Balance Coin algorithmic stablecoin crashes	July 21, 2026	$912,000
Cardano Midnight bridge exploit	July 20, 2026	$9,000,000 – $10,000,000
Allbridge exploit	July 19, 2026	$1,650,000
Across Protocol exploit	July 17, 2026	$3,350,000
Ostium exploit	July 15, 2026	$24,000,000
Bonzo Lend exploit	July 10, 2026	$9,050,000
Summer Finance exploit	July 6, 2026	$6,040,000
Knaken crypto platform collapses	June 30, 2026	$0
Polymarket vendor exploit	June 25, 2026	$2,940,000
SecondFi exploit	June 23, 2026	$2,400,000
Taiko bridge exploit	June 22, 2026	$1,700,000
Aztec hack #2	June 18, 2026	$2,100,000
Aztec Connect exploit	June 15, 2026	$2,100,000
Raydium legacy smart contract exploit	June 10, 2026	$1,340,000
Secret bridge exploit	June 10, 2026	$4,670,000
Humanity Protocol theft	June 9, 2026	$36,000,000
Gravity Bridge theft	May 30, 2026	$5,400,000
DxSale exploit	May 29, 2026	$7,300,000
SquidRouterModule exploit	May 25, 2026	$3,200,000
Polymarket private key compromise	May 22, 2026	$700,000
RetoSwap theft	May 20, 2026	$2,700,000
Verus bridge hack	May 17, 2026	$11,600,000	$8,500,000
Thorchain exploit	May 15, 2026	$10,800,000
Transit Finance hack	May 13, 2026	$1,880,000
TAC bridge exploit	May 12, 2026	$2,800,000
TrustedVolumes exploit	May 6, 2026	$6,700,000
Ekubo exploit	May 5, 2026	$1,400,000
Wasabi Protocol exploit	April 30, 2026	$5,000,000
Zondacrypto withdrawal halt	April 25, 2026	$96,000,000