2364 hack event(s)
Description of the event: On November 12, 2026, Edel Finance announced that approximately $300,000 worth of $EDEL tokens were stolen and sold on the market. The team is working with authorities and exchanges to investigate and block the funds, with some tokens successfully blocked by exchanges. A more detailed post-mortem is forthcoming.
Amount of loss: $ 300,000 Attack method: Unknown
Description of the event: On November 12, 2026, MapleStory Universe confirmed unauthorized external access to part of its off-chain server infrastructure, exposing some user data (wallet addresses, nicknames, login history, partial emails, linked social accounts, etc.) and information from 328 Builder apps; the blockchain and smart contracts were unaffected, with no assets stolen. The team blocked the access path, replaced servers, and plans to rotate operational keys.
Amount of loss: 0 Attack method: Server Intrusion
Description of the event: PennysiaSettlement (Ethereum) was exploited via an arbitrary external call vulnerability in executeSwap. The attacker deployed fake tokens to bypass spend checks and used residual user approvals to drain approximately $5,131 in assets from 4 users via transferFrom calls through the settlement contract.
Amount of loss: $ 5,131 Attack method: Smart Contract Vulnerability
Description of the event: The Initia L1 was halted at 06:18 UTC on November 10, 2026, in coordination with validators after identifying unauthorized transfers from escrow accounts holding assets bridged to several rollups. Compromised rollup infrastructure keys allowed the attacker to fabricate IBC transfers; approximately $605,000 USDC left via Noble along with ~$10k in other tokens. Most remaining assets stayed on the halted L1.
Amount of loss: $ 615,000 Attack method: Private Key Leak
Description of the event: On November 10, 2026, Across Protocol’s domain registrar Namecheap was hit by a social engineering attack, allowing an attacker to take control of the across.to domain and set up a phishing site. The team was alerted within ~15 minutes and took the site down; SEAL911 and Cloudflare helped flag it as phishing and pull DNS records. Some users who visited and connected wallets/signed approvals during the brief window may have been affected (not a smart-contract exploit). The project pledged to make all affected users whole and advised revoking permissions. Third-party integrations and API users were unaffected.
Amount of loss: - Attack method: Social Engineering
Description of the event: On the evening of November 10, 2026, an attacker exploited a flaw in the skew calculations of Rujira's Custom Concentrated Liquidity (CCL) strategy, manipulating trading activity in the BTC/USDC orderbook and imbalancing existing liquidity positions, resulting in approximately $200,000 in losses. Rujira halted the CosmWasm application layer and plans to remove the vulnerable skew parameter and fully reimburse affected users before resuming operations.
Amount of loss: $ 200,000 Attack method: Smart Contract Vulnerability
Description of the event: Ankr’s Ethereum cross-chain bridge was exploited. The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and amounts. All receipts carried valid signatures from the bridge’s trusted consensus signer, allowing the withdraw() function to release assets without verifying against actual source-chain events. Loss ≈ $304.5k.
Amount of loss: $ 304,500 Attack method: Smart Contract Vulnerability
Description of the event: The development team Ethersphere behind the decentralized storage project Swarm suffered a supply chain attack. On November 9, 2026, attackers published a malicious bee-js 13.3.0 to npm and pushed a trojanized Swarm Desktop 0.56.2 via auto-updates. The malware reads Bee node config files and encrypted wallet keystores (with plaintext passwords in the config) and exfiltrates them, while also installing a remote-access backdoor. npm and the project have removed the versions; no confirmed fund losses.
Amount of loss: 0 Attack method: Supply Chain Attack
Description of the event: On November 9, 2026, an attacker on the decentralized exchange Arcus exploited an accounting bug in sub-account fund transfers, inflating the account balance and withdrawing 2,234,391 USDG on-chain. An additional ~$3 million in withdrawal requests was blocked by the bridge’s rate limit and later reversed. Arcus paused withdrawals, fixed the bug within about an hour, restored services, and fully covered the shortfall from company treasury. No other user balances, positions, or orders were affected.
Amount of loss: $ 2,234,391 Attack method: Accounting Bug
Description of the event: DeFi yield aggregator ACryptoS suffered a vault exploit due to a missing input validation check in the depositMulti function (array length not verified against token count). Attackers could deposit a tiny single-token amount to mint the vast majority of vault shares and withdraw a proportional share of both tokens. The attack hit 77 vaults across 5 chains (Arbitrum, BSC, Polygon, Base, Optimism), with total losses of approximately $665,000. Deposits have been disabled while withdrawals remain open; the project offered a 10% whitehat bounty for fund return and announced it is being deprecated due to lack of resources, urging users to withdraw ASAP.
Amount of loss: $ 665,429 Attack method: Smart Contract Vulnerability
Description of the event: LNbits (open-source Lightning Network wallet and tools suite) suffered a wave of attacks where attackers created new accounts on instances and withdrew funds without authorization. The team urgently instructed all users to shut down their LNbits servers immediately while preparing multiple security patches. At least one instance reported a loss of approximately 2,285,545 sats. Patches expected soon.
Amount of loss: $ 1,700 Attack method: Software Vulnerability
Description of the event: Degen Coin Flip discovered an exploit in its Degen Spin game and was attacked by over 30,000 wallets. Damage was limited to about $10,000, all from the house. User funds are safe as players use their own wallets and the project does not hold balances. Spin and side bets are paused for fixes; other games are unaffected.
Amount of loss: $ 10,000 Attack method: Smart Contract Vulnerability
Description of the event: Keplr Wallet accounts created via Google or Apple social login (powered by Web3Auth) suffered a private key breach due to a Web3Auth infrastructure vulnerability, leading to unauthorized transactions. Over 44,000 wallets were affected with ~$6.01 million in on-chain transfers. Web3Auth, assisted by Keplr, conducted whitehat recovery moves to secure funds in designated recovery wallets. Accounts using recovery phrases or hardware wallets were unaffected. Social logins have been paused.
Amount of loss: $ 6,010,000 Attack method: Supply Chain Attack
Description of the event: Indian crypto exchange Unocoin detected unauthorized server access on Nov 6 and Nov 9, 2026, froze its BitGo and Fireblocks enterprise accounts, and suspended all services. On Nov 12 it identified outgoing transactions from an ETH address in its BitGo infrastructure (used for ERC-20 funding) and escalated the matter to BitGo. The exchange states that over 90% of customer crypto is in cold storage and has not confirmed any customer fund losses; it is rebuilding servers from scratch.
Amount of loss: 0 Attack method: Infrastructure Compromise
Description of the event: $TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived. The delayed input then withdrew nearly all USDT from the pool, causing ~$555K net loss.
Amount of loss: $ 555000 Attack method: Smart Contract Vulnerability
Description of the event: The FLOKI team announced an exploit in its Telegram trading bot and took it offline. They are identifying affected users and will move remaining funds to new secure wallets. Users are instructed not to deposit into bot wallets, to move any funds from exported private keys to self-controlled wallets, and to ignore unsolicited “refund/recovery” messages.
Amount of loss: - Attack method: Unknown
Description of the event: On November 3, 2026, the InsurancePool and CoreVault contracts on BSC were attacked, resulting in a loss of approximately $112,300 (about 160.26 BNB). The attacker used a flash loan to manipulate liquidity pool prices/oracle, inflating a CoreVault redemption by about 33 times to extract excess funds from the InsurancePool before repaying the loan.
Amount of loss: $ 112300 Attack method: Flash Loan Attack
Description of the event: Brazil’s largest crypto exchange Mercado Bitcoin suffered a security incident in the early hours of November 2, 2026. Attackers drained approximately $38 million from its multi-chain hot wallets and some deposit addresses. The platform quickly suspended deposits and withdrawals, stated that no customers were affected and no data was leaked, and will absorb the loss itself. About $11 million has been frozen.
Amount of loss: $ 49,000,000 Attack method: Signing Capability Compromise
Description of the event: The main wallet of King (one of Solana’s oldest and most successful MEV/arbitrage bots with ~$7.2M lifetime PnL) was emptied in 146 seconds via five plain transfers signed with its own private key, just 24 seconds after it stopped trading on November 2, 2026. Approximately $856K was stolen. Funds were swapped to SOL and bridged to Ethereum; about $280K was frozen by Mayan and Relay bridges, while ~$574K (251 ETH) remains unmoved in an Ethereum address. A 20% on-chain bounty was offered with no reply.
Amount of loss: $ 856,000 Attack method: Hot Wallet Key Compromise
Description of the event: On November 2, 2026, BitMart exchange was hacked, with attackers draining approximately $391,000 from related hot wallets on Base, Arbitrum, and Optimism. Preliminary investigation suggests the attack may have been carried out by the same group that targeted Brazil’s Mercado Bitcoin on the same day. The exchange was undergoing restructuring with a severely understaffed security team.
Amount of loss: $ 391000 Attack method: Unknown