Взломы и эксплойты

Более $405M украдено с 2020.

На этой странице приведен список известных взломов и эксплойтов, в результате которых средства пользователей подвергаются риску. Многие другие эксплойты затрагивают только средства, хранящиеся во взломанном смарт-контракте. Но эксплойты, перечисленные на этой странице, используют неограниченное количество доступов для кражи средств. Используя Revoke.cash для управления доступами, вы можете защитить свои средства от этих уязвимостей. Проверьте, защищен ли ваш кошелек, нажав на эксплойты ниже.

Magpie Hack

Обнаружено на2024-04-23
Украденная сумма$130k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Polygon zkEVM Logo
Arbitrum Logo
Optimism Logo
Blast Logo
Avalanche Logo
Base Logo
zkSync Era Logo

Описание

About $130k was stolen from users of crosschain DEX Magpie. The Magpie team has stated that they have paused the affected smart contract and are working on a compensation plan for affected users.

Проверить

Merkle Trade Hack

Обнаружено на2024-04-18
Украденная сумма$20k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Optimism Logo
Avalanche Logo

Описание

About $20k was stolen from users of Merkle Trade, a perp DEX on multiple networks. After discovering the vulnerability in their newer EVM Swap & Deposit smart contract, Merkle Trade rolled back their service to an older smart contract. Only users that have interacted with Merkle's new Swap & Deposit functionality on EVM chains since the 18th of April were affected.

Проверить

Dolomite Hack

Обнаружено на2024-03-20
Украденная сумма$1.8M
Затронутые сети
Ethereum Logo

Описание

On March 20 2024, over $1.8m was stolen from users of an old version of DeFi protocol Dolomite. The exploit was found in an old contract that was deployed in 2019 and had since been discontinued. However, several users still had lingering approvals to this old contract, which the attacker was able to exploit to drain funds from their wallets.

Проверить

ParaSwap Whitehat Hack

Обнаружено на2024-03-20
Украденная сумма$24k
Затронутые сети
Ethereum Logo
Arbitrum Logo
Optimism Logo
Base Logo

Описание

On March 20th 2024, ParaSwap discovered a vulnerability in one of their smart contracts. After discovering this vulnerability, they executed a successful whitehat hack to rescue affected user funds. A few addresses were missed so about $24k of funds ended up being stolen. ParaSwap is working on refunding all affected users shortly.

Проверить

Unizen Hack

Обнаружено на2024-03-08
Украденная сумма$2.2M
Затронутые сети
Ethereum Logo

Описание

Over 2 million dollars was stolen from users of decentralised exchange Unizen. Not much is known yet so we will update after a full post-mortem.

Проверить

Seneca Hack

Обнаружено на2024-02-28
Украденная сумма$6.4M
Затронутые сети
Ethereum Logo
Arbitrum Logo

Описание

Over $6m was stolen from users of DeFi protocol Seneca on Ethereum and Arbitrum. Malicious actors were able to exploit a bug in several smart contracts belonging to the Seneca system. Not much is known about the specific exploit yet and we are still awaiting a full post-mortem.

Проверить

Concentric Hack

Обнаружено на2024-01-22
Украденная сумма$1.7M
Затронутые сети
Arbitrum Logo

Описание

Over $1.7m was stolen from users of Concentric, a DeFi protocol on Arbitrum. The attackers were able to gain access to the protocol's admin keys, which they used to execute malicious upgrades on the protocol's contracts - allowing them to drain the wallets of any users that had active token approvals for the protocol.

Проверить

Socket Hack

Обнаружено на2024-01-16
Украденная сумма$3.3M
Затронутые сети
Ethereum Logo

Описание

Over 3 million dollars was stolen from users with active token approvals to cross-chain bridge provider Socket. Socket is the underlying technology used by several bridges, such as the popular Bungee Exchange and Rainbow Wallet's bridge functionality. If you've used any of these bridges in the past, you may be affected.

Проверить

Floor Protocol Hack

Обнаружено на2023-12-17
Украденная сумма$1.8M
Затронутые сети
Ethereum Logo

Описание

Close to $2M worth of NFTs has been stolen from users of the NFT fractionalization platform Floor Protocol on the 17th of December, mostly Bored Apes and Pudgy Penguins. The vulnerability was patched by the team, preventing further losses, which could have been over 10x larger.

Проверить

NFT Trader Hack

Обнаружено на2023-12-16
Украденная сумма$400k
Затронутые сети
Ethereum Logo

Описание

Close to $3M worth of NFTs was stolen from users of the peer to peer platform NFTTrader, mostly made up of Bored Apes and Mutant Apes. The main exploiter discovered a reentrancy bug in multiple old contracts of NFT Trader, allowing them to drain users' approved assets. Multiple other exploiters followed suit. Representatives from Yuga Labs and Boring Security DAO have since successfully negotiated with the main exploiter to return the assets in return for a 10% bounty. Several hundreds of thousands of dollars worth of NFTs is still in the hands of other exploiters.

Проверить

Ledger Connect Kit Hack

Обнаружено на2023-12-14
Украденная сумма$610k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Optimism Logo
Avalanche Logo
Base Logo
Fantom Logo

Описание

Over $600k has been stolen from users of many different crypto websites, including SushiSwap and Revoke.cash. This hack is a result of a vulnerability in the Ledger Connect Kit library, which is used by many crypto websites to connect to Ledger hardware wallets. The vulnerable library allowed hackers to inject a malicious script into these popular crypto websites. Many websites, like SushiSwap and Revoke.cash were quick to take their websites offline and remove the affected library. Most big websites were able to remove the library within a few hours, but some websites took longer to mitigate the issue. Because it is not known how many websites were affected, we recommend to check if you're affected by this hack if you used any crypto websites on the 14th of December 2023.

Проверить

Unibot Hack

Обнаружено на2023-10-31
Украденная сумма$600k
Затронутые сети
Ethereum Logo

Описание

Over $600k has been stolen from users of Unibot, an automated Telegram trading bot. The team had released a new version of their router contract on October 28th, which was exploited on October 31th 2023. The Unibot team has since refunded all the affected users.

Проверить

Maestro Hack

Обнаружено на2023-10-25
Украденная сумма$500k
Затронутые сети
Ethereum Logo

Описание

Over $500k has been stolen from users of Maestro, an automated Telegram trading bot. The team had released a new version of their router contract on October 13th, which was exploited on October 25th 2023 due to misconfigured permissions on some of the smart contract's functionality. The Maestro team quickly issued a fix for the smart contract bug by upgrading their upgradeable router contract. All affected users that lost funds in the exploit were reimbursed for their losses. Because the router contract was upgraded, it is not necessary to revoke your approvals to this contract, but you may do so if you wish.

Проверить

Galxe Frontend Hack

Обнаружено на2023-10-06
Украденная сумма$270k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Optimism Logo
Avalanche Logo
Base Logo
Fantom Logo
Celo Logo

Описание

Over $270k was stolen from users of Galxe, a popular Web3 community building platform. Hackers were able to gain access the platform's DNS settings through social engineering after which they pointed the DNS records to a malicious website that they controlled. Any users who interacted with the Galxe website on the 6th of October 2023 may be at risk.

Проверить

CivFund Hack

Обнаружено на2023-07-08
Украденная сумма$180k
Затронутые сети
Ethereum Logo

Описание

Over $180k was stolen from users of CivFund. It is still uncertain how the hack happened because the smart contract is not open source, but it is likely that there was an issue with access control allowing the attackers to call privileged functions, and steal approved user funds in the process.

Проверить

2023 Multichain Hack

Обнаружено на2023-07-07
Украденная сумма$120M
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Optimism Logo
Avalanche Logo
zkSync Era Logo
Fantom Logo
Gnosis Chain Logo
Celo Logo

Описание

Over $120M was stolen by hackers that exploited the Multichain MPC wallets. As of now it is unclear how this compromise happened. No approved user funds have been stolen, but the Multichain team has recommended revoking approvals due to the uncertainty of the exploit.

Проверить

Biswap v3 Migrator Hack

Обнаружено на2023-06-30
Украденная сумма$850k
Затронутые сети
BNB Chain Logo

Описание

Over $850k was stolen from liquidity providers of Biswap, a decentralized exchange on BNB Chain. Biswap recently launched their v3, and the team created a migrator contract to help users migrate their liquidity from v2 to v3. The migrator contract lacked proper access control, and an attacker was able to call the migrator contract to steal funds from liquidity providers. The Biswap team has started reimbursing affected users.

Проверить

Unagii Whitehat Hack

Обнаружено на2023-06-28
Украденная сумма$60k
Затронутые сети
Ethereum Logo

Описание

About $100k was rescued from a vulnerable contract of Unagii, an Ethereum DeFi yield aggregator. The funds were rescued from the vulnerable contract by the Unagii team, but close to $60k was still taken from a single user by an automated MEV operator. The Unagii team has since reimbursed all the affected users.

Проверить

Hashflow Whitehat Hack

Обнаружено на2023-06-14
Украденная сумма$100k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Avalanche Logo

Описание

Over $600k was rescued from deprecated contracts of decentralised exchange Hashflow. A whitehat hacker created a contract to rescue the funds and return them to the rightful owners. Users of Hashflow are advised to revoke all approvals to these deprecated contracts before claiming their rescued funds. Some user funds were still stolen by black-hat hackers after the initial rescue though.

Проверить

Atlantis Loans Hack

Обнаружено на2023-06-11
Украденная сумма$2.5M
Затронутые сети
BNB Chain Logo

Описание

Over $2.5M was stolen from users of Atlantis Loans, a DeFi protocol on BNB Chain. The attacker created a malicious governance proposal that maliciously updated the contracts of several contracts in the system. These updated smart contracts were then used to drain approved user funds.

Проверить

SushiSwap Hack

Обнаружено на2023-04-09
Украденная сумма$3.5M
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Polygon zkEVM Logo
Arbitrum Logo
Arbitrum Nova Logo
Optimism Logo
Avalanche Logo
Fantom Logo
Gnosis Chain Logo
Moonbeam Logo
Moonriver Logo
Boba Logo
Fuse Logo

Описание

Over $3.5M was stolen from users of the popular DEX SushiSwap. The vulnerability only concerns a recently deployed SushiSwap contract, so only users who interacted with the exchange between the 1st and the 9th of April are affected.

Проверить

BSCex Hack

Обнаружено на2023-03-27
Украденная сумма$8.2M
Затронутые сети
BNB Chain Logo

Описание

Over $8.2M was stolen from users of BSCex / SwapX, a DEX on BNB Chain. Vulnerabilities were found in four old contracts belonging to the DEX. Many users still have active approvals to these contracts, even though they haven't used it for a long time.

Проверить

Harvest Keeper Rug Pull

Обнаружено на2023-03-19
Украденная сумма$700k
Затронутые сети
BNB Chain Logo

Описание

Over $700k has been stolen by Harvest Keeper from their users. Harvest Keeper claimed to be an "AI-powered" trading platform that provided unsustainably high yields, but turned out to be a scam. When they rugpulled they didn't just steal the deposited funds, but also all approved user funds.

Проверить

Revert Finance Hack

Обнаружено на2023-02-18
Украденная сумма$30k
Затронутые сети
Ethereum Logo
Polygon Logo
Arbitrum Logo
Optimism Logo

Описание

About $30k was stolen from users of Revert Finance. Hackers were able to execute arbitrary code from the context of the vulnerable contract, allowing them to transfer approved user funds.

Проверить

Dexible Hack

Обнаружено на2023-02-17
Украденная сумма$2M
Затронутые сети
Ethereum Logo
Arbitrum Logo

Описание

Over $2M was stolen from users of Dexible, a DEX aggregator. Hackers exploited a vulnerability that allowed them to provide their own Router contract, which they programmed to steal all approved user funds.

Проверить

Rubic Hack

Обнаружено на2022-12-25
Украденная сумма$1.4M
Затронутые сети
Ethereum Logo

Описание

Over $1.4M was stolen from the users of cross-chain DEX Rubic. Hackers were able to exploit active approvals because the USDC contract was mistakenly added as a whitelisted "Router contract". The Rubic team has compensated affected users.

Проверить

Polynomial Protocol Hack

Обнаружено на2022-12-12
Украденная сумма$7k
Затронутые сети
Optimism Logo

Описание

Around $7k was stolen from a select number of users of Polynomial Protocol, a derivatives platform on Optimism. Since this contract was no used for all functionality, only a few users were affected. Polynomial Protocol reimbursed the affected users.

Проверить

Brahma Hack

Обнаружено на2022-11-09
Украденная сумма$90k
Затронутые сети
Ethereum Logo

Описание

Around $90k was stolen from users of Brahma, a cross-chain DeFi protocol. Hackers were able to exploit a vulnerability due to incorrect access control.

Проверить

BitKeep Swap Hack

Обнаружено на2022-10-18
Украденная сумма$1.1M
Затронутые сети
BNB Chain Logo
Polygon Logo

Описание

Over $1.1M was stolen from users of the BitKeep Wallet. Hackers were able to abuse unlimited approvals to steal approved user funds on BNB Chain and Polygon. The BitKeep team reimbursed affected users.

Проверить

Rabby Swap Hack

Обнаружено на2022-10-11
Украденная сумма$200k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Arbitrum Nova Logo
Optimism Logo
Avalanche Logo
Cronos Logo
Fantom Logo
Gnosis Chain Logo
Celo Logo
Astar Logo
Moonbeam Logo
Metis Logo
Aurora Logo
Boba Logo
Harmony Logo
Klaytn (Unsupported) Logo
HECO (Unsupported) Logo

Описание

About $200k was stolen from users of the Rabby Wallet. Only users who used the wallet's Swap function and have active approvals are at risk.

Проверить

Transit Swap Hack

Обнаружено на2022-10-02
Украденная сумма$21M
Затронутые сети
Ethereum Logo
BNB Chain Logo

Описание

Over $21M was stolen from users of Transit Swap, a DEX on Ethereum and BNB Chain. Any wallets with active approvals to these smart contracts are at risk.

Проверить

Celer Frontend Hack

Обнаружено на2022-08-17
Украденная сумма$240k
Затронутые сети
Ethereum Logo
BNB Chain Logo
Polygon Logo
Arbitrum Logo
Optimism Logo
Avalanche Logo
Fantom Logo
Astar Logo
Metis Logo
Aurora Logo

Описание

Over $200k was stolen from users of Celer. Hackers were able to compromise their official website and inject malicious code into it. This malicious code requested users to grant unlimited approvals to the hackers' wallets.

Проверить

Curve Frontend Hack

Обнаружено на2022-08-09
Украденная сумма$575k
Затронутые сети
Ethereum Logo

Описание

Over $500k was stolen from users of the popular DEX Curve. Hackers were able to compromise their official website and inject malicious code into it. They injected malicious approval transactions into the frontend, draining users' wallets. Anyone that interacted with the Curve frontend on the 9th of August is at risk.

Проверить

PREMINT Frontend Hack

Обнаружено на2022-07-17
Украденная сумма$400k
Затронутые сети
Ethereum Logo

Описание

Over $400k was stolen from users of PREMINT, a popular NFT platform. Hackers were able to compromise their official website and inject malicious code into it. This malicious code requested users to grant unlimited approvals to the hackers' wallets.

Проверить

Quixotic Hack

Обнаружено на2022-07-01
Украденная сумма$200k
Затронутые сети
Optimism Logo

Описание

Over $200k was stolen from users of Quixotic, an NFT marketplace on Optimism. The contract allowed malicious actors to sell worthless NFTs to victims for high prices due to missing signature verifications. The smart contract is now paused, but it is still recommended to revoke approvals.

Проверить

Namecheap DNS Hijack

Обнаружено на2022-06-23
Украденная сумма$500k
Затронутые сети
Ethereum Logo

Описание

Over $500k was stolen from users of several popular dapps, including Convex, Ribbon, and DeFiSaver. Hackers were able to access these websites' Namecheap settings to inject malicious code into the websites. This malicious code requested users to grant unlimited approvals to the hackers' wallets.

Проверить

Zapper Whitehat Hack

Обнаружено на2022-06-14
Украденная сумма$0
Затронутые сети
Ethereum Logo

Описание

Over $2.5M was rescued from a vulnerable Zapper contract. The Zapper team was notified of the vulnerability by whitehat hackers and were able to rescue the approved user funds. After revoking active approvals, users were reimbursed their funds.

Проверить

BasketDAO Hack

Обнаружено на2022-03-30
Украденная сумма$1.2M
Затронутые сети
Ethereum Logo

Описание

Over $1.2M was stolen from users of BasketDAO, a DeFi protocol for creating token baskets. Two of their contracts contained vulnerabilities that allowed hackers to steal approved user funds. Since then, BasketDAO has shut down and was acquired by another DeFi protocol, PieDAO.

Проверить

Auctus Hack

Обнаружено на2022-03-29
Украденная сумма$700k
Затронутые сети
Ethereum Logo

Описание

Over $700k has been stolen from users of Auctus, a decentralized options protocol on Ethereum. The Auctus team discovered a vulnerability in one of their older Beta contracts, which allowed attackers to drain approved funds from users' wallets.

Проверить

LI.FI Hack

Обнаружено на2022-03-20
Украденная сумма$600k
Затронутые сети
Ethereum Logo

Описание

Around $600k was stolen from users of LI.FI, a cross-chain bridge and DEX aggregator. Hackers exploited a vulnerability that allowed them to execute arbitrary functions from the context of the smart contract, including transactions that drained approved user funds. LI.FI has since then patched the vulnerability and reimbursed affected users.

Проверить

2022 Multichain Hack

Обнаружено на2022-01-17
Украденная сумма$3M
Затронутые сети
Ethereum Logo
BNB Chain Logo
Avalanche Logo

Описание

Over $3M was stolen by hackers that exploited a bug in the contracts of Multichain (formerly Anyswap), a cross-chain swap router. Any wallets that granted approvals to their smart contracts are at risk.

Проверить

Sorbet Finance Whitehat Hack

Обнаружено на2021-12-11
Украденная сумма$0
Затронутые сети
Ethereum Logo

Описание

About $26M was rescued from a vulnerable Sorbet Finance smart contract. The team was able to drain all vulnerable funds and has placed it in a special escrow smart contract, where the original owners can reclaim them. Active approvals must be revoked before receiving refunds.

Проверить

BadgerDAO Frontend Hack

Обнаружено на2021-12-02
Украденная сумма$120.3M
Затронутые сети
Ethereum Logo

Описание

Over $120M was stolen from users of BadgerDAO, a popular DeFi platform. Hackers were able to compromise their official website and inject malicious code into it. This malicious code requested users to grant unlimited approvals to the hackers' wallets.

Проверить

dYdX Whitehat Hack

Обнаружено на2021-11-27
Украденная сумма$200k
Затронутые сети
Ethereum Logo

Описание

About $2M was rescued from a vulnerable dYdX smart contract. The team was able to drain all vulnerable funds and has been refunding users once they revoke their active approvals. Despite their efforts, hackers were still able to steal just over $200k, which the dYdX team has reimbursed out of their own pocket.

Проверить

bZx Hack

Обнаружено на2021-11-05
Украденная сумма$55M
Затронутые сети
BNB Chain Logo
Polygon Logo

Описание

Over $55M was stolen from users of DeFi platform bXz. Hackers gained access to the private keys of an admin account and deployed a malicious update to bZx' smart contracts. This new code allowed them to drain bZx' contracts and all approved user funds. This was the final nail in the coffin for bZx, which was exploited multiple times before.

Проверить

StableMagnet Rug Pull

Обнаружено на2021-06-24
Украденная сумма$27M
Затронутые сети
BNB Chain Logo

Описание

Over $27M was stolen from users of StableMagnet, a DEX on BNB Chain. The StableMagnet team built a backdoor into their smart contract that allowed them to drain the funds in liquidity pools and from users with active approvals.

Проверить

Furucombo Hack

Обнаружено на2021-02-27
Украденная сумма$14M
Затронутые сети
Ethereum Logo

Описание

Over $14M was stolen from users of Furucombo, an app that helps users compose DeFi transactions. Hackers were able to trick the Furucombo governance to whitelist a scam contract, which was subsequently able to drain all approved user funds.

Проверить

Bancor Whitehat Hack

Обнаружено на2020-06-18
Украденная сумма$135k
Затронутые сети
Ethereum Logo

Описание

About $400k was rescued from a vulnerable Bancor contract. A vulnerability was discovered by the 1inch team and reported to Bancor. Most of the vulnerable funds were saved by the Bancor team, but just over $100k was still taken by automated front-running bots.

Проверить
Русский
Русский