Find a crypto hack by project, year or chain. The database covers attacks on DeFi protocols, centralized exchanges, bridges, wallets and other crypto services. Detailed case studies explain how each attack worked and what happened to the funds.
Recorded incidents1 335
Sum of known estimates$21.3BBefore recoveries and reimbursements
Each year shows the incident count, the sum of known estimates and the number of incidents with an estimate. The current year covers the period through 23 Oct 2026.
Each incident is counted once in annual totals, including incidents affecting several chains.
Case studies
How major crypto hacks happened
Each case explains the attack mechanism, the basis for its dollar estimate and what happened to the funds.
≈ $1 460 000 000
Bybit: a compromised wallet interface
In February 2025, attackers compromised Safe infrastructure and altered the interface used to sign a Bybit transfer. Signers approved a malicious operation, allowing funds to be drained from the exchange’s cold wallet.
Affected service
Centralized exchange
Chains
Ethereum
Estimate basis
Bybit’s historical estimate was approximately $1.46 billion. The FBI rounded the amount to $1.5 billion.
Outcome
Bybit replenished client-asset backing through loans, deposits and ETH purchases. The exchange reported $42.89 million frozen as of 23 February 2025.
In August 2021, an access control flaw allowed an attacker to change Poly Network’s authorized signer list and withdraw assets across several chains. The project subsequently regained control of the wallets; frozen USDT followed a separate restoration process.
Affected service
DeFi protocol · Bridge
Chains
Ethereum, BNB Smart Chain, Polygon
Estimate basis
More than $610 million, based on Poly Network’s historical estimate in its incident review.
Outcome
On 23 August 2021, Poly Network received the remaining wallet key and began restoring users’ control over their assets. Frozen USDT followed a separate release process.
In October 2022, a proof verification flaw in the BSC Token Hub bridge allowed an attacker to create BNB without matching backing. The amount created and the amount moved to other chains describe different parts of the incident.
Affected service
DeFi protocol · Bridge
Chains
BNB Smart Chain, BNB Beacon Chain
Estimate basis
Nansen’s historical estimate of approximately $566 million for 2,000,000 BNB issued without backing.
Outcome
Validators halted BNB Smart Chain to limit further transfers. Subsequently, 1.02 million of the newly issued BNB were locked and burned.
In February 2022, a bypassed signature check allowed wrapped ETH to be minted on Solana without a matching deposit in the Wormhole bridge. Jump Crypto replenished the backing with its own funds.
Affected service
DeFi protocol · Bridge
Chains
Solana, Ethereum
Estimate basis
SharkTeam’s historical estimate was approximately $326 million for 120,000 unbacked wrapped ETH. Chainalysis valued the amount at over $320 million.
Outcome
Jump replenished the bridge’s ETH backing, restoring collateral for the issued tokens. The stolen assets were tracked separately.
The download contains source-checked data from the selected case studies: dates, amount estimates, mechanisms, outcomes and source links. Use CSV in a spreadsheet or JSON for programmatic analysis.
The service type identifies who was affected; the mechanism explains how funds became accessible. An exchange may lose control of a wallet, a bridge may accept a forged cross-chain message, and a DeFi protocol may contain faulty contract calculations.
Smart-contract flaw
An attacker exploits a coding error, such as incorrect balance accounting, repeat withdrawals, or inadequate signature and permission checks. The contract executes an operation that the project’s rules should have rejected.
Keys and interfaces
A stolen private key lets an attacker sign operations as its owner. A compromised interface works differently: it displays an expected action while submitting another operation for the user to sign.
Cross-chain bridge flaw
A bridge accepts a message about an event on another chain. If message verification can be bypassed, an attacker may withdraw assets or mint tokens without a genuine deposit on the originating side.
Rug pull
Project creators use their privileges to take liquidity or user funds. The loss results from the actions of people who controlled the project.
The role of a flash loan
A flash loan provides funds for a single transaction and must be repaid before it ends. During an attack, it can amplify price or governance manipulation; a flaw in the protocol’s calculations or rules makes the theft possible.
Stolen, returned, frozen and reimbursed
The original estimate describes the scale of an attack. Returns, freezes and reimbursements describe subsequent actions involving the funds. Each measure has a distinct meaning.
Original amount
The US dollar estimate of assets drained or created during an attack. For a bridge exploit, this may include tokens minted without backing.
Returned
Funds have been transferred back to the affected project or its users. The recipient and return date establish this outcome.
Frozen
Funds have been blocked from transfer or use, for example by a token issuer or exchange.
Reimbursed
The project, insurer or another party paid affected users to cover their losses.
Backing replenished
Assets have been contributed to a bridge or protocol to replace missing backing. For Wormhole, Jump Crypto restored the backing of the issued tokens.
Methodology and data
How to read the incident data
The database covers hacks and other crypto-asset incidents affecting DeFi, exchanges, bridges, wallets and related services. The year follows the event date; chains identify where affected assets or contracts were located.
All amounts are expressed in US dollars using the estimate for the incident. The total adds known original estimates before recoveries and reimbursements. Token price changes can explain differences between estimates of the same event.
Amounts are known for 1278 of 1335 incidents; 57 have no established estimate. “No estimate” preserves that distinction. A zero amount is shown separately as 0 USD.
One event may have several names, such as Wormhole and Portal. Search connects these names to one incident page. An incident affecting several chains is counted once in annual figures.
The database is updated hourly. The data update time appears above the summary; detailed case studies carry a separate review date.
Detailed case studies link to project reports, technical research and other sources. These links document the attack mechanism, amount estimate and subsequent outcome.
Related sections
Explore how crypto services work in Yieldo’s dedicated sections.