Defi lending project More Markets lost $9.3&nbsp;million after an attacker was able to trick the lending protocol logic and empty the project's reserve. The attack was noticed by blockchain security researchers at Blockaid; More Labs later announced they were investigating. Oddly, while acknowledging that funds had been stolen, they wrote, "Our initial investigation reveals that MORE was not exploited. MORE's contracts are secure. MORE is solvent. The protocol is paused." They claimed that only 5% of the assets were bridged out of the Flow blockchain, though did not explain how they planned to prevent the attacker from moving more tokens or collapsing the token price entirely.

More Markets exploit

More Markets exploited for $9.3&nbsp;million

The ostensibly decentralized Cronos blockchain was halted after a price manipulation attack allowed an attacker to borrow more than $75&nbsp;million against nearly worthless collateral from the Tectonic lending platform. The attacker pumped the price of the thinly traded TONIC token, the native token of Tectonic, then borrowed against it. The attacker cashed out approximately $6&nbsp;million by bridging it to Ethereum before the Cronos chain was halted, limiting their profits. The blockchain was offline for almost 24 hours, during which time it was rolled back to a block prior to the hack — essentially undoing all the transactions that occurred after that block.<p>Cronos was launched by the exchange Crypto.com in 2021, and although the two entities are technically separate, they remain very closely linked. Because the Cronos chain is maintained by a relatively small number of validators, many controlled by Crypto.com, it was relatively easy to halt the chain — though the move was criticized by some who felt that it only illustrated Cronos' lack of decentralization and immutability. Some criticized the decision to halt the chain for nearly 24 hours over an exploit of a third-party protocol.</p>

"Cronos halts blockchain after $75 million lending exploit hits lending app Tectonic"

Tectonic theft

Crypto.com-affiliated Cronos blockchain halted after Tectonic theft

A vulnerability in a smart contract belonging to Rain, a crypto payments infrastructure provider, resulted in $1.1&nbsp;million in losses to various firms. Customers of the Avici cryptocurrency neobank, which offers a Visa credit card through which customers can spend crypto, suffered roughly $500,000 in losses. Customers of another neobank, Tria, lost more than $430,000.<p>The losses are somewhat unusual because the neobanks describe themselves as self-custodial, which normally means that customers have total control over their crypto assets rather than storing them on a third-party platform. Normally, self-custody is more resilient to exploits like this, given that assets remain in user wallets. However, because these neobanks require customers to load funds they want to be able to spend into a third-party contract, they were vulnerable to the theft.</p>

"A $1.1 million crypto card hack crashed a neobank's token 49%"

Avici exploit

Exploit on Rain crypto payments infrastructure provider causes losses for "self-custodial" neobanks

An attacker stole around $8.7&nbsp;million from the Moonwell defi lending protocol after manipulating the price of an illiquid token called MAMO. After pumping the MAMO token price, they "borrowed" various assets and abandoned the overinflated collateral.<p>This theft is the fourth Moonwell exploit in less than a year, following a <a href="https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction" target="_blank">$3.7&nbsp;million oracle manipulation attack</a> in November 2025, another <a href="https://www.web3isgoinggreat.com/?id=moonwell-exploit" target="_blank">oracle attack</a> in February 2026 amounting to $1.78&nbsp;million, and a <a href="https://www.web3isgoinggreat.com/?id=moonwell-governance-attack" target="_blank">$1&nbsp;million governance attack</a> in March.</p>

"Moonwell investigates lending market issue on Base as security firms flag multimillion-dollar exploit"

Moonwell price manipulation attack

Moonwell loses $8.7&nbsp;million to fourth exploit in less than a year

Ethereum lending protocol Term Finance lost around $8.5&nbsp;million when an attacker purchased the majority of the project's governance token — which was not widely held — and then voted themselves to be the controller of the project's vaults. Although the project has governance safeguard, including a timelock and veto procedure, neither went into effect for reasons the project has yet to explain.<p>The attacker withdrew around 2,843&nbsp;ETH (~$6.9&nbsp;millon) and $1.68&nbsp;million in the USDC stablecoin, amounting to about 68% of assets on the platform.</p><p>Term Finance previously lost $1.65&nbsp;million to an oracle misconfiguration error in April 2025, but recovered $1&nbsp;million of the funds.</p>

"Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power"

Term Finance governance attack

Term Finance loses $8.5&nbsp;million to governance attack

Multiple blockchains based on the Cosmos chain suffered exploits after Cosmos Labs publicly disclosed a vulnerability in the Cosmos EVM. Some have criticized Cosmos for "negligence" in their vulnerability management. KiiChain, one of the affected chains, wrote in their postmortem, "This loss was avoidable. ... Publishing a security fix in the open, before the chains running that code have been told privately and given time to patch, hands the vulnerability to anyone reading the commit. Standard responsible disclosure exists precisely to prevent this. Cosmos Labs gave no advance notice to downstream chains, did not flag the release as security critical, and did not tell affected chains that a public release had happened until Friday 21 August, two days later."<p>KiiChain was exploited for around 148&nbsp;million KII, which the attacker was able to cash out for around $1.6&nbsp;million. TAC, a Telegram-focused blockchain, was exploited for about 3&nbsp;billion&nbsp;TAC (~$7.5&nbsp;million). Nesa Chain was exploited, and though an attacker was able to steal tokens nominally worth $50&nbsp;million, lack of liquidity limited their profits to around $60,000. A blockchain called MANTRA also halted due to an exploit, but the network said that no user funds were impacted.</p>

"Cosmos Labs under fire over disclosure of bug affecting four blockchains"

Cosmos-based blockchain exploits

KiiChain, TAC, and other Cosmos-based blockchains exploited after "negligent" vulnerability disclosure

An attacker took advantage of a bug in the authorization logic for the BounceBit layer-1 blockchain, allowing them to transfer around 286.5&nbsp;million&nbsp;BB (~$3&nbsp;million) from nine wallets. BounceBit halted the blockchain shortly after, then later announced they would be permanently shutting down the chain and reissuing tokens on Binance's BNB Chain. "Maintaining a standalone Layer 1 is no longer the most effective way to serve our users," they said. They explained that it would be challenging to patch the underlying flaw because the chain was based on Evmos, an Ethereum blockchain implementation that was shut down in May.<p>BounceBit, a bitcoin <button class="define-target" id="restaking">restaking</button> protocol, raised $6&nbsp;million in seed funding in 2024 from Blockchain Capital, Breyer Capital, Bankless Ventures, OKX Ventures, HTX Ventures, and others.</p>

"Bitcoin restaking protocol BounceBit raises $6 million in seed funding; already boasts over $545 million in TVL"

BounceBit exploit

BounceBit exploited for $3&nbsp;million, announces shutdown and migration

The Maya Protocol announced that an attacker had stolen 20&nbsp;BTC (~$1.4&nbsp;million) and various other assets totaling $1.76&nbsp;million. A postmortem disclosed that the "sophisticated attacker exploited six chained bugs" to steal the assets. "The bugs exploited were not caught by Halborn <button class="define-target" id="audit">audit</button>, nor Fable 5 audit", wrote Maya founder on Twitter. Halborn is a blockchain security firm; Fable 5 is an AI model developed by Anthropic.

MAYAChain exploit

$1.76&nbsp;million stolen from MAYAChain in attack exploiting six bugs

The Coinsbuy crypto platform was exploited for around $8&nbsp;million across both the Ethereum and Tron blockchains. The attacker was able to steal the funds from eight <button class="define-target" id="wallet">wallets</button> belonging to the exchange. The wallets were later replenished by Coinsbuy, suggesting that the attack vector did not involve compromising the wallets themselves.<p>Coinsbuy has said that the vulnerability has been addressed, and offered a $100,000 "<button class="define-target" id="bug-bounty">bounty</button>" for the returned funds.</p>

"Hackers Drain $8 Million From Crypto Exchange Across Two Blockchains"

Coinsbuy exploit

Coinsbuy exploited for $8&nbsp;milllion

Thousands of users of a <button class="define-target" id="hardware-wallet">hardware wallet</button> called Coldcard, a physical device developed by the Canadian Coinkite firm to allow bitcoin holders to store their bitcoin on a device that's not connected to the internet, have suffered at least 2,055&nbsp;BTC (~$130&nbsp;million) in combined losses after thieves began exploiting a flaw with the wallet firmware's <button class="define-target" id="seed-phrase">seed phrase</button> generation. A 2021 version of the device firmware, which affects a wide range of Coldcard devices, skipped the device's more secure hardware randomness generator and instead fell back to generating seed phrases with random numbers <a href="https://en.wikipedia.org/wiki/Random_seed" target="_blank">seeded</a> from the device's serial number and clock registers. The resulting seed phrases are relatively trivially guessed, and hackers have been methodically draining vulnerable wallets as researchers warn that all vulnerable Coldcard devices will be drained soon if their owners do not move assets to secure wallets.<p>An estimated 2,055&nbsp;BTC (~$130 million) and counting has been drained in the days following the discovery of the attack, which began with an attack that saw 594&nbsp;BTC ($38&nbsp;million) drained from about 500 separate wallets. The first attack seemed to intentionally target higher-value wallets, with only wallets containing 0.15&nbsp;BTC (~$9,500) or more impacted. Attacks have come from an estimated 15 unique groups, according to Galaxy Research.</p><p>Hardware wallets are often used by more security conscious users, or those with more significant sums of money at risk, because the lack of internet connection makes the devices less vulnerable to phishing or malware-based attacks. However, if a wallet seed phrase can be obtained by an attacker, the lack of internet connection is no barrier to theft. Coldcard describes itself as "ultra-secure", and its website is filled with reviews describing the product as "one of the most secure Bitcoin hardware wallets ever built".</p>

"Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets"

"Major bitcoin wallet flaw drains $38 million worth of BTC in 25-minute sweep"

Coldcard hardware wallet flaw

Coldcard hardware wallet flaw sees more than 2,000&nbsp;BTC (~$130 million) drained across thousands of wallets

South Korean police say scammers running a fake <button class="define-target" id="staking">staking</button> website under the name of the real Flare Network took 3.4&nbsp;million XRP (~$8.5&nbsp;million) from 71 investors. It's possible the scammers stole closer to $19&nbsp;million. Victims were promised guaranteed returns of 1.5% to 1.8% a month; the site was only live for about a week in October 2025 before the operators disappeared with the deposits.<p>Two men were arrested on fraud charges, and Korean police are seeking a third. They reportedly advertised the scam project via YouTube and online articles.</p>

"12.3 Billion Won Crypto Scam Group Arrested"

Fake Flare Network staking site

Two arrested after Flare Network staking site scammed users out of 3.4 million XRP (~$8.5 million)

Singapore-based stablecoin payments company Triple-A confirmed that an attacker stole $11.8&nbsp;million in company funds from its treasury wallets. The company briefly took some services offline while they investigated the hack.<p>Triple-A did not say how much was taken or how the wallets were compromised, and said the impact was limited to "specific operational accounts" and able to be covered by treasury reserves. Blockchain analyst Specter estimated the loss at $11.8&nbsp;million, stolen across the bitcoin and Tron networks.</p>

"Official Statement Regarding Recent Wallet Activity"

Triple-A hack

Triple-A hacked for $11.8&nbsp;million

Balance Coin, a small <button class="define-target" id="algorithmic-stablecoin">algorithmic stablecoin</button> built on BNB Chain, lost its dollar <button class="define-target" id="peg">peg</button> and crashed to fractions of a cent after an attacker successfully exploited a flaw in its pricing logic. The attacker was able to trick the system into accepting an incorrectly low bitcoin price, which they then used to drain multiple vaults used by the project's lending protocol.<p>The attacker ultimately profited by about $912,000, consisting of funds stolen from 42DAO, the entity that runs the Balance protocol.</p>

"Balance stablecoin collapses 99% after $1 million exploit drains its bitcoin vaults"

Balance Coin algorithmic stablecoin crashes

42DAO's Balance Coin algorithmic stablecoin crashes after $912,000 theft

An attacker exploited the Wanchain <button class="define-target" id="bridge">bridge</button>, stealing 515&nbsp;million NIGHT tokens that had been bridged from Cardano to BNB. The NIGHT token belongs to Midnight, a privacy-focused blockchain linked to Cardano. The stolen tokens were priced at $9&nbsp;million to $10&nbsp;million at the time of the theft, although the massive outflow of tokens briefly caused the NIGHT token price to drop by about 43%.

Cardano Midnight bridge exploit

Wanchain bridge on Cardano exploited for more than $9&nbsp;million

The Allbridge blockchain <button class="define-target" id="bridge">bridge</button> was exploited for $1.66&nbsp;million in a <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker took advantage of a flaw in the project's logic that reprices assets against one another, after discovering that the same would happen even when borrowing an asset against collateral denominated in the same token. They were able to manipulate the project's internal pricing logic so that the asset's actual price diverged away from reality, pocketing $1.66&nbsp;million in proceeds.

Allbridge exploit

Allbridge exploited for $1.66&nbsp;million

The Solana deployment of the Across <button class="define-target" id="bridge">bridge</button> was hacked for around $3.35&nbsp;million. According to Across, the stolen funds belonged to Risk Labs, the foundation supporting the project, rather than users of the bridge.

Across Protocol exploit

Across Protocol exploited for $3.35&nbsp;million

Decentralized <button class="define-target" id="perps">perpetual futures</button> exchange Ostium was drained of at least $24&nbsp;million after an attacker manipulated its <button class="define-target" id="oracle">oracle</button> system — a system that pulls in off-chain price data. After the attacker apparently gained access to the private key used to sign oracle messages, they were able to submit future-dated oracle reports that tricked the system into thinking trades were profitable.<p>The attacker siphoned at least $24&nbsp;million USDC from the protocol, which they quickly swapped into ETH and laundered via Tornado Cash.</p>

"Another DeFi Exploit: Perp DEX Ostium Loses $18 Million in Oracle Attack"

Ostium exploit

Ostium loses at least $24&nbsp;million to oracle exploit

The Hedera-based decentralized lending platform Bozno Lend was exploited for just over $9&nbsp;million after an attacker took advantage of a flaw in the project's <button class="define-target" id="oracle">oracle</button> system. The attacker was able to deposit tokens worth only a few dollars, then manipulate the project's oracle to reflect a dramatically higher price. They then borrowed $6.63&nbsp;million in USDC and 34.5&nbsp;million <button class="define-target" id="wrapped-token">wrapped</button> HBAR (~$2.4&nbsp;million).<p>Bonzo has announced they will reimburse users affected by the exploit, with support from the Hedera Foundation.</p>

"Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update"

Bonzo Lend exploit

Bonzo Lend exploited for $9&nbsp;million in oracle attack

Summer Finance, a defi platform that provides "institutional defi vault infrastructure", was exploited for $6&nbsp;million in an apparent <button class="define-target" id="flash-loan">flash loan</button> attack. The attacker used a flash loan to deposit $64.8&nbsp;million and then withdraw $70.9&nbsp;million, taking advantage of a price manipulation bug that allowed them to withdraw more than they deposited.<p>Shortly after the exploit, Summer Finance announced it had "no viable path forward other than to wind down operations". They added, "a meaningful portion of the team's own capital was held in the affected vaults, removing the runway we needed to rebuild."</p>

"Lazy Summer USDC Vault Exploit Post-Mortem: What Happened and What Comes Next"

"Sunsetting Summer.fi and the Labs Company"

Summer Finance exploit

Summer Finance exploited for $6&nbsp;million, shuts down

The Dutch cryptocurrency platform Knaken (not to be confused with the American Kraken platform) abruptly went offline in early June, leaving roughly 30,000 customers unable to access their funds. The company was unable to secure a license under the EU's <a href="https://en.wikipedia.org/wiki/Markets_in_Crypto-Assets" target="_blank">MiCA</a> regulations, which it said forced them to shut down. Though they claimed to be winding down the company in an orderly fashion, they reportedly stopped paying customer withdrawals, and asked customers to stop filing claims.<p>Dutch prosecutors asked courts to declare the platform bankrupt and install a court-appointed trustee to oversee the process of extracting assets from the company to return to customers, who are missing around €7&nbsp;million (~$8&nbsp;million). The request was approved. The country's Fiscal Information and Investigation Service has also opened a criminal investigation into the platform.</p>

"Dutch Prosecutors Seek to Bankrupt Crypto Platform Knaken After Funds Frozen"

Knaken crypto platform collapses

Dutch Knaken crypto platform collapses with $8&nbsp;million in customer funds missing

Polymarket customers have lost around $2.97&nbsp;million to an attacker who then swapped stolen Polymarket USD (pUSD) to ETH.<p>Polymarket, a crypto-based prediction markets platform, quickly made an announcement to claim that a third-party vendor had been compromised to allow an attacker to inject a malicious script into the website frontend. Polymarket has said it will refund affected customers.</p>

Polymarket vendor exploit

Polymarket customers lose $2.97&nbsp;million, company blames third-party vendor

Users of the Cardano wallet SecondFi (formerly Yoroi) have lost a cumulative 16&nbsp;million ADA (~$2.4&nbsp;million) across three attacks targeting a vulnerability in the project's wallet generation code.<p>After the attacks commenced, SecondFi "rescued" another 129&nbsp;million ADA (~$19.4&nbsp;million) by moving the assets to a third party entity. They announced that an external accounting firm would verify the funds and process user claims.</p><p>About a month after the hack, SecondFi announced it would shut down operations.</p>

"SecondFi loses $2.4 million in Cardano wallet exploit"

SecondFi exploit

Users of the SecondFi Cardano wallet lose $2.4&nbsp;million in series of hacks

The Taiko <button class="define-target" id="bridge">bridge</button>, which allows assets to be transferred between the Ethereum mainnet and the Taiko Ethereum <button class="define-target" id="layer-2">layer-2</button> chain, was exploited for at least $1.7&nbsp;million before the network was halted, limiting losses. An attacker was able to forge withdrawal requests to appear as though they matched real deposits. Crypto security firm BlockSec said that the attacker may have gained access to a signing key that had been exposed on GitHub.

Taiko bridge exploit

Taiko bridge exploited

Three days after Aztec Labs' deprecated Aztec Connect blockchain <button class="define-target" id="bridge">bridge</button> was <a href="https://www.web3isgoinggreat.com/?id=aztec-connect-exploit" target="_blank">exploited</a> for $2.1&nbsp;million, the project has been hacked again for the same amount. Aztec Labs confirmed the second exploit, again trying to emphasize that the code was deprecated four years ago.<p>The hacks are part of a <a href="https://www.web3isgoinggreat.com/?collection=legacy-exploit" target="_blank">spate of exploits</a> targeting legacy smart contracts belonging to projects including <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a>. Although some projects have developed techniques to circumvent the immutable nature of blockchains and allow smart contracts to be upgraded or retired, many legacy contracts cannot be changed or shut down, leaving them vulnerable to attack indefinitely.</p>

Aztec hack #2

Aztec Connect hacked for a second time in less than a week

Aztec Connect, an abandoned defi privacy bridge from Aztec Labs, was drained of $2.1&nbsp;million after an attacker exploited a bug in the project's smart contracts. Although the project was deprecated three years ago, funds remained in the legacy system. "Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us," the project posted on social media.<p>The theft is only the latest in a string of attacks targeting vulnerable legacy smart contracts, many of which cannot be deleted, paused, or changed due to blockchains' immutable nature. <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a> are two other platforms that have recently suffered losses due to old, insecure code.</p>

"Aztec Connect’s abandoned smart contract exploited for $2.1M"

Aztec Connect exploit

Deprecated project Aztec Connect exploited for $2.1&nbsp;million

An attacker exploited a legacy <button class="define-target" id="smart-contract">smart contract</button> that had been used by the Raydium Solana <button class="define-target" id="dex">DEX</button> before it was deprecated in 2021. Though the contract was unused, there were still funds in the <button class="define-target" id="liquidity-pool">liquidity pools</button> affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.<p>Raydium has said it will compensate users who lost funds in the exploit.</p>

"Raydium Confirms $1.34M Drain on Deprecated AMM V3, Pledges Treasury Compensation"

Raydium legacy smart contract exploit

Raydium users lose $1.34&nbsp;million after legacy smart contract exploited

The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite <button class="define-target" id="mint">mint</button> bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of <button class="define-target" id="wrapped-token">wrapped</button> Axelar tokens on the Secret network, which they then redeeemed for around $4.67&nbsp;million.<p>The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in.</p><p>Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."</p>

"Secret Network bridge exploited for $4.7M with 'infinite mint' bug"

Secret bridge exploit

Secret bridge exploited for $4.67&nbsp;million a week before anyone notices

Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36&nbsp;million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven <button class="define-target" id="private-key">private keys</button> that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy <button class="define-target" id="multisig">multisignature</button> requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like <button class="define-target" id="bridge">bridges</button>. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.<p>With the keys, the attacker stole more than 6&nbsp;million of Humanity's H token, then used other keys to upgrade a bridge and drain 141&nbsp;million more tokens. With the bridge access, they also <button class="define-target" id="mint">minted</button> 300&nbsp;million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%.</p><p>Humanity Protocol markets itself as a competitor to Sam Altman's <a href="https://www.web3isgoinggreat.com/?collection=worldcoin" target="_blank">World</a> (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20&nbsp;million in 2025 from Pantera Capital and Jump Crypto.</p>

"Explained: The Humanity Protocol Hack (June 2026)"

"Humanity's $36 million exploit tied to compromised laptop hosting a 'multisig' wallet"

Humanity Protocol theft

Humanity Protocol loses $36&nbsp;million to employee laptop compromise

Gravity Bridge, a bridge between the Cosmos and Ethereum blockchains, suffered $5.4&nbsp;million in losses likely due compromised private keys. The developers of the protocol urged validators to halt while the theft was investigated, and the bridge was indeed halted shortly after. Two weeks after the hack, the Gravity Bridge interface remained unavailable.

Gravity Bridge theft

Gravity Bridge drained of $5.4&nbsp;million 

DxSale, a project that was popular in 2021 for launching new tokens and creating <button class="define-target" id="liquidity-pool">liquidity pools</button>, suffered a $7.3&nbsp;million exploit after ownership of a locker contract was transferred to a new address. Nine months later, the contract ownership was repeatedly moved between many new wallets&nbsp;— likely in an attempt to cover tracks&nbsp;— before $7.3&nbsp;million was taken from old liquidity pools. The stolen assets were then swapped to BNB and routed through <button class="define-target" id="bridge">bridges</button> and <button class="define-target" id="tumbler">mixers</button> to obscure the trail.

"Old DxSale Lockers Drained for $7.3M Across 1,400 BNB Chain Pools as Owner-Privilege Exploits Pile Up"

DxSale exploit

DxSale exploited for $7.3&nbsp;million

A third-party Gnosis Safe smart contract called SquidRouterModule was exploited for $3.2&nbsp;million. The smart contract included a set string that could be passed to identify a "safe" message; however, the string was visible in the public smart contract code and used by an attacker to impersonate Gnosis Safe users and then drain their wallets. 86 wallets had used the module, and lost a combined $3.2&nbsp;million.<p>The name led to some confusion due to the similarly named Squid Router, which is not related. It's not clear if the users who installed the module were aware that the two projects were separate.</p>

"Explained: The SquidRouterModule Hack (May 2026)"

SquidRouterModule exploit

SquidRouterModule, unrelated to Squid Router, exploited for $3.2&nbsp;million

Crypto sleuth zachxbt identified that "A Polymarket admin address appears to have been compromised on Polygon", writing that $520,000 had been drained as of the time of his post. The theft ultimately amounted to around $700,000, and Polymarket confirmed that a "wallet used for internal top-up operations" had been compromised. They did not provide further details as to how the compromise happened, though the company's VP of Engineering later said that the private key was six years old and that all private keys would be replaced with a managed key going forward.

Polymarket private key compromise

Polymarket loses $700,000 to private key compromise

The RetoSwap decentralized exchange for trading the Monero <button class="define-target" id="privacycoin">privacycoin</button> was exploited after an attacker exploited a vulnerability in the Haveno Monero exchange protocol used by the project. Users lost an estimated $2.7&nbsp;million when their transactions were routed to the attacker's wallet.<p>Because Monero is a privacycoin, a type of cryptocurrency that obscures transaction details including sender and receiver wallets, it is not feasible to trace the stolen assets.</p>

RetoSwap theft

RetoSwap users lose $2.7&nbsp;million to Haveno vulnerability

An attacker stole $11.6&nbsp;million in various crypto assets from the Verus–Ethereum <button class="define-target" id="bridge">bridge</button>, which allows users to use tokens from the Verus network on the Ethereum chain and vice versa. The attacker then swapped the tokens for ETH, limiting the ability for issuers of more centralized tokens to freeze the stolen assets.<p>Verus halted the entire Verus network after the exploit was detected in hopes of limiting further damage.</p><p>The exploiter later accepted a <button class="define-target" id="bug-bounty">bounty</button> offer by Verus, returning 4,052&nbsp;ETH (~$8.5&nbsp;million) while keeping the remaining ~25% as a "bounty".</p>

"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid"

Verus bridge hack

Verus bridge hacked for $11.6&nbsp;million

The THORchain cross-chain liquidity protocol was exploited for around $10.8&nbsp;million across several blockchains: Bitcoin, Ethereum, BNB Chain, and Base. The protocol paused trading after observing the suspicious transactions. News of the hack caused the protocol's RUNE token to drop in price by more than 10%.

Thorchain exploit

THORchain exploited for $10.8&nbsp;million

Transit Finance was exploited for $1.88&nbsp;million after an attacker exploited a "legacy contract" on the TRON blockchain that the project said was deprecated in 2022. "Historical vulnerabilities within it" were exploited, the project explained, allowing the attacker to steal $1.88&nbsp;million.<p>Transit was <a href="https://www.web3isgoinggreat.com/?id=transit-swap-hacked-for-21-million-hacker-returns-large-portion" target="_blank">previously exploited in 2022</a> for $21&nbsp;million, although around 70% of the stolen assets were later returned.</p>

Transit Finance hack

Transit Finance hacked for $1.88&nbsp;million

The TAC bridge, which bridges assets from the Ethereum blockchain to the Telegram-linked TON chain, was exploited for $2.8&nbsp;million. The project paused the bridge and announced they were investigating.<p>The project has announced they intend to "restor[e] bridge liquidity through a legally structured sale of Foundation's TAC token treasury reserves."</p>

TAC bridge exploit

TAC bridge exploited for $2.8&nbsp;million

TrustedVolumes, a resolver and market maker used by 1inch and other defi platforms, suffered a $6.7&nbsp;million exploit after an attacker was able to steal funds without proper validation. The thief then swapped the stolen <button class="define-target" id="wrapped-token">w</button>ETH, USDT, wBTC, and USDC through ChangeNow and converted them to ETH to evade <button class="define-target" id="freezing">freezes</button>.<p>Blockchain research firm Blockaid has linked the attacker to a <a href="https://www.web3isgoinggreat.com/?id=1inch-loses-5-million-to-smart-contract-bug" target="_blank">similar exploit in March 2025</a> that saw $5&nbsp;million drained from 1inch. This time, 1inch has asserted that although they use TrustedVolumes as a resolver, the exploit did not involve any of their systems.</p>

"DeFi Platform TrustedVolumes Hit by $6.7M Exploit"

TrustedVolumes exploit

TrustedVolumes suffers $6.7&nbsp;million exploit

The Ekubo automated market maker infrastructure project experienced a $1.4&nbsp;million theft after attackers were able to take advantage of a <button class="define-target" id="smart-contract">smart contract</button> that improperly verified permissions. They stole 17&nbsp;<button class="define-target" id="wrapped-token">w</button>BTC ($1.4&nbsp;million), which they swapped for ETH and laundered via Tornado Cash.

"Attackers drain $1.4M in wrapped bitcoin from DeFi protocol Ekubo in approval-based exploit"

Ekubo exploit

Ekubo exploited for $1.4&nbsp;million

The Wasabi Protocol defi derivatives platform has been exploited for more than $5&nbsp;million across multiple blockchains. The attack has been attributed by blockchain security firms to a compromised admin <button class="define-target" id="private-key">key</button>, which allowed the attacker to upgrade contracts to steal assets.

"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say"

Wasabi Protocol exploit

Wasabi Protocol exploited for more than $5&nbsp;million

The Polish cryptocurrency exchange Zondacrypto faced complaints that withdrawals were not being processed as far back as December 2025, but the crisis seems to have escalated. CEO Przemysław Kral attempted to assuage insolvency fears by pointing to a cryptocurrency wallet containing around 4,500&nbsp;BTC (~$330&nbsp;million) as proof of assets, but he also admitted that the keys to the wallet were known only to the exchange's previous CEO and not transferred during the company's 2021 sale. The former CEO has been missing for four years.<p>Polish authorities have launched investigations into the apparent collapse. Losses have been estimated at 350&nbsp;million&nbsp;zł (~$96&nbsp;million).</p><p>Poland's Prime Minister Donald Tusk has also recently accused Zondacrypto of sponsoring conservative and right-wing politicians, including Polish President Karol Nawrocki. Nawrocki has repeatedly vetoed legislation aiming to regulate the crypto sector, describing it as overly burdensome to crypto businesses. Tusk has also alleged that Zondacrypto was funded by the Russian mafia and Russian intelligence services. These allegations are also being investigated by Polish authorities, and one report citing the country's Internal Security Agency claims that the Kremlin-linked <a href="https://en.wikipedia.org/wiki/Tambovskaya_Bratva" target="_blank">Tambovskaya Bratva</a> Russian mafia group took over the exchange as far back as 2018.</p>

"UOKiK zbada sprawę Zondacrypto. 'Znacznie poważniejsze nieprawidłowości'"

Polish leader Tusk claims Russia-linked crypto firm backed Nawrocki’s presidential bid"

"Powerful Russian mafia 'took control' of crisis-hit Polish firm Zondacrypto"

Zondacrypto withdrawal halt

Polish Zondacrypto exchange stops processing withdrawals amid possible insolvency

The Sui-based Volo Protocol defi yield platform was exploited for around $3.5&nbsp;million after an attacker targeted three vaults holding <button class="define-target" id="wrapped-token">w</button>BTC, XAUm (a tokenized gold asset), and the USDC stablecoin.<p>Volo says they have frozen or recovered all but around $60,000. They have also said they are "prepared to absorb this loss", rather than passing losses along to their users.</p>

Volo Protocol exploit

Volo Protocol exploited for $3.5&nbsp;million, most recovered

An attacker stole 116,500 rsETH (<button class="define-target" id="restaking">restaked</button> ether) from a blockchain bridge run by Kelp DAO. Based on prices at the time of the theft, the stolen tokens would be worth around $292&nbsp;million&nbsp;— however, the attacker is likely to face challenges selling a quantity of tokens that amounts to 18% of rsETH's circulating supply.<p>When tokens are bridged from one chain to another, the tokens on the original chain are locked in the bridge smart contract while the token is used on the other chain, preventing its owner from double-spending the asset. With 116,500 locked rsETH now stolen, those using the token on other blockchains are now holding possibly unbacked tokens.</p><p>The rush for holders to offload their dubiously backed tokens is likely to worsen contagion throughout defi protocols, where those platforms could be left holding the bag. Some platforms, including Aave, Lido Finance, and Ethena, have paused markets involving rsETH to try to protect themselves.</p><p>This hack has set the new record for the largest defi hack in 2026, following the $285&nbsp;million <a href="https://www.web3isgoinggreat.com/?id=drift-exploit" target="_blank">Drift exploit</a> on April 1.</p>

"2026's biggest crypto exploit: $292 million gets drained from Kelp DAO with wrapped ether stranded across 20 chains"

Kelp DAO hack

Kelp DAO bridge hacked for $292&nbsp;million

The Russian cryptocurrency exchange Grinex has halted trading after disclosing a hack of more than 1&nbsp;billion rubles (more than $13&nbsp;million). The exchange has claimed on Telegram that the hack was perpetrated by "foreign special services" they allege were trying to harm Russian financial independence.<p>According to blockchain intelligence firms TRM Labs and Chainalysis, Grinex is a rebranded version of the Garantex cryptocurrency exchange that was <a href="https://www.citationneeded.news/issue-79/#in-the-courts" target="_blank">shut down and sanctioned</a> in March 2025. Two of its operators were subsequently criminally charged in the US.</p>

"Russian Crypto Exchange Grinex Halts Trading, Alleging $13M Exploit by 'Western Special Services'"

"Sanctioned Russian Exchange Garantex Suspected of Rebrand as Grinex"

Grinex hack

Russian Grinex exchange halts trading after $13&nbsp;million+ exploit

Rhea Finance's lending product was exploited for around $18.4&nbsp;million after an attacker took advantage of a bug in the platform's <button class="define-target" id="slippage">slippage</button> protection feature. The stolen assets affected both platform and user funds.<p>Some of the stolen tokens were returned by the attacker to the protocol, and around $4.35&nbsp;million USDT were frozen by its issuer, Tether. Altogether, around $10&nbsp;million was recovered, leaving $8.4&nbsp;million outstanding.</p>

Rhea Finance exploit

Rhea Finance exploited for $18.4&nbsp;million, some recovered

Users who visited the website for the CoW Swap DEX aggregator on April 14 were unknowingly redirected to a malicious website that drained their crypto wallets. An attacker was able to socially engineer CoW Swap's domain registrar, allowing them to redirect visitors to a malicious site for a period of several hours. CoW Swap has estimated that people who used the service during that time lost around $1.2&nbsp;million.

CoW Swap DNS hijacking

CoW Swap users lose estimated $1.2&nbsp;million after DNS hijacking

On April Fools' Day, the Hyperbridge blockchain <button class="define-target" id="bridge">bridge</button> project posted a tweet claiming that the North Korean Lazarus hacking group had drained $37&nbsp;million from the project. A linked blog post contained a Rickroll GIF and an explanation of "Why Hyperbridge can't be hacked".<p>The following day, a Hyperbridge developer posted a screenshot of a blockchain transaction, writing "Lmao the uniBTC exploiter is testing Hyperbridge. I hope you have a quantum computer bro". Another commenter replied, "Rule #1 dont actively provoke attackers".</p><p>About two weeks later, an attacker was able to forge a transaction to change the admin rights for the Polkadot/Ethereum bridge contract, allowing them to mint 1&nbsp;billion DOT tokens. They were able to cash out about $2,500,000 due to limited liquidity.</p><p>The April Fools' posts have since been deleted.</p>

"Hyperbridge exploited less than two weeks after April Fools’ day hack prank"

Hyperbridge exploit

Hyperbridge exploited two weeks after April Fools' hack joke

After a fake version of the Ledger cryptocurrency wallet app made it onto the normally highly curated Apple App store, customers lost $9.5&nbsp;million dollars to the malicious product. Believing it was a genuine Ledger product, people entered their <button class="define-target" id="seed-phrase">seed phrases</button> into the app, then discovered their wallets were immediately drained.<p>One victim, a musician who goes by G. Love, wrote: "I lost my retirement fund in a hack/Scam when I switched my Ledger over to my new computer and by accident downloaded a malicious ledger app from the Apple store. All my BTC gone in an instant." According to him, he lost 5.9&nbsp;BTC (~$445,000).</p><p>Crypto sleuth zachxbt traced some of the stolen funds through Kucoin, a Chinese cryptocurrency exchange that was <a href="https://www.web3isgoinggreat.com/?id=kucoin-pleads-guilty" target="_blank">recently fined and forced to exit US markets</a> over licensing and anti-money laundering failures. "The three largest victims lost seven figures each," he wrote.</p><p>Apple removed the malicious app from their App Store on April 13, six days after it had been added.</p>


"A fake Ledger app on the Apple App Store drained $9.5 million in crypto"

Fake Ledger app

Users lose $9.5&nbsp;million to fake Ledger wallet app on the Apple App Store

Bitcoin ATM operator Bitcoin Depot has disclosed a March&nbsp;23 hack in which attackers stole 50.903&nbsp;BTC (~$3.67&nbsp;million) from company wallets. According to the company's disclosure with the SEC, the exploiters gained access to the company's IT systems and wallet credentials, allowing them to steal the assets.<p>Bitcoin Depot is the largest operator of crypto ATMs globally and in the United States, with approximately 8,700 kiosks in the US and 9,200 worldwide.</p>

 filed by Bitcoin Depot Inc. on April 6, 2026

Bitcoin Depot hack

Bitcoin Depot hacked for $3.67&nbsp;million

The Solana-based Drift <button class="define-target" id="defi">defi</button> <button class="define-target" id="perps">perpetual futures</button> exchange was exploited for $285&nbsp;million. The project alerted the community on social media, writing: "Drift Protocol is experiencing an active attack. ... This is not an April Fools joke."<p>The project later described the exploit as "a novel attack involving durable nonces, resulting in a rapid takeover of Drift's Security Council administrative powers." Once the attacker had access to admin capabilities, they quickly eliminated risk management limits on the protocol and drained huge quantities of tokens, which they swapped to USDC and then ETH. The attack was attributed to extremely sophisticated social engineering, likely by North Korean hackers.</p><p>Some have criticized USDC's issuer, Circle, for not <button class="define-target" id="freezing">freezing</button> the stolen funds during the six hours they were held in USDC. Unlike ETH, USDC is controlled by a centralized company that can, and regularly does, freeze assets determined to have been stolen or connected to illicit activity.</p><p>The theft is among the largest in defi history.</p>

"Drift says $280M exploit tied to 'sophisticated' admin takeover; ZachXBT criticizes Circle over USDC handling"

Event	Date	Amount More info	Recovered More info
More Markets exploit	August 31, 2026	$9,300,000
Tectonic theft	August 30, 2026	$6,000,000
Avici exploit	August 28, 2026	$1,100,000
Moonwell price manipulation attack	August 27, 2026	$8,700,000
Term Finance governance attack	August 23, 2026	$8,500,000
Cosmos-based blockchain exploits	August 22, 2026	$9,160,000
BounceBit exploit	August 20, 2026	$3,000,000
MAYAChain exploit	August 18, 2026	$1,700,000
Coinsbuy exploit	August 9, 2026	$8,000,000
Coldcard hardware wallet flaw	July 31, 2026	at least $130 million
Fake Flare Network staking site	July 30, 2026	$8,500,000 – $19,000,000
Triple-A hack	July 25, 2026	$11,800,000
Balance Coin algorithmic stablecoin crashes	July 21, 2026	$912,000
Cardano Midnight bridge exploit	July 20, 2026	$9,000,000 – $10,000,000
Allbridge exploit	July 19, 2026	$1,650,000
Across Protocol exploit	July 17, 2026	$3,350,000
Ostium exploit	July 15, 2026	$24,000,000
Bonzo Lend exploit	July 10, 2026	$9,050,000
Summer Finance exploit	July 6, 2026	$6,040,000
Knaken crypto platform collapses	June 30, 2026	$0
Polymarket vendor exploit	June 25, 2026	$2,940,000
SecondFi exploit	June 23, 2026	$2,400,000
Taiko bridge exploit	June 22, 2026	$1,700,000
Aztec hack #2	June 18, 2026	$2,100,000
Aztec Connect exploit	June 15, 2026	$2,100,000
Raydium legacy smart contract exploit	June 10, 2026	$1,340,000
Secret bridge exploit	June 10, 2026	$4,670,000
Humanity Protocol theft	June 9, 2026	$36,000,000
Gravity Bridge theft	May 30, 2026	$5,400,000
DxSale exploit	May 29, 2026	$7,300,000
SquidRouterModule exploit	May 25, 2026	$3,200,000
Polymarket private key compromise	May 22, 2026	$700,000
RetoSwap theft	May 20, 2026	$2,700,000
Verus bridge hack	May 17, 2026	$11,600,000	$8,500,000
Thorchain exploit	May 15, 2026	$10,800,000
Transit Finance hack	May 13, 2026	$1,880,000
TAC bridge exploit	May 12, 2026	$2,800,000
TrustedVolumes exploit	May 6, 2026	$6,700,000
Ekubo exploit	May 5, 2026	$1,400,000
Wasabi Protocol exploit	April 30, 2026	$5,000,000
Zondacrypto withdrawal halt	April 25, 2026	$96,000,000
Volo Protocol exploit	April 21, 2026	$3,500,000	$2,900,000
Kelp DAO hack	April 18, 2026	$292,000,000
Grinex hack	April 16, 2026	$13,000,000
Rhea Finance exploit	April 16, 2026	$18,400,000	$10,000,000
CoW Swap DNS hijacking	April 14, 2026	$1,200,000
Hyperbridge exploit	April 13, 2026	$2,500,000
Fake Ledger app	April 13, 2026	$9,500,000
Bitcoin Depot hack	April 6, 2026	$3,665,000
Drift exploit	April 1, 2026	$285,000,000