Hacks

A federal judge ordered Guo to forfeit $889 million after a jury convicted him of running a scheme that raised over $1 billion partly through the fake Himalaya Coin cryptocurrency.

Blockchain intelligence firm AMLBot has confirmed the Polymarket supply-chain attack total at approximately $3.1 million in PUSD across 11 user wallets, with funds bridged from Polygon to Ethereum and converted to ETH. Polymarket has pledged full refunds but has not named the compromised vendor.

Polymarket confirmed hackers drained approximately $3 million through a compromised third-party vendor that injected malicious code into the platform's website, and pledged full refunds to fewer than 15 affected accounts.

An attacker forged withdrawal proofs using an RSA-3072 private key accidentally committed to Taiko’s public raiko GitHub repository, draining $1.7 million from L1 bridge contracts and forcing the protocol to halt block production and urge all users to exit.

Secret Network's cross-chain bridge to Axelar has been suspended after an attacker exploited a years-old minting flaw in a CW20-ICS20 contract to drain $4.67 million in wrapped tokens over seven undetected days. The exploit ran from June 10 to June 17, drained seven Axelar-wrapped assets, and has sparked a dispute between the two teams over contract responsibility.

An attacker drained more than $7.5 million from jaredfromsubway.eth, the Ethereum address tied to roughly 70% of sandwich attacks on the network, after a counter-MEV honeypot fed it 66 fake token contracts over several weeks. Blockaid disclosed the exploit Saturday.

An Ethereum address tied to the HashFlare cloud-mining Ponzi moved 10,600 ETH worth about $18.5 million on Monday morning after sitting idle for roughly three and a half years. Onchain investigator ZachXBT, with help from security firm Cyvers, flagged the movement, the first activity from the address since the long-running scheme collapsed.

An attacker exploited a proof-verification flaw in Aztec Connect's abandoned RollupProcessorV3 contract to withdraw roughly $2.1 million, including 909 ETH, from a privacy bridge that Aztec Labs shut down three years ago and can no longer control.

The on-chain options and structured product protocol Thetanuts Finance was exploited for $2.1 million. Security firm Blockaid published the exploit transaction and exploiter address shortly after the attack.

DeFi logged approximately 70 separate exploits in Q2 2026, roughly doubling the previous quarterly record, even as the $746 million dollar total remains a fraction of historical single-event peaks.