Hacked target: Expanso (EXPSO)
Description of the event: Expanso (EXPSO) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 87,317Attack method: Rug Pull
HACKED ARCHIVE
Hacked Event Broadcast
Verified blockchain security incidents with original evidence and historical event dates.
Live source archive
Hacked target: Jewels (JWL)
Description of the event: CJewels (JWL) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 65,784Attack method: Rug Pull
Hacked target: Kyber Network
Description of the event: Kyber Network tweeted that KyberSwap Elastic has experienced a security incident. According to the analysis of the SlowMist security team, the root cause of this attack is that in calculating the number of tokens needed for the exchange from the current price to the boundary scale price, the liquidity will be added to the portion of the fee compounding because of KyberSwap Elastic's reinvestment curve, thus causing its calculation result to be larger than expected, which can cover the user's need for exchange, but the actual price has already crossed the boundary scale, which makes the protocol think that the liquidity within the current scale has already met the need for exchange, and therefore does not carry out liquidity update. The protocol assumes that the liquidity within the current scale is sufficient to cover the redemption needs, and therefore does not update the liquidity. The result is that the liquidity is increased twice when the reverse exchange crosses the boundary scale, allowing the attacker to obtain more tokens than expected. On Nov. 27, the Kyber Network tweeted that the KyberSwap team had contacted the owner of the frontrun bots that had withdrawn approximately $5.7 million from the KyberSwap pool on Polygon and Avalanche. After negotiations, the owners of the frontrun bots have agreed to return 90% of their users' funds to a designated address. In return, they will receive a 10% bounty. On December 13th, the KyberSwap team recovered approximately $508,000 worth of funds from the owners of frontrun bots. To date, the total amount of funds returned by the owners of frontrun bots is approximately $5.17 million.
Amount of loss: $ 54,700,000Attack method: Liquidity Exploit
Hacked target: InfStones
Description of the event: Lido officials say that over the course of the last 24 hours, Lido DAO contributors were made aware of a platform vulnerability that affected an active Node Operator using the Lido on Ethereum protocol (InfStones) sometime over the course of the previous few months. The vulnerability was disclosed to InfStones in July 2023 by security researchers dWallet Labs. The Node Operator has announced that the vulnerability has been 184 addressed. The vulnerability is related to the possible exposure of root-level access to 25 validator servers that may not be related to the Lido protocol, including possibly key material, to external attackers. It is not clear to contributors at this time if servers and/or keys related to Lido validators were included in the scope of affected systems or not.
Attack method: Third-party Vulnerability
Hacked target: Fake TrustPad (TPAD)
Description of the event: Fake TrustPad (TPAD) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 240,006Attack method: Rug Pull
Hacked target: DarkProtocol (DARK)
Description of the event: DarkProtocol (DARK) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 230,833Attack method: Rug Pull
Hacked target: GigaDAO (GIGS)
Description of the event: Dor (DOR) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 240,270Attack method: Rug Pull
Hacked target: Web (WEB)
Description of the event: Web (WEB) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 217,791Attack method: Rug Pull
Hacked target: Creso (CRE)
Description of the event: Creso (CRE) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 233,693Attack method: Rug Pull
Hacked target: IPMB (IPMB)
Description of the event: IPMB (IPMB) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 232,074Attack method: Rug Pull
Hacked target: DigiFund (DFUND)
Description of the event: DigiFund (DFUND) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 237,894Attack method: Rug Pull
Hacked target: RepubliK (RPK)
Description of the event: RepubliK (RPK) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 235,995Attack method: Rug Pull
Hacked target: PAPABEAR (PAPA)
Description of the event: PAPABEAR (PAPA) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 235,249Attack method: Rug Pull
Hacked target: Changpeng Zhao (CZ)
Description of the event: Changpeng Zhao (CZ) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 302,028Attack method: Rug Pull
Hacked target: AISurf (AISC)
Description of the event: AISurf (AISC) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 237,074Attack method: Rug Pull
Hacked target: HTX & Heco
Description of the event: HTX (formerly Huobi) and its related Heco Bridge were hacked for a combined $113.3 million.
Amount of loss: $ 113,300,000Attack method: Unknown
Hacked target: Dor (DOR)
Description of the event: Dor (DOR) on BSC is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 258,467Attack method: Rug Pull
Hacked target: CredixFinance (CREDIX)
Description of the event: CredixFinance (CREDIX) on ETH is suspected of a rug pull, with the deployer removing substantial liquidity, causing a 100% price decline.
Amount of loss: $ 82,906Attack method: Rug Pull
Hacked target: Loopring
Description of the event: Loopring's Twitter account has been hacked; please do not click on the phishing link.
Attack method: Account Compromise
Hacked target: Kronos Research
Description of the event: Crypto quantization company Kronos Research tweeted that they experienced unauthorized access of some of their API keys.
Amount of loss: $ 26,000,000Attack method: API Key Attack