2352 hack event(s)
Description of the event: Ankr’s Ethereum cross-chain bridge was exploited. The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and amounts. All receipts carried valid signatures from the bridge’s trusted consensus signer, allowing the withdraw() function to release assets without verifying against actual source-chain events. Loss ≈ $304.5k.
Amount of loss: $ 304,500 Attack method: Smart Contract Vulnerability
Description of the event: DeFi yield aggregator ACryptoS suffered a vault exploit due to a missing input validation check in the depositMulti function (array length not verified against token count). Attackers could deposit a tiny single-token amount to mint the vast majority of vault shares and withdraw a proportional share of both tokens. The attack hit 77 vaults across 5 chains (Arbitrum, BSC, Polygon, Base, Optimism), with total losses of approximately $665,000. Deposits have been disabled while withdrawals remain open; the project offered a 10% whitehat bounty for fund return and announced it is being deprecated due to lack of resources, urging users to withdraw ASAP.
Amount of loss: $ 665,429 Attack method: Smart Contract Vulnerability
Description of the event: LNbits (open-source Lightning Network wallet and tools suite) suffered a wave of attacks where attackers created new accounts on instances and withdrew funds without authorization. The team urgently instructed all users to shut down their LNbits servers immediately while preparing multiple security patches. At least one instance reported a loss of approximately 2,285,545 sats. Patches expected soon.
Amount of loss: $ 1,700 Attack method: Software Vulnerability
Description of the event: Degen Coin Flip discovered an exploit in its Degen Spin game and was attacked by over 30,000 wallets. Damage was limited to about $10,000, all from the house. User funds are safe as players use their own wallets and the project does not hold balances. Spin and side bets are paused for fixes; other games are unaffected.
Amount of loss: $ 10,000 Attack method: Smart Contract Vulnerability
Description of the event: Keplr Wallet accounts created via Google or Apple social login (powered by Web3Auth) suffered a private key breach due to a Web3Auth infrastructure vulnerability, leading to unauthorized transactions. Over 44,000 wallets were affected with ~$6.01 million in on-chain transfers. Web3Auth, assisted by Keplr, conducted whitehat recovery moves to secure funds in designated recovery wallets. Accounts using recovery phrases or hardware wallets were unaffected. Social logins have been paused.
Amount of loss: $ 6,010,000 Attack method: Supply Chain Attack
Description of the event: $TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived. The delayed input then withdrew nearly all USDT from the pool, causing ~$555K net loss.
Amount of loss: $ 555000 Attack method: Smart Contract Vulnerability
Description of the event: The FLOKI team announced an exploit in its Telegram trading bot and took it offline. They are identifying affected users and will move remaining funds to new secure wallets. Users are instructed not to deposit into bot wallets, to move any funds from exported private keys to self-controlled wallets, and to ignore unsolicited “refund/recovery” messages.
Amount of loss: - Attack method: Unknown
Description of the event: On November 3, 2026, the InsurancePool and CoreVault contracts on BSC were attacked, resulting in a loss of approximately $112,300 (about 160.26 BNB). The attacker used a flash loan to manipulate liquidity pool prices/oracle, inflating a CoreVault redemption by about 33 times to extract excess funds from the InsurancePool before repaying the loan.
Amount of loss: $ 112300 Attack method: Flash Loan Attack
Description of the event: Brazil’s largest crypto exchange Mercado Bitcoin suffered a security incident in the early hours of November 2, 2026. Attackers drained approximately $38 million from its multi-chain hot wallets and some deposit addresses. The platform quickly suspended deposits and withdrawals, stated that no customers were affected and no data was leaked, and will absorb the loss itself. About $11 million has been frozen.
Amount of loss: $ 49,000,000 Attack method: Signing Capability Compromise
Description of the event: The main wallet of King (one of Solana’s oldest and most successful MEV/arbitrage bots with ~$7.2M lifetime PnL) was emptied in 146 seconds via five plain transfers signed with its own private key, just 24 seconds after it stopped trading on November 2, 2026. Approximately $856K was stolen. Funds were swapped to SOL and bridged to Ethereum; about $280K was frozen by Mayan and Relay bridges, while ~$574K (251 ETH) remains unmoved in an Ethereum address. A 20% on-chain bounty was offered with no reply.
Amount of loss: $ 856,000 Attack method: Hot Wallet Key Compromise
Description of the event: On November 2, 2026, BitMart exchange was hacked, with attackers draining approximately $391,000 from related hot wallets on Base, Arbitrum, and Optimism. Preliminary investigation suggests the attack may have been carried out by the same group that targeted Brazil’s Mercado Bitcoin on the same day. The exchange was undergoing restructuring with a severely understaffed security team.
Amount of loss: $ 391000 Attack method: Unknown
Description of the event: BTCPay Server reported that hot wallets on multiple instances are being swept by unauthorized attackers. The project urgently advised all operators to shut down their instances immediately using ./btcpay-down.sh until the investigation is complete.
Amount of loss: $ 1,628,450 Attack method: Unauthorized Signing Access
Description of the event: On November 4, 2026, Crédit Mutuel Arkéa issued a statement confirming that the attacker gained access through the platform of an unnamed third-party service provider, then used the bank's own accounts to transfer funds to other financial institutions. The funds may have subsequently been converted into cryptocurrency through specialized platforms. The bank denied that the breach originated from its online banking subsidiary, Fortuneo, and stated that customer assets were not affected. Regarding the approximately $133 million in losses previously reported by ZachXBT, the bank did not confirm the exact figure but acknowledged the scale of the incident. Some funds have been frozen, while the final losses remain under assessment.
Amount of loss: $ 133000000 Attack method: Supply Chain Attack
Description of the event: In early November 2026, Solana lending protocol Loopscale faced a sustained campaign involving high-volume malicious API requests. Attackers exploited misconfigured asset-pricing parameters to take undercollateralized loans and attempt disproportionate redemptions from the SOL and USDC Genesis Vaults. The team paused the protocol on November 5, stated that affected vaults were made whole, and confirmed no user deposit losses, while coordinating with law enforcement.
Amount of loss: 0 Attack method: Smart Contract Vulnerability
Description of the event: On/around October 31, 2026, at least 12 DeFi websites (mostly registered via Name.com) suffered DNS/registrar-level hijacking. Traffic was redirected to malicious frontends serving the StepDrainer wallet-drainer kit. Users who connected wallets and signed transactions had assets stolen; the underlying smart contracts were not compromised.
Amount of loss: $ 138,000 Attack method: Supply Chain Attack
Description of the event: The AI trading platform VergeX was attacked. Some users received withdrawal verification emails triggered by the attack. The official confirmed a total of 3,688.58 USDC was affected; risk controls triggered within one minute, all affected funds have been returned, and other users’ funds were unaffected. Services are being restored in stages.
Amount of loss: $ 3,688.58 Attack method: Unknown
Description of the event: On October 31, 2026, the Bitcoin dual-staking protocol b14g suffered a security incident in which approximately 97 million CORE tokens staked through the protocol were withdrawn without authorization and transferred to attacker-controlled addresses. The team paused the affected contracts and is coordinating with the Core team, security partners, and exchanges to trace, freeze, and recover the funds. BTC staked via the protocol remained time-locked on Bitcoin and was unaffected.
Amount of loss: $ 1,470,000 Attack method: Smart Contract Vulnerability
Description of the event: Six Premia V3 underwriter vaults on Arbitrum were drained on October 31, 2026. The attacker created empty option pools, used flash loans to buy options (locking vault collateral into those pools), and then withdrew the collateral as liquidity, resulting in approximately $400,500–$464,600 in losses.
Amount of loss: $ 400,500 Attack method: Smart Contract Vulnerability
Description of the event: On October 31, 2026, Troves (a DeFi protocol on Starknet) had its xWBTC/WBTC vault exploited, resulting in a loss of approximately 8.57 WBTC (about $667,000). The cause was a legacy rebalancing contract that retained permissions after being replaced. The team revoked the permissions, paused affected vaults, and offered a whitehat bounty for fund recovery.
Amount of loss: $ 667000 Attack method: Smart Contract Vulnerability
Description of the event: The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs.
Amount of loss: $ 783,100 Attack method: Smart Contract Vulnerability