Confirmed hacks, exploits, incident response, fund recovery, and postmortems.
94 articles
Crypto hackers stole $97 million in July by targeting keys and governance systems, not code, leaving even fully audited protocols dangerously exposed.
Most crypto exchange hacks exploit humans, not code; leaked keys, social engineering, and unpatched systems cause far more losses than blockchain.
A five-year-old Bitcoin wallet flaw in Coldcard firmware exposed $38 million to theft by silently using weak randomness to generate seed phrases.
A fake job offer on Telegram let hackers steal $24.15 million from AFX Trade by compromising validators, not code; a user goodwill plan is due August 3.
Wanchain has given the NIGHT token hacker until August 6 to return 90% of stolen funds, offering a 10% bounty to avoid legal action.
Passing a DeFi security audit means little if teams skip re-reviews and deployment checks; most hacks hit protocols that were already audited.
Crypto hacks surged 50% in H1 2026, with the biggest losses bypassing audits entirely by targeting keys, signers, and cloud infrastructure instead of code.
Physical crypto attacks reached $124M in H1 2026, and owning a hardware wallet may actually raise your risk, not lower it.
North Korea's own elite crypto hackers turned against the regime, stealing state funds, exposing how $6 billion in cryptocurrency theft created an.
Nearly 90% of stolen crypto funds are unrecoverable, as hackers now exploit human trust over code, driving losses to $956 million in H1 2026.
Justin Sun lost his entire $30 million World Liberty Financial investment to alleged fraud, proving even crypto billionaires can't escape the industry's.
Binance runs monthly phishing simulations on staff, with repeated failures risking termination, as social engineering now drives 65% of its security.
Attackers minted $5.23 million in unauthorized WEMIX$ stablecoin by hijacking its contract, crashing the token 99% and forcing WEMIX to halt all bridges.
Garden Finance and WEMIX lost a combined $6.7 million in crypto hacks hours apart, exposing how attackers now target infrastructure, not just code.
Crypto lost over $47 million in one week as hackers shifted from smart contracts to bridges and off-chain validator systems, exposing a critical security.
The Drift Protocol hacker moved $44.4 million in ETH to Tornado Cash after four months of silence, with investigators linking the attack to North Korea's.
Dango perpetuals exchange will shut down July 29 after an April exploit and just $1.77M TVL exposed the limits of small DEX survival.
Hackers drained $31.6 million from two crypto bridges in hours by stealing validator keys, exposing the human security failures AI-powered attacks are.
Three DeFi exploits drained $35.5 million in 24 hours on July 23, including one bridge hacked twice using the same unpatched flaw from May.
Compromised validator keys, not code bugs, enabled two bridge exploits that drained $31.6 million in just seven hours on July 23.
A new AI tool called AMLGuard traces stolen cryptocurrency across blockchains with 94% accuracy, catching laundering schemes traditional crypto AML tools.
A $65.4M flash loan let an attacker drain $6M from Summer.fi's DeFi vaults, exposing a critical flaw in ERC-4626 composability design.
SecondFi phishing scams are targeting hack victims with fake recovery emails; here's how to spot them before signing a malicious transaction.
A flash loan attack drained $1.65M from Allbridge Core by exploiting pool pricing logic, not buggy code, exposing a security gap no standard audit would.
Allbridge lost $1.65M in a flash loan attack on Solana, with stolen funds bridged to Ethereum and obscured through privacy mixers.
Phishing surpassed code exploits as crypto's costliest attack in 2026, with just four social engineering schemes stealing $310 million, or 85 percent of.
DeFiTuna lost $580K in a Solana lending exploit tied to unaudited code upgrades, exposing a growing blind spot in DeFi security.
Cross-chain bridges lost $328 million in 2026, and the pattern is always the same: forged messages, not broken code, drain the funds.
Four DeFi hacks stole $34M in July 2026 by converting USDC to DAI, exposing a laundering template that defeats Circle's freeze authority.
A $9 million DeFi exploit on Hedera wasn't a network breach; a manipulated price feed let an attacker borrow millions against nearly worthless collateral.
Hackers hijacked SpaceX's verified X account to pump a fake memecoin, draining $135,000 in under an hour and exposing social media logins as crypto's.
Crypto lost $35M in one week to a governance takeover, oracle flaws, and weak wallet seed phrases, exposing systemic DeFi security failures.
A zeroed signature fooled Bonzo Lend's oracle into accepting a fake price, letting attackers borrow $9 million in minutes using worthless collateral.
Hedera network was hacked for $3.7 million, with attackers using the LayerZero bridge to move stolen funds to Ethereum as HBAR dropped 3%.
Web3 lost $1.31 billion to hacks in H1 2026, with a single Drift Protocol exploit accounting for $285 million of the total damage.
Injective blocked an npm package hack with zero downloads, keeping user funds safe and highlighting crypto supply chain security risks.
Web3 hacks stole $75M in June by exploiting wallets, Layer 2 protocols, and supply chains simultaneously, proving your private key is just one.
June 2026's $75.87 million crypto hack spree exploited broken wallet math, flawed zero-knowledge proofs, and leaked keys across 40 incidents.
DefiLlama's hack database shows a $3.5 billion Bitcoin theft went undetected for five years, exposing crypto's critical security blind spot.
A trader lost nearly $2M when a DEX aggregator routed 1,126 ETH through a thin liquidity pool, buying tokens at 120 times their fair market price.
A $4.4M token purchase let an attacker legally drain $20M from BONK DAO's treasury, exposing a critical flaw in decentralized governance security.
A $6 million exploit is actively draining Summer.fi vaults, exposing critical security gaps in DeFi automation as platform losses mount across 2026.
Ethical hackers proved a $70 billion Aptos blockchain exploit was feasible using a $3,000 server, exposing a critical flaw that was patched within hours.
Gnosis Pay absorbed a $1.8M loss after a Zodiac module exploit hit 5,281 wallets, then fully refunded every user within days.
Hinkal, a DeFi privacy protocol, lost $820,000 to a smart contract flaw that let an attacker bypass deposit verification and drain nearly all its TVL.
Smart contract audits reduce risk but cannot stop every hack; reentrancy bugs, oracle manipulation, and bridge exploits still drain billions annually.
A single compromised laptop triggered Humanity Protocol's $36M hack, exposing the hidden custody risks threatening $120B in wrapped token protocols.
Hackers no longer need your MetaMask password; they hijack trusted libraries and auto-updates to steal your seed phrase and drain your wallet silently.
Not every crypto failure is a scam: CryptoLinks' warning system classifies threats by evidence level, helping investors spot real fraud before losing.
Private keys, not code bugs, caused 40% of crypto's $16.69 billion in hack losses; here's how MPC wallets and new designs are fighting back.
