HACKED ARCHIVE

Hacked Event Broadcast

Verified blockchain security incidents with original evidence and historical event dates.

Live source archive

Search eventsTargetCategorySeverity

Hacked target: MALT2026-10-03

Description of the event: An attacker exploited a logic flaw in MALT’s swap function. With negligible input they triggered an external rebalanceHook that pulled DAI from the protocol’s Capital Source into the same pool. The swap then checked its invariant against the post-hook balances and treated the treasury-funded DAI as caller-supplied funds, allowing a disproportionate MALT withdrawal and a loss of about $ 72,000.

Amount of loss: $ 72000Attack method: Smart Contract Vulnerability

Hacked target: GoldPesa2026-10-02

Description of the event: On Base, an attacker exploited GoldPesa’s GPXHooks. The hook rebalanced through a shared, flash-accounted PositionManager without checking that the GPX/USDC currency deltas were zero. The attacker opened an unlock, minted an unsettled WETH/USDC position (about 115,000 USDC of phantom debt), then swapped on the GPX pool to trigger the hourly reBalance. The hook’s burn credit was netted against that debt, and the attacker burned its own position and withdrew about 114,900 USDC from the PoolManager.

Amount of loss: $ 114900Attack method: Smart Contract Vulnerability

Hacked target: NEAR Intents2026-10-01

Description of the event: NEAR Intents suffered a security incident caused by a bug in the Omni deposit and withdrawal infrastructure’s interaction with its smart contract, with a preliminary loss of approximately $3.8 million. The contract-side vulnerability has been patched, full compensation has been pledged, and the team has reported the incident to law enforcement while working to trace and recover the funds.

Amount of loss: $ 3,800,000Attack method: Smart Contract Vulnerability

Hacked target: FlashLoopAdapter（Aave V3 Loop Safe Module）2026-10-01

Description of the event: The attacker exploited an access-control vulnerability in FlashLoopAdapter by spoofing Safe authentication and bypassing the module authorization check. By controlling the swapRouter and swapCalldata, the attacker targeted the victim Safes with execTransactionFromModule() and executed unauthorized transactions. The attacker also used a Morpho WETH flash loan to repay the affected Safe’s Aave V3 debt and unlock its collateral, ultimately draining weETH from two Safes and retaining approximately 114.09 ETH, worth about $305,000.

Amount of loss: $ 305,000Attack method: Smart Contract Vulnerability

Hacked target: MCN Labs2026-09-30

Description of the event: The MCN Labs–related LPBonus contract used inconsistent MSN reserve values in reward accounting. Accrual updated the reward index with the reserve at that moment, while withdrawal applied a user weight based on the reserve at claim time. The attacker first lowered the reserve to ~89.33 MSN during accrual, then raised it to ~491.11 MSN before calling UserRemoveLp, allowing a newly registered LP to claim ~1,442,165.71 FIST against only ~940,041.61 FIST of intervening reward funding—about $92,600 in losses.

Amount of loss: $ 92,600Attack method: Smart Contract Vulnerability

Hacked target: MUSystem2026-09-30

Description of the event: MUSystem’s deposit() counted the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation, while withdraw() allowed same-transaction redemption without capping returned ETH to the amount deposited. Sixteen fresh addresses repeated this cycle and drained ETH from the contract, causing about $36,900 in losses.

Amount of loss: $ 36,900Attack method: Smart Contract Vulnerability

Hacked target: Fake GIWA Chain2026-09-27

Description of the event: On September 27, 2026, multi-chain DEX DYORSWAP listed a network presented as GIWA Mainnet with chain ID 9134. That network was a scammer-built fake chain with a fraudulent bridge. Users deposited real Ethereum-mainnet ETH into the fake bridge, and the operators later drained about 766.25 ETH (about $2,000,000). Official GIWA, an Upbit-linked L2, said its mainnet was not live. DYORSWAP said its own contracts were not exploited, began treasury compensation, and has already paid more than 200 ETH, with tracing still ongoing.

Amount of loss: $ 2,000,000Attack method: Fake Chain / Bridge Scam

Hacked target: Fake GIWA Bridge2026-09-26

Description of the event: Scammers deployed a fake GIWA L2 network using the legitimate Chain ID 9134, complete with a functional bridge and batcher. Approximately 1,335 addresses bridged ~767.65 ETH believing it was the official mainnet launch. The attackers drained ~766.25 ETH (~$2M). The real GIWA mainnet had not launched. DYORSWAP initially listed the fake network due to the matching Chain ID and later compensated affected users from its treasury.

Amount of loss: $ 2,000,000Attack method: Fake Chain / Fake Bridge Scam

Hacked target: Duelbits2026-09-24

Description of the event: Crypto casino and sportsbook Duelbits had its hot wallets drained across Ethereum, BNB Chain, Tron, Solana and Bitcoin in under an hour. The team confirmed a loss of about $7,000,000 and took the site offline. Security firms assessed the incident as a hot-wallet private-key compromise, not a smart-contract exploit. The attacker then bridged and swapped most of the stolen assets into ETH and consolidated them in one address. Duelbits said user balances were unaffected, relaunched on September 27 with about $8,000,000 across hot and cold wallets for payouts, and no public recovery or freeze of the stolen funds has been reported.

Amount of loss: $ 7,000,000Attack method: Private Key Leakage

Hacked target: Meter Passport2026-09-24

Description of the event: Blockaid reported an ongoing exploit of Meter.io’s Meter Passport bridge on BNB Chain. An attacker minted a large amount of unbacked wrapped MTRG through the bridge and sold part of it on PancakeSwap. About $2,300,000 of unbacked wMTRG had been minted in roughly two transactions when the alert went out, and the attack was still ongoing.

Amount of loss: $ 2,300,000Attack method: Smart Contract Vulnerability

Hacked target: Bitget2026-09-24

Description of the event: At 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure. Attackers compromised a critical backend system in the wallet stack, spoofed transaction data, and triggered Bitget’s own authorization process to move funds out. The firm ruled out private-key theft and fake user withdrawal requests. The loss was first put at about $351,600,000 and later revised to about $387,500,000 after Zcash and TRON assets were included. Cold wallets and Bitget Wallet were unaffected. Withdrawals were paused, the User Protection Fund is said to cover the loss, and some attacker addresses have been frozen.

Amount of loss: $ 387,500,000Attack method: Internal System Compromise

Hacked target: Payy Network2026-09-24

Description of the event: Payy’s Ethereum bridge contract was exploited and fully drained, with about 1,832,149 USDC leaving the contract. Payy said the stolen funds were users’ non-custodial deposits to Payy Network / Payy Wallet, paused all transactions, and said it is working on fund retrieval and a root-cause analysis.

Amount of loss: $ 1,832,149Attack method: Smart Contract Vulnerability

Hacked target: Limit Break2026-09-24

Description of the event: An attacker exploited a bug in Limit Break’s Payment Processor V2, abusing stale Magic Eden EVM marketplace approvals to steal blue-chip NFTs via zero-price “sales” and to drain WETH in reverse. V2 could not be paused, so Yuga Labs VP of Blockchain @0xQuit led a whitehat rescue that moved 23,155 NFTs worth over $5.7M to safety; about 660 WETH could not be recovered in time. Magic Eden and Limit Break later urged users to revoke V2/V3 approvals immediately.

Amount of loss: $ 2,800,000Attack method: Smart Contract Vulnerability

Hacked target: The personal X account of Nano Labs founder Jack Kong2026-09-23

Description of the event: The personal X account of Nano Labs founder Jack Kong was compromised. Attackers used it to promote a fake AI trading token called Binance World Assets ($BWA), claiming it would use trading fees on BNB Chain to trade bStocks and share profits with holders. Nano Labs’ official account later stated that the posts were unauthorized, that the company had not issued or endorsed any such token, and warned users not to click links or send funds to any contracts.

Attack method: The X account was hacked

Hacked target: Drop2026-09-22

Description of the event: The Drop project suffered an attack via a malicious governance proposal, through which the attacker transferred treasury funds, resulting in a loss of approximately $4.4 million.

Amount of loss: $ 4,400,000Attack method: Governance Attack

Hacked target: Astroport2026-09-22

Description of the event: Astroport (a Cosmos ecosystem DEX) announced a security incident on the Neutron chain that may have resulted in the theft of admin privileges for its contracts. Neutron has halted chain operations for investigation, and the project advised users to immediately withdraw liquidity from all Astroport pools across chains. Terra-side contracts were unaffected.

Amount of loss: $ 4,900,000Attack method: Compromised administrator privileges

Hacked target: Internet Token2026-09-21

Description of the event: Internet Token DAO’s LiquidityUnifier on Base was exploited after it trusted a caller-supplied Uniswap V3 pool address. A fake pool callback minted about 925 million INT out of thin air. The attacker drained 5.847 WETH (about $16,033.55) from the official INT/WETH pool and kept about 764 million INT. The mint role was not revoked in time, copycat exploits inflated supply to about 156 billion, and the attacker submitted a governance proposal aiming to move treasury funds.

Amount of loss: $ 265,000Attack method: Smart Contract Vulnerability

Hacked target: RWC Token2026-09-21

Description of the event: The RWC token on BNB Smart Chain was exploited with a flash loan. An unprotected burn function let the attacker destroy RWC sitting in the PancakeSwap RWC/USDT pair and call sync() to rewrite reserves, inflating the price before selling back. The pool lost about 109,460.85 USDT in one transaction. The attacker kept about 39,964.07 USDT; the remaining about 69,496.78 USDT was routed to the project’s company and platform wallets by the token’s fee logic.

Amount of loss: $ 109,460.85Attack method: Smart Contract Vulnerability

Hacked target: GaslessReservoirEnabler2026-09-21

Description of the event: The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner. An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.

Amount of loss: $ 23,000Attack method: Smart Contract Vulnerability

Hacked target: DoinGud2026-09-21

Description of the event: The dormant NFT platform DoinGud was exploited on Polygon via a bug in its Diamond bidding contract: acceptBid paid out but never cleared the bid record, so the same bid could be reused. An attacker flash-loaned USDC equal to the contract balance, bid on themselves, accepted the bid twice, and drained about $35,486 USDC.e on September 21, 2026.

Amount of loss: $ 35,486Attack method: Smart Contract Vulnerability