Bybit Cold Wallet Compromise, February 2025: What Happened & What to Check
Around $1.5 billion in ETH was moved out of a Bybit cold wallet on 21 February 2025 during a routine transfer. The…
Ethereum
WazirX Multisig Compromise, July 2024: What Happened & What to Check
Approximately $234.9m was taken from a WazirX multi-signature wallet held under a third-party custody arrangement.
Orbit Chain Bridge Compromise, December 2023: What Happened & What to Check
Roughly $81.5m left Orbit Bridge on New Year's Eve 2023 in transactions that carried valid signatures.
Ledger Connect Kit Supply Chain Attack, December 2023: What Happened & What to Check
A compromised npm package injected a wallet drainer into every dapp loading Ledger Connect Kit from the CDN — regardless of whether…
Mixin Network Database Compromise, September 2023: What Happened & What to Check
Mixin reported roughly $200m lost after the database of its cloud service provider was attacked, and suspended deposits and withdrawals.
Curve Finance Vyper Compiler Reentrancy, July 2023: What Happened & What to Check
A bug in specific Vyper versions silently broke reentrancy locks, exposing several Curve pools whose own code was correct.
Multichain Unauthorised Outflows, July 2023: What Happened & What to Check
Assets left Multichain bridge contracts with no exploit visible on-chain, amid the reported detention of the project's chief executive.
Atomic Wallet User Fund Theft, June 2023: What Happened & What to Check
Funds were drained from Atomic Wallet users across multiple chains. The root cause has never been conclusively published.
Euler Finance Donation Attack, March 2023: What Happened & What to Check
A missing health check on a donation function let an attacker force their own liquidation at a profit, taking about $197m. Nearly…
Wintermute Vanity Address Compromise, September 2022: What Happened & What to Check
A weakness in the Profanity vanity-address generator made the private key for Wintermute's DeFi operations recoverable. About $160m was taken.