249 hack event(s)
Description of the event: The Twitter account of MicroStrategy, the largest public holder of BTC, appears to have been compromised, with phishing airdrop links being posted. According to on-chain detective ZachXBT, the incident has resulted in the theft of assets worth $440,000.
Amount of loss: $ 440,000 Attack method: Twitter was hacked
Description of the event: SlowMist founder Cos tweeted that there is a backdoor code in the Tornado Cash IPFS version frontend that hijacks deposit certificates. A governance attack led to malicious proposals being passed, and the malicious code has been present for about two months.
Amount of loss: - Attack method: Governance Attack
Description of the event: The Blast ecosystem project Risk is suspected of a rug pull, resulting in a loss of approximately 500 ETH. Currently, its official Twitter account is showing as non-existent.
Amount of loss: $ 1,496,000 Attack method: Rug Pull
Description of the event: Axie Infinity co-founder Jihoz tweeted that his personal two addresses have been compromised. The attack is limited to his personal accounts and is unrelated to the validation or operation of the Ronin chain. Additionally, the leaked keys are unrelated to the operations of Sky Mavis. He reassured everyone that strict security measures have been taken for all related activities.
Amount of loss: $ 10,000,000 Attack method: Private Key Leakage
Description of the event: The official Twitter account of ARPA, a permissionless threshold network based on the BLS signature scheme, has been compromised, and false token claiming links have been posted.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: The hot wallet of the crypto gambling platform Duelbits was attacked, resulting in a loss of approximately $4.6 million.
Amount of loss: $ 4,600,000 Attack method: Private Key Leakage
Description of the event: The blockchain gaming platform PlayDapp was hacked, with the attacker's address being added as a minter, minting 200 million PLA tokens (valued at $36.5 million). Shortly after the incident, PlayDapp sent a message to the attacker through on-chain transactions, requesting the return of the stolen funds and offering a $1 million bug bounty reward, but negotiations ultimately failed. On February 12, the hacker minted an additional 1.59 billion PLA tokens, valued at $253.9 million, and began transferring them through cryptocurrency trading platforms. On February 13, PlayDapp announced on Twitter that the PLA smart contract had been paused, while also advising users to cease trading for migration snapshots and stating that every effort is being made to protect holders' assets.
Amount of loss: $ 290,000,000 Attack method: Private Key Leakage
Description of the event: Keith Grossman, the president of MoonPay, currently has a compromised X account distributing wallet drainer links.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: On January 31st, according to blockchain investigator ZachXBT, Ripple fell victim to a hacking attack resulting in the theft of 213 million XRP, valued at approximately $112.5 million. Ripple's co-founder, Chris Larsen, tweeted, "Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) – we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved."
Amount of loss: $ 112,500,000 Attack method: Unknown
Description of the event: The official Twitter account of zk-data marketplace Masa is suspected to be compromised, and fake airdrop links have been posted.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: DWF Labs tweeted that the Twitter account of their managing partner, Andrei Grachev, has been compromised.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: GoledoFinance on Conflux was attacked, with a loss of 7.9m $CFX ($1.7M). The Goledo team has completed the initial investigation of the large borrowings in the lending pool. The team has determined that the issue is related to a flash loan.
Amount of loss: $ 1,700,000 Attack method: Flash Loan Attack
Description of the event: The Wall Street Memes token was subject to a coordinated attack. The hackers exploited a vulnerability with their staking provider and accessed the $WSM staking contract.
Amount of loss: - Attack method: Coordinated Attack
Description of the event: South Korean Web3 social music service Somesing announced that it fell victim to a security vulnerability attack last Saturday, resulting in a loss of 730 million native tokens (SSX), equivalent to approximately $11.58 million.
Amount of loss: $ 11,580,000 Attack method: Unknown
Description of the event: The Algorand Foundation tweeted that the Twitter account of Staci Warden (@StaciW_DC), the CEO of the Foundation, has been compromised.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: Saga DAO, a community-run fan club for Solana's sellout mobile phone fell victim to a hacker attack, resulting in a theft of 750 SOL, equivalent to approximately $60,000. On February 2nd, SagaDAO tweeted that all funds stolen last week had been recovered. 65,761.03 USDC has been sent back to the Align multisig wallet protected by Phase Labs. The funds were returned from the original attacker's address.
Amount of loss: $ 65,761 Attack method: Remote Hack
Description of the event: Arkham official announced on Twitter that its CEO, Miguel Morel, fell victim to a SIM card swap attack. Miguel Morel's Twitter account was compromised.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: The interoperability protocol Socket tweeted that the protocol experienced a security incident. An attacker exploited a vulnerability on a newly added module under the Socket Aggregator system. The module was responsible for swapping tokens on behalf of users. The vulnerability in said module allowed the attacker to steal funds from users who had given infinite approval of tokens to the Socket Gateway contract. The attack was carried out through 2 malicious transactions on Ethereum. The total exploited value is estimated to be around $3.3m. On January 23rd, Socket announced the successful recovery of 1032 ETH from the funds involved in the incident. A recovery and distribution plan for users will be promptly released.
Amount of loss: $ 3,300,000 Attack method: Contract Vulnerability
Description of the event: Independent crypto data aggregator CoinGecko's Twitter accounts @CoinGecko and @GeckoTerminal was compromised. One of their team members clicked on a fraudulent Calendly link by accident, granting unauthorized app access to a hacker who then posted on their behalf.
Amount of loss: - Attack method: Twitter was hacked
Description of the event: The U.S. Securities and Exchange Commission (SEC) stated on Monday in a release that its Twitter account was compromised on January 9th due to an unauthorized party gaining control of the associated phone number through a "SIM card swap" attack. After gaining control of the phone number, the unauthorized party reset the password for the SEC's Twitter account. Access to the phone number was obtained through the telecommunications provider, not through the SEC's systems.
Amount of loss: - Attack method: Twitter was hacked