#smart-contract-exploit
LightNews LightNews
web3isgoinggreat.com
Raydium users lose $1.34 million after legacy smart contract exploited

June 10, 2026
https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit
Raydium users lose $1.34 million after legacy smart contract exploited An attacker exploited a legacy smart contract that had been used by the Raydium Solana DEX before it was deprecated in 2021. Though the contract was unused, there were still funds in the liquidity pools affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets. Raydium has said it will compensate users who lost funds in the exploit.
June 15, 2026 at 9:22 PM
arstechnica.com
How North Korea pulled off a $1.5 billion crypto heist—the biggest in history
Attack on Bybit didn’t hack infrastructure or exploit smart contract code. So how did it work?
arstechnica.com
February 24, 2025 at 11:43 PM
web3isgoinggreat.com
Yearn Finance suffers fourth exploit only weeks after third

December 16, 2025
https://www.web3isgoinggreat.com/?id=yearn-finance-exploit-4
Yearn Finance suffers fourth exploit only weeks after third Only weeks after losing $6.6 million to an infinite mint exploit, a Yearn Finance smart contract has again been exploited, allowing an attacker to make off with around 103 ETH (~$300,000). The affected contract is a legacy contract that was part of the Yearn v1 project (once known as iearn). The attacker used a flash loan to manipulate the price of tokens in the vault, allowing them to withdraw the iearn assets, which they then swapped for ETH. This is Yearn's fourth hack, following the $6.6 million theft in November, an $11 million exploit in 2023, and an $11 million exploit in 2021. Yearn also lost around $1.4 million in 2023 in connection to the Euler Finance attack.
December 17, 2025 at 2:12 AM
web3isgoinggreat.com
"Peripheral" Aave smart contract hacked for $56,000

August 28, 2024
https://www.web3isgoinggreat.com/?id=peripheral-aave-smart-contract-hack
"Peripheral" Aave smart contract hacked for $56,000 The popular defi lending platform, Aave, suffered a smart contract exploit that allowed an attacker to steal around $56,000. A smart contract outside of the core Aave protocol, which is used to allow people to use existing collateral to repay their loans, had gradually accrued a balance of tokens leftover from slippage. These small leftover token amounts are sometimes called "dust". Altogether, these tokens amounted to around $70,000 across several blockchain networks. An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000. Various people associated with Aave emphasized that there was no risk to user funds or flaw in the core Aave protocol, and one described the hack as "raiding the tip jar".
August 28, 2024 at 5:38 PM
web3isgoinggreat.com
Shido exploited for at least $3.3 million

February 28, 2024
https://www.web3isgoinggreat.com/?id=shido-contract-exploit
Shido exploited for at least $3.3 million The Shido blockchain suffered an exploit of their staking smart contract, in which an attacker was able to transfer ownership of the contract to another address and then upgrade the contract with a function that allowed them to withdraw staked tokens. Altogether, the attacker withdrew all 4.3 billion staked $SHIDO tokens — over half the entire circulating supply. Although the stolen tokens were nominally priced at $35 million, the massive theft caused the price to plummet 94%. The attacker has converted the stolen tokens to around 956 ETH ($3.3 million). The Shido team announced that they would be trying to offer a "bounty" to the hacker.
March 3, 2024 at 4:41 PM
valkyrie.hacker.gf
You could break so many brains by using Claude Code to find and exploit smart contract bugs
March 31, 2026 at 3:08 AM
web3isgoinggreat.com
Ribbon Finance suffers $2.7 million exploit, plans to use "dormant" users' funds to repay active users

December 12, 2025
https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit
Ribbon Finance suffers $2.7 million exploit, plans to use "dormant" users' funds to repay active users Ribbon Finance, which has partially rebranded to Aevo, has lost $2.7 million after attackers exploited a vulnerability in the smart contract for legacy Ribbon vaults that enabled them to manipulate oracle prices and withdraw a large amount of ETH and USDC. Ribbon has announced it will cover $400,000 of the lost funds with its own assets. However, Ribbon is also offering users a lower-than-expected haircut on their assets by assuming that some of the largest affected accounts will not withdraw their assets, having been dormant for several years. While this plan may benefit active users, it seems like it could get very messy if those dormant users do wish to withdraw their assets and discover they've been used to pay others.
December 15, 2025 at 7:32 PM
web3isgoinggreat.com
Resupply stablecoin lender exploited for $9.3 million

June 26, 2025
https://www.web3isgoinggreat.com/?id=resupply-exploit
Resupply stablecoin lender exploited for $9.3 million An attacker was able to exploit a vulnerability in a smart contract used by the Resupply stablecoin lender to extract about $9.3 million from the project. After depositing around $200,000, they were able to inflate the price of another token and borrow almost $10 million. Resupply announced the theft shortly afterwards, and stated that they had paused the vulnerable contract. Resupply is a fairly new project, having officially launched on March 20 — about three months before the exploit.
June 27, 2025 at 6:48 PM
arstechnica.com
The lessons learned here bring cryptocurrency security back to some of its most basic elements.
How North Korea pulled off a $1.5 billion crypto heist—the biggest in history
Attack on Bybit didn’t hack infrastructure or exploit smart contract code. So how did it work?
arstechnica.com
February 25, 2025 at 4:51 PM
web3isgoinggreat.com
Balancer exploited for at least $110 million

November 3, 2025
https://www.web3isgoinggreat.com/?id=balancer-exploit-2
Balancer exploited for at least $110 million The defi protocol Balancer suffered a major exploit that drained over $110 million across several blockchains, including Ethereum, Polygon, Base, and Sonic. Attackers exploited faulty access control in the manageUserBalance function of Balancer's v2 smart contract, enabling unauthorized internal withdrawals. The stolen tokens included 6,850 osETH, 6,590 wETH, and 4,260 wstETH, later consolidated into new wallets likely for laundering. The exploit also impacted forked protocols like Beets Finance, which lost around $3 million. Balancer's BAL token dropped over 10% following the theft. This was Balancer's third major security incident since 2020, despite prior audits by OpenZeppelin and Trail of Bits.
November 3, 2025 at 3:29 PM
web3isgoinggreat.com
Exploit on Rain crypto payments infrastructure provider causes losses for "self-custodial" neobanks

August 28, 2026
https://www.web3isgoinggreat.com/?id=avici-exploit
Exploit on Rain crypto payments infrastructure provider causes losses for "self-custodial" neobanks A vulnerability in a smart contract belonging to Rain, a crypto payments infrastructure provider, resulted in $1.1 million in losses to various firms. Customers of the Avici cryptocurrency neobank, which offers a Visa credit card through which customers can spend crypto, suffered roughly $500,000 in losses. Customers of another neobank, Tria, lost more than $430,000. The losses are somewhat unusual because the neobanks describe themselves as self-custodial, which normally means that customers have total control over their crypto assets rather than storing them on a third-party platform. Normally, self-custody is more resilient to exploits like this, given that assets remain in user wallets. However, because these neobanks require customers to load funds they want to be able to spend into a third-party contract, they were vulnerable to the theft.
August 30, 2026 at 2:49 PM
web3isgoinggreat.com
The Idols NFT loses $324,000 to exploit

January 14, 2025
https://www.web3isgoinggreat.com/?id=idols-nft-exploit
The Idols NFT loses $324,000 to exploit An attacker noticed a vulnerability in a smart contract for The Idols, an NFT project that also incorporates ETH staking functionality. They discovered that a function used to distribute rewards had a bug when the sender and recipient addresses were the same, allowing a holder to repeatedly claim rewards. By taking advantage of this bug, they were able to siphon 97 stETH (~$324,000) from the project. Although The Idols boasts of two audits from several years ago, the contract containing the vulnerability may not have been audited.
January 16, 2025 at 8:16 PM
web3isgoinggreat.com
Ekubo exploited for $1.4 million

May 5, 2026
https://www.web3isgoinggreat.com/?id=ekubo-exploit
Ekubo exploited for $1.4 million The Ekubo automated market maker infrastructure project experienced a $1.4 million theft after attackers were able to take advantage of a smart contract that improperly verified permissions. They stole 17 wBTC ($1.4 million), which they swapped for ETH and laundered via Tornado Cash.
May 6, 2026 at 1:36 PM
shieldforge.xyz
🔑 The Silent Threat: How Dormant Token Approvals Fuel a Smart Contract Exploit

https://shieldforge.xyz/blog/dormant-token-approvals-smart-contract-exploit

#web3 #cryptosecurity #contractsecurity #erc20
The Silent Threat: How Dormant Token Approvals Fuel a Smart Contract Exploit
Dormant token approvals pose a silent threat, turning legitimate but compromised DeFi protocols into vectors for a smart contract exploit. Learn how forgotten permissions can be weaponized against your wallet.
shieldforge.xyz
September 26, 2026 at 11:00 AM
web3isgoinggreat.com
CrossCurve users exploited for around $3 million

February 1, 2026
https://www.web3isgoinggreat.com/?id=crosscurve-users-exploited-for-around-3-million
CrossCurve users exploited for around $3 million Hackers exploited a bug in smart contracts deployed by the defi protocol CrossCurve to steal an estimated $3 million across multiple blockchains. The thief was able to spoof cross-chain messages, causing the CrossCurve bridge to release assets not belonging to them. CrossCurve took a conciliatory tone in on-chain messages sent to the thief, writing, "These tokens were wrongfully taken from users due to a smart contract exploit. We do not believe this was intentional on your part, and there is no indication of malicious intent." (Who among us hasn't accidentally stolen millions of dollars?) However, they warned, they planned to escalate to working with law enforcement and blockchain security firms to investigate and prosecute the theft if the funds were not returned within 72 hours.
February 7, 2026 at 10:39 PM
blockchainreport.bsky.social
Limit Break protocol targeted by ongoing exploit! ~$1.7M in NFTs drained by attackers impersonating users via a vulnerability in the Payment Processor V2 smart contract. If you've granted NFT Operator permissions to this contract, revoke them IMMEDIATELY. #blockchain #security #defi
September 25, 2026 at 8:33 AM
web3isgoinggreat.com
Unleash Protocol exploited for $3.9 million

December 30, 2025
https://www.web3isgoinggreat.com/?id=unleash-protocol-exploit
Unleash Protocol exploited for $3.9 million Unleash Protocol, a project promising to allow creators to register their intellectual property on the blockchain, has been exploited for around $3.9 million. An attacker was able to gain administrative access, despite the project's governance system ostensibly being protected by a multisignature wallet. They then deployed a new smart contract, which allowed them to siphon assets from the project. The attacker then bridged the funds to ETH and laundered them via the Tornado Cash cryptocurrency mixer.
December 31, 2025 at 1:01 AM
web3isgoinggreat.com
Secret bridge exploited for $4.67 million a week before anyone notices

June 10, 2026
https://www.web3isgoinggreat.com/?id=secret-bridge-exploit
Secret bridge exploited for $4.67 million a week before anyone notices The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite mint bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of wrapped Axelar tokens on the Secret network, which they then redeeemed for around $4.67 million. The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in. Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."
June 22, 2026 at 3:01 PM
web3isgoinggreat.com
Truebit exploited for over $26 million

January 8, 2026
https://www.web3isgoinggreat.com/?id=truebit-exploit
Truebit exploited for over $26 million A bug in a smart contract belonging to the Ethereum-based Truebit project allowed an attacker to steal 8,535 ETH (~$26.4 million). The thief targeted one of the project's older contracts — deployed in 2021 — which contained a bug in which the price calculation to mint sufficiently large quantities of the protocol's TRU token would overflow, erroneously allowing people to mint large amounts of TRU for next to nothing. The exploiter took advantage of this by minting TRU and swapping it for ETH, ultimately causing the TRU token price to crash 99.9%. Another subsequent attack saw around $300,000 more drained from the project. Truebit acknowledged the hack and urged users not to interact with the vulnerable smart contract.
January 13, 2026 at 2:41 AM
web3isgoinggreat.com
Saga halts blockchain after $7 million theft

January 21, 2026
https://www.web3isgoinggreat.com/?id=saga-exploit
Saga halts blockchain after $7 million theft The Saga project halted its blockchain after acknowledging that $7 million had been stolen. An attacker was evidently able to mint a large quantity of Saga Dollar tokens, though it's not yet clear whether it was because of a smart contract vulnerability, private key compromise, or some other issue. The attacker was quick to swap most of the assets to ETH to thwart asset freezes or blockchain halts. The Saga Dollar token lost its peg and fell to around $0.75 after the attack.
January 21, 2026 at 10:53 PM
shieldforge.xyz
🔑 How Dormant Token Approvals Amplify Smart Contract Exploit Risk After Governance Attacks

https://shieldforge.xyz/blog/governance-exploit-dormant-token-approvals

#web3 #cryptosecurity #contractsecurity #smartcontracts
How Dormant Token Approvals Amplify Smart Contract Exploit Risk After Governance Attacks
A smart contract exploit often begins with a governance compromise, turning old DeFi protocols into drain vectors. Learn how dormant token approvals are weaponized in these attacks and why proactive revocation is critical.
shieldforge.xyz
June 20, 2026 at 10:26 AM
web3isgoinggreat.com
GMX exchange hacked for $42 million

July 9, 2025
https://www.web3isgoinggreat.com/?id=gmx-hack
GMX exchange hacked for $42 million The decentralized perpetual exchange GMX has been exploited for $42 million. The exploit involved a vulnerability in one version of the exchange's price calculation smart contract. GMX paused some trading while they investigated the hack, and placed other temporary restrictions on the platform. GMX offered a 10% "bug bounty" to the hacker if they returned the funds. As of 24 hours after the theft, the hacker had not acknowledged the offer, and had begun swapping the stolen tokens.
July 10, 2025 at 2:23 PM
web3isgoinggreat.com
Aperture Finance users lose at least $3.4 million

January 25, 2026
https://www.web3isgoinggreat.com/?id=aperture-finance-exploit
Aperture Finance users lose at least $3.4 million An attacker exploited a bug in an Aperture Finance smart contract to steal at least $3.4 million from users who had enabled "instant liquidity management" features. Aperture Finane is a defi platform that aims to allow users to trade by telling large language models their "intents". Aperture has said they disabled portions of their web app impacted by the bug, and are working to try to trace and recover stolen funds.
January 27, 2026 at 2:25 AM
web3isgoinggreat.com
Arcadia Finance exploited for $3.5 million

July 15, 2025
https://www.web3isgoinggreat.com/?id=arcadia-finance-exploit
Arcadia Finance exploited for $3.5 million The Arcadia Finance defi margin protocol was exploited for $3.5 million after an attacker found a vulnerability in a project smart contract. The attacker quickly swapped the stolen tokens and bridged them from Base to the Ethereum mainnet. The attacker stole the funds in two separate transactions that were more than four hours apart. Arcadia is backed by Coinbase Ventures. The project acknowledged the hack, encouraging users to revoke permissions.
July 15, 2025 at 2:21 PM
oldmate.bsky.social
See also: crypto enthusiasts who want "smart contracts" in charge of decisions because "code is law", but also the state needs to recompense them when they lose their crypto to some exploit of aforementioned smart contract..
March 18, 2024 at 1:17 PM