Verified blockchain security incidents with original evidence and historical event dates.
Historical events use their original event dates. Latest event dates first. Severity follows existing archive classifications.
According to the announcement from BingX, at around 4 AM Singapore time on September 20, BingX's security systems detected an unauthorized intrusion targeting one of their hot wallets.
Compound community’s Discord server has been hacked. Please do not click on any links until the situation is resolved.
According to on-chain investigator ZachXBT on the X platform, the decentralized AI data network Masa suffered a hack on September 20, incurring losses exceeding six figures in USD. However, Masa did not disclose this hack to the community.
Banana Gun stated on X platform that some users experienced unauthorized wallet transfers. The issue may have stemmed from a front-end vulnerability. Prioritizing security, the team kept the bot offline during the investigation of the root cause. On September 25, Banana Gun announced on X platform that a total of 11 users were affected, with losses amounting to $3 million. All affected users will be fully compensated from the Banana Gun treasury, without selling any tokens for reimbursement. Following a thorough investigation by the Banana Gun development team and external experts, it was discovered that a potential vulnerability in the Telegram message oracle used by Banana Gun might have led to the attack.
The official X account of the metaverse project Decentraland has been hacked. The hacker has posted a fake phishing link. Please avoid interacting with it.
The official X account of AI Modular Data Preprocessing Layer DIN was hacked, and a large number of phishing posts and links were sent.
Ethena Labs posted on X platform that their Ethena domain registrar account was recently compromised. They have taken measures to disable the website until further notice. The protocol is not affected, and funds are secure. Please do not interact with any sites or applications claiming to be the Ethena frontend.
DeFi project DeltaPrime has officially confirmed on platform X that a security incident occurred. DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M. This was due to a compromised private key.
The yield-optimizing DeFi protocol BaseBros Fi has vanished after executing a rug pull via an unaudited smart contract.
Peer-to-peer trading platform OTSea's staking contract on Ethereum was exploited by an EOA, resulting in the theft of approximately $26,000.
Indonesian crypto exchange Indodax suffered an attack a few hours ago, with the hacker stealing various tokens from hot wallets. The total loss is approximately $22 million. According to the analysis by the SlowMist security team, the possibility that the hot wallet has been compromised can be ruled out. It is possible that the withdrawal system has been hacked.
Omnipus contracts were drained of approximately $30,000 during the OPUS token presale. The attack exploited a vulnerability in which the contracts mistakenly believed the attackers had sent too much ETH and refunded them.
Caterpillar Coin suffered a flashloan attack resulting in a loss of ~$1.4M and causing a 99% slippage on the token. The attack exploited vulnerabilities in the "price protection mechanisms", which led to the manipulation of token reserves and rewards.
The Render Network posted on X, stating that the X account of its founder and CEO, Jules Urbach, was hacked and used to post fake airdrop information. Please do not click any links from the account, and carefully verify all information through official sources.
The Ethereum modular execution layer Fuel posted on X, stating that their official Discord had been attacked. Users are advised not to click on any suspicious links or provide any personal information.
NBA star Jaylen Brown's X account was hacked, and a large amount of fake token information was posted. Users are advised to be cautious and avoid interacting with fraudulent contracts.
NEAR's official account posted on X, stating that the official X account of NEAR Protocol had been hijacked. The hacker posted a series of messages attacking the Crypto ecosystem.
The decentralized liquidity yield project Penpie was attacked, resulting in nearly $30 million in losses. According to the analysis by the SlowMist security team, the core issue of this incident lies in Penpie’s erroneous assumption that all markets created by Pendle Finance are legitimate when registering new Pendle markets. However, Pendle Finance’s market creation process is open, allowing anyone to create a market with customizable key parameters such as the SY contract address. Exploiting this, the attacker created a market contract with a malicious SY contract. They leveraged Penpie’s mechanism, which required calls to external SY contracts to claim rewards, and used flash loans to inject a large amount of liquidity into the market and pool, artificially inflating the rewards and profiting from it.
The official ChainLink Discord has been hacked. Please do not click on any links until the situation is resolved.
The decentralized algorithmic stablecoin protocol Pythia was attacked due to a vulnerability in its staking contract, resulting in a loss of 21 ETH (approximately $53,000).