Hacked Event Broadcast

Degen Coin Flip discovered an exploit in its Degen Spin game and was attacked by over 30,000 wallets. Damage was limited to about $10,000, all from the house. User funds are safe as players use their own wallets and the project does not hold balances. Spin and side bets are paused for fixes; other games are unaffected.

$TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived. The delayed input then withdrew nearly all USDT from the pool, causing ~$555K net loss.

The FLOKI team announced an exploit in its Telegram trading bot and took it offline. They are identifying affected users and will move remaining funds to new secure wallets. Users are instructed not to deposit into bot wallets, to move any funds from exported private keys to self-controlled wallets, and to ignore unsolicited “refund/recovery” messages.

On November 3, 2026, the InsurancePool and CoreVault contracts on BSC were attacked, resulting in a loss of approximately $112,300 (about 160.26 BNB). The attacker used a flash loan to manipulate liquidity pool prices/oracle, inflating a CoreVault redemption by about 33 times to extract excess funds from the InsurancePool before repaying the loan.

Brazil’s largest crypto exchange Mercado Bitcoin suffered a security incident in the early hours of November 2, 2026. Attackers drained approximately $38 million from its multi-chain hot wallets and some deposit addresses. The platform quickly suspended deposits and withdrawals, stated that no customers were affected and no data was leaked, and will absorb the loss itself. About $11 million has been frozen.

On November 2, 2026, BitMart exchange was hacked, with attackers draining approximately $391,000 from related hot wallets on Base, Arbitrum, and Optimism. Preliminary investigation suggests the attack may have been carried out by the same group that targeted Brazil’s Mercado Bitcoin on the same day. The exchange was undergoing restructuring with a severely understaffed security team.

King, one of Solana’s oldest arbitrage/MEV bots with ~$7.2M lifetime PnL, was drained of approximately $786,000 in assets, including ~4,260 WSOL, 191 SOL, and ~$366,000 in stablecoins. Funds were moved via drainer addresses and bridged cross-chain.

The main wallet of King (one of Solana’s oldest and most successful MEV/arbitrage bots with ~$7.2M lifetime PnL) was emptied in 146 seconds via five plain transfers signed with its own private key, just 24 seconds after it stopped trading on November 2, 2026. Approximately $856K was stolen. Funds were swapped to SOL and bridged to Ethereum; about $280K was frozen by Mayan and Relay bridges, while ~$574K (251 ETH) remains unmoved in an Ethereum address. A 20% on-chain bounty was offered with no reply.

Brazil’s largest crypto exchange Mercado Bitcoin suffered a security incident in the early hours of November 2, 2026. Attackers drained approximately $38 million from its multi-chain hot wallets and some deposit addresses. The platform quickly suspended deposits and withdrawals, stated that no customers were affected and no data was leaked, and will absorb the loss itself. About $11 million has been frozen.

BTCPay Server reported that hot wallets on multiple instances are being swept by unauthorized attackers. The project urgently advised all operators to shut down their instances immediately using ./btcpay-down.sh until the investigation is complete.

BTCPay Server reported that hot wallets on multiple instances are being swept by unauthorized attackers. The project urgently advised all operators to shut down their instances immediately using ./btcpay-down.sh until the investigation is complete.

On November 4, 2026, Crédit Mutuel Arkéa issued a statement confirming that the attacker gained access through the platform of an unnamed third-party service provider, then used the bank's own accounts to transfer funds to other financial institutions. The funds may have subsequently been converted into cryptocurrency through specialized platforms. The bank denied that the breach originated from its online banking subsidiary, Fortuneo, and stated that customer assets were not affected. Regarding the approximately $133 million in losses previously reported by ZachXBT, the bank did not confirm the exact figure but acknowledged the scale of the incident. Some funds have been frozen, while the final losses remain under assessment.

On-chain investigator ZachXBT reported that French bank Crédit Mutuel Arkéa (with ~$235 billion in assets) had its centralized exchange accounts compromised in early November 2026, with losses exceeding $133 million (mainly withdrawn as USDC/USDT). Funds were rapidly swapped to ETH, bridged across chains, and laundered into privacy assets like Monero. The bank has not publicly confirmed the incident.

In early November 2026, Solana lending protocol Loopscale faced a sustained campaign involving high-volume malicious API requests. Attackers exploited misconfigured asset-pricing parameters to take undercollateralized loans and attempt disproportionate redemptions from the SOL and USDC Genesis Vaults. The team paused the protocol on November 5, stated that affected vaults were made whole, and confirmed no user deposit losses, while coordinating with law enforcement.

On October 31, 2026, the Bitcoin dual-staking protocol b14g suffered a security incident in which approximately 97 million CORE tokens staked through the protocol were withdrawn without authorization and transferred to attacker-controlled addresses. The team paused the affected contracts and is coordinating with the Core team, security partners, and exchanges to trace, freeze, and recover the funds. BTC staked via the protocol remained time-locked on Bitcoin and was unaffected.

On October 31, 2026, Troves (a DeFi protocol on Starknet) had its xWBTC/WBTC vault exploited, resulting in a loss of approximately 8.57 WBTC (about $667,000). The cause was a legacy rebalancing contract that retained permissions after being replaced. The team revoked the permissions, paused affected vaults, and offered a whitehat bounty for fund recovery.

Six Premia V3 underwriter vaults on Arbitrum were drained on October 31, 2026. The attacker created empty option pools, used flash loans to buy options (locking vault collateral into those pools), and then withdrew the collateral as liquidity, resulting in approximately $400,500–$464,600 in losses.

The AI trading platform VergeX was attacked. Some users received withdrawal verification emails triggered by the attack. The official confirmed a total of 3,688.58 USDC was affected; risk controls triggered within one minute, all affected funds have been returned, and other users’ funds were unaffected. Services are being restored in stages.

Flap (a modular token launch platform)’s official website flap.sh was hit by a DNS hijacking attack and redirected to a malicious clone site. Attackers gained control at the domain registrar level, pointed DNS to a malicious Dutch server, and deployed the StepDrainer wallet-drainer toolkit. This tricked users who visited and connected wallets into signing malicious transactions (e.g., unlimited approvals) to drain assets. The team warned users not to visit the site, connect wallets, or sign anything, and migrated to the new domain flap.cool.

On/around October 31, 2026, at least 12 DeFi websites (mostly registered via Name.com) suffered DNS/registrar-level hijacking. Traffic was redirected to malicious frontends serving the StepDrainer wallet-drainer kit. Users who connected wallets and signed transactions had assets stolen; the underlying smart contracts were not compromised.