Verified blockchain security incidents with original evidence and historical event dates.
Live source archive
Oct 20, 20262314 verified updatesTimes shown in UTC
Hacked target: Ledger Connect Kit
Description of the event: the Ledger Connect Kit suffered a supply chain attack, with attackers stealing at least $600,000. The SlowMist security team immediately initiated an analysis of the relevant code and discovered that the attackers implanted malicious JavaScript code in versions @ledgerhq/connect-kit=1.1.5/1.1.6/1.1.7. They directly replaced the normal window logic with a Drainer class, triggering not only a fake DrainerPopup popup but also handling the transfer logic for various assets. Attackers launched phishing attacks against cryptocurrency users through CDN.
Amount of loss: $ 600,000Attack method: Malicious Code Injection Attack
Hacked target: OKX
Description of the event: According to information from SlowMist Zone, the OKX DEX contract appears to have encountered an issue. After SlowMist's analysis, it was found that when users exchange, they authorize the TokenApprove contract, and the DEX contract transfers the user's tokens by calling the TokenApprove contract. The DEX contract has a claimTokens function that allows a trusted DEX Proxy to make calls, with its functionality being to invoke the claimTokens function of the TokenApprove contract to transfer tokens authorized by the user. The trusted DEX Proxy is managed by the Proxy Admin, and the Proxy Admin Owner can upgrade the DEX Proxy contract through the Proxy Admin. On December 12, 2023, at 22:23:47, the Proxy Admin Owner upgraded the DEX Proxy contract to a new implementation contract through the Proxy Admin. The new implementation contract's functionality is to directly call the claimTokens function of the DEX contract to transfer tokens. Subsequently, attackers began calling the DEX Proxy to steal tokens. The Proxy Admin Owner upgraded the contract again at 23:53:59 on December 12, 2023, with similar functionality, and continued stealing tokens after the upgrade. This attack may be a result of the Proxy Admin Owner's private key being leaked. Currently, the DEX Proxy has been removed from the trusted list.
Amount of loss: $ 2,700,000Attack method: Private Key Leakage
Hacked target: Peapods Finance
Description of the event: On December 13th, Peapods Finance was hacked by white hat hackers due to a reentrancy vulnerability. On December 14th, Peapods Finance tweeted that the hackers returned 90% of the funds. On December 15th, the hacker, @0xaxxe, tweeted that he returned the white hat fee to the team.
Amount of loss: $ 230,000Attack method: Reentrancy Attack
Hacked target: Levana
Description of the event: The perpetual contract on Osmosis, Levana, has been subjected to an attack resulting in a loss exceeding $1.14 million. A post-incident report provided by its team indicates that between December 13th and December 26th, attackers successfully drained 10% of Levana's liquidity pool. Levana states that efforts are underway to rectify the issue, assuring that existing trading positions and profits remain unaffected. Future plans involve compensating affected liquidity providers through airdrops and the distribution of protocol fees collected during the attack period.
Amount of loss: $ 1,140,000Attack method: Oracle Attack
Hacked target: Venus Protocol
Description of the event: According to on-chain data, a user deposited 0.5 BNB into Venus and borrowed a series of assets, including stkBNB, ankrBNB, etc. The user then exchanged them for 116.45 ETH assets and transferred them to another account. In response to the attack on Venus, official personnel from the Venus Protocol addressed the issue on Telegram, stating, "The core pool and XVS are not affected. The attack occurred due to a price malfunction in Binance's oracle, involving the BNB price in a small independent pool. The snBNB team is currently addressing this issue. The cause has been identified, and it has been reported to the Binance oracle team."
Amount of loss: $ 270,000Attack method: Oracle Attack
Hacked target: stoic_DAO
Description of the event: There is a price slippage on project stoic_DAO. 10% of the total Zeta token supply was swapped for ~91 ETH.
Amount of loss: $ 198,033Attack method: Rug Pull
Hacked target: Xai
Description of the event: Xai, a Layer 3 solution for AAA gaming, has issued an alert for phishing impersonating Xai, where attackers have fraudulently obtained approximately $374 ETH, valued at approximately $845.8K.
Amount of loss: $ 845,800Attack method: Phishing Attack
Hacked target: Abattoir of Zir (DIABLO)
Description of the event: Abattoir of Zir (DIABLO) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 235,705Attack method: Rug Pull
Hacked target: Time
Description of the event: On December 7, 2023, Time on the ETH were attacked due to a security vulnerability in the thirdweb pre-built smart contracts, which resulted in approximately $190,000 in profits for the attacker.
Amount of loss: $ 190,000Attack method: Contract Vulnerability
Hacked target: Strong Finance (STRONG)
Description of the event: Strong Finance (STRONG) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 60,919Attack method: Rug Pull
Hacked target: CKD Token (CKD)
Description of the event: CKD Token (CKD) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 539,000Attack method: Rug Pull
Hacked target: thirdweb
Description of the event: On December 5, 2023, thirdweb, the Web3 base development platform, indicated that a security vulnerability was discovered in pre-built smart contracts. The impacted pre-built contracts include but are not limited to DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20. Please see a full list of impacted smart contracts and mitigation steps at this link (https://blog.thirdweb.com/security-vulnerability/).
Attack method: Contract Vulnerability
Hacked target: Stargate Snapshot
Description of the event: A Discord Mod on LayerZero has reported that a scammer who introduced a phishing link within a proposal vote on the Stargate Snapshot platform, enticing users to stake $STG tokens. Over 1K users took part in the vote, resulting in a loss of ~$43K
Amount of loss: $ 43,000Attack method: Phishing Attack
Hacked target: MYX Finance (QMYX)
Description of the event: MYX Finance (QMYX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 128,727Attack method: Rug Pull
Hacked target: FCN-TRUST (FCN)
Description of the event: The FCN-TRUST (FCN) token On BSC was exploited for over $504k in a flash loan attack. The attack caused the token price to crash by 99%.
Amount of loss: $ 504,000Attack method: Flash Loan Attack
Hacked target: Velodrome
Description of the event: Optimism decentralized trading protocol Velodrome tweeted that the frontend is currently compromised, please do not interact with Velodrome for the time being, the team is investigating. On December 1, Velodrome posted an update stating, "We are happy to announce that earlier today we were able to regain control of our domain following a social engineering attack on our provider. We are still working to restore our primary domain and will share an update soon. More details on the attack + response will follow." On December 2, Velodrome tweeted that their provider was exploited again and please do not interact with our front end. On the same day, Velodrome stated that "the domain has been restored again and is locked at the TLD level pending transfer to a new provider. You can now resume using https://velodrome.finance. Our decentralized frontend can be accessed at http://velo.drome.eth.limo and has remained uncompromised."
Amount of loss: $ 250,000Attack method: DNS Hijacking Attack
Hacked target: Aerodrome
Description of the event: Aerodrome tweeted that the frontend is currently compromised, please do not interact with Aerodrome for the time being, the team is investigating.
Attack method: DNS Hijacking Attack
Hacked target: HOUNAX
Description of the event: Virtual Asset Platform HOUNAX Investigated for Fraud. On November 1, HOUNAX was placed by the Hong Kong Securities and Futures Commission (SFC) on a warning list of "Suspicious Virtual Asset Trading Platforms," which is designed to alert investors to risks. On November 29, Hong Kong police reported that 158 Hong Kong investors had been lured by the unlicensed platform HOUNAX and lost approximately HK$155 million ($19.83 million).
Amount of loss: $ 19,830,000Attack method: Scam
Hacked target: Symbiogenesis (SYSIS)
Description of the event: Symbiogenesis (SYSIS) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 54,086Attack method: Rug Pull
Hacked target: AssetClub (ACC)
Description of the event: AssetClub (ACC) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.