{
  "name": "Cross-Chain Bridge Exploit Database",
  "url": "https://www.omarmoonis.com/learn/bridge-exploits/",
  "creator": "Omar Moonis",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "updated": "2026-10-17",
  "amountNote": "amountUsd is USD at the time of the incident, as reported by the cited sources, not restated to current prices.",
  "rootCauses": [
    {
      "key": "key-compromise",
      "label": "Key or signer compromise",
      "description": "An attacker obtained enough signing authority, by stealing keys or taking control of the operator or device that held them, to authorize transfers. The contract and signing protocol behaved as designed.",
      "related": {
        "label": "The key-management controls that address this",
        "url": "/tools/self-custody/#framework-h2"
      }
    },
    {
      "key": "signature-verification",
      "label": "Signature or proof verification flaw",
      "description": "The contract or signing protocol accepted a signature, proof or block it should have rejected, or a flaw in the signing protocol's own cryptography exposed the key it was meant to protect.",
      "related": {
        "label": "How bridge trust models differ",
        "url": "/tools/defi-primer/#bridges"
      }
    },
    {
      "key": "access-control",
      "label": "Access control flaw",
      "description": "A privileged function could be called by someone who should not have been able to call it.",
      "related": {
        "label": "What an admin key is and why it concentrates risk",
        "url": "/learn/glossary/admin-key/"
      }
    },
    {
      "key": "contract-logic",
      "label": "Contract logic flaw",
      "description": "Accounting, deposit or approval handling behaved differently from intent.",
      "related": {
        "label": "What a smart contract is, and where its bugs come from",
        "url": "/learn/glossary/smart-contract/"
      }
    },
    {
      "key": "upgrade-config",
      "label": "Upgrade or configuration error",
      "description": "The defect shipped in an upgrade or initialization step rather than in the original design.",
      "related": {
        "label": "Why upgradeable contracts carry this risk",
        "url": "/learn/glossary/upgradeability/"
      }
    },
    {
      "key": "undisclosed",
      "label": "Undisclosed",
      "description": "No root cause has been published by the protocol or a credible third party."
    }
  ],
  "incidents": [
    {
      "id": "anyswap-2021",
      "date": "2021-07-10",
      "protocol": "Anyswap (later Multichain), V3 router",
      "type": "bridge",
      "amountUsd": 7900000,
      "amountLabel": "$7.9MM",
      "chains": [
        "Ethereum",
        "BNB Chain",
        "Fantom"
      ],
      "rootCause": "signature-verification",
      "summary": "The V3 router's MPC signing reused an ECDSA nonce (the k value) in two transactions on BNB Chain, which let the attacker back-calculate the router's private key and move about 5.5MM MIM and 2.4MM USDC. Only the V3 pools were affected. The key was not stolen from an operator but leaked by a defect in the signing protocol itself, so it is classed as a signing-protocol flaw, the same rule applied to THORChain's GG20 incident in 2026. TechFlow dates the attack to 4:00 AM Beijing time on 11 July, which is 10 July UTC.",
      "outcome": "Anyswap patched the code and reopened after a 48 hour timelock. TechFlow reported that the team said it would compensate the losses.",
      "sources": [
        {
          "name": "Rekt",
          "url": "https://rekt.news/anyswap-rekt"
        },
        {
          "name": "The Defiant",
          "url": "https://thedefiant.io/news/hacks/defi-traders-lost-more-than-11m-across-two-weekend-hacks"
        },
        {
          "name": "TechFlow on the compensation pledge",
          "url": "https://www.techflowpost.com/en-US/newsletter/19686"
        }
      ]
    },
    {
      "id": "thorchain-2021-07-15",
      "date": "2021-07-15",
      "protocol": "THORChain (first 2021 incident)",
      "type": "cross-chain-infrastructure",
      "amountUsd": 5000000,
      "amountLabel": "$5.0MM",
      "chains": [
        "Ethereum",
        "THORChain"
      ],
      "rootCause": "contract-logic",
      "summary": "A bug in the Bifrost Ethereum router read the transaction value incorrectly in an override loop, letting the attacker withdraw about 2,500 ETH plus SUSHI, YFI, DODO and ALCX they had not deposited.",
      "outcome": "Funds were not reported recovered.",
      "sources": [
        {
          "name": "Rekt",
          "url": "https://rekt.news/thorchain-rekt"
        }
      ]
    },
    {
      "id": "thorchain-2021-07-22",
      "date": "2021-07-22",
      "protocol": "THORChain (second 2021 incident)",
      "type": "cross-chain-infrastructure",
      "amountUsd": 8000000,
      "amountLabel": "$8.0MM",
      "chains": [
        "Ethereum",
        "THORChain"
      ],
      "rootCause": "contract-logic",
      "summary": "The attacker used a fake router and fake vault to forge a deposit event carrying a malicious memo, which the Bifrost refund logic honored, paying out ALCX, XRUNE, USDC, SUSHI, YFI and USDT. THORChain first estimated the loss at about $800K.",
      "outcome": "RUNE fell about 25%. The attacker left most of the loot behind, and Rekt does not report a confirmed recovery.",
      "sources": [
        {
          "name": "Rekt",
          "url": "https://rekt.news/thorchain-rekt2"
        }
      ]
    },
    {
      "id": "poly-network-2021",
      "date": "2021-08-10",
      "protocol": "Poly Network",
      "type": "bridge",
      "amountUsd": 612000000,
      "amountLabel": "$612MM",
      "chains": [
        "Ethereum",
        "BNB Chain",
        "Polygon"
      ],
      "rootCause": "access-control",
      "summary": "A crafted cross-chain message called a function whose 4-byte selector collided with the one that replaces the keeper set, and the manager contract did not restrict which contract and method a relayed message could reach. That put a privileged function in the hands of an unauthorized caller, who swapped in their own keeper address and authorized withdrawals as the protocol. It is classed as an access control flaw because the failure was that reachability, not a stolen key (BlockSec and CertiK found no key theft), although the selector collision and missing target checks also make a contract logic reading defensible.",
      "outcome": "Substantially all funds were returned in stages over about 13 days, the last batch on 23 August 2021. Tether froze about $33MM of USDT along the way.",
      "sources": [
        {
          "name": "BlockSec analysis",
          "url": "https://blocksec.com/blog/the-further-analysis-of-the-poly-network-attack"
        },
        {
          "name": "CertiK analysis",
          "url": "https://www.certik.com/resources/blog/poly-network-exploit"
        },
        {
          "name": "CNBC (final return)",
          "url": "https://www.cnbc.com/2021/08/23/poly-network-hacker-returns-remaining-cryptocurrency.html"
        }
      ]
    },
    {
      "id": "pnetwork-2021",
      "date": "2021-09-19",
      "protocol": "pNetwork",
      "type": "bridge",
      "amountUsd": 12500000,
      "amountLabel": "$12.5MM",
      "chains": [
        "Bitcoin",
        "BNB Chain"
      ],
      "rootCause": "undisclosed",
      "summary": "An attacker exploited a bug in the codebase of the pNetwork pBTC-on-BNB Chain bridge and drained 277 BTC of collateral. No technical post-mortem that this database could locate states the specific flaw.",
      "outcome": "pNetwork offered a $1.5MM bounty for the return of the funds. No recovery has been reported.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/118060/defi-pnetwork-hack-wrapped-bitcoin-12-million-lost"
        }
      ]
    },
    {
      "id": "qubit-2022",
      "date": "2022-01-27",
      "protocol": "Qubit Finance (QBridge)",
      "type": "bridge",
      "amountUsd": 80000000,
      "amountLabel": "$80MM",
      "chains": [
        "Ethereum",
        "BNB Chain"
      ],
      "rootCause": "contract-logic",
      "summary": "A deposit function accepted a zero-value transfer as though collateral had arrived, letting the attacker mint borrowing power against nothing. 206,809 BNB was drained.",
      "outcome": "Not recovered.",
      "sources": [
        {
          "name": "Merkle Science analysis",
          "url": "https://blog.merklescience.com/hacktrack/analysis-of-qubit-finance-exploit"
        },
        {
          "name": "Qubit Finance post-mortem",
          "url": "https://medium.com/@QubitFin/porotocol-exploit-report-3-82f4e3ade34b"
        }
      ]
    },
    {
      "id": "wormhole-2022",
      "date": "2022-02-02",
      "protocol": "Wormhole",
      "type": "bridge",
      "amountUsd": 326000000,
      "amountLabel": "$326MM",
      "chains": [
        "Ethereum",
        "Solana"
      ],
      "rootCause": "signature-verification",
      "summary": "The Solana-side contract could be tricked into accepting a forged guardian signature set, letting the attacker mint 120,000 wETH without depositing anything.",
      "outcome": "Jump Crypto replaced the shortfall within days. In February 2023 the exploiter's remaining vault positions at Oasis.app were recovered under an English High Court order, reportedly in coordination with Jump.",
      "sources": [
        {
          "name": "Kudelski Security vulnerability analysis",
          "url": "https://kudelskisecurity.com/research/quick-analysis-of-the-wormhole-attack"
        },
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022"
        },
        {
          "name": "CertiK incident analysis",
          "url": "https://www.certik.com/resources/blog/wormhole-bridge-exploit-incident-analysis"
        },
        {
          "name": "Citation Needed on the Oasis recovery",
          "url": "https://www.citationneeded.news/oasis-defi-centralization/"
        }
      ]
    },
    {
      "id": "ronin-2022",
      "date": "2022-03-23",
      "protocol": "Ronin Network",
      "type": "bridge",
      "amountUsd": 624000000,
      "amountLabel": "$624MM",
      "chains": [
        "Ethereum",
        "Ronin"
      ],
      "rootCause": "key-compromise",
      "summary": "The attacker obtained 5 of 9 validator keys, 4 belonging to Sky Mavis and a 5th to Axie DAO, the latter reachable through an allowlist left in place after an earlier scaling arrangement. Every signature was valid.",
      "outcome": "Attributed to the Lazarus Group by US authorities in April 2022. Largely not recovered. Sky Mavis raised $150MM in Binance-led funding to reimburse users.",
      "sources": [
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-ronin-hack-march-2022"
        },
        {
          "name": "US Treasury (OFAC attribution)",
          "url": "https://home.treasury.gov/news/press-releases/jy0768"
        },
        {
          "name": "Decrypt on the $150MM raise",
          "url": "https://rhino.decrypt.co/97054/sky-mavis-raises-150m-binance-led-funding-ronin-bridge-refund"
        }
      ]
    },
    {
      "id": "harmony-horizon-2022",
      "date": "2022-06-23",
      "protocol": "Harmony (Horizon Bridge)",
      "type": "bridge",
      "amountUsd": 100000000,
      "amountLabel": "$100MM",
      "chains": [
        "Ethereum",
        "Harmony"
      ],
      "rootCause": "key-compromise",
      "summary": "The bridge ran a 2-of-5 multisig, so compromising two signers was enough to authorize any transfer. The quorum was the vulnerability.",
      "outcome": "Not recovered. The FBI attributed the theft to the Lazarus Group in January 2023.",
      "sources": [
        {
          "name": "Harmony (official)",
          "url": "https://medium.com/harmony-one/harmonys-horizon-bridge-hack-1e8d283b6d66"
        },
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-harmony-horizon-bridge-hack"
        },
        {
          "name": "The Block on the multisig takeover",
          "url": "https://www.theblock.co/post/154029/harmonys-100-million-hacker-took-control-of-its-multi-signature-wallet-analysts-say"
        },
        {
          "name": "The Block on the FBI attribution",
          "url": "https://www.theblock.co/post/204928/fbi-confirms-lazarus-group-and-apt38-were-responsible-for-100-million-bridge-hack"
        }
      ]
    },
    {
      "id": "nomad-2022",
      "date": "2022-08-01",
      "protocol": "Nomad",
      "type": "bridge",
      "amountUsd": 190000000,
      "amountLabel": "$190MM",
      "chains": [
        "Ethereum",
        "Moonbeam",
        "Evmos"
      ],
      "rootCause": "upgrade-config",
      "summary": "A routine initialization set a trusted root to zero, which made every message appear pre-approved. Once the first transaction was public, hundreds of accounts copied it in an open free-for-all.",
      "outcome": "Whitehats returned about $36MM, roughly a fifth, within weeks (per Zerion). The rest was not recovered.",
      "sources": [
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-nomad-bridge-hack-august-2022"
        },
        {
          "name": "Elliptic",
          "url": "https://www.elliptic.co/blog/analysis/nomad-loses-156-million-in-seventh-major-crypto-bridge-exploit-of-2022"
        },
        {
          "name": "Zerion on the returned funds",
          "url": "https://zerion.io/blog/nomad-bridge-hack/"
        },
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/193215/nomad-to-restart-bridge-after-190-million-hack-in-august"
        }
      ]
    },
    {
      "id": "bnb-bridge-2022",
      "date": "2022-10-06",
      "protocol": "BNB Chain (Token Hub)",
      "type": "bridge",
      "amountUsd": 566000000,
      "amountLabel": "$566MM",
      "chains": [
        "BNB Beacon Chain",
        "BNB Chain"
      ],
      "rootCause": "signature-verification",
      "summary": "A flaw in IAVL merkle proof verification let the attacker forge a proof for a withdrawal that was never deposited, minting 2MM BNB. The $566MM is the nominal value of the BNB minted, not the amount that left the chain.",
      "outcome": "Validators halted the chain. About $100MM of the minted BNB left the chain (estimates run to $110MM or more) and most of the rest never moved. Roughly $7MM was reportedly frozen.",
      "sources": [
        {
          "name": "BNB Chain (official)",
          "url": "https://www.bnbchain.org/en/blog/bnb-chain-ecosystem-update"
        },
        {
          "name": "BNB Chain (official follow-up)",
          "url": "https://www.bnbchain.org/en/blog/bnb-chain-a-decentralized-response"
        },
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-bnb-chain-hack-october-2022"
        },
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/175437/biance-bnb-chain-is-back-up-after-bridge-exploit"
        }
      ]
    },
    {
      "id": "poly-network-2023",
      "date": "2023-07-02",
      "protocol": "Poly Network (second incident)",
      "type": "bridge",
      "amountUsd": 10100000,
      "amountLabel": "$10.1MM",
      "chains": [
        "Ethereum",
        "BNB Chain",
        "Polygon",
        "Metis"
      ],
      "rootCause": "undisclosed",
      "summary": "The attacker minted 57 tokens across 10 chains but cashed out only about 5,196 ETH ($10.1MM) because liquidity was thin. Beosin and Dedaub suggested compromised admin keys, alleging that keys for three of four admin wallets were taken, but Poly Network had not confirmed a cause. Reports date the attack to 1 or 2 July, and this entry uses 2 July.",
      "outcome": "Poly Network suspended services and appealed to the attacker to return the funds. No recovery was reported.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://www.theblock.co/news/ecosystems/2023-07-03-attacker-pockets-10-million-from-poly-network-security-attack-beosin-237452"
        }
      ]
    },
    {
      "id": "multichain-2023",
      "date": "2023-07-06",
      "protocol": "Multichain",
      "type": "bridge",
      "amountUsd": 126000000,
      "amountLabel": "$126MM",
      "chains": [
        "Ethereum",
        "Fantom",
        "Moonriver",
        "Dogechain"
      ],
      "rootCause": "undisclosed",
      "summary": "Funds moved out of multiple bridge contracts, more than $102MM of it from the Fantom bridge contract on Ethereum (Unchained). Multichain said its CEO had been taken away by Chinese police in May 2023 and that the team had lost access to its MPC servers. CertiK attributed the outflows to a private key compromise, while Chainalysis described them as a possible hack or insider rug pull, and Decrypt later reported that the CEO's sister had moved assets out of the MPC wallets. Every reading involves the keys, but whether they were stolen or used by insiders has never been settled and Multichain published no post-mortem, so the cause is classed as undisclosed under this page's rule for contested causes.",
      "outcome": "The protocol ceased operations. Circle and Tether reportedly froze more than $65MM of related stablecoins. The rest was not recovered.",
      "sources": [
        {
          "name": "Decrypt",
          "url": "https://decrypt.co/148559/multichain-shutters-operations-chinese-police-take-ceo-sister-custody"
        },
        {
          "name": "Cointelegraph on the Chainalysis assessment",
          "url": "https://cointelegraph.com/news/multichain-possible-rug-pull-chainalysis"
        },
        {
          "name": "CertiK on the private key reading",
          "url": "https://www.certik.com/skynet-report/multichain-collapse-the-private-key-leak-that-drained-usd125m"
        },
        {
          "name": "Unchained on the outflows",
          "url": "https://unchainedcrypto.com/hack-or-rugpull-multichain-sees-126-million-abnormal-outflows/"
        },
        {
          "name": "Bridge hack list (cwhinfrey)",
          "url": "https://gist.github.com/cwhinfrey/9fd1bbc31bbcff08fca242b90c7f875d"
        }
      ]
    },
    {
      "id": "heco-bridge-2023",
      "date": "2023-11-22",
      "protocol": "HECO Bridge (HTX)",
      "type": "bridge",
      "amountUsd": 87000000,
      "amountLabel": "$87MM",
      "chains": [
        "Ethereum",
        "HECO"
      ],
      "rootCause": "key-compromise",
      "summary": "A compromised operator key authorized withdrawals from the bridge, about $87MM per CertiK (PeckShield counted $86.6MM). HTX exchange hot wallets were also drained in the same window, about $23.4MM per Wintermute's head of research (ForkLog), while CertiK counted $13.6MM taken from HTX hot wallets on Ethereum plus $12.6MM of suspicious TRON transfers. That is a separate exchange theft, excluded from this figure and from the totals on this page.",
      "outcome": "Not recovered. Justin Sun pledged that HTX would fully compensate its hot wallet losses (ForkLog). No compensation for the bridge losses was confirmed in the sources cited here.",
      "sources": [
        {
          "name": "CertiK",
          "url": "https://www.certik.com/resources/blog/heco-bridge-exploit"
        },
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/284107/heco-bridge-exploiters-launder-145-million-usd-eth-tornado-cash"
        },
        {
          "name": "Neptune Mutual analysis",
          "url": "https://medium.com/neptune-mutual/analysis-of-the-heco-bridge-and-htx-exploit-9cf3524db7c3"
        },
        {
          "name": "ForkLog on the loss estimates",
          "url": "https://forklog.com/en/news/analysts-estimate-losses-from-htx-and-heco-bridge-hack-at-110-million"
        }
      ]
    },
    {
      "id": "orbit-chain-2023",
      "date": "2023-12-31",
      "protocol": "Orbit Chain",
      "type": "bridge",
      "amountUsd": 81500000,
      "amountLabel": "$81.5MM",
      "chains": [
        "Ethereum",
        "Orbit Chain"
      ],
      "rootCause": "undisclosed",
      "summary": "About $81.5MM was drained from the bridge's Ethereum vault on New Year's Eve UTC. Rekt and Halborn believe signer keys on the vault multisig were compromised, but no post-mortem has been published. In January 2024 operator Ozys alleged that a former CISO had weakened a firewall, a company claim that remains unproven.",
      "outcome": "Not recovered.",
      "sources": [
        {
          "name": "Rekt",
          "url": "https://www.rekt.news/orbit-bridge-rekt"
        },
        {
          "name": "Halborn technical analysis",
          "url": "https://halborn.com/blog/post/explained-the-orbit-bridge-hack-december-2023"
        },
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/business/2024/01/02/orbit-chain-loses-81m-in-cross-chain-bridge-exploit"
        },
        {
          "name": "ForkLog on the Ozys statement",
          "url": "https://forklog.com/en/former-orbit-bridge-employee-suspected-of-aiding-80-million-attack/amp"
        }
      ]
    },
    {
      "id": "socket-bungee-2024",
      "date": "2024-01-16",
      "protocol": "Socket / Bungee",
      "type": "cross-chain-infrastructure",
      "amountUsd": 3300000,
      "amountLabel": "$3.3MM",
      "chains": [
        "Ethereum"
      ],
      "rootCause": "contract-logic",
      "summary": "A route contract on the Socket cross-chain aggregator failed to validate user-supplied calldata, letting the attacker drain wallets that had granted the gateway unlimited token approvals. Only users with live approvals were affected. Socket is a router rather than a custody bridge, which is why it is tagged cross-chain infrastructure.",
      "outcome": "Socket said it recovered about $2.3MM (1,032 ETH) of the $3.3MM and promised a distribution plan. Users were urged to revoke approvals.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/272986/socket-says-bungee-protocol-exploited"
        },
        {
          "name": "The Block on the recovery",
          "url": "https://www.theblock.co/post/273964/socket-ether-recovery-bungee-exploit"
        },
        {
          "name": "DL News",
          "url": "https://www.dlnews.com/articles/defi/hacker-swipes-33m-from-bungee-crypto-bridge-users/"
        }
      ]
    },
    {
      "id": "lifi-2024",
      "date": "2024-07-16",
      "protocol": "LI.FI",
      "type": "cross-chain-infrastructure",
      "amountUsd": 11600000,
      "amountLabel": "$11.6MM",
      "chains": [
        "Ethereum",
        "Arbitrum"
      ],
      "rootCause": "contract-logic",
      "summary": "A newly deployed facet on the LI.FI cross-chain aggregator allowed arbitrary calls, which the attacker used to drain 153 wallets holding infinite approvals to the LI.FI contract. LI.FI is a router rather than a custody bridge, which is why it is tagged cross-chain infrastructure.",
      "outcome": "LI.FI disabled the facet on all chains and said it was evaluating options to fully compensate affected users. No recovery was reported.",
      "sources": [
        {
          "name": "LI.FI incident report",
          "url": "https://li.fi/knowledge-hub/incident-report-16th-july"
        },
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/business/2024/07/16/defi-protocol-lifi-struck-by-8m-exploit"
        }
      ]
    },
    {
      "id": "ronin-2024",
      "date": "2024-08-06",
      "protocol": "Ronin Network (second incident)",
      "type": "bridge",
      "amountUsd": 12000000,
      "amountLabel": "$12MM",
      "chains": [
        "Ethereum",
        "Ronin"
      ],
      "rootCause": "upgrade-config",
      "summary": "A contract upgrade left a flaw in how the bridge counted operator votes, which a whitehat operator exploited, reportedly via an MEV bot, before any malicious actor did.",
      "outcome": "Returned by the whitehat operators within days. Ronin planned a $500K bounty.",
      "sources": [
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/tech/2024/08/06/ronin-bridge-paused-after-9m-drained-in-apparent-whitehat-hack"
        },
        {
          "name": "Halborn analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-ronin-network-hack-august-2024"
        },
        {
          "name": "Decrypt",
          "url": "https://kakapo.decrypt.co/243343/ronin-gaming-network-recovers-swiped-ethereum-12-million-attack"
        }
      ]
    },
    {
      "id": "garden-finance-2025",
      "date": "2025-10-30",
      "protocol": "Garden Finance",
      "type": "cross-chain-infrastructure",
      "amountUsd": 11400000,
      "amountLabel": "$11.4MM",
      "chains": [
        "Solana",
        "BNB Chain",
        "Other EVM chains (not itemized)"
      ],
      "rootCause": "key-compromise",
      "summary": "An attacker drained about $11.4MM of the solver's own assets across multiple chains from one of Garden's independent solvers, the market makers whose inventory fills cross-chain swaps on the network. Garden's incident report, dated 28 January 2026 and released through Chainwire the next day, says the attacker obtained the solver's SSH key from the local device used to run its production executor, gained root access to the solver server and found the solver's private key stored in an environment variable. EY's review of the server's SSH logs found access from four IP addresses in Japan and China on 30 October 2025, and zeroShadow said the incident originated from a leaked private key on a compromised device, although the exact method of compromise is unknown, and linked it with high confidence to the North Korea-affiliated group DangerousPassword. Garden says no protocol contracts were compromised and no user funds were at risk. The report names Solana and BNB Chain among the drained balances without itemizing the rest. The loss is counted because the solver inventory is the liquidity that settles transfers across Garden's network, which this page treats as cross-chain infrastructure, but it was not a loss of user deposits held in custody. ZachXBT questioned whether the solver was independent of Garden.",
      "outcome": "Garden paused all user-facing services and posted an on-chain offer of a 10% bounty on the solver's behalf, which drew no response. Funds were bridged off Solana via Mayan, swapped to ETH and deposited into Tornado Cash. Garden said it removed the need for solvers to be reachable on public IP addresses, added independent third-party solvers and appointed a new CISO. In late July 2026 an attacker who reached an independent solver's off-chain database drained about $450K in USDT across Ethereum, Base, Arbitrum and BNB Chain (per Blockaid), and Garden again paused its services, telling Cointelegraph that only solver-owned assets were affected.",
      "sources": [
        {
          "name": "Garden incident report (archived copy, removed from garden.finance)",
          "url": "https://web.archive.org/web/20260916013452/https://garden.finance/blog/garden-incident-report-october-30-2025"
        },
        {
          "name": "Garden forensic findings (Decrypt, Chainwire release)",
          "url": "https://decrypt.co/356301/garden-finance-shares-forensic-findings-security-breach-limited-to-solver-layer"
        },
        {
          "name": "The Block (Garden release)",
          "url": "https://www.theblock.co/post/387636/garden-finance-shares-forensic-findings-security-breach-limited-to-solver-layer"
        },
        {
          "name": "Cointelegraph on the July 2026 incident",
          "url": "https://cointelegraph.com/news/garden-finance-app-offline-450k-htlc-exploit"
        },
        {
          "name": "Web3 is Going Just Great",
          "url": "https://web3isgoinggreat.com/single/garden-hacked-for-11-million"
        },
        {
          "name": "The Register",
          "url": "https://www.theregister.com/2025/10/31/attackers_dig_up_11m_in/"
        }
      ]
    },
    {
      "id": "kelpdao-2026",
      "date": "2026-04-18",
      "protocol": "Kelp DAO",
      "type": "cross-chain-infrastructure",
      "amountUsd": 292000000,
      "amountLabel": "$292MM",
      "chains": [
        "Ethereum"
      ],
      "rootCause": "key-compromise",
      "summary": "A forged cross-chain message was accepted after the LayerZero Labs verifier (DVN) that Kelp's rsETH bridge relied on attested to it. LayerZero's incident report says the breach began on 6 March 2026, when two internal RPC nodes the DVN read from were compromised, and that an external RPC provider was then knocked offline so the DVN relied only on the compromised nodes. Mandiant, CrowdStrike and independent researchers cited in the report attribute the attack to the North Korean group TraderTraitor. The bridge required a single verifier, so no second check existed, and 116,500 rsETH (about $292MM) was released from the reserve behind wrapped versions on more than 20 chains on 18 April 2026. Kelp's emergency pause came 46 minutes after the drain and blocked two further attempts of roughly 40,000 rsETH each. Kelp and LayerZero dispute who chose the 1-of-1 verifier setup.",
      "outcome": "LayerZero Labs said its DVN would no longer sign as the sole required verifier on any channel and that it rebuilt the compromised infrastructure. Kelp announced on 5 May that rsETH bridging would move to Chainlink CCIP. Chainlink's blog of 20 May said seven teams had announced migrations to Chainlink in the previous two weeks, representing more than $4Bn in total value, a tally that included a move of more than $400MM to Chainlink Data Feeds rather than CCIP and put Kelp's rsETH at more than $1.5Bn. In an 18 August update Chainlink raised its figure to $15Bn migrating to CCIP. These are Chainlink's tallies of announced migrations, not measured flows.",
      "sources": [
        {
          "name": "LayerZero Labs incident report",
          "url": "https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"
        },
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"
        },
        {
          "name": "CoinDesk on the configuration dispute",
          "url": "https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster"
        },
        {
          "name": "The Block on the move to CCIP",
          "url": "https://www.theblock.co/post/400131/kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit"
        },
        {
          "name": "Chainlink blog, 20 May 2026 (archived original)",
          "url": "https://web.archive.org/web/20260610054030/https://blog.chain.link/the-great-migration/"
        },
        {
          "name": "Chainlink blog (updated 18 August 2026)",
          "url": "https://chain.link/blog/migrated-to-chainlink-overview"
        }
      ],
      "relatedPost": "/blog/gone-in-46-minutes/"
    },
    {
      "id": "thorchain-2026",
      "date": "2026-05-15",
      "protocol": "Thorchain",
      "type": "cross-chain-infrastructure",
      "amountUsd": 10000000,
      "amountLabel": "$10MM",
      "chains": [
        "Bitcoin",
        "Ethereum",
        "BNB Chain",
        "Base"
      ],
      "rootCause": "signature-verification",
      "summary": "THORChain's own report traces the loss of roughly $10MM (third-party trackers put it at $10.7MM or more) to the GG20 threshold-signature library it inherited from Binance. A malicious validator combined three weaknesses, a key-generation check that accepted a malformed Paillier modulus, a range proof that did not bind its commitment, and a blinding value too small to hide its secret, to reconstruct a vault's private key from leaked key shares. The protocol's signing proofs failed to reject inputs they should have, so it is classed as a verification flaw rather than a conventional key theft.",
      "outcome": "The affected vault was paused and every validator upgraded to v3.19.1 before signing resumed. THORChain plans to move away from GG20. RUNE fell 12%.",
      "sources": [
        {
          "name": "THORChain Exploit Report #2",
          "url": "https://blog.thorchain.org/thorchain-exploit-report-2"
        },
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12"
        },
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/401462/thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit"
        }
      ],
      "relatedPost": "/blog/cross-chain-bridges-the-cdos-of-defi/"
    },
    {
      "id": "verus-2026",
      "date": "2026-05-18",
      "protocol": "Verus (Ethereum Bridge)",
      "type": "bridge",
      "amountUsd": 11580000,
      "amountLabel": "$11.58MM",
      "chains": [
        "Ethereum",
        "Verus"
      ],
      "rootCause": "contract-logic",
      "summary": "The bridge verified notary signatures and Merkle proofs correctly but never checked that the source amount recorded on Verus matched the payout claimed on Ethereum, so a valid proof could be used to draw out more than was deposited (Merkle Science). The attacker took 103.6 tBTC, 1,625 ETH and 147,000 USDC.",
      "outcome": "The attacker returned 4,052.4 ETH and kept 1,350 ETH, about 25%, under a bounty arrangement Verus offered publicly.",
      "sources": [
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-verus-ethereum-bridge-hack-may-2026"
        },
        {
          "name": "Merkle Science analysis",
          "url": "https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack"
        },
        {
          "name": "The Block on the return",
          "url": "https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth"
        }
      ],
      "relatedPost": "/blog/the-keys-were-always-the-weakest-link/"
    },
    {
      "id": "gravity-bridge-2026",
      "date": "2026-05-30",
      "protocol": "Gravity Bridge",
      "type": "bridge",
      "amountUsd": 5400000,
      "amountLabel": "$5.4MM",
      "chains": [
        "Ethereum",
        "Cosmos"
      ],
      "rootCause": "undisclosed",
      "summary": "About $4.3MM in USDC, 274 WETH and smaller balances were withdrawn from the bridge. The Block reported a suspected compromised signing key, while Rekt traced it to a permissionless token-deployment function that let the attacker poison the token registry. Neither Gravity nor Althea had confirmed a cause at the time of the reports. Reports date the drain to 29 or 30 May, and this entry uses 30 May.",
      "outcome": "Network halted. Part of the proceeds were laundered through ChangeNow and Binance, and Rekt reports flows into Tornado Cash.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://www.theblock.co/post/403108/cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say"
        },
        {
          "name": "Rekt",
          "url": "https://rekt.news/gravity-bridge-rekt"
        },
        {
          "name": "BeInCrypto",
          "url": "https://beincrypto.com/gravity-bridge-hack-key-compromise-5m/"
        }
      ],
      "relatedPost": "/blog/the-keys-were-always-the-weakest-link/"
    },
    {
      "id": "afx-trade-2026",
      "date": "2026-07-22",
      "protocol": "AFX Trade bridge",
      "type": "bridge",
      "amountUsd": 24150000,
      "amountLabel": "$24.15MM",
      "chains": [
        "Arbitrum",
        "Ethereum"
      ],
      "rootCause": "key-compromise",
      "summary": "Five hot-validator keys signed one withdrawal worth about 24.15MM USDC, reaching the voting threshold of the bridge's off-chain validator set, and the withdrawal passed a 200 second dispute window. No smart contract bug was involved, and QuillAudits concluded the off-chain signing system was compromised. Arbitrum's own bridge was not breached.",
      "outcome": "AFX offered the attacker a white-hat settlement, keeping 30% in return for sending back the other 70%. The USDC was swapped for about 12,467 ETH. SEAL and zeroShadow said a link to the Lazarus-affiliated group UNC4899 was preliminary.",
      "sources": [
        {
          "name": "Rekt",
          "url": "https://rekt.news/afx-trade-rekt"
        },
        {
          "name": "Halborn technical analysis",
          "url": "https://www.halborn.com/blog/post/explained-the-afxbridge-hack-july-2026"
        },
        {
          "name": "Unchained",
          "url": "https://unchainedcrypto.com/arbitrum-based-afx-trade-drained-of-24-million/"
        }
      ]
    },
    {
      "id": "verus-2026-07",
      "date": "2026-07-23",
      "protocol": "Verus (Ethereum Bridge, second incident)",
      "type": "bridge",
      "amountUsd": 7540000,
      "amountLabel": "$7.54MM",
      "chains": [
        "Ethereum",
        "Verus"
      ],
      "rootCause": "contract-logic",
      "summary": "A second drain of the same bridge contract from a new wallet. Per Rekt, citing SlowMist, VerusProof.checkExportAndTransfers checked the transfer hash against attacker-supplied transfer data but never validated the export's accounting values (total amounts, fees, burned amounts and output value) or that the prior export held enough value to cover the payouts. The attacker made a legitimate 0.01 VRSC transfer, then submitted a forged export committing to eight payouts, and the genuine notarized heights let the proofs pass. The checkCCEValues fix made after May held, so this was a different code-level gap in the same trust boundary rather than the May bug repeated, although Blockaid described the same entry path and bug class. Some reports date it 22 July, and this entry uses 23 July, as most sources do.",
      "outcome": "Not reported recovered. Rekt reports no statement or bounty offer from Verus, and the funds, consolidated into about 3,916 ETH, were moved through Tornado Cash.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://theblock.co/post/409489/new-verus-ethereum-bridge-attack"
        },
        {
          "name": "Rekt",
          "url": "https://rekt.news/veruscoin-rekt"
        },
        {
          "name": "Whale Alert",
          "url": "https://whale-alert.io/stories/bad10112b90bc8/Verus-Ethereum-Bridge-suffers-second-75-million-exploit"
        }
      ]
    },
    {
      "id": "liquid-network-2026",
      "date": "2026-09-06",
      "protocol": "Liquid Network",
      "type": "bridge",
      "amountUsd": 320000000,
      "amountLabel": "$320MM",
      "chains": [
        "Bitcoin",
        "Liquid Network"
      ],
      "rootCause": "signature-verification",
      "summary": "Blockstream's Elements software cached range proof verifications under a key that did not fully capture the transaction context, so an attacker could point new, invalid issuance data at a previously approved cache entry and skip verification. This let the attacker mint roughly 4,000 L-BTC with no bitcoin backing them and withdraw them from the federation's reserve wallet.",
      "outcome": "The attacker, who described themselves as a white hat, returned about 3,400 BTC and kept about 598.5 BTC, demanding a 10% bounty that Blockstream refused to treat as white-hat activity. Liquid halted transactions, and block production resumed on 10 September while peg-outs stayed suspended.",
      "sources": [
        {
          "name": "CoinDesk",
          "url": "https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys"
        },
        {
          "name": "Chainalysis",
          "url": "https://www.chainalysis.com/blog/320m-exploit-liquid-network/"
        },
        {
          "name": "The Block on the bounty dispute",
          "url": "https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-liquid-414247"
        },
        {
          "name": "Cointelegraph on the restart",
          "url": "https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit"
        }
      ]
    },
    {
      "id": "meter-2026",
      "date": "2026-09-23",
      "protocol": "Meter (Passport Bridge)",
      "type": "bridge",
      "amountUsd": 2300000,
      "amountLabel": "$2.3MM",
      "chains": [
        "BNB Chain",
        "Meter"
      ],
      "rootCause": "signature-verification",
      "summary": "Meter attributed the incident to a block validation flaw (as reported by CoinGabbar), which let an attacker mint wrapped MTRG on BNB Chain without depositing the underlying MTRG. Blockaid flagged roughly $2.3MM of unbacked tokens minted across two transactions, partly sold on PancakeSwap before Meter intervened. No detailed post-mortem has been located.",
      "outcome": "Meter paused its mainnet and bridge and said transactions after block 100731417 may not be honored. MTR and MTRG each fell by roughly 75% to 80%.",
      "sources": [
        {
          "name": "CoinGabbar (Meter update)",
          "url": "https://www.coingabbar.com/en/crypto-hack-news-today-meter-exploit-mtrg-crash-bitget-hack"
        },
        {
          "name": "CryptoTimes",
          "url": "https://www.cryptotimes.io/2026/09/24/meter-passport-exploit-reportedly-mints-2-3-million-in-unbacked-mtrg/"
        },
        {
          "name": "Crypto-Economy",
          "url": "https://crypto-economy.com/three-defi-exploits-swipe-11m-from-payy-duelbits-meter-in-one-day/"
        }
      ]
    },
    {
      "id": "payy-2026",
      "date": "2026-09-24",
      "protocol": "Payy Network",
      "type": "bridge",
      "amountUsd": 1918793,
      "amountLabel": "$1.92MM",
      "chains": [
        "Ethereum",
        "Payy Network"
      ],
      "rootCause": "signature-verification",
      "summary": "Payy's post-mortem, posted on 29 September 2026 and supported by a Spearbit review, says an attacker submitted an invalid burn proof that Payy's deployed Noir/Barretenberg verifier accepted. The flaw sat in Barretenberg's small-subgroup IPA verification path, which lacked a boundary check that Aztec added in a fix committed on 14 May 2026 and released in v5.0.0 on 13 July. Aztec did not notify Payy, which was running a pinned October 2025 build, and the rollup contract had no independent check that a burn hash be nonzero. The forged burn, with zero note commitments and a zero burn hash, was recorded on Payy's network at 03:25:41 UTC on 24 September. Ethereum settlements at 04:21:23 and 09:30:35 UTC paid out 1,828,589.378 USDC and 90,202.820 USDC, and a second burn of 1 USDC was fronted by a burn substitutor whom the rollup later reimbursed, for 1,918,793.198 USDC in total. The stolen funds were users' non-custodial deposits.",
      "outcome": "Payy paused all network transactions on 24 September and on 25 September (UTC) ruled out a compromised key, social engineering and an off-chain infrastructure exploit. Its post-mortem traced 682.3 ETH from the first payout into Tornado Cash on 26 September, while the 90,202.82 USDC from the second settlement was still in the receiving wallet on 28 September. No recovery has been announced. Payy opened a claims process paying eligible users in USDC on Ethereum, with the wallet to close when it ends, then paused the form on 13 October to rework it and said the 30-day window would reset.",
      "sources": [
        {
          "name": "Payy post-mortem",
          "url": "https://polybase.notion.site/Payy-USDC-withdrawal-exploit-postmortem-v4-final-3ea822fadf1e8097abb4dae2bc3c18cf"
        },
        {
          "name": "Payy on X",
          "url": "https://x.com/payy_link"
        },
        {
          "name": "Payy remediation form",
          "url": "https://tally.so/r/lbJVEk"
        },
        {
          "name": "Certora analysis",
          "url": "https://www.certora.com/blog/payy-exploit-forged-zk-proof-attack"
        },
        {
          "name": "Unchained",
          "url": "https://unchainedcrypto.com/payy-rules-out-a-compromised-key-in-1-92-million-drain-of-users-deposits/"
        },
        {
          "name": "KuCoin",
          "url": "https://www.kucoin.com/news/flash/payy-network-confirms-ethereum-bridge-hacked-stealing-1-8m-in-usdc"
        }
      ]
    },
    {
      "id": "near-intents-2026",
      "date": "2026-10-01",
      "protocol": "NEAR Intents",
      "type": "cross-chain-infrastructure",
      "amountUsd": 3800000,
      "amountLabel": "$3.8MM",
      "chains": [
        "NEAR",
        "BNB Chain"
      ],
      "rootCause": "contract-logic",
      "summary": "A bug in how NEAR Intents' Omni deposit and withdrawal system interacted with its smart contract let an attacker trigger irregular withdrawals from the protocol's BNB Chain hot wallet. CoinDesk reported that the contract-side vulnerability had since been patched, without giving a time, and deposits and withdrawals were disrupted on 11 networks while it investigated.",
      "outcome": "The funds were moved to KuCoin and converted to bitcoin. NEAR Intents said it identified the attacker and set a 48 hour deadline, and about a day later the exploiter returned the funds in full. NEAR Intents closed its investigation and had pledged full reimbursement to users.",
      "sources": [
        {
          "name": "The Block",
          "url": "https://www.theblock.co/news/ecosystems/2026-10-01-near-intents-halts-services-after-3-8-million-exploit-promises-full-compensation-417404"
        },
        {
          "name": "CoinDesk",
          "url": "https://coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues"
        },
        {
          "name": "Decrypt on the return",
          "url": "https://decrypt.co/380014/near-intents-recovers-3-8-million-after-48-hour-ultimatum"
        }
      ]
    }
  ]
}