Hacked target: ETHTrustFund
Description of the event: ETHTrustFund conducted a rugpull and stole approximately $2 million worth of cryptocurrencies on Base.
Amount of loss: $ 2,000,000Attack method: Rug Pull
HACKED ARCHIVE
Hacked Event Broadcast
Verified blockchain security incidents with original evidence and historical event dates.
Live source archive
Hacked target: Arbitrum
Description of the event: The arbitrum.com website appears to have been hacked and is being redirected to the official website of the Meme project MOG. Please stay vigilant and ensure the safety of your assets.
Attack method: DNS Attack
Hacked target: Rho Markets
Description of the event: A misconfiguration in the Rho Markets lending protocol allowed an MEV bot operator to take $7.6 million from the project's users across multiple chains. The MEV bot operator sent an on-chain message indicating their willingness to return all the funds. Subsequently, the MEV bot operator returned the funds as planned.
Amount of loss: $ 7,600,000Attack method: Oracle Misconfiguration
Hacked target: WazirX
Description of the event: The cryptocurrency exchange WazirX posted preliminary investigation results of the cyber attack on Twitter, stating that one of its multisig wallets was compromised, resulting in a loss of over $230 million.
Amount of loss: $ 230,000,000Attack method: Wallet Stolen
Hacked target: LI.FI
Description of the event: According to the monitoring by the SlowMist security team, the cross-chain bridge aggregation protocol LI.FI has experienced suspicious transactions, resulting in user losses of over $10 million. Please revoke approvals to the related contracts.
Amount of loss: $ 11,600,000Attack method: Contract Vulnerability
Hacked target: MALOU (NEVER)
Description of the event: On BNB Chain, the MALOU (NEVER) token experienced over 99% slippage. The address 0xd7c358b8337d3116f5765060f48C1C71B9908B84 used a backdoor to sell NEVER tokens, obtaining 428 BNB (approximately $240,000), which were then transferred into Tornado.
Amount of loss: $ 240,000Attack method: Rug Pull
Hacked target: Minterest
Description of the event: According to Fuzzland co-founder Chaofan Shou, the cross-chain lending protocol Minterest was attacked. The attacker used a flash loan attack, resulting in a loss of approximately $1.4 million for the protocol.
Amount of loss: $ 1,400,000Attack method: Flash Loan Attack
Hacked target: Ethena
Description of the event: According to on-chain sleuth ZachXBT, the Ethena Discord server has been hacked. Do not click on any links for the time being.
Attack method: Account Compromise
Hacked target: Dough Finance
Description of the event: Dough Finance was attacked due to a contract vulnerability. Some unauthorized funds were extracted by hackers, resulting in a loss of approximately $2.1 million. Around 76 ETH (approximately $260,000) has been returned by white hat hackers.
Amount of loss: $ 2,100,000Attack method: Contract Vulnerability
Hacked target: Unstoppable Domains
Description of the event: Web3 domain provider Unstoppable Domains stated on Twitter that Unstoppabledomains.com was attacked. Until further notice, please do not open any emails from @unstoppabledomains.com or use the website.
Attack method: Unknown
Hacked target: Compound
Description of the event: Compound DAO security advisor Michael Lewellen tweeted that the Compound Finance official website (http://compound.finance) has been compromised and is currently hosting a phishing site. Do not interact with the site until further notice.
Attack method: DNS Attack
Hacked target: Smart Bank Token (SBT)
Description of the event: The Smart Bank Token (SBT) contract on BNBChain was attacked, resulting in a loss of approximately $56,000.
Amount of loss: $ 56,000Attack method: Unknown
Hacked target: OpSec
Description of the event: The OpSec staking contract was maliciously upgraded, allowing the attacker to withdraw and sell OPSEC tokens worth approximately 59 ETH (around $182,000).
Amount of loss: $ 182,000Attack method: Security Vulnerability
Hacked target: Wasabi Wallet
Description of the event: According to a message posted by Wasabi Wallet on Twitter, users have reported that a coordinator named WasabiCoordinator is gradually stealing user funds through a complex attack. Wasabi Wallet advises all users connected to this coordinator to immediately stop CoinJoin operations and announces that a new version will be released soon to prevent such attacks. Subsequently, Wasabi Wallet tweeted that there were three types of attacks in this incident: attacks on free coordinators, supply chain (GitHub) compromise, user-targeted attacks.
Attack method: Security Vulnerability
Hacked target: Linking The World (LW)
Description of the event: According to monitoring by the SlowMist security team, Linking The World (LW) was attacked on BNBChain due to a contract vulnerability, losing approximately $80,000.
Amount of loss: $ 80,000Attack method: Contract Vulnerability
Hacked target: Doja Cat
Description of the event: On July 8, rapper Doja Cat's Twitter account was hacked to promote a memecoin. Doja Cat quickly posted on her Instagram account, stating that her Twitter account had been compromised.
Attack method: Account Compromise
Hacked target: Interlay
Description of the event: Polkadot issued a warning on Twitter, alerting users that the official Twitter account of Interlay, a cross-chain interoperability project, was compromised and used to post a scam message. Users are advised to be cautious and avoid clicking any links.
Attack method: Account Compromise
Hacked target: Authy
Description of the event: 23pds, the CISO at SlowMist, tweeted that the 2FA service Authy has been hacked, resulting in the theft of the phone numbers of 33 million users. If you are an Authy user, please be vigilant against phishing attacks. The official developer, Twilio, has confirmed the vulnerability. Many professionals in the crypto industry use this 2FA software, so please ensure the security of your assets.
Attack method: Information Leakage
Hacked target: MintRisesPrices
Description of the event: MintRisesPrices on BNBChain suffered a reentrancy attack, resulting in a loss of approximately $59,000.
Amount of loss: $ 59,000Attack method: Reentrancy Attack
Hacked target: Bittensor
Description of the event: On July 2, 2024, the decentralized AI project Bittensor was attacked, resulting in some Bittensor wallet users being compromised. The hackers stole approximately 32,000 TAO tokens, valued at around $8 million. On-chain investigator ZachXBT suggested that the attack may have been due to a private key leak. However, Bittensor later clarified that the affected users were actually compromised because a malicious Bittensor package had been uploaded to the Python PyPi package manager.
Amount of loss: $ 8,000,000Attack method: Security Vulnerability