2324 hack event(s)
Description of the event: The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating.
Amount of loss: $ 947,000 Attack method: Supply Chain Attack
Description of the event: The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
Amount of loss: $ 21900 Attack method: Governance Attack
Description of the event: X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken.
Amount of loss: $ 4,850,000 Attack method: Flash Loan Governance Attack
Description of the event: The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.
Amount of loss: $ 385000 Attack method: Rug Pull
Description of the event: The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.
Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability
Description of the event: The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.
Amount of loss: $ 90,500 Attack method: Smart Contract Vulnerability
Description of the event: The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.
Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability
Description of the event: Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.
Amount of loss: $ 41000 Attack method: Smart Contract Vulnerability
Description of the event: Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.
Amount of loss: $ 20000 Attack method: Private Key Leakage
Description of the event: An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.
Amount of loss: $ 59,800 Attack method: Smart Contract Vulnerability
Description of the event: AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.
Amount of loss: $ 152,809 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited insufficient randomness in some Qubic wallet seed generation (affecting seeds created in any browser on iPhone/iPad, Safari on Mac before Oct 18, 2026, or the Qubic iOS app before July 2025), draining approximately 2.94 trillion QU (~$1.3 million) from 1,404 wallets. The issue was in seed generation, not the Qubic protocol. The network was halted, most funds frozen, and seed generation fixed in version 4.26.4.
Amount of loss: $ 1,300,000 Attack method: Private Key Leakage
Description of the event: The Affluent DeFi protocol on the TON chain experienced an unbacked minting incident classified under token and share accounting, resulting in a loss of approximately $1,053,000 due to a smart contract vulnerability.
Amount of loss: $ 1,053,000 Attack method: Smart Contract Vulnerability
Description of the event: UNCX Network’s Vesting V2 contracts had a share-accounting logic vulnerability (VestingManager.cancel failed to ensure retained shares covered already-released amounts). The attacker transferred tokens directly to lower the shares-per-token rate, released and canceled schedules, and drained excess tokens from the shared vesting pool. Initial loss on Ethereum was ~$86k, later escalating to ~$1.49M across multiple chains.
Amount of loss: $ 1490000 Attack method: Smart Contract Vulnerability
Description of the event: A transaction validation vulnerability in Pirate Chain source code allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the total supply by about 20%. The newly minted funds were transferred into the Sapling shielded pool. NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals. The exploit combined two validation failures: bypassing the issuance check and incorrect interpretation of the output scripts. dPoW operators suspended notarizations as a precaution, and exchanges/pools were asked to pause operations while a recovery plan is developed.
Amount of loss: $ 10,746,000 Attack method: Transaction Validation Vulnerability
Description of the event: Crypto gambling platform Gamdom was attacked on October 13, 2026, due to an unauthorized server connection, resulting in approximately $4.2 million stolen from hot wallets. The incident affected multiple blockchains; the platform went offline for investigation and moved remaining hot wallet funds to cold storage.
Amount of loss: $ 4,208,000 Attack method: Hot Wallet Server Compromise
Description of the event: Papertrade, a synthetic perpetuals platform with up to 1000x leverage built on Hyperliquid’s HyperEVM, suffered a ~$1.28 million loss about 8 hours after its Oct. 10, 2026 launch. A wallet moved ETH prices on Hyperliquid (via large buys/sells) while holding highly leveraged positions on Papertrade that settled against the manipulated BBO midpoint, extracting profits from the platform’s shared USDC liquidity pool. Papertrade attributed it to overly permissive open-interest limits at launch and tightened them.
Amount of loss: $ 1,280,000 Attack method: Price Manipulation
Description of the event: BitBay’s Polygon DAI/USDC vault, UsdcDaiV4Vault, was exploited. The attacker first called reposition() to force the vault’s liquidity to zero, then redeemed only one minimal share. Because _withdraw() sends the contract’s entire token balance when liquidity == 0 instead of the user’s proportional share, about 14,838.47 DAI (roughly $14,000) was drained.
Amount of loss: $ 14,000 Attack method: Smart Contract Vulnerability
Description of the event: EtherVista’s liquidity pool was exploited due to an integer overflow in the K-invariant check inside EtherVistaPair.swap(). Both reserves are uint112, so their product can wrap around and the check can pass even when the real reserve product drops sharply. The attacker registered a self-controlled contract as an authorized router and ran two crafted swaps to drain WETH and VISTA, with a loss of about $18,600.
Amount of loss: $ 18600 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.
Amount of loss: $ 16,514 Attack method: Smart Contract Vulnerability