Someone Spent $4M to Vote $20M Out of BonkDAO's Treasury — And It Was All 'Legal'
A governance attack on BonkDAO drained $20M in BONK tokens from the Solana DAO's treasury using the project's own voting system. No smart contract hack required.
A governance attack on BonkDAO drained $20M in BONK tokens from the Solana DAO's treasury using the project's own voting system. No smart contract hack required.
A supply chain attack on a third-party frontend vendor drained $3.1 million in PUSD from 11 Polymarket wallets. Users never touched a phishing link. They just visited the site. Now the CFTC has opened an investigation into the company for deceptive marketing.
Resupply, a stablecoin lending protocol backed by Convex and Yearn Finance, was drained of $9.5 million via a donation attack on a freshly deployed vault. The attacker started with a $4,000 flash loan and used 1 wei as collateral to borrow 10 million stablecoins.
THORChain was drained across Bitcoin, Ethereum, BNB Chain, and Base simultaneously on May 15. RUNE dropped 12%, all trading and signing was halted, and the team still hasn't explained the attack vector.
April 2026 was the worst month in crypto hack history: 30 attacks, $625M drained, North Korea behind 76% of it. Now a developer is claiming DPRK trained an AI to autonomously exploit DeFi — and the Wasabi Protocol's $5M multi-chain drain may be its latest hit.
A zero-day exploit in Litecoin's MimbleWimble privacy layer triggered a 13-block chain reorg, wiping three hours of transactions. Litecoin denied it was a zero-day. GitHub commits say otherwise.
Kelp DAO's rsETH bridge was drained in minutes after an attacker forged LayerZero cross-chain messages. Bad debt cascaded across Aave, Compound, and Euler. It's 2026's biggest DeFi hack — so far.
A fraudulent Ledger Live app slipped through Apple's review process, stayed live for roughly two weeks, and drained $9.5 million from 50+ victims before ZachXBT blew the whistle.