Thieves stole 192,600&nbsp;SOL (~$41.5&nbsp;million) from a wallet belonging to the Swiss cryptocurrency exchange SwissBorg. The attack is being blamed on a vulnerability in the API of Kiln, a <button class="define-target" id="staking">staking</button> partner used for SwissBorg's "Earn" program.<p>SwissBorg announced that they would be reimbursing impacted customers using treasury funds, and working with security firms and law enforcement to try to recover the stolen assets.</p>

"SwissBorg hacked for $41M SOL after third-party API compromise"

"SwissBorg’s SOL Earn Wallet Exploited for $41.5M After Partner's API Is Compromised"

SwissBorg exploit

$41.5&nbsp;million stolen from SwissBorg in Kiln API exploit

A user of the Venus Protocol borrowing and lending platform was successfully phished by an attacker who gained access to their account and drained $13.5&nbsp;million in stablecoins and wBETH. The user signed a malicious transaction, approving the attacker's address for token withdrawals.<p>Venus paused the protocol as they investigated the theft. The project then proposed a vote to force liquidation of the attacker's wallet and recover the stolen funds.</p>

"Venus Protocol pauses after user loses funds in suspected phishing attack"

Venus Protocol user exploited

Venus Protocol user exploited for $13.5&nbsp;million; most funds later recovered

The Bunni <button class="define-target" id="dex">decentralized exchange</button> was exploited for approximately $8.4&nbsp;million across the Unichain Ethereum <button class="define-target" id="layer-2">layer 2</button> network and the Ethereum mainnet. Bunni acknowledged the theft and paused the protocol shortly after the attack.

"Decentralized exchange Bunni loses an estimated $8.4 million in smart contract exploit"

Bunni exploit

Bunni decentralized exchange exploited for $8.4&nbsp;million

The YU bitcoin-backed <button class="define-target" id="stablecoin">stablecoin</button> list its intended dollar <button class="define-target" id="peg">peg</button> after what they described as "an attempted attack", later writing that there was an "unauthorized transfer of funds". Although they initially wrote that "All funds are safe", they later stated that they "identified the stolen assets on-chain and are actively working with law enforcement to pursue recovery." Research firm Lookonchain observed a large mint of the YU token that may have been related — if so, the attacker successfully stole at least 1,501&nbsp;ETH ($6.75&nbsp;million), and holds a substantial quantity of YU they still haven't sold.<p>Despite the project's attempted reassurances, the YU stablecoin lost its $1 peg, plummeting as low as around $0.20. As of writing, about a day later, the stablecoin is still well below its peg, at around $0.94.</p>

Yala stablecoin depegs

Yala stablecoin depegs after theft

The Nemo Protocol on the Sui blockchain suffered a $2.4&nbsp;million exploit. The <button class="define-target" id="defi">defi</button> yield infrastructure protocol acknowledged the theft shortly after, explaining they had paused the protocol <button class="define-target" id="smart-contract">smart contracts</button> as they investigated the theft. It appears the thief was able to <button class="define-target" id="oracle-manipulation">manipulate</button> a price oracle, siphoning $2.4&nbsp;million in USDC from the project. They then <button class="define-target" id="bridge">bridged</button> the funds from Arbitrum to Ethereum.

"Sui-based Nemo Protocol exploited for $2.4 million"

Nemo Protocol exploit

Nemo Protocol exploited for $2.4&nbsp;million

A <button class="define-target" id="bridge">bridge</button> for Shibarium, the <button class="define-target" id="layer-2">layer-2</button> network for the Shiba Inu project, was exploited for approximately $2.4&nbsp;million in funds. The attacker bought 4.6&nbsp;million BONE tokens (the governance token for Shibarium) using a <button class="define-target" id="flash-loan">flash loan</button>, then used compromised validator signing keys to take control of the majority of validator power. Then, they used that control to drain around 225&nbsp;ETH and 92.6&nbsp;billion SHIB, together priced at around $2.4&nbsp;million at the time of the theft.<p>The project has paused staking on the network, freezing the BONE tokens borrowed by the attacker, which may limit the attacker's profits.</p>

"BONE Price Surges 40% After Shibarium Flash Loan Exploit"

"Shibarium bridge suffers 'sophisticated' flash loan attack, with $2.4 million drained"

Shibarium bridge hit with $2.4&nbsp;million flash loan attack

John-Paul Thorbjornsen, the founder of Thorchain and Vultisig, suffered a wallet drain, reportedly after experiencing a video meeting scam from an attacker who had exploited the Telegram account belonging to one of his friends. According to JP, the scammer used a malicious video call link to place malware on his computer, which then exfiltrated private keys for one of his crypto wallets. Some questioned whether he had made up the story, as he immediately began using the story to promote his Vultisig product.<p>Later that week, Thorbjornsen apparently suffered another loss — this one confirmed on-chain to be around $1.35&nbsp;million.</p><p>According to crypto sleuth zachxbt, the attackers appeared to be a part of North Korean crypto hacking operations. "JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits. So it’s a bit poetic he got rekt here by DPRK," he wrote.</p>

"THORSwap issues bounty offer tied to more than $1M exploit of THORChain founder's wallet"

Event	Date	Amount More info	Recovered More info
SwissBorg exploit	September 9, 2025	$41,500,000
Venus Protocol user exploited	September 2, 2025	$13,500,000	$11,400,000
Bunni exploit	September 2, 2025	$8,400,000
Yala stablecoin depegs	September 14, 2025	$6,750,000
Nemo Protocol exploit	September 7, 2025	$2,400,000
Shibarium bridge hit with $2.4 million flash loan attack	September 12, 2025	$2,400,000
Thorchain founder exploited	September 9, 2025	$1,350,000