0xc0ffeebabe5d496b2dde509f9fa189c25cf29671

Reported crypto scam address

This EVM (Ethereum, BNB Chain, Base and other EVM chains) address was named in 9 public crypto scam reports: Hack. First reported 2026-04-22. Last updated 2026-10-18.

BiFi Lending USDT market exploit on Ethereum (2026-10-17): ~$165.4K drained via idle-market interest re-accrual

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Project or site name: BiFi Lending
  • Incident date: 2026-10-17
  • Reported: 2026-10-18
  • Last updated: 2026-10-18

BiFi Lending's USDT market on Ethereum lost about $165.4K (about 165.6K USDT) when a flash-loan-funded transaction re-applied about 36 days of stored idle interest many times inside one block. This report lists the exploit transaction's sender and the bot contract that ran it. Source: DefimonAlerts on X, 2026-10-18 07:45 UTC (https://x.com/DefimonAlerts/status/2111725425554571750); oculr exploit report "Interest Accounting Exploit on BiFi results in $165.4K worth of USDT being stolen" (https://www.oculr.xyz/reports/bifi-exploit-2026-10-18). What happened: BiFi's USDT market had been idle for…

Other addresses in this report: 0xe08d97e151473a848c3d9ca3f323cb720472d015

DRLVault V3 exploit (2025-11-10) — attacker addresses

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-10-15
  • Last updated: 2026-10-16

DRLVault V3 exploit on Ethereum, 2025-11-10. DeFiHackLabs summary: DRLVaultV3 - Price Manipulation. Loss as recorded by DeFiHackLabs: 100K USDT. Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0xC0ffeEBABE5D496B2DDE509f9fa189C25cF29671 — labeled "attacker" (Ethereum; https://etherscan.io/address/0xC0ffeEBABE5D496B2DDE509f9fa189C25cF29671) - 0xe08d97e151473a848c3d9ca3f323cb720472d015 — labeled "attack contract" (Ethereum;…

Other addresses in this report: 0xe08d97e151473a848c3d9ca3f323cb720472d015

Anyswap WETHPermit exploit (2025-07-29) — attacker addresses

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-10-15
  • Last updated: 2026-10-16

Anyswap WETHPermit exploit on EVM, 2025-07-29. DeFiHackLabs summary: AnyswapWETHPermit - Permit Validation Bypass. Loss as recorded by DeFiHackLabs: 200 WETH. Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0xC0ffeEBABE5D496B2DDE509f9fa189C25cF29671 — labeled "attacker" (EVM) - 0xE08D97e151473A848C3d9CA3f323Cb720472D015 — labeled "attack contract" (EVM) Sources: https://github.com/Su…

Other addresses in this report: 0xe08d97e151473a848c3d9ca3f323cb720472d015

Blueberry Protocol exploit (2024-02-23) — attacker addresses

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-10-15
  • Last updated: 2026-10-16

Blueberry Protocol exploit on Ethereum, 2024-02-23. DeFiHackLabs summary: BlueberryProtocol - logic flaw. Loss as recorded by DeFiHackLabs: ~$1,400,000 USD. Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 — labeled "attacker" (Ethereum; https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671) - 0x3aa228a80f50763045bdfc45012da124bd0a6809 — labeled "attack contract"…

Other addresses in this report: 0x3aa228a80f50763045bdfc45012da124bd0a6809

ERC20Token Bank exploit (2023-05-31) — attacker addresses

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-10-15
  • Last updated: 2026-10-16

ERC20Token Bank exploit on Ethereum, 2023-05-31. DeFiHackLabs summary: ERC20TokenBank - Price Manipulation. Loss as recorded by DeFiHackLabs: ~111K USD$. Addresses below are copied verbatim from the DeFiHackLabs proof-of-concept header for this incident, where they are explicitly labeled (attacker = attacker EOA; attack contract = contract deployed/used by the attacker): - 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 — labeled "attacker" (Ethereum; https://etherscan.io/address/0xc0ffeebabe5d496b2dde509f9fa189c25cf29671) - 0x7c28e0977f72c5d08d5e1ac7d52a34db378282b3 — labeled "attack contract"…

Other addresses in this report: 0x7c28e0977f72c5d08d5e1ac7d52a34db378282b3

DeFi Exploit: RIP MEV Bot 2

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-04-27
  • Last updated: 2026-04-27

DeFi Exploit: RIP MEV Bot 2 Date: 11/07/2023 Loss: $2,000,000 USD Tags: MEV Bot, REKT Summary: The sandwicher has become the sandwiched. $2M was lost on Tuesday night as an MEV bot got a taste of its own medicine. Is this a simple case of ‘you win some, you lose some’? Exploit/attacker addresses extracted from on-chain analysis and incident reports. Reference: https://rekt.news/ripmevbot2 Source: https://de.fi/rekt-database

Other addresses in this report: 0x46d9b3dfbc163465ca9e306487cba60bc438f5a2, 0x05f016765c6c601fd05a10dba1abe21a04f924a5

DeFi Exploit: Curve, Vyper - REKT

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-04-27
  • Last updated: 2026-04-27

DeFi Exploit: Curve, Vyper - REKT Date: 07/30/2023 Loss: $69,300,000 USD Tags: Curve, Vyper, REKT Summary: Multiple protocols bit by the Vyper. Curve Finance returns to the leaderboard with a total of $69M drained from four pools. Some funds have been returned with hopefully more to come. Will this wake-up call be enough to trigger a change? Exploit/attacker addresses extracted from on-chain analysis and incident reports. Reference: https://rekt.news/curve-vyper-rekt Source: https://de.fi/rekt-database

Other addresses in this report: 0x7a16ff8270133f063aab6c9977183d9e72835428, 0xdc24316b9ae028f1497c275eb9192a3ea0f67022, 0xdce5d6b41c32f578f875efffc0d422c57a75d7d8, 0xb1c33b391c2569b737ec387e731e88589e8ec148, 0x8301ae4fc9c624d1d396cbdaa1ed877821d7c511, 0x6ec21d1868743a44318c3c259a6d4953f9978538, 0xb752def3a1fded45d6c4b9f4a8f18e645b41b324

Curve / Vyper Exploit — Attacker Address

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-04-22
  • Last updated: 2026-04-22

Ethereum address belonging to the attacker who exploited Curve / Vyper. Total stolen: $69,300,000 USD. Source: rekt.news (https://rekt.news/curve-vyper-rekt). This address was used to receive or launder stolen funds from the Curve / Vyper protocol exploit.

Curve / Vyper Exploit — Attacker Address

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-04-22
  • Last updated: 2026-04-22

Ethereum address belonging to the attacker who exploited Curve / Vyper. Total stolen: $69,300,000 USD. Source: rekt.news (https://rekt.news/curve-vyper-rekt). This address was used to receive or launder stolen funds from the Curve / Vyper protocol exploit.

Report a crypto scam · How to report a crypto scam