2328 hack event(s)
Description of the event: A TranchePool on Avalanche associated with Valinor Digital, Oatfi, and Fence Finance was exploited due to a settlement logic flaw. At the UTC day rollover, a scheduled principal payment was incorrectly treated as received, artificially restoring ~$1.013M of draw capacity and allowing the attacker to draw the same amount of USDC a second time.
Amount of loss: $ 1,013,000 Attack method: Smart Contract Vulnerability
Description of the event: Predict.fun (a BNB Chain prediction market) saw approximately 397,708 USDT drained from 29 user smart wallets (Kernel/ZeroDev-based) in two waves on October 22 and 27, 2026. Each drain was signed with the compromised owner private key; no protocol contracts were exploited. The team attributes it to a compromised third-party API documentation site, took the site offline, and pledged full reimbursement to affected users, with a full post-mortem forthcoming.
Amount of loss: $ 397,708 Attack method: Private Key Leak
Description of the event: The Diamante ecosystem experienced a security breach involving unauthorized activity by a malicious actor. The team activated emergency protocols, coordinated with exchanges and liquidity providers to suspend affected withdrawals and transfers, identified the suspected attacker, is working with law enforcement across multiple countries for recovery, and pledged to make all affected participants whole.
Amount of loss: - Attack method: Unknown
Description of the event: The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating.
Amount of loss: $ 947,000 Attack method: Supply Chain Attack
Description of the event: A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.
Amount of loss: $ 7,450,000 Attack method: Misconfiguration
Description of the event: The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
Amount of loss: $ 21900 Attack method: Governance Attack
Description of the event: X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken.
Amount of loss: $ 4,850,000 Attack method: Flash Loan Governance Attack
Description of the event: The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.
Amount of loss: $ 385000 Attack method: Rug Pull
Description of the event: The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.
Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability
Description of the event: The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.
Amount of loss: $ 90,500 Attack method: Smart Contract Vulnerability
Description of the event: The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.
Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability
Description of the event: Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.
Amount of loss: $ 41000 Attack method: Smart Contract Vulnerability
Description of the event: Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.
Amount of loss: $ 20000 Attack method: Private Key Leakage
Description of the event: An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.
Amount of loss: $ 59,800 Attack method: Smart Contract Vulnerability
Description of the event: AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.
Amount of loss: $ 152,809 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited insufficient randomness in some Qubic wallet seed generation (affecting seeds created in any browser on iPhone/iPad, Safari on Mac before Oct 18, 2026, or the Qubic iOS app before July 2025), draining approximately 2.94 trillion QU (~$1.3 million) from 1,404 wallets. The issue was in seed generation, not the Qubic protocol. The network was halted, most funds frozen, and seed generation fixed in version 4.26.4.
Amount of loss: $ 1,300,000 Attack method: Private Key Leakage
Description of the event: The Affluent DeFi protocol on the TON chain experienced an unbacked minting incident classified under token and share accounting, resulting in a loss of approximately $1,053,000 due to a smart contract vulnerability.
Amount of loss: $ 1,053,000 Attack method: Smart Contract Vulnerability
Description of the event: UNCX Network’s Vesting V2 contracts had a share-accounting logic vulnerability (VestingManager.cancel failed to ensure retained shares covered already-released amounts). The attacker transferred tokens directly to lower the shares-per-token rate, released and canceled schedules, and drained excess tokens from the shared vesting pool. Initial loss on Ethereum was ~$86k, later escalating to ~$1.49M across multiple chains.
Amount of loss: $ 1490000 Attack method: Smart Contract Vulnerability
Description of the event: A transaction validation vulnerability in Pirate Chain source code allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the total supply by about 20%. The newly minted funds were transferred into the Sapling shielded pool. NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals. The exploit combined two validation failures: bypassing the issuance check and incorrect interpretation of the output scripts. dPoW operators suspended notarizations as a precaution, and exchanges/pools were asked to pause operations while a recovery plan is developed.
Amount of loss: $ 10,746,000 Attack method: Transaction Validation Vulnerability
Description of the event: Crypto gambling platform Gamdom was attacked on October 13, 2026, due to an unauthorized server connection, resulting in approximately $4.2 million stolen from hot wallets. The incident affected multiple blockchains; the platform went offline for investigation and moved remaining hot wallet funds to cold storage.
Amount of loss: $ 4,208,000 Attack method: Hot Wallet Server Compromise