Hackers Stole $163M in Crypto in August, +15% vs July

Hackers stole $163M in crypto in August, +15% vs July, ~16 incidents, including losses at a BTC hodler, BtcTurk, ODIN FUN, BetterBank, CrediX.

What Accounts for an ~$21–22M Increase Compared to Last Month?

In fact, just 5 major incidents. First of all, the largest individual loss of 783 BTC – worth $91.4 million at the time, according to PeckShieldAlert. Next come hacks of crypto platforms, and the remainder from smaller local incidents amounted to roughly 1% in total, a little over $1M.

BtcTurk: Repeat Compromise and the Exchange's Response

The Turkish crypto exchange BtcTurk is experiencing a second major incident in just over a year: $50M in August 2025 after $54M in June 2024 – combined losses exceed $100M. CEO Özgür Güneri confirmed the detection of unauthorized access, the affected wallets were frozen, and investigations with local authorities are underway.

ODIN FUN – AMM Logic Vulnerability After an Update

A memecoin launchpad that fell victim to roughly $7M due to a bug in AMM liquidity code. Attackers deposited BTC together with SATOSHI, ODINPEPE, and other tokens and, using disproportionate deposits and self-trading, inflated the internal valuation of those tokens relative to BTC. They withdrew ~58.2 BTC, and the attack was carried out by several accounts. The platform froze operations pending audits.

BetterBank.io – Rogue Reward Minting on PulseChain

The protocol lost up to $5M due to unauthorized minting of rewards based on user-generated liquidity pairs. The attacker could mint rewards and bypass bulk-mint taxes using external pairs. The team quickly paused operations, announced a restart of the reward contract, re-issuing rewards to prior holders, with loss coverage from reserves.

CrediX Finance – Control Over the Multisig and Bridges, Then Silence

About $4.5M in losses after gaining access to the multisig admin and bridge wallets roughly six days before the main liquidity extraction. The scenario included minting new tokens, posting them as collateral, and subsequently withdrawing funds from pools. The site then went offline, and the X and Telegram channels were deleted. Before disappearing, the team posted and then deleted a note about an alleged agreement with the exploiter to return funds within 24–48 hours, funded by the treasury, and promised to compensate users via an airdrop – the return didn't happen yet.

Join BloFin and qualify for up to $1,000 today

Start Trading

What Key Security Gaps Does August Highlight?

Of course, social engineering remains highly relevant and can lead to very substantial losses. Centralization remains a problem, particularly where centralized exchange infrastructure allows escalation of access to exchange wallets. Also in scope are administrative multisig keys and bridge wallets as a single point of total compromise. The pricing logic and AMM invariants without proper audit also remain exploitable, notably. Likewise, issuance and reward mechanisms are tied to external liquidity pairs.

Use only trusted crypto platforms, always be careful with your data, and stay tuned for the latest updates in crypto, blockchain, and DeFi.