New incidents on the YFarmX Crypto Exploit Tracker: what was hit, how much was lost and how the attack worked, with on-chain references and sources on every record.https://yfarmx.com/en-GBhttps://yfarmx.com/tools/exploit-tracker/exploit-0132/https://yfarmx.com/tools/exploit-tracker/exploit-0132/Liquid acknowledged a roughly 4,000 BTC withdrawal, valued at about $320m at the time. SideSwap says the L-BTC used for the peg-out was created through an Elements bug. On 7 September, 3,400 BTC returned to the federation address; the return transaction sent 598.49955894 BTC back to the actor. The dollar figure here is the initial gross withdrawal estimate, before recovery.Sun, 06 Sep 2026 00:00:00 GMTSoftware BugLiquid / BitcoinBridgehttps://yfarmx.com/tools/exploit-tracker/exploit-0004/https://yfarmx.com/tools/exploit-tracker/exploit-0004/Aquifer, an automated market maker on Solana, was exploited on 31 August 2026. DefiLlama records the loss at $2,469,729 and classifies it as an access-control incident involving an arbitrary external call.Mon, 31 Aug 2026 00:00:00 GMTAccess ControlSolanaAMMhttps://yfarmx.com/tools/exploit-tracker/exploit-0003/https://yfarmx.com/tools/exploit-tracker/exploit-0003/Security firm Blockaid flagged a suspected exploit on More Markets, a lending protocol on Flow EVM, on 31 August 2026, saying an attacker combined Ankr’s liquid staking token ankrFLOW with Aave V3 efficiency mode to overborrow against the mFlowWFLOW reserve. More Markets said the same day that it was investigating a claim it had been exploited. DefiLlama records the loss at $410,000, an unbacked mint.Mon, 31 Aug 2026 00:00:00 GMTSmart Contract BugFlowLendinghttps://yfarmx.com/tools/exploit-tracker/exploit-0002/https://yfarmx.com/tools/exploit-tracker/exploit-0002/Ontology’s core development team paused mainnet block production on 31 August 2026 after what it first described as a potential security concern found during a routine check. A follow-up on 1 September confirmed it had identified malicious attack activity targeting the network. The chain resumed on 2 September, with every sync node required to upgrade to v3.1.5.Mon, 31 Aug 2026 00:00:00 GMTOtherOntologyLayer 1https://yfarmx.com/tools/exploit-tracker/exploit-0001/https://yfarmx.com/tools/exploit-tracker/exploit-0001/An attacker exploited Injective’s binary-options settlement and insurance-fund logic on 31 August 2026. Block production stopped for 3 hours 42 minutes while an emergency release, v1.20.3-safeharbor.1, was deployed. Injective’s official account described the incident on 1 September as an accelerated network upgrade and said the blockchain and INJ remained secure throughout. Co-founder Eric Chen said Injective users were not affected and that the team had helped with recovery.Mon, 31 Aug 2026 00:00:00 GMTSmart Contract BugInjectiveDerivativeshttps://yfarmx.com/tools/exploit-tracker/exploit-0006/https://yfarmx.com/tools/exploit-tracker/exploit-0006/Cronos's post-mortem puts Tectonic's 30 August collateral-manipulation incident at approximately $120.4m in affected borrowing. A validator-coordinated rollback reversed about $111.2m; Cronos says $9.19m had left the chain before the halt and remained unrecovered. The headline figure records gross affected borrowing, before the restoration.Sun, 30 Aug 2026 00:00:00 GMTOracle ManipulationCronosLendinghttps://yfarmx.com/tools/exploit-tracker/exploit-0005/https://yfarmx.com/tools/exploit-tracker/exploit-0005/An attacker exploited a rounding error in an unmaintained legacy Balancer V1 pool on Ethereum on 30 August 2026. DefiLlama, filing it under the Balancer parent protocol, records the loss at $234,000 and classifies it as a token and share accounting rounding error.Sun, 30 Aug 2026 00:00:00 GMTSmart Contract BugEthereumAMMhttps://yfarmx.com/tools/exploit-tracker/exploit-0007/https://yfarmx.com/tools/exploit-tracker/exploit-0007/On 28 August 2026, Avici, a Solana-based neobank, said its card-issuing partner Rain had identified a vulnerability in an outdated version of a Solana card contract holding user card balances. Avici puts the amount drained at $500,859.22 across 1,685 affected users, all of whom it says will be refunded in full. The contract was upgraded across all programs, no further unauthorised activity has been observed, and a report was filed with the FBI's IC3.Fri, 28 Aug 2026 00:00:00 GMTAccess ControlSolanaPaymentshttps://yfarmx.com/tools/exploit-tracker/exploit-0008/https://yfarmx.com/tools/exploit-tracker/exploit-0008/On 27 August 2026, between 06:09:45 and 09:46:25 UTC, an attacker inflated the price of MAMO on Moonwell's Base deployment and borrowed against the inflated collateral, taking 71.36 cbBTC, 623.60 WETH, 2,560,000 USDC and 368 wstETH, $11,028,762 in all. PeckShield and CertiK put the attacker's proceeds at about $8.7m, aggregated in DAI on Ethereum; the postmortem by Anthias Labs estimates the net gain at $6,784,655 against roughly $1.947m of capital deployed, seeded from about 799 ETH, with residual bad debt of about $9.131m.Thu, 27 Aug 2026 00:00:00 GMTOracle ManipulationBaseBorrowinghttps://yfarmx.com/tools/exploit-tracker/exploit-0009/https://yfarmx.com/tools/exploit-tracker/exploit-0009/On 25 August 2026, an accounting bug in the Comet AMM's BLND-USDC pool on Stellar, the backstop for the Blend lending protocol, allowed same-asset swaps of USDC for USDC that corrupted the pool's reserve calculations. SlowMist logs the drain at $717,518.92. Blend's operators paused the backstop; Blend said its own contracts were not at fault and lending-pool deposits were not at risk, but backstop depositors holding Comet BLND-USDC LP shares took the loss.Tue, 25 Aug 2026 00:00:00 GMTSmart Contract BugStellarAMMhttps://yfarmx.com/tools/exploit-tracker/exploit-0010/https://yfarmx.com/tools/exploit-tracker/exploit-0010/On 23 August 2026, an attacker took governance control of Term Finance's Strategy and Meta Vaults, built on Yearn v3, and drained about 2,843 ETH plus 1.68m USDC, roughly $8.5m in all, swapping the stablecoins to DAI. The takeover cost about $951: the attacker bought 0.4852 tmvETH for roughly 0.5 ETH and staked it, and because the pre-drain staked supply was just 0.5352 gtmvETH, that stake carried about 90.66 per cent of all votes, per GoPlus Security's breakdown.Sun, 23 Aug 2026 00:00:00 GMTGovernance AttackEthereumLendinghttps://yfarmx.com/tools/exploit-tracker/exploit-0011/https://yfarmx.com/tools/exploit-tracker/exploit-0011/On 22 August 2026, TAC, a Cosmos-based EVM chain bridging the TON ecosystem, was drained of about $7.5m from a custodial account through a flaw in the shared Cosmos EVM module, and validators halted the chain at block 24,671,475. The same day KiiChain lost 148,326,583.15 KII to 18 repeats of the technique and halted at block 9,355,723, and MANTRA halted for roughly 30 hours before restarting.Sat, 22 Aug 2026 00:00:00 GMTOtherTACLayer 1https://yfarmx.com/tools/exploit-tracker/exploit-0012/https://yfarmx.com/tools/exploit-tracker/exploit-0012/From 23:41 UTC on 21 August 2026, an attacker used a call-on-behalf convenience feature in SAND's omnichain token contract on Base to register itself as bridge administrator, reconfigured the LayerZero verification settings so it alone could authorise mints, and minted unbacked SAND on Base and BNB Smart Chain. The sums extracted were far smaller than the mint: 14,742,341.84 SAND, about $697,000, was withdrawn from the Ethereum vault, and a further 93,415,334.86 SAND was sold on Base for 327.59 WETH, for a total attacker capture of about $987,000. The Sandbox's own post-mortem puts the total economic impact at about $1,496,784, and that is the figure logged here.Fri, 21 Aug 2026 00:00:00 GMTAccess ControlMultichainGaminghttps://yfarmx.com/tools/exploit-tracker/exploit-0013/https://yfarmx.com/tools/exploit-tracker/exploit-0013/Between 21:02 UTC on 19 August and 01:54 UTC on 20 August 2026, an attacker moved 286,543,148 BB in 14 transactions from nine BounceBit mainnet accounts over four hours and 52 minutes; block production was halted at height 20,702,857 at 02:36:37 UTC, 42 minutes after the final unauthorised transfer. BounceBit's own account states no dollar figure; at market prices the sum was near $3m, and that conversion is the figure logged here. The flaw sat in the Evmos stack the BTC-restaking chain was built on: a caller could name an arbitrary account as the funding source, with no check that the account had authorised it.Wed, 19 Aug 2026 00:00:00 GMTAccess ControlBounceBitRestakinghttps://yfarmx.com/tools/exploit-tracker/exploit-0014/https://yfarmx.com/tools/exploit-tracker/exploit-0014/On 30 July 2026, bitcoin began draining out of Coldcard-generated addresses in waves, the first taking about 594 BTC from roughly 500 wallets in 25 minutes. TRM Labs' 5 August analysis puts the running total at about 1,816 BTC, roughly $116m, from more than 5,200 addresses across at least four waves, making it the largest hardware-wallet exploit of 2026 by TRM's accounting. Coinkite had disclosed the same day the draining began that a build flag set to zero in March 2021 replaced the hardware random number generator with a software fallback, cutting Mk3 seeds to roughly 40 bits of real randomness against a 128-bit target. No device was touched: the seeds were guessable.Thu, 30 Jul 2026 00:00:00 GMTPrivate Key CompromiseBitcoinWallethttps://yfarmx.com/tools/exploit-tracker/exploit-0015/https://yfarmx.com/tools/exploit-tracker/exploit-0015/On 28 July 2026, an attacker exploited missing access control on the vault behind Crypto DAO's Pro token, calling a state-changing exec() function that had been left publicly callable in a single flash-loan-assisted transaction. Per GoPlus Security's analysis, carried in SlowMist's database, the attacker's actual profit was about $52,000, with the contract losing around 167,200 Pro tokens.Tue, 28 Jul 2026 00:00:00 GMTAccess ControlBNB ChainDeFihttps://yfarmx.com/tools/exploit-tracker/exploit-0016/https://yfarmx.com/tools/exploit-tracker/exploit-0016/On 26 July 2026 an attacker compromised ownership of a contract behind WEMIX$, the dollar stablecoin of the WEMIX gaming chain, and issued 5,225,525 tokens without authorisation. WEMIX says those were converted into 30,736 WEMIX and 724,198.27 USDC.e, which was bridged to Ethereum and BNB Smart Chain, swapped into ETH and USDT and spread across wallets, with some deposited at centralised exchanges.Sun, 26 Jul 2026 00:00:00 GMTAccess ControlWEMIX3.0Stablecoinhttps://yfarmx.com/tools/exploit-tracker/exploit-0017/https://yfarmx.com/tools/exploit-tracker/exploit-0017/On 25 July 2026, wallets belonging to Triple-A, a licensed digital payments company, were drained of more than $9.7M across TRON, Ethereum, Polygon and Arbitrum. The attacker bridged the proceeds to Ethereum and consolidated about 5,227 ETH into a single address. The analyst who flagged it reported that deposits had not been disabled, so each new deposit was being taken as it arrived.Sat, 25 Jul 2026 00:00:00 GMTOtherMultichainPaymentshttps://yfarmx.com/tools/exploit-tracker/exploit-0020/https://yfarmx.com/tools/exploit-tracker/exploit-0020/On 23 July 2026, B² Network, a Bitcoin layer-2, lost about $3.86M after an attacker seized the upgrade authority on its staking contract. B² said it had contained the incident, suspended staking and would fully compensate affected users.Thu, 23 Jul 2026 00:00:00 GMTAccess ControlBitcoin L2Stakinghttps://yfarmx.com/tools/exploit-tracker/exploit-0019/https://yfarmx.com/tools/exploit-tracker/exploit-0019/On 23 July 2026, the Verus Ethereum bridge was drained of about $7.54M through the same contract flaw as its May 2026 hack. An attacker forged the cross-chain proof the bridge failed to verify and triggered unbacked payouts, taking ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD.Thu, 23 Jul 2026 00:00:00 GMTBridgeEthereumBridge