hacked

Aave, in collaboration with multiple institutions, has launched the "DeFi United" rescue plan to address the approximately $292 million loss caused by the KelpDAO vulnerability attack and to prevent the spread of bad debts.The attack originated from a vulnerability in the LayerZero integration, where hackers forged uncollateralized rsETH and borrowed approximately $190 million in assets on Aave, leading to collateral distortion and triggering a bank run, causing the platform's TVL to evaporate by about $10 billion at one point.Currently, Lido Finance, EtherFi, and founder Stani Kulechov have proposed funding plans; Arbitrum has frozen some funds, but the remaining assets have been transferred through THORChain, making recovery difficult. The current focus is on joint funding to "patch the holes" and stabilize the DeFi lending system.

According to the official announcement from Volo, a security vulnerability incident occurred with the BTCFi and LST protocols on the Sui network, resulting in approximately $3.5 million in assets (including WBTC, XAUm, and USDC) being stolen from three specific Vaults.After the incident, the team immediately notified the Sui Foundation and ecological partners, and froze all Vaults to prevent further losses. Volo stated that this vulnerability only involved three Vaults, and the remaining Vaults do not have the same attack vector, with approximately $28 million in TVL assets remaining safe. The official emphasized that they will bear the loss themselves and will not pass the loss onto users, and will release a complete post-incident report and remediation plan after the investigation is completed.

On-chain data shows that the Kelp DAO's rsETH bridging protocol based on LayerZero has allegedly been exploited by hackers, resulting in a loss of 116,500 rsETH, worth approximately $292 million.Kelp DAO officials stated that they have detected suspicious cross-chain activities involving rsETH, and have now suspended the rsETH contracts on the mainnet and multiple Layer2s. They are working with security experts and will provide updates on the situation.

According to Cointelegraph, since the $280 million attack on Drift Protocol on April 1, at least 12 DeFi protocols and cryptocurrency companies have been attacked in just over two weeks.Since early April, attacks on crypto protocols or companies include CoW Swap, Hyperbridge, Bybit, Dango, Silo Finance, BSC TMM, Aethir, MONA, Zerion, and the recent Rhea Finance and Grinex exchanges.Among them, the DeFi protocol Rhea Finance reported that the attackers "exploited a vulnerability in Rhea's margin trading feature to execute a coordinated liquidity pool manipulation attack," affecting the Rhea Lend smart contract. According to blockchain security company CertiK, the stolen funds amount to approximately $7.6 million.

According to ZachXBT, Bitcoin Depot submitted an 8-K on April 6, 2026, stating that 50.9 BTC had been stolen; its on-chain tracking shows that 19 high-confidence theft addresses had transferred a total of 54.45 BTC as early as March 20, which is 3.55 BTC more than the disclosed amount, and the funds ultimately flowed into KuCoin, indicating that the company may have only noticed the anomaly three days later.

According to Decrypt, Bitcoin ATM operator Bitcoin Depot Inc. suffered a security breach on March 23, with hackers stealing approximately 50.9 bitcoins from the company's controlled wallet, valued at $3.665 million.It is reported that the attackers infiltrated the company's IT system and obtained credentials for the digital asset settlement account, allowing them to transfer cryptocurrency without authorization. This is at least the second known security incident for the company, which previously experienced a hack in 2023 that resulted in the personal data of 58,000 users being compromised.

According to market news, Bitcoin ATM operator Bitcoin Depot has submitted documents to the U.S. SEC disclosing that the company has encountered a cybersecurity attack. Hackers gained access to digital asset settlement account credentials by infiltrating the IT system and stole approximately 50.9 BTC from the company's wallet, valued at about $3.665 million.After the incident, the company has initiated an emergency response procedure, hired external cybersecurity experts to investigate, and notified law enforcement. The company stated that the customer platform and user data were not affected. This incident has been classified by the company as a significant matter, which may lead to reputational damage and additional costs related to legal and regulatory issues.

According to CoinDesk, Galaxy Digital (GLXY) recently experienced a cybersecurity incident where hackers gained unauthorized access to its isolated research and development workspace. The company stated that the affected environment was only used for research and development, completely isolated from core infrastructure, production systems, trading platforms, and customer accounts, with losses amounting to less than $10,000.Galaxy Digital stated that it quickly intervened, completed the lockdown and reinforcement of the compromised workspace, and deployed additional protective measures at the blockchain infrastructure level.

According to monitoring by PeckShield, LML suffered a hack resulting in a loss of approximately $950,000, causing the LML token to plummet by 99.6%. The attacker exchanged 950,000 USDT for 450.6 ETH and deposited it into TornadoCash.

Huma Finance issued a reminder on platform X that its partner Arf's official X account @arf_one has been hacked. Please do not interact with any posts from that account until it is restored.

According to Reuters: Hackers linked to Iran claim to have hacked the email of the FBI director.

According to Cointelegraph, Immunefi's latest security report shows that cryptocurrency hacking attacks are still steadily occurring, with losses increasingly concentrated in a few large-scale attack events.The report states that between 2021 and 2025, there were 425 publicly known hacking incidents, with an estimated average loss of about $25 million per incident. In just 2024 and 2025, 191 hacking incidents caused losses of $4.67 billion, with only 5 incidents accounting for 62% of the total losses.Additionally, the study tracked 82 tokens that were hacked, of which 83.9% saw their median price drop by 61% within six months, and during this period, the price remained below the price on the day of the attack.

Solv Protocol official announcement, a limited vulnerability exploitation occurred in a single BRO Vault, affecting a very small number of users (fewer than 10), with an affected amount of 38.0474 SolvBTC, approximately 2.7 million USD. All other vaults and user funds remain secure and unaffected. Solv Protocol is actively investigating with security partners and has taken measures to prevent any recurrence of such incidents.Solv Protocol will cover the related losses for affected users. Additionally, the official has reached out to the hacker, offering a 10% white hat bounty if the funds are returned promptly.

According to disclosures from the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain trading results in its order system.The attacker manipulated the nonce, causing on-chain matched trades to be canceled or invalidated before execution, while off-chain records remained valid, leading to API false reports that affected trading behaviors of bots like Negrisk, resulting in user losses. The analysis of the attack process is as follows:The attacker submitted/matched large reverse trades with the market-making bot on the Polymarket off-chain orderbook.The attacker constructed transactions with forged/repeated nonces or utilized on-chain nonce competition, causing the on-chain transactions to inevitably revert.The Polymarket API returned "transaction successful" to the bot before on-chain confirmation, leading the bot to believe that the position had been hedged, while the actual on-chain state had not changed.The attacker then executed real on-chain trades to take advantage of the direction exposed by the bot, thus profiting "risk-free."Since the revert occurred at the chain level, Polymarket fees would not explode, making the attack cost controllable and executable continuously.GoPlus recommends that users pause automated trading tools, verify on-chain trading statuses, enhance wallet security, and closely monitor official announcements from Polymarket.

Arbitrum has issued a security alert on the X platform, and the official X account of Arbitrum Governance has been compromised. Please do not click on any links posted by this account or interact with it. The team is working to restore account access, and updates will be provided later.

According to a post by SolanaFloor on the X platform, multiple treasury and fee wallets of Step Finance were compromised. On-chain data shows that during the attack, approximately 261,854 SOL tokens were unstaked and transferred, worth about 30 million dollars.Additionally, Step Finance's official statement mentioned that they are currently investigating the attack, and more information will be released later.

The community has announced that the official Solar X account (https://x.com/Solana_zh) is suspected to have been hacked, and the account is currently unable to log in. They are urgently contacting the platform for resolution.Solar has also issued a risk warning to the community, stating that during this period, any requests for information, funds, or sensitive operations made in the name of Solar on the X platform are fraudulent. Community users are reminded not to be deceived.

According to crypto analyst Specter (@SpecterAnalyst), the L 1 protocol Saga is suspected to have been hacked, resulting in a loss of approximately $7 million. The attacker has exchanged about $6 million of this amount and transferred it across chains to the Ethereum network.