The year opened quietly. Markets were flat, governance forums were arguing about token emissions, and everyone had just finished tweeting their 2026 security predictions. Then January happened. 20+ incidents. roughly 350M$+ gone.

January 1. PRXVT lost $97K Base
The protocol had a reward system that tracked unique users. Someone figured out that CREATE2 lets you generate wallet addresses deterministically and cheaply .so they generated hundreds of “unique” wallets in bulk, each one claiming rewards as if it were a real user. The protocol couldn’t tell the difference. The year was four hours old.

January 3. Valinity, $63K
Valinity relied on an external price feed to know what assets were worth. The attacker moved that price feed temporarily, artificially and while it was lying, made trades the protocol thought were fair but weren’t. The protocol trusted a number it shouldn’t have trusted. $63K. textbook attack.

January 5. TMX TRIBE ,$1.4M Arbitrum
TMX had a vault that minted receipt tokens when you deposited, and redeemed them when you exited, except the AUM accounting was broken. The vault counted assets it had already paid out as still being “there.” So an attacker deposited, got receipt tokens, triggered the accounting bug, and redeemed more than they put in. Loop it a few times and he walked out with $1.4M. 

January 6. IPOR Fusion ,$336K, Arbitrum
IPOR’s vault ran a plugin system modular components called “fuses” that you could register through governance to extend what the vault could do. The attacker registered a malicious fuse and got it whitelisted through the normal process. Then they used EIP-7702 feature that lets a regular wallet temporarily behave like a smart contract for one transaction to call that fuse with permissions it was never supposed to have. The access control checked who was calling but didn’t account for a wallet pretending to be a contract mid-transaction. The fuse did what the attacker built it to do. $336K drained from a legacy vault. The DAO reimbursed users. The vulnerability lived in the gap between “we approved this plugin” and “we never checked what this plugin could actually touch. source

January 7. Polycule ,$230K, Polygon
No smart contract was exploited here. Polycule’s backend servers had a vulnerability where an attacker could trick the server into making requests on their behalf a classic web2 bug called server-side request forgery. They used it to forge a copy-trade event: a signal the platform treated as a legitimate user instruction. Because the funds sat in a wallet the platform itself controlled custodial architecture ,one forged instruction was enough to authorize the drain. 

January 8. Truebit ,$26.5M, Ethereum
The attacker called getPurchasePrice() with a carefully chosen large value that caused an integer overflow mid-calculation, wrapping the result back to near zero. The contract thought the tokens were free. So the attacker minted 240 million TRU for essentially 0 ETH, sold them back into the bonding curve reserve for real ETH, and repeated the loop until 8,535 ETH was gone. One integer overflow and the company itself gone to zero .

January 10. Social Engineering Scam , $282M
No smart contracts were exploited. No flash loans. No oracle manipulation. Someone with signing authority over a very large wallet was deceived into approving a malicious transaction through a spoofed interface, a compromised communication channel, or both. That’s it. $282 million, two-thirds of January’s entire losses, extracted by lying to a human being. 

January 13. YO Protocol ,$3.7M, Ethereum
When you swap tokens on a DEX, you set a slippage tolerance — the maximum price difference you’ll accept between submitting and executing a trade. YO Protocol’s swap function didn’t enforce a minimum on how much you’d receive out. YO Protocol’s tolerance was configured too loosely.

January 19. Makina $5M, Ethereum
Makina used a spot pool price as its oracle like based on the current price was in a liquidity pool, . With a flash loan attacker borrowed a massive amount of money within a single transaction, use it to temporarily shift that spot price, and interacted with the protocol while it’s lying. The loan was repaid at the end of the same transaction.Thank god the price returned to normal. The damage doesn’t. sedd .

January 20. SynapLogic $186K
Referral system flaw. The buy function took an array of referrer addresses (refBy), each supposed to get 10% of the purchase amount. Attacker filled it with their own address repeated 31 times (310% total). The contract paid out far more than it received, draining funds from the purchase pool. A second similar attack minted tokens but they were locked in vesting and couldn’t be sold. Project later paused and the team reportedly rugged.

January 21. Saga $7M, Saga chain
IBC bridge minting exploit. The attacker deployed a malicious helper contract that abused SagaEVM’s IBC bridge/precompile logic. By crafting custom cross-chain messages, they bypassed validation checks and minted approximately $7M of Saga Dollar ($D) without providing collateral.the vulnerability was inherited from Ethermint, the upstream EVM framework SagaEVM was built on . SagaEVM was paused at block 6,593,800 after the exploit was confirmed.

January 25. Aperture Finance $3.67M, 11 Chains
 Arbitrary call + approval abuse. Aperture V3/V4 contracts exposed an arbitrary external call capability. The attacker exploited this to execute unauthorized transferFrom() calls using existing ERC-20 and ERC-721 approvals that users had previously granted to Aperture. Funds and liquidity position NFTs were drained directly from victim wallets across 11 chains. 

January 26. HypurrFi , $84K, HyperEVM
 HypurrFi accidentally deployed unaudited helper code intended to streamline swaps into lending positions through Euler Finance integration. The vulnerable code was included in a production release and exposed through the frontend before completing a security review. An attacker exploited the flaw in the EulerVaultGateway contract.

January 26. Matcha meta/SwapNet $13.43M, Base + Ethereum
it is same as aperture exploit , the approve(spender, type(uint256).max) pattern . The attacker found a way to invoke transferFrom through those standing approvals and drained wallets . The users' tokens moved without the users doing anything. The approval they signed months ago was still valid, still unlimited, still waiting. $13.43M in a single day, taken not from the protocol contracts but directly from user wallets. The approvals are always valid until you revoke them. Most people never do.

January 27. PGNLZ Token ~$100K, BNB Chain
The attacker used a flash loan to acquire massive buying power, then exploited PGNLZ’s tokenomics by purchasing a huge amount of PGNLZ from the PancakeSwap liquidity pool. The token’s automatic burn mechanism destroyed trillions of PGNLZ during the swap, drastically reducing token reserves inside the pool. With the pool severely imbalanced, the attacker sold back only a small fraction of the acquired tokens and extracted nearly all remaining USDT liquidity, generating roughly $100K profit after repaying all loans.

January 28. XPlayer $717K, BNB Chain
very similar to previous one , LP reserve manipulation via privileged burn function. A whitelisted contract could trigger LP token burns directly from the PancakeSwap pair. The burn removed XPL from the liquidity pool and immediately called sync(), changing reserves without a corresponding swap. This violated the AMM's constant-product assumptions and artificially increased XPL's price inside the pool. Using flash-loan capital, the attacker bought XPL, triggered the LP burn, then sold XPL back at the manipulated price, draining approximately $717K.

January 28. Holdstation $192K, World Chain & BNB Chain
 Admin key compromise via malicious IDE extension. A core developer installed a malicious IDE extension that exfiltrated an admin private key, leading to the compromise of four privileged wallets. The attacker used the stolen administrative privileges to deploy malicious contracts and upgrade Vault Proxy implementations, gaining control over protocol funds. Approximately $66K was stolen on World Chain, while another $126K on BNB Chain was frozen before withdrawal.

January 29. Revert Lend $50K, Base
 Collateral escape via position-management pathway. An attacker exploited a missing safety constraint in Revert Finance’s newly launched Aerodrome Lend vault. The protocol allowed collateralized LP NFTs to be temporarily unstaked for management operations through the GaugeManager execution path. During this unstaked window, the attacker withdrew all liquidity from a debt-backed NFT position while keeping the loan active, leaving the vault holding an empty NFT shell as collateral.

January 30. Gyroscope $807K, Arbitrum → Ethereum
Arbitrary calldata execution in cross-chain bridge. The attacker exploited a missing input validation flaw in Gyroscope’s bridge contract. By bridging just 1 wei of GYD from Arbitrum to Ethereum and specifying the GYD token contract itself as the recipient, the attacker supplied malicious calldata that executed an approve() call on the destination chain. This granted unlimited token spending approval to the attacker, who then drained over 6 million GYD and liquidated the tokens for approximately $807K.

January 31. Step Finance $27–30M reported, 261,854 SOL drained, Solana
Treasury key compromise and stake-authority takeover. An attacker gained control over multiple Step Finance treasury wallets through what the team described as a “well-known attack vector.” Using the compromised authority, the attacker transferred stake-account control to their own address, unstaked treasury-held SOL, and drained approximately 261,854 SOL. No smart contract vulnerability was disclosed; the incident appears to have been an operational security failure involving privileged wallet access.

The most common disclosure was silence. Flash loans are still working, unlimited approvals are still live, and private keys are still being stored in ways that make them stealable. Nothing that happened this month was new. That’s the problem.

credits : nobody , johnnytime , https://smartcontractshacking.com , certikAlert , blocksec .