Access control
Nomad Bridge Replay Exploit, August 2022: What Happened & What to Check
A routine upgrade left Nomad accepting any message as proven. Hundreds of addresses copied the same transaction and drained the bridge in…
Ethereum
Bridge exploit
Harmony Horizon Bridge Key Compromise, June 2022: What Happened & What to Check
Compromise of two of five multi-signature keys was enough to authorise withdrawals from Harmony's Horizon bridge, taking roughly $100m.
Flash loan
Beanstalk Governance Flash Loan Attack, April 2022: What Happened & What to Check
An attacker borrowed enough voting power in a single transaction to pass their own malicious proposal and drain roughly $182m.
Bridge exploit
Ronin Bridge Validator Key Compromise, March 2022: What Happened & What to Check
Attackers obtained enough Ronin validator signatures to forge withdrawals, draining 173,600 ETH and 25.5m USDC. The theft went unnoticed for six days.
Bridge exploit
Wormhole Signature Verification Exploit, February 2022: What Happened & What to Check
A flaw in Wormhole's Solana signature verification let an attacker mint 120,000 wETH without depositing collateral. Jump Crypto replaced the shortfall.
Front-end compromise
BadgerDAO Front-End Injection, December 2021: What Happened & What to Check
A compromised Cloudflare API key let attackers inject approval-harvesting script into the BadgerDAO front end. The contracts were never touched.
Flash loan
Cream Finance Oracle Manipulation, October 2021: What Happened & What to Check
Manipulation of the price feed used to value collateral let an attacker borrow far beyond its worth, taking roughly $130m.
Access control
Poly Network Cross-Chain Exploit, August 2021: What Happened & What to Check
An attacker exploited Poly Network's cross-chain contract to reassign the keeper role, taking roughly $611m — then returned substantially all of it.
Key compromise
KuCoin Hot Wallet Compromise, September 2020: What Happened & What to Check
Roughly $281m left KuCoin hot wallets. A large share was recovered through token contract upgrades and freezes by issuers.
Reentrancy
The DAO Recursive Call Exploit, June 2016: What Happened & What to Check
A reentrancy flaw in The DAO's split function drained roughly 3.6 million ETH and led to the contentious hard fork that produced…