2339 hack event(s)
Description of the event: Brazil’s largest crypto exchange Mercado Bitcoin suffered a security incident in the early hours of November 2, 2026. Attackers drained approximately $38 million from its multi-chain hot wallets and some deposit addresses. The platform quickly suspended deposits and withdrawals, stated that no customers were affected and no data was leaked, and will absorb the loss itself. About $11 million has been frozen.
Amount of loss: $ 49,000,000 Attack method: Unknown
Description of the event: King, one of Solana’s oldest arbitrage/MEV bots with ~$7.2M lifetime PnL, was drained of approximately $786,000 in assets, including ~4,260 WSOL, 191 SOL, and ~$366,000 in stablecoins. Funds were moved via drainer addresses and bridged cross-chain.
Amount of loss: $ 786,000 Attack method: Unknown
Description of the event: BTCPay Server reported that hot wallets on multiple instances are being swept by unauthorized attackers. The project urgently advised all operators to shut down their instances immediately using ./btcpay-down.sh until the investigation is complete.
Amount of loss: $ 1,628,450 Attack method: Unauthorized Signing Access
Description of the event: Flap (a modular token launch platform)’s official website flap.sh was hit by a DNS hijacking attack and redirected to a malicious clone site. Attackers gained control at the domain registrar level, pointed DNS to a malicious Dutch server, and deployed the StepDrainer wallet-drainer toolkit. This tricked users who visited and connected wallets into signing malicious transactions (e.g., unlimited approvals) to drain assets. The team warned users not to visit the site, connect wallets, or sign anything, and migrated to the new domain flap.cool.
Amount of loss: - Attack method: DNS Hijacking
Description of the event: The AI trading platform VergeX was attacked. Some users received withdrawal verification emails triggered by the attack. The official confirmed a total of 3,688.58 USDC was affected; risk controls triggered within one minute, all affected funds have been returned, and other users’ funds were unaffected. Services are being restored in stages.
Amount of loss: $ 3,688.58 Attack method: Unknown
Description of the event: On October 31, 2026, the Bitcoin dual-staking protocol b14g suffered a security incident in which approximately 97 million CORE tokens staked through the protocol were withdrawn without authorization and transferred to attacker-controlled addresses. The team paused the affected contracts and is coordinating with the Core team, security partners, and exchanges to trace, freeze, and recover the funds. BTC staked via the protocol remained time-locked on Bitcoin and was unaffected.
Amount of loss: $ 1,470,000 Attack method: Smart Contract Vulnerability
Description of the event: Six Premia V3 underwriter vaults on Arbitrum were drained on October 31, 2026. The attacker created empty option pools, used flash loans to buy options (locking vault collateral into those pools), and then withdrew the collateral as liquidity, resulting in approximately $400,500–$464,600 in losses.
Amount of loss: $ 400,500 Attack method: Smart Contract Vulnerability
Description of the event: The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs.
Amount of loss: $ 783,100 Attack method: Smart Contract Vulnerability
Description of the event: On October 29, 2026, multiple Binance hot wallets (notably Binance 14 on Ethereum) were drained of billions in assets within a short window. The attacker used EIP-7702 delegation to gain control and sweep funds across several chains, marking one of the largest exchange security incidents in crypto history. Binance suspended deposits/withdrawals, stated that user funds are safe and will cover all losses, while stablecoin issuers quickly froze significant amounts.
Amount of loss: $ 6,300,000,000 Attack method: DevOps Engineer’s Laptop Compromised
Description of the event: Polymarket’s international platform (Polymarket.com) suffered a security incident after a third-party provider (DebugBear, a website performance monitoring tool) was compromised. Malicious JavaScript drained funds from some users’ accounts (approximately $2.65–2.7 million). Trading was paused for about an hour, then resumed. Polymarket promised to fully reimburse all affected traders and referred the matter to UK law enforcement.
Amount of loss: $ 2,700,000 Attack method: Supply Chain Attack
Description of the event: A TranchePool on Avalanche associated with Valinor Digital, Oatfi, and Fence Finance was exploited due to a settlement logic flaw. At the UTC day rollover, a scheduled principal payment was incorrectly treated as received, artificially restoring ~$1.013M of draw capacity and allowing the attacker to draw the same amount of USDC a second time.
Amount of loss: $ 1,013,000 Attack method: Smart Contract Vulnerability
Description of the event: Hifi Finance suffered a DAO governance takeover. An attacker, using addresses funded via Tornado Cash, cast four last-minute votes to pass a malicious proposal (Proposal 21), gained control, upgraded the BalanceSheet contract, minted 25 million HIFI tokens, and drained approximately $1 million in user collateral (mostly RWA tokens).
Amount of loss: $ 1,000,000 Attack method: Governance Attack
Description of the event: Predict.fun (a BNB Chain prediction market) saw approximately 397,708 USDT drained from 29 user smart wallets (Kernel/ZeroDev-based) in two waves on October 22 and 27, 2026. Each drain was signed with the compromised owner private key; no protocol contracts were exploited. The team attributes it to a compromised third-party API documentation site, took the site offline, and pledged full reimbursement to affected users, with a full post-mortem forthcoming.
Amount of loss: $ 397,708 Attack method: Private Key Leak
Description of the event: The Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected participants whole.
Amount of loss: - Attack method: Private Key Leakage
Description of the event: The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating.
Amount of loss: $ 947,000 Attack method: Supply Chain Attack
Description of the event: A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.
Amount of loss: $ 7,450,000 Attack method: Misconfiguration
Description of the event: The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.
Amount of loss: $ 21900 Attack method: Governance Attack
Description of the event: X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken.
Amount of loss: $ 4,850,000 Attack method: Flash Loan Governance Attack
Description of the event: The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.
Amount of loss: $ 385000 Attack method: Rug Pull
Description of the event: The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.
Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability