2345 hack event(s)
Description of the event: A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.
Amount of loss: $ 7,450,000 Attack method: Misconfiguration
Description of the event: The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
Amount of loss: $ 21900 Attack method: Governance Attack
Description of the event: X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken.
Amount of loss: $ 4,850,000 Attack method: Flash Loan Governance Attack
Description of the event: Between October 24 and 26, 2026, an attacker exploited a bug in the XCM executor on Polkadot Asset Hub to reduce the recorded issuance of dotUSD without changing underlying account balances, breaking the assumption that recorded issuance equals the sum of all balances. This distorted pricing in the DOT/dotUSD pool and enabled arbitrage trades at an artificial rate. The Polkadot Treasury, as the sole liquidity provider, lost an estimated $1.381 million in DOT value. No user funds were lost. The vulnerability was reported via bug bounty and fixed in the codebase in June 2026 but was not deployed to the affected production runtime in time.
Amount of loss: $ 1,381,000 Attack method: XCM Executor Vulnerability
Description of the event: The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.
Amount of loss: $ 385000 Attack method: Rug Pull
Description of the event: The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.
Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability
Description of the event: The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.
Amount of loss: $ 90,500 Attack method: Smart Contract Vulnerability
Description of the event: The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.
Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability
Description of the event: Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.
Amount of loss: $ 41000 Attack method: Smart Contract Vulnerability
Description of the event: Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.
Amount of loss: $ 20000 Attack method: Private Key Leakage
Description of the event: An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.
Amount of loss: $ 59,800 Attack method: Smart Contract Vulnerability
Description of the event: AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.
Amount of loss: $ 152,809 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited insufficient randomness in some Qubic wallet seed generation (affecting seeds created in any browser on iPhone/iPad, Safari on Mac before Oct 18, 2026, or the Qubic iOS app before July 2025), draining approximately 2.94 trillion QU (~$1.3 million) from 1,404 wallets. The issue was in seed generation, not the Qubic protocol. The network was halted, most funds frozen, and seed generation fixed in version 4.26.4.
Amount of loss: $ 1,300,000 Attack method: Private Key Leakage
Description of the event: The Affluent DeFi protocol on the TON chain experienced an unbacked minting incident classified under token and share accounting, resulting in a loss of approximately $1,053,000 due to a smart contract vulnerability.
Amount of loss: $ 1,053,000 Attack method: Smart Contract Vulnerability
Description of the event: UNCX Network’s Vesting V2 contracts had a share-accounting logic vulnerability (VestingManager.cancel failed to ensure retained shares covered already-released amounts). The attacker transferred tokens directly to lower the shares-per-token rate, released and canceled schedules, and drained excess tokens from the shared vesting pool. Initial loss on Ethereum was ~$86k, later escalating to ~$1.49M across multiple chains.
Amount of loss: $ 1490000 Attack method: Smart Contract Vulnerability
Description of the event: A transaction validation vulnerability in Pirate Chain source code allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the total supply by about 20%. The newly minted funds were transferred into the Sapling shielded pool. NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals. The exploit combined two validation failures: bypassing the issuance check and incorrect interpretation of the output scripts. dPoW operators suspended notarizations as a precaution, and exchanges/pools were asked to pause operations while a recovery plan is developed.
Amount of loss: $ 10,746,000 Attack method: Transaction Validation Vulnerability
Description of the event: Crypto gambling platform Gamdom was attacked on October 13, 2026, due to an unauthorized server connection, resulting in approximately $4.2 million stolen from hot wallets. The incident affected multiple blockchains; the platform went offline for investigation and moved remaining hot wallet funds to cold storage.
Amount of loss: $ 4,208,000 Attack method: Hot Wallet Server Compromise
Description of the event: Papertrade, a synthetic perpetuals platform with up to 1000x leverage built on Hyperliquid’s HyperEVM, suffered a ~$1.28 million loss about 8 hours after its Oct. 10, 2026 launch. A wallet moved ETH prices on Hyperliquid (via large buys/sells) while holding highly leveraged positions on Papertrade that settled against the manipulated BBO midpoint, extracting profits from the platform’s shared USDC liquidity pool. Papertrade attributed it to overly permissive open-interest limits at launch and tightened them.
Amount of loss: $ 1,280,000 Attack method: Price Manipulation
Description of the event: BitBay’s Polygon DAI/USDC vault, UsdcDaiV4Vault, was exploited. The attacker first called reposition() to force the vault’s liquidity to zero, then redeemed only one minimal share. Because _withdraw() sends the contract’s entire token balance when liquidity == 0 instead of the user’s proportional share, about 14,838.47 DAI (roughly $14,000) was drained.
Amount of loss: $ 14,000 Attack method: Smart Contract Vulnerability
Description of the event: EtherVista’s liquidity pool was exploited due to an integer overflow in the K-invariant check inside EtherVistaPair.swap(). Both reserves are uint112, so their product can wrap around and the check can pass even when the real reserve product drops sharply. The attacker registered a self-controlled contract as an authorized router and ran two crafted swaps to drain WETH and VISTA, with a loss of about $18,600.
Amount of loss: $ 18600 Attack method: Smart Contract Vulnerability