$282.9M lost this week $2.0B lost in 30 days $95.2B lost this year
An attacker moved approximately $6.07 million from Duelbits' hot wallets across five chains in a suspected private-key compromise. The platform was taken offline for investigation and system security, later reopening on September 27, 2026, with deposits and withdrawals enabled. This incident follows a similar $4.6 million theft in February 2024.
Source: Rekt News (opens in a new tab)
An exploit on MALT on the Polygon network resulted in the draining of approximately 13,440 DAI from the Capital Source treasury. The exploit involved unisolated treasury rebalance capital, allowing a negligible swap to yield a disproportionate MALT output.
MALT experienced a loss of approximately $72k due to a vulnerability in its swap function. The function recorded caller input and pre-swap reserves, then invoked an external rebalanceHook before transferring output, allowing for manipulation.
Duelbits experienced a suspicious outflow of approximately $4.3 million in cryptocurrency across Ethereum and BNB Chain. The stolen funds were subsequently swapped by the attacker.
On September 3, 2026, approximately 4,011 XRPH Wallet user accounts were compromised due to seed phrase leakage, resulting in the theft of XRPH, XRPHAI, and other assets totaling around $452,000. The stolen funds were bridged to Ethereum and converted to DAI, which remains in a single address. The XRPH Wallet project confirmed the XRP Ledger itself was not affected, took the app offline, and is investigating.
Term Labs was targeted in a governance attack, resulting in a loss of approximately $8.5 million. The stolen funds, including 2,843 ETH and $1.6 million DAI, are currently held at a specific address.
The address labeled Bofur Capital lost $2M due to an address poisoning attack after withdrawing from Compound. A phisher sent a small USDC transaction to spoof the address, and the victim mistakenly copied the wrong address, leading to the drain. The stolen funds were swapped to 2M DAI.
Unknown victims were drained of $25.6 million in crypto, including aWBTC, DAI, WBTC, and ETH. The hacker swapped the stolen funds and holds them across four addresses.