2360 hack event(s)
Description of the event: The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.
Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability
Description of the event: The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.
Amount of loss: $ 90,500 Attack method: Smart Contract Vulnerability
Description of the event: The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.
Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability
Description of the event: Slice (onchain commerce protocol) suffered an exploit in its FundsModule where the 0x9d2edfac function trusted release amounts returned by caller-selected source contracts without verifying that corresponding ETH or USDC was actually received. The attacker used two contracts that returned nonzero amounts while transferring no assets, enabling immediate withdrawals of ~$41k from pooled reserves to the attacker.
Amount of loss: $ 41000 Attack method: Smart Contract Vulnerability
Description of the event: Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately.
Amount of loss: $ 20000 Attack method: Private Key Leakage
Description of the event: An attacker exploited two flaws in an Argent-style smart wallet system. The recovery module’s unrestricted setter allowed a crafted recovery period to wrap the deadline timestamp into the past, enabling same-transaction recovery and ownership change with a valid guardian signature. The execution module also failed to reject reuse of identical signed payloads (executed 19 times in one tx and 9 times in another). The attacker used the repeated executions to trade against a low-liquidity MARK/WETH pool, resulting in a loss of approximately $59,800.
Amount of loss: $ 59,800 Attack method: Smart Contract Vulnerability
Description of the event: AlpsCon AI Trade Hub on BNB Chain was exploited. An attacker used the publicly known private key of a Hardhat default test account that had remained on the KYC whitelist for ~14 months, executed code via EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward accounting bug (fresh stake treated as historical to claim accumulated rewards), netting ~$152K USDC after repaying the loan.
Amount of loss: $ 152,809 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited insufficient randomness in some Qubic wallet seed generation (affecting seeds created in any browser on iPhone/iPad, Safari on Mac before Oct 18, 2026, or the Qubic iOS app before July 2025), draining approximately 2.94 trillion QU (~$1.3 million) from 1,404 wallets. The issue was in seed generation, not the Qubic protocol. The network was halted, most funds frozen, and seed generation fixed in version 4.26.4.
Amount of loss: $ 1,300,000 Attack method: Private Key Leakage
Description of the event: The Affluent DeFi protocol on the TON chain experienced an unbacked minting incident classified under token and share accounting, resulting in a loss of approximately $1,053,000 due to a smart contract vulnerability.
Amount of loss: $ 1,053,000 Attack method: Smart Contract Vulnerability
Description of the event: UNCX Network’s Smart Token Vesting V2 contracts were exploited across multiple chains (Ethereum, BNB Chain, Base, and Robinhood Chain). Attackers used a sequence of public vesting actions (release and cancel) that created discrepancies between pooled token balances and recorded shares, allowing attacker-controlled positions to withdraw more assets than entitled. Approximately 10 tokens and 11 transactions were involved. Early estimates put losses at about $1.49M; the project later confirmed roughly $807K–$808K in realized extracted value, with about $58K recovered by whitehats.
Amount of loss: $ 807,000 Attack method: Smart Contract Vulnerability
Description of the event: A transaction validation vulnerability in Pirate Chain source code allowed the unauthorized creation of approximately 39.8 million ARRR, increasing the total supply by about 20%. The newly minted funds were transferred into the Sapling shielded pool. NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals. The exploit combined two validation failures: bypassing the issuance check and incorrect interpretation of the output scripts. dPoW operators suspended notarizations as a precaution, and exchanges/pools were asked to pause operations while a recovery plan is developed.
Amount of loss: $ 10,746,000 Attack method: Transaction Validation Vulnerability
Description of the event: Crypto gambling platform Gamdom was attacked on October 13, 2026, due to an unauthorized server connection, resulting in approximately $4.2 million stolen from hot wallets. The incident affected multiple blockchains; the platform went offline for investigation and moved remaining hot wallet funds to cold storage.
Amount of loss: $ 4,208,000 Attack method: Hot Wallet Server Compromise
Description of the event: Papertrade, a synthetic perpetuals platform with up to 1000x leverage built on Hyperliquid’s HyperEVM, suffered a ~$1.28 million loss about 8 hours after its Oct. 10, 2026 launch. A wallet moved ETH prices on Hyperliquid (via large buys/sells) while holding highly leveraged positions on Papertrade that settled against the manipulated BBO midpoint, extracting profits from the platform’s shared USDC liquidity pool. Papertrade attributed it to overly permissive open-interest limits at launch and tightened them.
Amount of loss: $ 1,280,000 Attack method: Price Manipulation
Description of the event: BitBay’s Polygon DAI/USDC vault, UsdcDaiV4Vault, was exploited. The attacker first called reposition() to force the vault’s liquidity to zero, then redeemed only one minimal share. Because _withdraw() sends the contract’s entire token balance when liquidity == 0 instead of the user’s proportional share, about 14,838.47 DAI (roughly $14,000) was drained.
Amount of loss: $ 14,000 Attack method: Smart Contract Vulnerability
Description of the event: EtherVista’s liquidity pool was exploited due to an integer overflow in the K-invariant check inside EtherVistaPair.swap(). Both reserves are uint112, so their product can wrap around and the check can pass even when the real reserve product drops sharply. The attacker registered a self-controlled contract as an authorized router and ran two crafted swaps to drain WETH and VISTA, with a loss of about $18,600.
Amount of loss: $ 18600 Attack method: Smart Contract Vulnerability
Description of the event: An attacker exploited an accounting bug in X7Pioneer’s claimRewards(). The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.
Amount of loss: $ 16,514 Attack method: Smart Contract Vulnerability
Description of the event: 79th Vault (79AU token) on BNB Chain was attacked due to a compromise of the operator’s private key. The attacker used a privileged OPERATOR_ROLE-only function in the token contract (which allowed moving 79AU directly out of the PancakeSwap 79AU/USDT pair and calling sync()) to extract about 2.01 million 79AU in multiple transactions within roughly one hour, then sold them back into the pool to drain USDT and convert proceeds into about 16,249 BNB (~$12.5 million loss; pool USDT reserves fell from ~$15.2M to ~$3.9M). The project revoked the role, applied emergency fixes, and later recovered ~15,000 BNB via white-hat negotiations.
Amount of loss: $ 12,500,000 Attack method: Private Key Leakage
Description of the event: Two legacy Set Protocol products (ETHEMAAPY and ETHMACOAPY) were exploited due to an upward rounding vulnerability in the actualizeFee() function. Attackers used the bug to inflate share value even when no fee was charged, then issued and redeemed shares to extract excess collateral, resulting in losses of approximately $50k.
Amount of loss: $ 50,000 Attack method: Smart Contract Vulnerability
Description of the event: A Tornado Cash-funded address called an unprotected drain function on a dormant MakerDAO ETH-A liquidation keeper. The upgradeable proxy had won auctions #1457–1460 in 2020 (200 WETH total) but never called deal(), leaving the collateral in the Flipper. The attacker called deal(), moved the collateral to the keeper via Vat.flux, then used GemJoin.exit() to withdraw 200 WETH to an attacker-chosen address and unwrap it to ETH. The flaw was in the third-party keeper, not MakerDAO core.
Amount of loss: $ 538000 Attack method: Smart Contract Vulnerability
Description of the event: Web3 financial platform Based discovered that an unauthorized third party had accessed an internal dashboard used to manage the Based Visa Card program and contained the incident shortly after detection. KYC data collected by the card issuer for some cardholders (including name, ID/passport number, date of birth, and address) may have been obtained. Card numbers, CVV, PIN, ID photos, liveness records, the Based Wallet, and card funds were not affected, and cards continue to work normally. Affected users were notified by email, authorities were informed, and users were warned about phishing and social-engineering risks.
Amount of loss: 0 Attack method: Unauthorized Access to Internal Systems