| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | AA | AB | AC | AD | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | Protocol | Auditor | Amount | Date | URL | Type | Chain(s) | Cause(s) | TLDR | Lessons | Current Status | Flashloan? | Oracle? | Tornado? | Other | ||||||||||||||||
2 | Ronin Network | Unaudited | $ 624.00 | 2022-03-23 | https://rekt.news/ronin-rekt/ | Bridge | Ronin | Opsec Failure | Compromised 5 validators to withdraw funds from bridge contract | Revoke unnecessary access, require greater than 5/9 sigs | Some funds withdrawn, most remain in wallet | ||||||||||||||||||||
3 | Poly Network | Unaudited | $ 611.00 | 2021-08-11 | https://rekt.news/polynetwork-rekt/ | Bridge | Ethereum, BSC, Polygon | Contract Exploit | Spoofed cross chain contract call exploiting code flaw | Cross chain contracts need severe limitations and checks | Hacker purportedly in process of returning funds | ||||||||||||||||||||
4 | Wormhole | Neodyme | $ 326.00 | 2022-02-03 | https://rekt.news/wormhole-rekt/ | Bridge | Solana | Contract Exploit | Spoofed signature to bypass checks on contract | Process for signature verification was insufficient | Liquidated some, most still in Ethereum wallet | ||||||||||||||||||||
5 | Bitmart | N/A | $ 196.00 | 2021-12-04 | https://rekt.news/bitmart-rekt/ | CEX | CEX | Uncertain - Compromised Keys | Somehow gained access and drained a Bitmart wallet | Some washed, some still in wallet | |||||||||||||||||||||
6 | Nomad Bridge | Quanstamp | $ 190.00 | 2022-08-01 | https://rekt.news/nomad-rekt/ | Bridge | Moonbeam, EVMOS, Milkomeda | Contract Exploit | Free-for-all exploiting a flaw allowing root privileges after a contract "upgrade" | Peer review + audits important part of upgrade | Spread to four corners of crypto | Quanstamp audit in June? | |||||||||||||||||||
7 | Beanstalk | Omniscia | $ 181.00 | 2022-04-17 | https://rekt.news/beanstalk-rekt/ | Stablecoin | Ethereum | Flashloan Exploit | Used flash loan to push through governance proposal to transfer all assets to themself | Need a delay of on-chain governance proposals | Tornadoed | Y | Y | Omniscia audit but they claim attack was outside their scope of audit | |||||||||||||||||
8 | Compound | Unaudited | $ 147.00 | 2021-09-29 | https://rekt.news/compound-rekt/ | Lending | Ethereum | Contract Exploit | An error on their contract was called and exploited multiple times before it could be fixed | ||||||||||||||||||||||
9 | Vulcan Forged | Unaudited | $ 140.00 | 2021-12-13 | https://rekt.news/vulcan-forged-rekt/ | GameFi | Ethereum, Polygon | Uncertain - Compromised Keys | Integrated wallets' private keys compromised and drained | PYR tanked and funds seem largely held in wallets | |||||||||||||||||||||
10 | Cream Finance | Unaudited | $ 130.00 | 2021-10-21 | https://rekt.news/cream-rekt-2/ | Lending | Ethereum | Contract Exploit | Use flash loan to manipulate pricing oracle and repay at a depressed price | Don't piss off insiders and really think through edge cases with pricing oracles | Tornado, renBridge for BTC, stake CRETH2 in Uniswap | Y | Y | Compound fork | |||||||||||||||||
11 | Badger | Unaudited | $ 120.00 | 2021-12-02 | https://rekt.news/badger-rekt/ | Yield Aggregator | Ethereum | Front-End Hack | Front-end attack, potentially via compromised Cloudflare account, to approve spending unlimited funds | Pause activity good idea, but needed to take user report of sus activity sooner | BTC bridged back to Bitcoin and ERC20 remain on Ethereum | ||||||||||||||||||||
12 | Harmony Bridge | N/A | $ 100.00 | 2022-06-23 | https://rekt.news/harmony-rekt/ | Bridge | Harmony One, Ethereum, BSC | Uncertain - Compromised Keys | Entire bridge drained from 2 compromised addresses | Need more than 2 signers + better opsec | Could be Lazarus Group | ||||||||||||||||||||
13 | Mirror Protocol | Unaudited | $ 92.00 | 2021-10-08 | https://rekt.news/mirror-rekt/ | Derivatives | Terra | Contract Exploit | Lock contract didn't check for duplicate calls allowing attacker to unlock collateral deposited multiple times | Amount monitoring, contract audit and definitely better communications | |||||||||||||||||||||
14 | Fei Rari | Unaudited | $ 80.00 | 2022-05-01 | https://rekt.news/fei-rari-rekt/ | Yield Aggregator | Ethereum | Contract Exploit | Use a flashloan to borrow 2K ETH, reentrant call bypassing checks, and never recorded borrowed amount | Stop forking Compound, and watch those re-entrancy conditions | Tornadoed $15M and remaining in wallet | Y | Y | Compound fork | |||||||||||||||||
15 | Qubit Finance | Theori | $ 80.00 | 2022-01-28 | https://rekt.news/qubit-rekt/ | Bridge | BSC, Ethereum | Contract Exploit | Lending protocol with bridge; exploited flaw to bypass need to deposit funds to withdraw on other chain | Eliminate vestigial functions, cross-chain is hard | Remains in BSC wallet | Theori audit 2021-12-13; lending platform with built-in bridge that was hacked | |||||||||||||||||||
16 | Ascendex | Unaudited | $ 77.70 | 2021-12-12 | https://rekt.news/ascendex-rekt/ | CEX | CEX | Uncertain - Compromised Keys | Funds drained from compromised hot wallet | Don't trust CEX with your funds | |||||||||||||||||||||
17 | EasyFi | Unaudited | $ 59.00 | 2021-04-19 | https://rekt.news/easyfi-rekt/ | Lending | Polygon | Opsec Failure | Compromised machine but maybe sus? | ||||||||||||||||||||||
18 | Uranium Finance | Unaudited | $ 57.20 | 2021-04-28 | https://rekt.news/uranium-rekt/ | DEX | BSC | Contract Exploit | Exploited a simple math that allowed swapping 1 token for 98% of the total balance but also sus | Modify forked contracts as your own risk | Most taken out through Tornado | Y | |||||||||||||||||||
19 | bZx | Unaudited | $ 55.00 | 2021-11-05 | https://rekt.news/bzx-rekt/ | Lending | Polygon, BSC, Ethereum | Opsec Failure | Dev phished leading to compromised wallet phrase | Protocols with user funds need to take opsec much more seriously | |||||||||||||||||||||
20 | Cashio | Unaudited | $ 48.00 | 2022-03-23 | https://rekt.news/cashio-rekt/ | Payments | Solana | Contract Exploit | Bypassed validation by creating fake root contract that is never validated and chain of fake accounts | Validation checks are critical. Audit? | Majority of funds bridged back to Ethereum and sitting in wallet | ||||||||||||||||||||
21 | Pankcake Bunny | Haechi | $ 45.00 | 2021-05-19 | https://rekt.news/pancakebunny-rekt/ | Yield Aggregator | BSC | Contract Exploit | Used flash loans to manipulate price on pools via a bug and claim massive reward | Damn bugs, maybe guard against edge cases in pools? | Cashed out BUNNY token reking price and TVL | Y | |||||||||||||||||||
22 | Kucoin | Internal | $ 45.00 | 2020-09-29 | https://rekt.news/epic-hack-homie/ | CEX | Ethereum | Opsec Failure | Hot wallet private key used to remove funds | Article lists $150M, maybe as high as $280M | |||||||||||||||||||||
23 | Alpha Finance | Quanstamp, Peckshield | $ 37.50 | 2021-02-13 | https://rekt.news/alpha-finance-rekt/ | Yield | Ethereum | Contract Exploit | Most likely an insider exploted contract mechanisms and bugs in unannounced contracts | Large number of people involved means more difficult to chase down inside jobs | Funds distributed to pools, Tornado, and more | Y | Y | ||||||||||||||||||
24 | Vee Finance | Slowmist, Certik | $ 34.00 | 2021-09-21 | https://rekt.news/veefinance-rekt/ | Lending | Avalanche | Contract Exploit | Created fresh trading pairs, leveraged trading, manipulate prices from single source oracle | Avoid projects from pump groups, avoid projects that ignore their auditors | Bridged back to Ethereum and held in wallet | Y | |||||||||||||||||||
25 | Crypto.com | Deloitte | $ 33.70 | 2022-01-18 | https://rekt.news/cryptocom-rekt/ | CEX | CEX | Unknown | Crypto has not acknowledged but much ETH and BTC moved from user wallets to tumblers | ||||||||||||||||||||||
26 | Meerkat Finance | Unaudited | $ 32.00 | 2021-03-04 | https://rekt.news/meerkat-finance-bsc-rekt/ | Yield Aggregator | BSC | Contract Exploit | Sus rug; exploited permissionless init function allowing them to become vault owner, drained vaults | Crtiical to use checks and extra care when using proxy contracts | |||||||||||||||||||||
27 | MonoX | Halborn, Peckshield | $ 31.40 | 2021-11-30 | https://rekt.news/monox-rekt/ | DEX | Polygon, Ethereum | Contract Exploit | Manipulated native token price via a bug, used to swap for all other toekns | Bugs suck esp when they get prices wrong, tokenIn and tokenOut could be same token... | Appears to be mostly gone | ||||||||||||||||||||
28 | Spartan Protocol | Certik | $ 30.50 | 2021-05-02 | https://rekt.news/spartan-rekt/ | DEX | BSC | Contract Exploit | Took advantage of flawed logic for calculating liquidity shares enabling a much larger claim of assets | Subtle but critical difference in current balance vs cached balance | Held in wallet or moved through 1inch to Anyswap | Y | |||||||||||||||||||
29 | Grim Finance | Solidity Finance | $ 30.00 | 2021-12-18 | https://rekt.news/grim-finance-rekt/ | Yield Aggregator | Fantom | Contract Exploit | Exploited reentrancy in depositFor() function | If you modify existing codebase (Beefy), be sure to pay attention to common exploits such as reentrancy | Appears to be mostly gone | Fork of Beefy | |||||||||||||||||||
30 | Wintermute | N/A | $ 27.60 | 2022-06-05 | https://rekt.news/wintermute-rekt/ | N/A | Optimism | Opsec Failure | Wintermute provided incorrect address and exploiter managed to reverse engineer proxy address | Don't delay under assumption that only original wallet owner could get access | 1/20th of OP sold, 1/20 sent to Vitalik, rest remaining | Y | |||||||||||||||||||
31 | StableMagnet | Techrate | $ 27.00 | 2021-06-23 | https://rekt.news/stablemagnet-rekt/ | DEX | BSC | Rugpull | Devs swapped in different library than source code allowing them to steal user funds | Can't trust Techrate, dev reputation matters | Appears to be mostly gone | ||||||||||||||||||||
32 | |||||||||||||||||||||||||||||||
33 | |||||||||||||||||||||||||||||||
34 | |||||||||||||||||||||||||||||||
35 | |||||||||||||||||||||||||||||||
36 | |||||||||||||||||||||||||||||||
37 | |||||||||||||||||||||||||||||||
38 | |||||||||||||||||||||||||||||||
39 | |||||||||||||||||||||||||||||||
40 | |||||||||||||||||||||||||||||||
41 | |||||||||||||||||||||||||||||||
42 | |||||||||||||||||||||||||||||||
43 | |||||||||||||||||||||||||||||||
44 | |||||||||||||||||||||||||||||||
45 | |||||||||||||||||||||||||||||||
46 | |||||||||||||||||||||||||||||||
47 | |||||||||||||||||||||||||||||||
48 | |||||||||||||||||||||||||||||||
49 | |||||||||||||||||||||||||||||||
50 | |||||||||||||||||||||||||||||||
51 | |||||||||||||||||||||||||||||||
52 | |||||||||||||||||||||||||||||||
53 | |||||||||||||||||||||||||||||||
54 | |||||||||||||||||||||||||||||||
55 | |||||||||||||||||||||||||||||||
56 | |||||||||||||||||||||||||||||||
57 | |||||||||||||||||||||||||||||||
58 | |||||||||||||||||||||||||||||||
59 | |||||||||||||||||||||||||||||||
60 | |||||||||||||||||||||||||||||||
61 | |||||||||||||||||||||||||||||||
62 | |||||||||||||||||||||||||||||||
63 | |||||||||||||||||||||||||||||||
64 | |||||||||||||||||||||||||||||||
65 | |||||||||||||||||||||||||||||||
66 | |||||||||||||||||||||||||||||||
67 | |||||||||||||||||||||||||||||||
68 | |||||||||||||||||||||||||||||||
69 | |||||||||||||||||||||||||||||||
70 | |||||||||||||||||||||||||||||||
71 | |||||||||||||||||||||||||||||||
72 | |||||||||||||||||||||||||||||||
73 | |||||||||||||||||||||||||||||||
74 | |||||||||||||||||||||||||||||||
75 | |||||||||||||||||||||||||||||||
76 | |||||||||||||||||||||||||||||||
77 | |||||||||||||||||||||||||||||||
78 | |||||||||||||||||||||||||||||||
79 | |||||||||||||||||||||||||||||||
80 | |||||||||||||||||||||||||||||||
81 | |||||||||||||||||||||||||||||||
82 | |||||||||||||||||||||||||||||||
83 | |||||||||||||||||||||||||||||||
84 | |||||||||||||||||||||||||||||||
85 | |||||||||||||||||||||||||||||||
86 | |||||||||||||||||||||||||||||||
87 | |||||||||||||||||||||||||||||||
88 | |||||||||||||||||||||||||||||||
89 | |||||||||||||||||||||||||||||||
90 | |||||||||||||||||||||||||||||||
91 | |||||||||||||||||||||||||||||||
92 | |||||||||||||||||||||||||||||||
93 | |||||||||||||||||||||||||||||||
94 | |||||||||||||||||||||||||||||||
95 | |||||||||||||||||||||||||||||||
96 | |||||||||||||||||||||||||||||||
97 | |||||||||||||||||||||||||||||||
98 | |||||||||||||||||||||||||||||||
99 | |||||||||||||||||||||||||||||||
100 |