Verified blockchain security incidents with original evidence and historical event dates.
Description of the event: According to a report by Cointelegraph, the homepage of toy manufacturer LEGO Group was hacked on October 5th local time, briefly displaying a "LEGO Coin" token scam. The fraudulent token was present on the LEGO Group's website for approximately 75 minutes before being removed.
Description of the event: The Fire ($FIRE) token on Ethereum was exploited just 24 seconds after its launch, resulting in the theft of 9 ETH (approximately $24,000). The root cause was related to the token burn mechanism within the transfer() function.
Description of the event: The multi-chain liquidity re-staking protocol Bedrock announced on social media that the team is aware of a security vulnerability involving uniBTC, with the total estimated loss from the theft around $2 million. According to the SlowMist security team’s analysis, the attack was caused by Bedrock mistakenly supporting the minting of uniBTC at a 1:1 exchange rate with the native token.
Description of the event: According to on-chain sleuth ZachXBT, the project Truflation was hacked a few hours ago for $5M+ on multiple chains from the treasury multisig and personal wallets.
Description of the event: Onyx protocol suffered a security breach, resulting in a loss of over $3.8 million. The attacker exploited a known precision issue in the Compound V2 code. Additionally, the NFTLiquidation contract failed to properly validate untrusted user input, allowing the attacker to inflate the self-liquidation reward amount, which further worsened the losses.
Description of the event: ReHold CTO Michael Semin disclosed on the X platform that on July 15, 2024, ReHold's CEO and co-founder, Renat Gafarov, withdrew over $700,000 from the company's smart contract without his approval. ReHold has since moved to a new domain.
Description of the event: On September 24, ether.fi experienced a security incident involving its domain registrar, Gandi.net, resulting in the compromise of the ether[.]fi domain.
Description of the event: On September 22, Bankroll Network on BNB was attacked due to a contract vulnerability, resulting in a loss of approximately $230,000.
Description of the event: A crypto yield platform called Shezmu suffered a loss of around $4.9 million in $ShezUSD after an attacker exploited a flaw that allowed anyone to mint collateral, which they could then use to borrow ShezUSD. These tokens were relatively illiquid, however, so the total amount the attacker could have obtained was likely considerably less. Shortly after the attack, Shezmu offered a 10% "bounty" for the return of the funds. The attacker responded that they would only consider a 20% bounty. Shezmu agreed to the terms, and announced to their followers that they had achieved a recovery from the "white hat" hacker.
Description of the event: The Immutable Discord server was compromised. According to an official tweet from Immutable, a community support contractor’s Discord was compromised, leading to a phishing link being posted.
Description of the event: According to the announcement from BingX, at around 4 AM Singapore time on September 20, BingX's security systems detected an unauthorized intrusion targeting one of their hot wallets.
Description of the event: Compound community’s Discord server has been hacked. Please do not click on any links until the situation is resolved.
Description of the event: According to on-chain investigator ZachXBT on the X platform, the decentralized AI data network Masa suffered a hack on September 20, incurring losses exceeding six figures in USD. However, Masa did not disclose this hack to the community.
Description of the event: The official X account of the metaverse project Decentraland has been hacked. The hacker has posted a fake phishing link. Please avoid interacting with it.
Description of the event: Ethena Labs posted on X platform that their Ethena domain registrar account was recently compromised. They have taken measures to disable the website until further notice. The protocol is not affected, and funds are secure. Please do not interact with any sites or applications claiming to be the Ethena frontend.
Description of the event: Banana Gun stated on X platform that some users experienced unauthorized wallet transfers. The issue may have stemmed from a front-end vulnerability. Prioritizing security, the team kept the bot offline during the investigation of the root cause. On September 25, Banana Gun announced on X platform that a total of 11 users were affected, with losses amounting to $3 million. All affected users will be fully compensated from the Banana Gun treasury, without selling any tokens for reimbursement. Following a thorough investigation by the Banana Gun development team and external experts, it was discovered that a potential vulnerability in the Telegram message oracle used by Banana Gun might have led to the attack.
Description of the event: The official X account of AI Modular Data Preprocessing Layer DIN was hacked, and a large number of phishing posts and links were sent.
Description of the event: DeFi project DeltaPrime has officially confirmed on platform X that a security incident occurred. DeltaPrime Blue (Arbitrum) was attacked and drained for $5.98M. This was due to a compromised private key.
Description of the event: Peer-to-peer trading platform OTSea's staking contract on Ethereum was exploited by an EOA, resulting in the theft of approximately $26,000.
Description of the event: The yield-optimizing DeFi protocol BaseBros Fi has vanished after executing a rug pull via an unaudited smart contract.