61 hack event(s)
Description of the event: The main wallet of King (one of Solana’s oldest and most successful MEV/arbitrage bots with ~$7.2M lifetime PnL) was emptied in 146 seconds via five plain transfers signed with its own private key, just 24 seconds after it stopped trading on November 2, 2026. Approximately $856K was stolen. Funds were swapped to SOL and bridged to Ethereum; about $280K was frozen by Mayan and Relay bridges, while ~$574K (251 ETH) remains unmoved in an Ethereum address. A 20% on-chain bounty was offered with no reply.
Amount of loss: $ 856,000 Attack method: Hot Wallet Key Compromise
Description of the event: In early November 2026, Solana lending protocol Loopscale faced a sustained campaign involving high-volume malicious API requests. Attackers exploited misconfigured asset-pricing parameters to take undercollateralized loans and attempt disproportionate redemptions from the SOL and USDC Genesis Vaults. The team paused the protocol on November 5, stated that affected vaults were made whole, and confirmed no user deposit losses, while coordinating with law enforcement.
Amount of loss: 0 Attack method: Smart Contract Vulnerability
Description of the event: The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating.
Amount of loss: $ 947,000 Attack method: Supply Chain Attack
Description of the event: The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.
Amount of loss: $ 385000 Attack method: Rug Pull
Description of the event: Dominion Market’s Solana silver token $SILV suffered a treasury multisig compromise. With 3-of-5 keys, the attacker emptied the treasury and pulled SILV from loans, dumping about 46,909 tokens (face value ~$3 million) into thin DEX pools and realizing about $238,000 as the peg broke. The team pulled liquidity, rotated hardware, froze tokens bought in the incident window, and planned USDC refunds plus a repeg.
Amount of loss: $ 238,000 Attack method: Private Key Leakage
Description of the event: Solana-based proprietary AMM Aquifer was exploited for about $2.5 million. Public reporting points to compromised protocol-linked wallets or admin credentials rather than a confirmed smart-contract bug. The attacker operated addresses on both Solana and Ethereum. The same day, Aquifer’s Solana upgrade authority posted an on-chain white-hat offer: return at least 80% of stolen assets by September 3, 2026, 14:00 UTC to designated recovery addresses, and keep up to 20% as a bounty, in exchange for no civil claims by the project.
Amount of loss: $ 2,500,000 Attack method: Smart Contract Vulnerability
Description of the event: The Fogo Foundation experienced a compromise by an unknown actor, resulting in 400 million FOGO tokens being sent to a bad actor. The Foundation immediately alerted exchanges, law enforcement, and forensic experts. Initially stated no impact on the blockchain, but later halted the mainnet as a precaution to restrict associated addresses and prevent further asset movement. Mainnet was later restarted after recovering and permanently removing 237 million tokens.
Amount of loss: $ 3,000,000 Attack method: Private Key Compromised
Description of the event: Attackers exploited a vulnerability in an outdated version of Rain’s Solana card contract used by Avici (and a few other programs). By submitting crafted signature bundles to gain unauthorized admin rights via AddCollateralAdmin and then withdrawing collateral, they drained $500,859.22 from 1,685 users’ card balances. Self-custodial wallets were unaffected. The contract was upgraded across all programs, and full refunds were promised.
Amount of loss: $ 500,859.22 Attack method: Smart Contract Vulnerability
Description of the event: FlashTrade (a Solana perps protocol) detected an unauthorized $98,000 withdrawal from its ephemeral instance. As a precaution, trading, deposits, and withdrawals were paused. Thanks to the newly rolled-out withdrawal batching and monitoring system, the incident was detected quickly and contained. The team will fully cover the amount, with all user funds safe.
Amount of loss: $ 98,000 Attack method: Validation Flaw
Description of the event: The Solana-based DeFi protocol DefiTuna's lending pools were exploited by an attacker who drained approximately $580K, creating a matching deficit in the USDC lending pool. The attack vector has been identified and patched; the team is investigating and working on fund recovery.
Amount of loss: $ 580,000 Attack method: Smart Contract Vulnerability
Description of the event: BonkDAO suffered a governance attack. The attacker spent ~$4M to buy BONK tokens for sufficient voting power and passed a malicious governance proposal (BIP-76) to transfer ~$20M BONK from the treasury to controlled wallets. No smart contract exploit; used the DAO's own voting system.
Amount of loss: $ 20,000,000 Attack method: Governance Attack
Description of the event: Solana-based decentralized exchange Raydium disclosed a vulnerability in its deprecated AMM V3 program (phased out in 2021), which allowed an attacker to drain approximately $1.34 million from five inactive liquidity pools (Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL). The flaw was due to insufficient validation of LP mint addresses, enabling the attacker to create a fake LP token and bypass proportion checks to withdraw funds. No current users, active programs, SDK, or dApp were affected. Raydium will fully compensate losses from its treasury and is conducting a security review of mainnet programs.
Amount of loss: $ 1,340,000 Attack method: Smart Contract Vulnerability
Description of the event: According to The Block, the Solana-based decentralized exchange Drift Protocol has been hit by a major exploit, with losses totaling at least $200 million. Some estimates suggest the figure is closer to $270 million, making it the second-largest DeFi security breach in the Solana ecosystem, trailing only the Wormhole bridge hack. The attack targeted multiple Drift vaults, including JLP Delta Neutral, SOL Super Staking, and BTC Super Staking. On-chain data reveals that the attacker swapped the stolen assets for USDC via Jupiter, then bridged them to Ethereum to purchase ETH. As of 17:45 UTC, the attacker held approximately 19,913 ETH (worth roughly $42 million). Drift stated they are currently investigating the "abnormal activity" and have advised users to suspend all deposits. Subsequently, according to PeckShield's statistics, Drift Protocol suffered losses exceeding $285 million in the attack.
Amount of loss: $ 285,000,000 Attack method: Social Engineering
Description of the event: Solana-based Prop AMM project GoonFi v2's WSOL/USDC pool was drained of ~$254k due to a program config/logic bug that caused mispricing. Searchers exploited the vulnerability in a single atomic transaction, and the project team has subsequently halted the program.
Amount of loss: $ 254,000 Attack method: Smart Contract Vulnerability
Description of the event: BONKfun announced on X that its official website fell victim to a malicious social engineering attack on March 11. The attacker hijacked the BONKfun domain via the Domain Name Service (DNS) provider and transferred it to an external registrar. The team confirmed that the incident was not caused by a breach of BONK or BONKfun’s internal systems, codebases, or team accounts. Following the incident, the team took immediate action: shutting down the website, coordinating with wallet service providers to flag the domain as malicious, and containing the impact on users. The attack resulted in approximately $30,000 in customer losses; the team will compensate affected users at 110% to cover potential opportunity costs. Control over the BONKfun domain and registration was fully restored around 5 PM ET on March 18. Major wallet provider functionalities were restored by the evening of March 19, and the website is now securely back online. As some antivirus software still flags the main domain as a risk, the team is actively addressing the issue. For users unable to access the official site due to antivirus blocks, a backup domain with identical functionality is now live and available for use.
Amount of loss: $ 30,000 Attack method: Domain Hijacking
Description of the event: Stake Nova suffered a loss of approximately $137,014, representing about 95% of user deposits. The root cause was an unchecked validation issue in the RedeemNovaSol() function, which led to a flash-loan exploit that drained the liquidity pool. The vulnerability has now been fixed, the dApp has been taken offline, and the website is currently under maintenance. The team is offering a 10% on-chain bounty to the attacker; otherwise, they stated they will continue to pursue accountability.
Amount of loss: $ 137,014 Attack method: Flash Loan Attack
Description of the event: Step Finance has issued a statement on X regarding a recent exploit, disclosing that approximately $40 million was stolen from its treasury due to a compromise of an executive's device. Upon detecting the vulnerability, Step Finance launched an investigation in collaboration with cybersecurity researchers and relevant authorities, and has notified law enforcement. While certain operations were temporarily suspended during this period, the team has successfully recovered approximately $3.7 million in Remora assets and $1 million in other positions.
Amount of loss: $ 40,000,000 Attack method: Private Key Leakage
Description of the event: Meteora suffered a $1.5 million USDC loss in a fake OTC escrow scam while attempting to buy back its $MET token. Scammers deceived the team using a fraudulent escrow setup for an OTC deal. This was not a smart contract exploit but a social engineering attack. The incident was disclosed in Meteora’s Q1 2026 Token Holder Report, where they also mentioned filing a police report. The protocol used $1M USDC for legitimate buybacks separately.
Amount of loss: $ 1,500,000 Attack method: Social Engineering
Description of the event: GoPlus has issued a security alert: Users who claimed the DMT airdrop from @dexmaxai are advised to revoke approvals immediately or transfer their assets to a secure wallet. Multiple victims reported today that they were tricked into granting approvals for other tokens during the DMT airdrop process, resulting in over a thousand users being compromised and more than USD 130,000 in assets stolen via cross-chain transfers. The official website and Twitter account of @dexmaxai are now offline, indicating a possible rug pull. Investigations show that attackers prompted users to sign additional transactions during the airdrop claim, thereby obtaining malicious token approvals and subsequently transferring the approved assets. After stealing funds, attackers bridged the assets to Ethereum, with most of the stolen funds flowing into HitBTC, while a smaller portion remains on-chain.
Amount of loss: $ 130,000 Attack method: Phishing Attack
Description of the event: The Solana-based mini entertainment project DoodiPals suffered a private key leak. The attacker sold tokens from dozens of wallets and exchanged them for SOL, making a total profit of about 917 SOL (approximately $171,000 USD).
Amount of loss: $ 171,000 Attack method: Private Key Leakage