A vault flaw created during a routine code refactor three years ago enabled a $1.3 million theft on the Radix blockchain, forcing validators to halt the network for 10 days. The Radix Foundation disclosed the incident on September 17.
Decentralized cross-chain swap protocol Chainflip paused its network after losing 736,442.17 USDT through six unauthorized payouts when an attacker exploited its handling of TRON transaction memos. The protocol has announced users will be made whole.
Balancer issued a warning on Aug. 31 for liquidity providers to withdraw from its deprecated V1 pools after a fixed-point rounding flaw led to approximately $234,000 being drained. The deprecated pools are non-pausable, leaving withdrawal as the only protection.
Hackers exploited a critical balance-handling flaw in the Cosmos EVM module to drain funds from six blockchains between August 20-25, 2026. Cosmos Labs had identified the vulnerability affecting approximately 40 blockchains but failed to act for four months before the attacks occurred.
Cross-chain decentralized exchange Maya Protocol suspended its network after an attacker exploited multiple software vulnerabilities to steal approximately $1.7 million in Bitcoin and other cryptocurrencies. The exploit caused the protocol's native CACAO token to plummet 89%.
The Coreum cross-chain bridge connecting to the XRP Ledger was drained of approximately 199,916 XRP on August 9 in under two hours. The attack exploited a flaw in the bridge's relayer logic rather than a vulnerability in the XRP Ledger itself.
An attacker exploited a missing eight-byte check in Across Protocol's offchain code to fabricate $41.7 million in Solana deposit events, draining approximately $4 million from a Risk Labs-operated relayer on July 17, 2026. The attack was part of a broader wave of cross-chain bridge exploits that drained over $35 million across multiple protocols within hours.
The BY token project suffered an $88,400 loss through a Binance Smart Chain exploit targeting vulnerable contract logic, occurring during what security firm CertiK identified as the worst month for DeFi exploits in four years with attacks on 27 out of 30 days in April 2026.
