Avalanche Safe Stale-Approval Drain
A stale, unrevoked token approval let an attacker drain ~$7.45M from a 2-of-7 Safe multisig on Avalanche, but a MEV bot front-ran the theft and returned most funds.
Loss
7.5M
USD
Volume I · The catalog
Since 2009, more than $15.32B has been drained from blockchains and the businesses that touch them. This is the running ledger — citation-first, on-chain verifiable, and updated as we learn more.
Front page · The biggest№ 001
Bybit Heist
Malicious JavaScript injected into Safe{Wallet}'s signing UI drained 401,000 ETH ($1.46B) from a Bybit cold-wallet transfer, the largest crypto theft ever.
Recent filings
All →Bloom Trading Solana Bot Wallet Drain
A remote code execution flaw in a third-party module let an attacker drain roughly $947,000 in SOL from 49 wallets belonging to nine users of the Bloom Trading Telegram bot.
Loss947.0KUSDX100 Global Senate Governance Takeover
A flash loan bought two of three governance Senate seats in a single block, passing a malicious proposal that drained roughly $4.85M from X100 Global's treasury.
Loss4.8MUSDInitia Unauthorized Mint
A Move function flaw let an attacker mint unbacked tokens on the Initia L1 and bridge roughly $2.6M to Ethereum, forcing a full chain and rollup halt.
Loss2.6MUSDNemTokenV2 Liquidity Pool Accounting Exploit
A settlement-accounting flaw in the NemTokenV2 contract let an attacker drain its PancakeSwap pool on BNB Chain for roughly $822,000 by repeatedly skimming reserves.
Loss821.9KUSDWAX Bridge Zero-Fee Withdrawal Exploit
A missing fee check in WAX's bridge withdraw function let an attacker pull mapped tokens for free, draining about $90,500 across WAX, Solana and Ethereum.
Loss90.5KUSD