397 hack event(s)
Description of the event: $TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived. The delayed input then withdrew nearly all USDT from the pool, causing ~$555K net loss.
Amount of loss: $ 555000 Attack method: Smart Contract Vulnerability
Description of the event: The FLOKI team announced an exploit in its Telegram trading bot and took it offline. They are identifying affected users and will move remaining funds to new secure wallets. Users are instructed not to deposit into bot wallets, to move any funds from exported private keys to self-controlled wallets, and to ignore unsolicited “refund/recovery” messages.
Amount of loss: - Attack method: Unknown
Description of the event: On November 3, 2026, the InsurancePool and CoreVault contracts on BSC were attacked, resulting in a loss of approximately $112,300 (about 160.26 BNB). The attacker used a flash loan to manipulate liquidity pool prices/oracle, inflating a CoreVault redemption by about 33 times to extract excess funds from the InsurancePool before repaying the loan.
Amount of loss: $ 112300 Attack method: Flash Loan Attack
Description of the event: On/around October 31, 2026, at least 12 DeFi websites (mostly registered via Name.com) suffered DNS/registrar-level hijacking. Traffic was redirected to malicious frontends serving the StepDrainer wallet-drainer kit. Users who connected wallets and signed transactions had assets stolen; the underlying smart contracts were not compromised.
Amount of loss: $ 138,000 Attack method: Supply Chain Attack
Description of the event: Predict.fun (a BNB Chain prediction market) saw approximately 397,708 USDT drained from 29 user smart wallets (Kernel/ZeroDev-based) in two waves on October 22 and 27, 2026. Each drain was signed with the compromised owner private key; no protocol contracts were exploited. The team attributes it to a compromised third-party API documentation site, took the site offline, and pledged full reimbursement to affected users, with a full post-mortem forthcoming.
Amount of loss: $ 397,708 Attack method: Private Key Leak
Description of the event: The Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected participants whole.
Amount of loss: - Attack method: Private Key Leakage
Description of the event: The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.
Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability
Description of the event: AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.
Amount of loss: $ 152,809 Attack method: Smart Contract Vulnerability
Description of the event: The MCN Labs–related LPBonus contract used inconsistent MSN reserve values in reward accounting. Accrual updated the reward index with the reserve at that moment, while withdrawal applied a user weight based on the reserve at claim time. The attacker first lowered the reserve to ~89.33 MSN during accrual, then raised it to ~491.11 MSN before calling UserRemoveLp, allowing a newly registered LP to claim ~1,442,165.71 FIST against only ~940,041.61 FIST of intervening reward funding—about $92,600 in losses.
Amount of loss: $ 92,600 Attack method: Smart Contract Vulnerability
Description of the event: The personal X account of Nano Labs founder Jack Kong was compromised. Attackers used it to promote a fake AI trading token called Binance World Assets ($BWA), claiming it would use trading fees on BNB Chain to trade bStocks and share profits with holders. Nano Labs’ official account later stated that the posts were unauthorized, that the company had not issued or endorsed any such token, and warned users not to click links or send funds to any contracts.
Amount of loss: - Attack method: The X account was hacked
Description of the event: The RWC token on BNB Smart Chain was exploited with a flash loan. An unprotected burn function let the attacker destroy RWC sitting in the PancakeSwap RWC/USDT pair and call sync() to rewrite reserves, inflating the price before selling back. The pool lost about 109,460.85 USDT in one transaction. The attacker kept about 39,964.07 USDT; the remaining about 69,496.78 USDT was routed to the project’s company and platform wallets by the token’s fee logic.
Amount of loss: $ 109,460.85 Attack method: Smart Contract Vulnerability
Description of the event: The BNB Chain DeFi protocol Likwid was exploited due to a margin-borrow contract bug. In the leverage=0 path of LikwidMarginPosition, pair reserves were not updated, so each borrow reused the same quote. The attacker first pumped a thin meme pool, then repeated the collateral/borrow cycle and drained 74.31 BNB (~$ 55,721) from the vault. The funds were later sent to Tornado Cash.
Amount of loss: $ 55,721 Attack method: Smart Contract Vulnerability
Description of the event: Attackers exploited ORBToken’s receive() function (which auto-granted max allowance) and ORBCore’s whitelist tax exemption. The addPoolAndSell function lacked a reentrancy guard, enabling repeated tax-free sells. Combined with burnLP destroying large amounts of ORB in the LP and a subsequent sync() to manipulate reserves, the attacker extracted about $32,610.72.
Amount of loss: $ 32,610.72 Attack method: Smart Contract Vulnerability
Description of the event: The old BNB Chain DeFi protocol Amnext (AMC), a no-loss lottery/prize-pool product, was exploited. The attacker mass-minted Ticket AMC and drained about 154.02 WBNB from the protocol via PancakeSwap, causing a loss of approximately $ 116,100.
Amount of loss: $ 116,100 Attack method: Smart Contract Vulnerability
Description of the event: BeatXswap’s LiquidityVestingConvert used the Uniswap/Pancake V3 slot0() spot price as its only oracle, with no TWAP or deviation checks. An attacker flash-loaned 6,000,000 BTX, dumped it to crash the pool price, then called deposit() twice (10,000 + 2,000 USDT) to mint LP at the manipulated quote and drain 2,984,557 BTX (~$77,512).
Amount of loss: $ 77,512 Attack method: Price Manipulation
Description of the event: The WealthManagementV2 contract lost funds after owner privileges were suspected of being illegally transferred (possibly due to a leaked private key). The attacker-controlled owner instantly set extreme plan parameters (period=0, interestMultiplier/unlockMultiplier=528,300,000) via updatePlanConfig with no timelock or bounds, minted inflated interest by investing and redeeming in the same transaction, then unlocked and withdrew the funds via a second investment, resulting in a loss of 26,414 USDT.
Amount of loss: $ 26,414 Attack method: Private Key Leakage
Description of the event: An unnamed DEX router on BNB Chain was exploited because uniswapV3SwapCallback did not authenticate a real V3 pool. The attacker used a fake pool, set victims as payer, and drained existing token allowances via transferFrom, stealing about 62.28 WBNB from 29 wallets in one transaction.
Amount of loss: $ 46,070 Attack method: Smart Contract Vulnerability
Description of the event: Dream Health Chain’s staking/reward contracts on BSC were exploited for about 71,851 USDT. A broken award state machine allowed a claimed reward to be reset with a tiny or zero-effective DHC deposit, so the same fixed payout could be claimed repeatedly from the shared pool. The attacker looped pledge and claim, then sold about 542,070 DHC into the DHC-USDT pool.
Amount of loss: $ 71,851 Attack method: Smart Contract Vulnerability
Description of the event: CashCowCoin’s unverified trading router implementation contract had a flawed sell() flow. After the PancakeSwap Router completed the CCC→WBNB swap, the proxy called a privileged token function to transfer post-tax CCC from the Pair to the dead address and invoked Pair.sync(). This burned the sell-side CCC while permanently retaining the reduced WBNB reserve, enabling repeated draining of the pool’s WBNB through about 80 iterative sell cycles.
Amount of loss: $ 117,400 Attack method: Smart Contract Vulnerability
Description of the event: FH Token on the BSC chain was exploited in its FH/USDT liquidity pool on PancakeSwap V2. A flaw in the token’s _transfer function and isSell logic caused incorrect token burns during sells, allowing the attacker to drain funds from the pool through repeated buy-and-sell loops, resulting in a loss of approximately $20,000.
Amount of loss: $ 20,000 Attack method: Smart Contract Vulnerability