Decentralized <button class="define-target" id="perps">perpetual futures</button> exchange Ostium was drained of at least $24&nbsp;million after an attacker manipulated its <button class="define-target" id="oracle">oracle</button> system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.<p>The attacker siphoned at least $24&nbsp;million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.</p>

"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack"

Ostium exploit

Ostium loses at least $24&nbsp;million to oracle exploit

Polymarket customers have lost around $2.97&nbsp;million to an attacker who then swapped stolen Polymarket USD (pUSD) to ETH.<p>Polymarket, a crypto-based prediction markets platform, quickly made an announcement to claim that a third-party vendor had been compromised to allow an attacker to inject a malicious script into the website frontend. Polymarket has said it will refund affected customers.</p>

Polymarket vendor exploit

Polymarket customers lose $2.97&nbsp;million, company blames third-party vendor

Users of the Cardano wallet SecondFi (formerly Yoroi) have lost a cumulative 16&nbsp;million ADA (~$2.4&nbsp;million) across three attacks targeting a vulnerability in the project's wallet generation code.<p>After the attacks commenced, SecondFi "rescued" another 129&nbsp;million ADA (~$19.4&nbsp;million) by moving the assets to a third party entity. They have announced that an external accounting firm will verify the funds and process user claims.</p>

"SecondFi loses $2.4 million in Cardano wallet exploit"

SecondFi exploit

Users of the SecondFi Cardano wallet lose $2.4&nbsp;million in series of hacks

The Taiko <button class="define-target" id="bridge">bridge</button>, which allows assets to be transferred between the Ethereum mainnet and the Taiko Ethereum <button class="define-target" id="layer-2">layer-2</button> chain, was exploited for at least $1.7&nbsp;million before the network was halted, limiting losses. An attacker was able to forge withdrawal requests to appear as though they matched real deposits. Crypto security firm BlockSec said that the attacker may have gained access to a signing key that had been exposed on GitHub.

Taiko bridge exploit

Taiko bridge exploited

Three days after Aztec Labs' deprecated Aztec Connect blockchain <button class="define-target" id="bridge">bridge</button> was <a href="https://www.web3isgoinggreat.com/?id=aztec-connect-exploit" target="_blank">exploited</a> for $2.1&nbsp;million, the project has been hacked again for the same amount. Aztec Labs confirmed the second exploit, again trying to emphasize that the code was deprecated four years ago.<p>The hacks are part of a <a href="https://www.web3isgoinggreat.com/?collection=legacy-exploit" target="_blank">spate of exploits</a> targeting legacy smart contracts belonging to projects including <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a>. Although some projects have developed techniques to circumvent the immutable nature of blockchains and allow smart contracts to be upgraded or retired, many legacy contracts cannot be changed or shut down, leaving them vulnerable to attack indefinitely.</p>

Aztec hack #2

Aztec Connect hacked for a second time in less than a week

Aztec Connect, an abandoned defi privacy bridge from Aztec Labs, was drained of $2.1&nbsp;million after an attacker exploited a bug in the project's smart contracts. Although the project was deprecated three years ago, funds remained in the legacy system. "Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us," the project posted on social media.<p>The theft is only the latest in a string of attacks targeting vulnerable legacy smart contracts, many of which cannot be deleted, paused, or changed due to blockchains' immutable nature. <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a> are two other platforms that have recently suffered losses due to old, insecure code.</p>

"Aztec Connect’s abandoned smart contract exploited for $2.1M"

Aztec Connect exploit

Deprecated project Aztec Connect exploited for $2.1&nbsp;million

An attacker exploited a legacy <button class="define-target" id="smart-contract">smart contract</button> that had been used by the Raydium Solana <button class="define-target" id="dex">DEX</button> before it was deprecated in 2021. Though the contract was unused, there were still funds in the <button class="define-target" id="liquidity-pool">liquidity pools</button> affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.<p>Raydium has said it will compensate users who lost funds in the exploit.</p>

"Raydium Confirms $1.34M Drain on Deprecated AMM V3, Pledges Treasury Compensation"

Raydium legacy smart contract exploit

Raydium users lose $1.34&nbsp;million after legacy smart contract exploited

The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite <button class="define-target" id="mint">mint</button> bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of <button class="define-target" id="wrapped-token">wrapped</button> Axelar tokens on the Secret network, which they then redeeemed for around $4.67&nbsp;million.<p>The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in.</p><p>Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."</p>

"Secret Network bridge exploited for $4.7M with 'infinite mint' bug"

Secret bridge exploit

Secret bridge exploited for $4.67&nbsp;million a week before anyone notices

Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36&nbsp;million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven <button class="define-target" id="private-key">private keys</button> that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy <button class="define-target" id="multisig">multisignature</button> requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like <button class="define-target" id="bridge">bridges</button>. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.<p>With the keys, the attacker stole more than 6&nbsp;million of Humanity's H token, then used other keys to upgrade a bridge and drain 141&nbsp;million more tokens. With the bridge access, they also <button class="define-target" id="mint">minted</button> 300&nbsp;million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%.</p><p>Humanity Protocol markets itself as a competitor to Sam Altman's <a href="https://www.web3isgoinggreat.com/?collection=worldcoin" target="_blank">World</a> (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20&nbsp;million in 2025 from Pantera Capital and Jump Crypto.</p>

"Explained: The Humanity Protocol Hack (June 2026)"

"Humanity's $36 million exploit tied to compromised laptop hosting a 'multisig' wallet"

Humanity Protocol theft

Humanity Protocol loses $36&nbsp;million to employee laptop compromise

Gravity Bridge, a bridge between the Cosmos and Ethereum blockchains, suffered $5.4&nbsp;million in losses likely due compromised private keys. The developers of the protocol urged validators to halt while the theft was investigated, and the bridge was indeed halted shortly after. Two weeks after the hack, the Gravity Bridge interface remained unavailable.

Gravity Bridge theft

Gravity Bridge drained of $5.4&nbsp;million 

DxSale, a project that was popular in 2021 for launching new tokens and creating <button class="define-target" id="liquidity-pool">liquidity pools</button>, suffered a $7.3&nbsp;million exploit after ownership of a locker contract was transferred to a new address. Nine months later, the contract ownership was repeatedly moved between many new wallets&nbsp;— likely in an attempt to cover tracks&nbsp;— before $7.3&nbsp;million was taken from old liquidity pools. The stolen assets were then swapped to BNB and routed through <button class="define-target" id="bridge">bridges</button> and <button class="define-target" id="tumbler">mixers</button> to obscure the trail.

"Old DxSale Lockers Drained for $7.3M Across 1,400 BNB Chain Pools as Owner-Privilege Exploits Pile Up"

DxSale exploit

DxSale exploited for $7.3&nbsp;million

A third-party Gnosis Safe smart contract called SquidRouterModule was exploited for $3.2&nbsp;million. The smart contract included a set string that could be passed to identify a "safe" message; however, the string was visible in the public smart contract code and used by an attacker to impersonate Gnosis Safe users and then drain their wallets. 86 wallets had used the module, and lost a combined $3.2&nbsp;million.<p>The name led to some confusion due to the similarly named Squid Router, which is not related. It's not clear if the users who installed the module were aware that the two projects were separate.</p>

"Explained: The SquidRouterModule Hack (May 2026)"

SquidRouterModule exploit

SquidRouterModule, unrelated to Squid Router, exploited for $3.2&nbsp;million

Crypto sleuth zachxbt identified that "A Polymarket admin address appears to have been compromised on Polygon", writing that $520,000 had been drained as of the time of his post. The theft ultimately amounted to around $700,000, and Polymarket confirmed that a "wallet used for internal top-up operations" had been compromised. They did not provide further details as to how the compromise happened, though the company's VP of Engineering later said that the private key was six years old and that all private keys would be replaced with a managed key going forward.

Polymarket private key compromise

Polymarket loses $700,000 to private key compromise

The RetoSwap decentralized exchange for trading the Monero <button class="define-target" id="privacycoin">privacycoin</button> was exploited after an attacker exploited a vulnerability in the Haveno Monero exchange protocol used by the project. Users lost an estimated $2.7&nbsp;million when their transactions were routed to the attacker's wallet.<p>Because Monero is a privacycoin, a type of cryptocurrency that obscures transaction details including sender and receiver wallets, it is not feasible to trace the stolen assets.</p>

RetoSwap theft

RetoSwap users lose $2.7&nbsp;million to Haveno vulnerability

An attacker stole $11.6&nbsp;million in various crypto assets from the Verus–Ethereum <button class="define-target" id="bridge">bridge</button>, which allows users to use tokens from the Verus network on the Ethereum chain and vice versa. The attacker then swapped the tokens for ETH, limiting the ability for issuers of more centralized tokens to freeze the stolen assets.<p>Verus halted the entire Verus network after the exploit was detected in hopes of limiting further damage.</p><p>The exploiter later accepted a <button class="define-target" id="bug-bounty">bounty</button> offer by Verus, returning 4,052&nbsp;ETH (~$8.5&nbsp;million) while keeping the remaining ~25% as a "bounty".</p>

"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid"

Verus bridge hack

Verus bridge hacked for $11.6&nbsp;million

The THORchain cross-chain liquidity protocol was exploited for around $10.8&nbsp;million across several blockchains: Bitcoin, Ethereum, BNB Chain, and Base. The protocol paused trading after observing the suspicious transactions. News of the hack caused the protocol's RUNE token to drop in price by more than 10%.

Thorchain exploit

THORchain exploited for $10.8&nbsp;million

Transit Finance was exploited for $1.88&nbsp;million after an attacker exploited a "legacy contract" on the TRON blockchain that the project said was deprecated in 2022. "Historical vulnerabilities within it" were exploited, the project explained, allowing the attacker to steal $1.88&nbsp;million.<p>Transit was <a href="https://www.web3isgoinggreat.com/?id=transit-swap-hacked-for-21-million-hacker-returns-large-portion" target="_blank">previously exploited in 2022</a> for $21&nbsp;million, although around 70% of the stolen assets were later returned.</p>

Transit Finance hack

Transit Finance hacked for $1.88&nbsp;million

The TAC bridge, which bridges assets from the Ethereum blockchain to the Telegram-linked TON chain, was exploited for $2.8&nbsp;million. The project paused the bridge and announced they were investigating.<p>The project has announced they intend to "restor[e] bridge liquidity through a legally structured sale of Foundation's TAC token treasury reserves."</p>

TAC bridge exploit

TAC bridge exploited for $2.8&nbsp;million

TrustedVolumes, a resolver and market maker used by 1inch and other defi platforms, suffered a $6.7&nbsp;million exploit after an attacker was able to steal funds without proper validation. The thief then swapped the stolen <button class="define-target" id="wrapped-token">w</button>ETH, USDT, wBTC, and USDC through ChangeNow and converted them to ETH to evade <button class="define-target" id="freezing">freezes</button>.<p>Blockchain research firm Blockaid has linked the attacker to a <a href="https://www.web3isgoinggreat.com/?id=1inch-loses-5-million-to-smart-contract-bug" target="_blank">similar exploit in March 2025</a> that saw $5&nbsp;million drained from 1inch. This time, 1inch has asserted that although they use TrustedVolumes as a resolver, the exploit did not involve any of their systems.</p>

"DeFi Platform TrustedVolumes Hit by $6.7M Exploit"

TrustedVolumes exploit

TrustedVolumes suffers $6.7&nbsp;million exploit

The Ekubo automated market maker infrastructure project experienced a $1.4&nbsp;million theft after attackers were able to take advantage of a <button class="define-target" id="smart-contract">smart contract</button> that improperly verified permissions. They stole 17&nbsp;<button class="define-target" id="wrapped-token">w</button>BTC ($1.4&nbsp;million), which they swapped for ETH and laundered via Tornado Cash.

"Attackers drain $1.4M in wrapped bitcoin from DeFi protocol Ekubo in approval-based exploit"

Ekubo exploit

Ekubo exploited for $1.4&nbsp;million

The Wasabi Protocol defi derivatives platform has been exploited for more than $5&nbsp;million across multiple blockchains. The attack has been attributed by blockchain security firms to a compromised admin <button class="define-target" id="private-key">key</button>, which allowed the attacker to upgrade contracts to steal assets.

"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say"

Wasabi Protocol exploit

Wasabi Protocol exploited for more than $5&nbsp;million

The Polish cryptocurrency exchange Zondacrypto faced complaints that withdrawals were not being processed as far back as December 2025, but the crisis seems to have escalated. CEO Przemysław Kral attempted to assuage insolvency fears by pointing to a cryptocurrency wallet containing around 4,500&nbsp;BTC (~$330&nbsp;million) as proof of assets, but he also admitted that the keys to the wallet were known only to the exchange's previous CEO and not transferred during the company's 2021 sale. The former CEO has been missing for four years.<p>Polish authorities have launched investigations into the apparent collapse. Losses have been estimated at 350&nbsp;million&nbsp;zł (~$96&nbsp;million).</p><p>Poland's Prime Minister Donald Tusk has also recently accused Zondacrypto of sponsoring conservative and right-wing politicians, including Polish President Karol Nawrocki. Nawrocki has repeatedly vetoed legislation aiming to regulate the crypto sector, describing it as overly burdensome to crypto businesses. Tusk has also alleged that Zondacrypto was funded by the Russian mafia and Russian intelligence services. These allegations are also being investigated by Polish authorities, and one report citing the country's Internal Security Agency claims that the Kremlin-linked <a href="https://en.wikipedia.org/wiki/Tambovskaya_Bratva" target="_blank">Tambovskaya Bratva</a> Russian mafia group took over the exchange as far back as 2018.</p>

"UOKiK zbada sprawę Zondacrypto. 'Znacznie poważniejsze nieprawidłowości'"

Polish leader Tusk claims Russia-linked crypto firm backed Nawrocki’s presidential bid"

"Powerful Russian mafia 'took control' of crisis-hit Polish firm Zondacrypto"

Zondacrypto withdrawal halt

Polish Zondacrypto exchange stops processing withdrawals amid possible insolvency

The Sui-based Volo Protocol defi yield platform was exploited for around $3.5&nbsp;million after an attacker targeted three vaults holding <button class="define-target" id="wrapped-token">w</button>BTC, XAUm (a tokenized gold asset), and the USDC stablecoin.<p>Volo says they have frozen or recovered all but around $60,000. They have also said they are "prepared to absorb this loss", rather than passing losses along to their users.</p>

Volo Protocol exploit

Volo Protocol exploited for $3.5&nbsp;million, most recovered

An attacker stole 116,500 rsETH (<button class="define-target" id="restaking">restaked</button> ether) from a blockchain bridge run by Kelp DAO. Based on prices at the time of the theft, the stolen tokens would be worth around $292&nbsp;million&nbsp;— however, the attacker is likely to face challenges selling a quantity of tokens that amounts to 18% of rsETH's circulating supply.<p>When tokens are bridged from one chain to another, the tokens on the original chain are locked in the bridge smart contract while the token is used on the other chain, preventing its owner from double-spending the asset. With 116,500 locked rsETH now stolen, those using the token on other blockchains are now holding possibly unbacked tokens.</p><p>The rush for holders to offload their dubiously backed tokens is likely to worsen contagion throughout defi protocols, where those platforms could be left holding the bag. Some platforms, including Aave, Lido Finance, and Ethena, have paused markets involving rsETH to try to protect themselves.</p><p>This hack has set the new record for the largest defi hack in 2026, following the $285&nbsp;million <a href="https://www.web3isgoinggreat.com/?id=drift-exploit" target="_blank">Drift exploit</a> on April 1.</p>

"2026's biggest crypto exploit: $292 million gets drained from Kelp DAO with wrapped ether stranded across 20 chains"

Kelp DAO hack

Kelp DAO bridge hacked for $292&nbsp;million

The Russian cryptocurrency exchange Grinex has halted trading after disclosing a hack of more than 1&nbsp;billion rubles (more than $13&nbsp;million). The exchange has claimed on Telegram that the hack was perpetrated by "foreign special services" they allege were trying to harm Russian financial independence.<p>According to blockchain intelligence firms TRM Labs and Chainalysis, Grinex is a rebranded version of the Garantex cryptocurrency exchange that was <a href="https://www.citationneeded.news/issue-79/#in-the-courts" target="_blank">shut down and sanctioned</a> in March 2025. Two of its operators were subsequently criminally charged in the US.</p>

"Russian Crypto Exchange Grinex Halts Trading, Alleging $13M Exploit by 'Western Special Services'"

"Sanctioned Russian Exchange Garantex Suspected of Rebrand as Grinex"

Grinex hack

Russian Grinex exchange halts trading after $13&nbsp;million+ exploit

Rhea Finance's lending product was exploited for around $18.4&nbsp;million after an attacker took advantage of a bug in the platform's <button class="define-target" id="slippage">slippage</button> protection feature. The stolen assets affected both platform and user funds.<p>Some of the stolen tokens were returned by the attacker to the protocol, and around $4.35&nbsp;million USDT were frozen by its issuer, Tether. Altogether, around $10&nbsp;million was recovered, leaving $8.4&nbsp;million outstanding.</p>

Rhea Finance exploit

Rhea Finance exploited for $18.4&nbsp;million, some recovered

Users who visited the website for the CoW Swap DEX aggregator on April 14 were unknowingly redirected to a malicious website that drained their crypto wallets. An attacker was able to socially engineer CoW Swap's domain registrar, allowing them to redirect visitors to a malicious site for a period of several hours. CoW Swap has estimated that people who used the service during that time lost around $1.2&nbsp;million.

CoW Swap DNS hijacking

CoW Swap users lose estimated $1.2&nbsp;million after DNS hijacking

On April Fools' Day, the Hyperbridge blockchain <button class="define-target" id="bridge">bridge</button> project posted a tweet claiming that the North Korean Lazarus hacking group had drained $37&nbsp;million from the project. A linked blog post contained a Rickroll GIF and an explanation of "Why Hyperbridge can't be hacked".<p>The following day, a Hyperbridge developer posted a screenshot of a blockchain transaction, writing "Lmao the uniBTC exploiter is testing Hyperbridge. I hope you have a quantum computer bro". Another commenter replied, "Rule #1 dont actively provoke attackers".</p><p>About two weeks later, an attacker was able to forge a transaction to change the admin rights for the Polkadot/Ethereum bridge contract, allowing them to mint 1&nbsp;billion DOT tokens. They were able to cash out about $2,500,000 due to limited liquidity.</p><p>The April Fools' posts have since been deleted.</p>

"Hyperbridge exploited less than two weeks after April Fools’ day hack prank"

Hyperbridge exploit

Hyperbridge exploited two weeks after April Fools' hack joke

After a fake version of the Ledger cryptocurrency wallet app made it onto the normally highly curated Apple App store, customers lost $9.5&nbsp;million dollars to the malicious product. Believing it was a genuine Ledger product, people entered their <button class="define-target" id="seed-phrase">seed phrases</button> into the app, then discovered their wallets were immediately drained.<p>One victim, a musician who goes by G. Love, wrote: "I lost my retirement fund in a hack/Scam when I switched my Ledger over to my new computer and by accident downloaded a malicious ledger app from the Apple store. All my BTC gone in an instant." According to him, he lost 5.9&nbsp;BTC (~$445,000).</p><p>Crypto sleuth zachxbt traced some of the stolen funds through Kucoin, a Chinese cryptocurrency exchange that was <a href="https://www.web3isgoinggreat.com/?id=kucoin-pleads-guilty" target="_blank">recently fined and forced to exit US markets</a> over licensing and anti-money laundering failures. "The three largest victims lost seven figures each," he wrote.</p><p>Apple removed the malicious app from their App Store on April 13, six days after it had been added.</p>


"A fake Ledger app on the Apple App Store drained $9.5 million in crypto"

Fake Ledger app

Users lose $9.5&nbsp;million to fake Ledger wallet app on the Apple App Store

Bitcoin ATM operator Bitcoin Depot has disclosed a March&nbsp;23 hack in which attackers stole 50.903&nbsp;BTC (~$3.67&nbsp;million) from company wallets. According to the company's disclosure with the SEC, the exploiters gained access to the company's IT systems and wallet credentials, allowing them to steal the assets.<p>Bitcoin Depot is the largest operator of crypto ATMs globally and in the United States, with approximately 8,700 kiosks in the US and 9,200 worldwide.</p>

 filed by Bitcoin Depot Inc. on April 6, 2026

Bitcoin Depot hack

Bitcoin Depot hacked for $3.67&nbsp;million

The Solana-based Drift <button class="define-target" id="defi">defi</button> <button class="define-target" id="perps">perpetual futures</button> exchange was exploited for $285&nbsp;million. The project alerted the community on social media, writing: "Drift Protocol is experiencing an active attack. ... This is not an April Fools joke."<p>The project later described the exploit as "a novel attack involving durable nonces, resulting in a rapid takeover of Drift's Security Council administrative powers." Once the attacker had access to admin capabilities, they quickly eliminated risk management limits on the protocol and drained huge quantities of tokens, which they swapped to USDC and then ETH. The attack was attributed to extremely sophisticated social engineering, likely by North Korean hackers.</p><p>Some have criticized USDC's issuer, Circle, for not <button class="define-target" id="freezing">freezing</button> the stolen funds during the six hours they were held in USDC. Unlike ETH, USDC is controlled by a centralized company that can, and regularly does, freeze assets determined to have been stolen or connected to illicit activity.</p><p>The theft is among the largest in defi history.</p>

"Drift says $280M exploit tied to 'sophisticated' admin takeover; ZachXBT criticizes Circle over USDC handling"

Drift exploit

Drift exploited for $285&nbsp;million

The Resolv USD stablecoin, also known as USR, lost its intended dollar <button class="define-target" id="peg">peg</button> and dropped to around $0.14 after an exploiter was able to <button class="define-target" id="mint">mint</button> and sell tens of millions of unbacked tokens. USR is an asset-backed stablecoin that uses cryptoassets like bitcoin, ETH, and other stablecoins as collateral.<p>An exploiter took advantage of a flaw in USR's minting code to create tens of millions of USR tokens without depositing any assets to back them. The attacker then sold the unbacked USR, crashing the stablecoin's price to as low as $0.14. The attacker has profited at least 11,400&nbsp;ETH (~$24&nbsp;million), though they are still selling.</p><p>Some <button class="define-target" id="defi">defi</button> protocols paused USR-exposed strategies to avoid downstream impacts. Resolv issued a statement that the token's collateral pool was unaffected, though this is likely little comfort for those who purchased the unbacked USR.</p>

"Resolv Labs’ stablecoin depegs as attacker mints millions of tokens"

USR stablecoin depeg

USR stablecoin depegs in $24&nbsp;million exploit

The BNB Chain's Venus Protocol lending protocol accumulated $2.15&nbsp;million in <button class="define-target" id="bad-debt">bad debt</button> after an exploiter manipulated the price of the Thena protocol's THE token. THE had very low liquidity, and the exploiter took advantage of it to manipulate the THE price <button class="define-target" id="oracle">oracle</button> by borrowing against THE, using the borrowed funds to buy more THE, and repeating — causing the price oracle to reflect higher and higher prices. The attacker was able to avoid a supply cap on Venus by "donating" the funds rather than depositing them in the standard way.<p>While the exploit left the Venus Protocol with over $2&nbsp;million in bad debt, it's not clear if the attacker even made money from the exploit. The exploiter's position was ultimately liquidated, collapsing the increase in THE price. However, it's possible the exploiter took advantage of the price discrepancy elsewhere to profit.</p><p>The Venus Protocol has had a number of issues in the past — notably in <a href="https://www.web3isgoinggreat.com/?id=bnb-chain-team-prepares-to-step-in-to-prevent-massive-venus-protocol-liquidation" target="_blank">June 2023</a>, when the team developing the BNB Chain had to intervene when the a thief borrowed $150&nbsp;million on Venus against stolen tokens and then faced liquidation.</p>

"Venus Protocol left with roughly $2M in bad debt after exploit manipulates Thena's THE token price"

Venus Protocol bad debt

Venus Protocol accumulates $2.15&nbsp;million in bad debt after exploit

A trader using the Aave interface attempted to swap $50&nbsp;million USDT for AAVE. However, due to the enormous size of the order, the purchase had dramatic impact on the aave price. The Aave interface warned the customer about the price impact, and the trader clicked a checkbox to accept the order terms. Ultimately, they received only 324&nbsp;AAVE (~$37,600) in return for their $50&nbsp;million, losing 99.9% of their assets in the process.<p>The Aave founder offered to refund the user the $600,000 in fees collected from the transaction, and acknowledged "there are additional guardrails the industry can build to better protect users".</p>

Aave swap loss

Trader loses almost $50&nbsp;million in Aave swap gone wrong

Users of the Aave defi lending protocol who had borrowed from the <button class="define-target" id="wrapped-token">w</button><button class="define-target" id="staking">st</button>ETH/stETH pool suffered erroneous <button class="define-target" id="forced-liquidation">liquidations</button> when a price <button class="define-target" id="oracle">oracle</button> from Chaos Labs reported an inaccurately low price ratio between the two assets. The oracle bug caused some loans to report that they were below the required "health factor" (the ratio between the assets loaned and the amount of collateral provided by the borrower), triggering forcible liquidations across the platform amounting to $26.9&nbsp;million.<p>Chaos Labs, presumably embarrassed to have lived up to its name, promised to reimburse users whose positions were improperly liquidated.</p>

"Oracle error adds to turmoil at DeFi giant Aave"

Chaos Labs Aave liquidations

$26.9&nbsp;million erroneously liquidated on Aave after Chaos Labs oracle bug

A thief exploited a smart contract belonging to the Gondi NFT platform to steal 78&nbsp;NFTs priced at $230,000. Perhaps the most shocking part of the theft is that the attacker managed to find NFTs still holding any value at all. Around half of the stolen NFTs were taken from a single wallet.<p>According to Gondi, the exploiter took advantage of functionality that allowed users to sell their NFTs to automatically repay loans.</p><p>Gondi has said it has reimbursed customers by buying them "comparable items" from the same collections as their stolen NFTs, although it seems questionable that this will satisfy customers who purchased products whose whole selling point is that they <i>aren't</i> interchangeable.</p>

"NFT lending protocol Gondi says platform secured after $230K exploit"

Gondi theft

Thief pilfers NFTs priced at $230,000 from Gondi

The Solv Protocol bitcoin defi lending and staking platform disclosed an exploit that they said affected fewer than ten users, but nevertheless netted the attacker 38&nbsp;SolvBTC (a <button class="define-target" id="wrapped-token">wrapped</button> bitcoin token priced at $2.7&nbsp;million). Although Solv has not disclosed specifics of the attack, some researchers have suggested it was a bug in the protocol's <button class="define-target" id="burn">burn</button> and <button class="define-target" id="minting">mint</button> functionality.

Solv Protocol exploit

Solv Protocol exploited for $2.7&nbsp;million

After a thief drained a crypto wallet of 4&nbsp;million PRTG (notionally priced at $4.9&nbsp;million, but highly illiquid) after blundering Korean tax officials <a href="https://www.web3isgoinggreat.com/?id=crypto-stolen-from-korean-authorities-after-they-post-wallet-seed-phrase" target="_blank">posted the wallet's seed phrase to social media</a> in a photo among other seized items, the thief returned the assets. However, the tokens were quickly stolen again by a second thief, as they'd been returned to the same vulnerable wallet. The first thief turned themselves in and was arrested by Korean law enforcement shortly after taking the funds; the second thief has not been identified.

"Korea police track second thief after NTS crypto leak as first suspect surrenders"

Returned crypto stolen again from Korean authorities

When Korean authorities posted a photograph of seized cash and other items from a police raid, they included photos of cards containing crypto wallet <button class="define-target" id="seed-phrase">seed phrases</button>, which were proudly arranged on the table next to Ledger <button class="define-target" id="hardware-wallet">hardware wallets</button> for the photo op. Because it only takes a seed phrase to gain control of a crypto wallet, someone who saw the press release quickly acted to move around 4&nbsp;million PRTG tokens from the wallet. The tokens are notionally worth $4.9&nbsp;million, although the token is not highly liquid.<p>The blunder was likely due to the authorities' lack of knowledge about cryptocurrency. The move was somewhat akin to authorities publicly posting a username and password for a criminal's bank account — though that would likely be an easier mistake to unwind.</p>

"$4.8M in crypto stolen after Korean tax agency exposes wallet seed"

Crypto stolen from Korean authorities after they post wallet seed phrase

IoTeX, a platform to connect <a href="https://en.wikipedia.org/wiki/Internet_of_things" target="_blank">IoT</a> devices to blockchain networks, lost around $2&nbsp;million after a <button class="define-target" id="private-key">private key</button> compromise enabled an attacker to drain funds from the project's token safe. Initial loss estimates were as high as $8.8&nbsp;million, although IoTeX CEO Raullen Chai stated that the actual loss was closer to $2&nbsp;million.<p>Blockchain security researcher Specter has suggested there may be links between this attack and a <a href="https://www.web3isgoinggreat.com/?id=infini-hack" target="_blank">$50&nbsp;million theft from the Infini "stablecoin neobank"</a> a year ago.</p>

"IoTeX hit by private key exploit draining around $2 million from bridge contracts, per co-founder"

IoTeX bridge exploit

IoTeX bridge exploited for $2&nbsp;million after private key compromise

A lending pool operated by YieldBlox on the Stellar blockchain was emptied of around $10.2&nbsp;million in an <button class="define-target" id="oracle-manipulation">oracle manipulation</button> attack on the Reflector <button class="define-target" id="oracle">oracle</button> supplying prices for the USTRY/USDC market. Reflector has said that there was no flaw with their oracle, and that market illiquidity caused the problem. "Reflector quoted correct prices. ...  but it's impossible to quote adequate prices for a market fully handled by a single market-maker with almost zero trading activity."<p>The attacker was able to manipulate the oracle price to show that USTRY was priced at $100 (rather than its actual trading price of around $1.05). Then, they borrowed against the overvalued asset, withdrawing XLM and USDC priced at $10.2&nbsp;million. However, around 48&nbsp;million of the stolen XLM (~$7.2&nbsp;million) were <button class="define-target" id="freeze">frozen</button>.</p>

YieldBlox theft

YieldBlox lending pool drained of $10.2&nbsp;million

Federal authorities arrested Christopher Alexander Delgado, the CEO of Goliath Ventures (previously Gen-Z Ventures). According to the charging documents, what Delgado presented to prospective investors as a way to earn returns via crypto liquidity pools was actually a Ponzi scheme, where investors' money was just being used to pay off earlier investors. With the profits from his venture, Delgado allegedly threw lavish parties and purchased multiple multi-million dollar properties.

, US Attorney's Office for the Middle District of Florida

Goliath Ventures - United States v. Christopher Alexander Delgado

Goliath Ventures CEO charged

Goliath Ventures CEO charged with running $328&nbsp;million Ponzi scheme

Staff members working for South Korean prosecutors, for some reason, decided to use a "wallet checking tool" during an August 2025 audit of seized crypto assets. The tool they selected turned out to be a <button class="define-target" id="phishing">phishing</button> tool, and five wallets were drained of 320&nbsp;BTC.<p>On February 19, the office announced they had recovered the stolen assets and identified the thief.</p>

"Prosecutors recover $22 million worth of lost Bitcoin"

Phishing attack on South Korean prosecutors

South Korean prosecutors lose $22&nbsp;million of seized crypto to the wallet inspector, later recover it

After an <button class="define-target" id="oracle">oracle</button> misconfiguration, the Moonwell defi lending protocol accumulated $1.78&nbsp;million in <button class="define-target" id="bad-debt">bad debt</button>. When the protocol showed that <button class="define-target" id="wrapped-token">cb</button>ETH was priced at just over a dollar, rather than its actual market price of around $2,200, bots and humans alike rushed to take advantage of the mispricing. The error cascaded into liquidations across the platform.<p>This is the second time Moonwell has suffered a loss thanks to an oracle misconfiguration. In <a href="https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction" target="_blank">November 2025</a>, the platform was left with almost $3.7&nbsp;million in bad debt after a different asset was mispriced.</p><p>Although the vulnerable pull requests were at least partially developed by an AI tool, the security auditor who initially attributed the vulnerability to Claude Opus 4.6 later softened his criticism, noting that even senior developers could have made the same mistake. He did, however, criticize the project for a lack of sufficiently rigorous testing that should have caught the issue.</p>

"Moonwell hit by $1.78M exploit as AI vibe coding debate reaches DeFi"

DeFi lending protocol Moonwell hit with $1.8 million bad debt after oracle misconfiguration

Moonwell exploit

Moonwell lending protocol suffers $1.78&nbsp;million loss after second oracle misconfiguration in four months

The South Korean cryptocurrency exchange Bithumb disclosed that it had accidentally given its customers more than 620,000&nbsp;BTC (~$44&nbsp;billion) in a promotional event gone wrong. Intending to reward each customer with at least ₩2,000 (~$1.40), the exchange accidentally rewarded each customer at least 2,000&nbsp;BTC (almost $140&nbsp;million).<p>The exchange announced that they had recovered 99.7% of the erroneously awarded tokens, leaving around 1,860&nbsp;BTC (~$130&nbsp;million) unaccounted for.</p><p>The incident has drawn further scrutiny from Korean regulators, who said that the error "has exposed the vulnerabilities and risks of virtual assets." Regulatory agencies in the country had already been cracking down on crypto firms following a <a href="https://www.web3isgoinggreat.com/?id=upbit-hack" target="_blank">$30&nbsp;million hack of the Upbit crypto exchange</a> in November 2025.</p>

"South Korean crypto firm accidentally sends $44 billion in bitcoins to users"

Bithumb giveaway error

Bithumb accidentally gives away $44&nbsp;billion to customers

Hackers exploited a bug in smart contracts deployed by the defi protocol CrossCurve to steal an estimated $3&nbsp;million across multiple blockchains. The thief was able to spoof cross-chain messages, causing the CrossCurve <button class="define-target" id="bridge">bridge</button> to release assets not belonging to them.<p>CrossCurve took a conciliatory tone in on-chain messages sent to the thief, writing, "These tokens were wrongfully taken from users due to a smart contract exploit. We do not believe this was intentional on your part, and there is no indication of malicious intent." (Who among us hasn't accidentally stolen millions of dollars?) However, they warned, they planned to escalate to working with law enforcement and blockchain security firms to investigate and prosecute the theft if the funds were not returned within 72 hours.</p>

"CrossCurve Threatens Legal Action After $3M Cross-Chain Bridge Exploit"

CrossCurve users exploited for around $3&nbsp;million

The Solana-based <button class="define-target" id="defi">defi</button> portfolio tracker Step Finance lost 261,854&nbsp;SOL (~$28.7&nbsp;million) when a thief gained access to treasury and fee wallets. It's not yet clear how the attacker was able to steal the funds, although Step Finance posted to Twitter that the theft occurred via a "well known attack vector". Step wrote that they were working with cybersecurity firms and law enforcement to address the incident.

Step Finance theft

$29&nbsp;million stolen from from Step Finance treasury wallets

Some users of Matcha Meta, a <button class="define-target" id="dex">decentralized exchange</button> aggregator on the Base blockchain, suffered losses after a thief exploited a vulnerability in its SwapNet integration. SwapNet is another DEX aggregator that integrates with Matcha Meta, and Matcha blamed a vulnerability in their <button class="define-target" id="smart-contract">smart contracts</button> that enabled a thief to steal assets transferred via the integration.<p>Most of the lost funds came from a single user, who lost $13.34&nbsp;million in assets. Other users lost a combined $90,000.</p>

Matcha Meta exploit

$13.43&nbsp;million stolen from Matcha Meta users in SwapNet exploit

An attacker exploited a bug in an Aperture Finance smart contract to steal at least $3.4&nbsp;million from users who had enabled "instant liquidity management" features. Aperture Finance is a defi platform that aims to allow users to trade by telling large language models their "intents".<p>Aperture has said they disabled portions of their web app impacted by the bug, and are working to try to trace and recover stolen funds.</p>

Aperture Finance exploit

Aperture Finance users lose at least $3.4&nbsp;million

The Saga project halted its blockchain after acknowledging that $7&nbsp;million had been stolen. An attacker was evidently able to <button class="define-target" id="mint">mint</button> a large quantity of Saga Dollar tokens, though it's not yet clear whether it was because of a <button class="define-target" id="smart-contract">smart contract</button> vulnerability, <button class="define-target" id="private-key">private key</button> compromise, or some other issue. The attacker was quick to swap most of the assets to ETH to thwart asset <button class="define-target" id="freezing">freezes</button> or blockchain halts.<p>The Saga Dollar token lost its peg and fell to around $0.75 after the attack.</p>

"Saga becomes latest victim in DeFi hacking spree"

Event	Date	Amount More info	Recovered More info
Ostium exploit	July 15, 2026	$24,000,000
Polymarket vendor exploit	June 25, 2026	$2,940,000
SecondFi exploit	June 23, 2026	$2,400,000
Taiko bridge exploit	June 22, 2026	$1,700,000
Aztec hack #2	June 18, 2026	$2,100,000
Aztec Connect exploit	June 15, 2026	$2,100,000
Raydium legacy smart contract exploit	June 10, 2026	$1,340,000
Secret bridge exploit	June 10, 2026	$4,670,000
Humanity Protocol theft	June 9, 2026	$36,000,000
Gravity Bridge theft	May 30, 2026	$5,400,000
DxSale exploit	May 29, 2026	$7,300,000
SquidRouterModule exploit	May 25, 2026	$3,200,000
Polymarket private key compromise	May 22, 2026	$700,000
RetoSwap theft	May 20, 2026	$2,700,000
Verus bridge hack	May 17, 2026	$11,600,000	$8,500,000
Thorchain exploit	May 15, 2026	$10,800,000
Transit Finance hack	May 13, 2026	$1,880,000
TAC bridge exploit	May 12, 2026	$2,800,000
TrustedVolumes exploit	May 6, 2026	$6,700,000
Ekubo exploit	May 5, 2026	$1,400,000
Wasabi Protocol exploit	April 30, 2026	$5,000,000
Zondacrypto withdrawal halt	April 25, 2026	$96,000,000
Volo Protocol exploit	April 21, 2026	$3,500,000	$2,900,000
Kelp DAO hack	April 18, 2026	$292,000,000
Grinex hack	April 16, 2026	$13,000,000
Rhea Finance exploit	April 16, 2026	$18,400,000	$10,000,000
CoW Swap DNS hijacking	April 14, 2026	$1,200,000
Hyperbridge exploit	April 13, 2026	$2,500,000
Fake Ledger app	April 13, 2026	$9,500,000
Bitcoin Depot hack	April 6, 2026	$3,665,000
Drift exploit	April 1, 2026	$285,000,000
USR stablecoin depeg	March 22, 2026	$24,000,000
Venus Protocol bad debt	March 17, 2026	$2,150,000
Aave swap loss	March 12, 2026	$49,962,385
Chaos Labs Aave liquidations	March 10, 2026	$26,900,000
Gondi theft	March 9, 2026	$230,000
Solv Protocol exploit	March 5, 2026	$2,700,000
Returned crypto stolen again from Korean authorities	March 3, 2026	$4,920,000
Crypto stolen from Korean authorities after they post wallet seed phrase	February 26, 2026	$4,920,000	$4,920,000
IoTeX bridge exploit	February 21, 2026	$2,000,000
YieldBlox theft	February 21, 2026	$3,000,000	$7,200,000
Goliath Ventures CEO charged	February 20, 2026	$328,000,000
Phishing attack on South Korean prosecutors	February 19, 2026	$22,000,000	$22,000,000
Moonwell exploit	February 15, 2026	$1,780,000
Bithumb giveaway error	February 7, 2026	$44,000,000,000	$43,868,000,000
CrossCurve users exploited for around $3 million	February 1, 2026	$3,000,000
Step Finance theft	January 31, 2026	$28,700,000
Matcha Meta exploit	January 25, 2026	$13,430,000
Aperture Finance exploit	January 25, 2026	$3,400,000
Saga exploit	January 21, 2026	$7,000,000