Crypto Influencer | Tokenomics Expert | Web3 Strategist| Insights, news & memes from the crypto space. Helping you understand, build & thrive in digital assets.
Crypto/Finance
Joined March 2021
- Tweets5.8K
- Following305
- Followers631
- Likes7.7K
One sourced case a day, dates and numbers, never a price call. Today's spotlight: Ronin Bridge's $625M. Reply with the hack or scam you want covered next and I'll add it to the list.
Dec 2022: Ankr Protocol had a private key compromised that let an attacker call a hidden mint function and create quadrillions of aBNBc tokens from nothing. The attacker dumped a fraction before anyone noticed, still pulling about $5M.
April 2022: Inverse Finance lost about $15.6M after an attacker manipulated the price of a low-liquidity token on its own oracle, then borrowed far more than any real collateral covered. The same protocol got hit again two months later through a different oracle.
Unpopular opinion: an exploit an attacker later returns isn't a 'happy ending' -- it just means this particular attacker didn't want the heat. The flaw that let it happen was exactly as real either way.
March 2022: Cashio, a stablecoin protocol on Solana, lost about $52M after an attacker found a way to mint collateral tokens the contract never actually verified were real. The coin minted from nothing was worth zero seconds later.
March 2023: Euler Finance lost about $197M after an attacker combined a flash loan with a flaw in its 'donate to reserves' function to fake a bad debt position and drain healthy collateral. Unusually, the attacker returned nearly all the funds weeks later.
Which is scarier: a bridge exploit you can't stop once it's in motion, or a compromised frontend that tricks you into signing away access yourself? Reply A or B.
Dec 2021: Badger DAO lost about $120M after attackers injected malicious code into its website through a compromised Cloudflare API key -- not the smart contracts. Users approving a routine-looking transaction were quietly granting withdrawal rights on their wallets.
Feb 2022: Wormhole, a bridge connecting Solana to Ethereum, lost about $325M after an attacker found a way to fake a validator signature check, minting 120,000 wrapped ETH on Solana backed by nothing. Jump Crypto covered the loss within days to keep the bridge solvent.
March 2022: Ronin Bridge, the sidechain behind Axie Infinity, lost $625M in ETH and USDC -- still one of the largest crypto hacks ever recorded. No smart contract bug. Here's what actually happened 🧵
From there they compromised 4 Sky Mavis nodes. A 5th signature came from a validator run by the Axie DAO, which had never revoked emergency access it granted Sky Mavis nine months earlier.
I've been logging every case here with dates, sources and exact numbers -- no price calls, ever. If you want the running list in one place, reply 'list' and I'll DM it over.
July 2025: GMX, a decentralized perpetuals exchange on Arbitrum, lost about $42M in under an hour. No stolen keys, no rug pull -- just a reentrancy path nobody caught before launch. 🧵
Unpopular opinion: a team going silent for a few hours right after a suspicious on-chain transaction is a worse signal than the transaction itself. Silence is a choice. A drained wallet isn't.