1867 hack event(s)
Description of the event: A modular DeFi lending market built on Solana, Loopscale, has suffered an attack. The root cause of the exploit has been identified as an isolated issue with Loopscale’s pricing of RateX-based collateral. The incident led to the theft of approximately 5.7 million USDC and 1,200 SOL, accounting for about 12% of the platform's total funds.
Amount of loss: $ 5,800,000 Attack method: Oracle Attack
Description of the event: According to the SlowMist MistEye security monitoring system, Aventa, which specializes in creating intuitive Web3 utilities for the crypto community, appears to have been attacked, resulting in a loss of approximately 3.9 ETH.
Amount of loss: $ 7,000 Attack method: Flash Loan Attack
Description of the event: According to the SlowMist MistEye security monitoring system, LIFE Protocol has been attacked, resulting in a loss of over $51,000.
Amount of loss: $ 51,000 Attack method: Price Manipulation
Description of the event: According to the SlowMist MistEye security monitoring system, ACB appears to have been attacked on BSC, resulting in a loss of approximately $22,000.
Amount of loss: $ 22,804 Attack method: Contract Vulnerability
Description of the event: R0AR has been exploited, with total losses amounting to approximately $780K. According to analysis by the SlowMist security team, the root cause of the exploit was the presence of a backdoor in the contract. During deployment, the R0ARStaking contract altered the balance (user.amount) of a specified address by directly modifying storage slots. Subsequently, the attacker extracted all funds from the contract through an emergency withdrawal function. R0AR stated in a tweet: “At this stage, we do not believe this to be an external exploit. One nefarious developer, external to the R0AR core team, is seemingly behind the drain. They have been removed from the project with all accesses revoked.”
Amount of loss: $ 780,000 Attack method: Insider Manipulation
Description of the event: The ZKsync security team discovered that an admin account had been compromised, giving the attacker control of approximately $5 million worth of ZK tokens — the remaining unclaimed tokens from the ZKsync airdrop.
Amount of loss: $ 5,000,000 Attack method: Private Key Leakage
Description of the event: The decentralized perpetual futures exchange KiloEx was exploited, resulting in a loss of approximately $7.4 million across multiple chains including BNB and Base. According to analysis by the SlowMist security team, the root cause of the incident was the lack of access control checks in KiloEx’s top-level contract (MinimalForwarder), which allowed the attacker to manipulate oracle prices.
Amount of loss: $ 7,400,000 Attack method: Contract Vulnerability
Description of the event: According to the SlowMist MistEye security monitoring system, a MEV bot (address: 0x49e27d11379f5208cbb2a4963b903fd65c95de09) has lost approximately 116.7 ETH due to a lack of access control.
Amount of loss: $ 210,000 Attack method: Lack of Strict Access Control
Description of the event: According to the SlowMist MistEye security monitoring system, the NFT project Next Earth has suffered a reentrancy attack on Polygon.
Amount of loss: $ 17,000 Attack method: Reentrancy Attack
Description of the event: According to an announcement from blockchain payment platform UPCX, unauthorized activity was detected in its management accounts. As a precaution, the platform has urgently suspended UPC deposits and withdrawals. The official statement assures that user assets remain unaffected, and an active investigation is underway to determine the cause of the incident, with further updates to follow. Earlier reports suggested that an unauthorized party had accessed UPCX’s official addresses. The attacker allegedly transferred a total of 18.4 million UPC (approximately $70 million) from three management accounts.
Amount of loss: $ 70,000,000 Attack method: Unknown
Description of the event: According to the SlowMist MistEye security monitoring system, the leveraged trading project SIR.trading (@leveragesir) on the Ethereum chain has been attacked, resulting in a loss of over $300,000 in assets. The root cause of this hack is that the transiently stored value set using tstore in the function was not cleared after the function call ended. This allowed the attacker to exploit this characteristic by constructing specific malicious addresses to bypass permission checks and transfer tokens.
Amount of loss: $ 355,000 Attack method: Contract Vulnerability
Description of the event: According to monitoring by SlowMist's security team, Min Token (MIN) is suspected to have been attacked on BSC, resulting in a loss of approximately $21,400.
Amount of loss: $ 21,415 Attack method: Price Manipulation
Description of the event: An attacker using a flash loan attack stole $13 million in the Magic Internet Money token from the Abracadabra Money project. The attack was enabled by a bug in the platform's smart contracts, and the hacker ultimately made off with around 6,262 ETH.
Amount of loss: $ 13,000,000 Attack method: Contract Vulnerability
Description of the event: RWA restaking platform Zoth suffered a $8.29 million hack after an attacker gained access to admin privileges that allowed them to modify the platform's smart contracts. The hacker "upgraded" the contract to a malicious version, then withdrew $8.45 million in USD0++, a token issued by the Usual protocol. After swapping the assets into various other tokens, they were left with 4,223 ETH (~$8.29 million).
Amount of loss: $ 8,290,000 Attack method: Private Key Leakage
Description of the event: The media platform Watcher.Guru, which focuses on cryptocurrency and financial market news, posted on X that its account was hacked today. Watcher.Guru is still investigating the specific method of the breach and has contacted X's official team for further clarification.
Amount of loss: - Attack method: Account Compromise
Description of the event: BNB-based memecoin launchpad Four.Meme was attacked. According to the SlowMist security team’s analysis, the attacker purchased a small amount of tokens before launch through the 0x7f79f6df function of Four.Meme, and used this feature to send tokens to a specified PancakeSwap Pair address that had not yet been created. This allowed the attacker to create the Pair and add liquidity without needing to transfer the yet-to-be-launched tokens to the Pair, bypassing the transfer restrictions (MODE_TRANSFER_RESTRICTED) that applied before the Four.Meme Token launch. Ultimately, the attacker was able to add liquidity at an unintended price to steal pool liquidity.
Amount of loss: $ 130,000 Attack method: Price Manipulation
Description of the event: On March 18, the Simple Staking pools of Voltage Finance, a DeFi platform built on the Fuse Network, suffered an unauthorized withdrawal, resulting in a total loss of $171,027.20 in USDCE and $151,085.87 in WETH.
Amount of loss: $ 320,000 Attack method: Contract Vulnerability
Description of the event: Kaito official representative Sandra (@sandraaleow) posted on X that Kaito AI founder Yu Hu and Kaito's X account have been compromised. However, no KAITO wallets have been affected.
Amount of loss: - Attack method: Account Compromise
Description of the event: Berally, a platform for social trading using AI agents within the Berachain ecosystem, is suspected to have been hacked. The official statement reads: “Partial information of the deployer's key was leaked, leading to the sell-off of all vesting tokens and withdrawal of funds from the liquidity pool. The dApp contract remains secure and unaffected by the hack, but please temporarily revoke access to the dApp and Staking. An investigation is underway, and an update will be provided as soon as possible.”
Amount of loss: $ 86,725 Attack method: Private Key Leakage
Description of the event: Jupiter co-founder Meow's X account was reportedly hacked and posted token CA-related content, which has now been deleted. Users are advised to stay vigilant.
Amount of loss: - Attack method: Account Compromise