Smart-contract flaw
An attacker exploits a coding error, such as incorrect balance accounting, repeat withdrawals, or inadequate signature and permission checks. The contract executes an operation that the project’s rules should have rejected.
Crypto hacks and exploits
Crypto Hacks & Exploits Database
Find a crypto hack by project, year or chain. The database covers attacks on DeFi protocols, centralized exchanges, bridges, wallets and other crypto services. Detailed case studies explain how each attack worked and what happened to the funds.
Recorded incidents1 335
Sum of known estimates$21.3BBefore recoveries and reimbursements
With an amount estimate1 278
Without an amount estimate57
Incident database
Find a crypto incident
Compare dates, amounts, affected services and attack mechanisms. Search includes project names and known aliases.
| Date | Project | Amount, USD | Chains | Affected service | Mechanism |
|---|---|---|---|---|---|
| Orbit Bridge | $81.7M | Ethereum | DeFi protocol Bridge | Input validation | |
| Channels Finance | $320K | BNB Smart Chain | DeFi protocol | Token and share accounting | |
| Locus Finance | $321K | Ethereum, Arbitrum | DeFi protocol | Key compromise | |
| Levana Perps | $1.1M | Osmosis | DeFi protocol | Oracle manipulation | |
| Thunder Terminal | $240K | Ethereum, Solana | Centralized exchange | Frontend and infrastructure | |
| Telcoin | $1.3M | Polygon | Payments service | Access control flaw | |
| Pine Protocol | $95K | Ethereum | DeFi protocol | Protocol logic flaw | |
| INX Digital Company | $1.6M | Ethereum | Centralized exchange | Frontend and infrastructure | |
| Transit Finance | $110K | BNB Smart Chain, Ethereum | DeFi protocol | Input validation | |
| Flooring Protocol | $1.6M | Ethereum | DeFi protocol | Access control flaw | |
| GoodDollar | $2.0M | Ethereum | DeFi protocol | Reentrancy | |
| NFT Trader | $3.0M | Ethereum | DeFi protocol | Reentrancy | |
| Ledger Connect Kit | $484K | Ethereum | Wallet | Frontend and infrastructure | |
| OKX DEX | $2.7M | Ethereum | DeFi protocol | Key compromise | |
| Peapods Finance | $231K | Ethereum | DeFi protocol | Reentrancy | |
| Venus Protocol | $274K | BNB Smart Chain | DeFi protocol | Oracle manipulation | |
| Xai | $846K | Ethereum | Token | Social engineering | |
| ElephantStatus | $165K | BNB Smart Chain | DeFi protocol | Oracle manipulation | |
| TIME | $190K | Ethereum | Token | Input validation | |
| Stargate Finance | $43K | Ethereum | DeFi protocol | Social engineering | |
| Florence Finance | $1.5M | Ethereum | DeFi protocol | Social engineering | |
| Velodrome | $250K | Optimism | DeFi protocol | Frontend and infrastructure | |
| TheNFTV2 | $19K | Ethereum | DeFi protocol | Protocol logic flaw | |
| Heco Bridge | $86.6M | Ethereum | DeFi protocol Bridge | Key compromise | |
| Huobi | $13.6M | Ethereum | Centralized exchange | Key compromise | |
| KyberSwap Elastic | $48.0M | Ethereum, Base, Polygon, Optimism, Arbitrum | DeFi protocol | Token and share accounting | |
| dYdX V3 | $9.0M | Ethereum | DeFi protocol | Market manipulation | |
| Kronos Research | $26.0M | Ethereum | Other service | Frontend and infrastructure | |
| SpookySwap | $5K | Fantom | DeFi protocol | Frontend and infrastructure | |
| Samudai | $1.3M | Ethereum | DeFi protocol | Key compromise | |
| Poloniex Detailed case study Source ↗ | $126.0M | Tron, Ethereum, Bitcoin | Centralized exchange | Social engineering | |
| Raft | $3.3M | Ethereum | DeFi protocol | Token and share accounting | |
| CoinSpot | $2.4M | Ethereum | Centralized exchange | Key compromise | |
| Curve Finance MEV Bot | $2.0M | Ethereum | DeFi protocol | Access control flaw | |
| TheStandard.io | $290K | Arbitrum | DeFi protocol | Protocol logic flaw | |
| TrustPad | $155K | BNB Smart Chain | DeFi protocol | Access control flaw | |
| Onyx Protocol | $2.1M | Ethereum | DeFi protocol | Token and share accounting | |
| Unibot | $640K | Ethereum | DeFi protocol | Access control flaw | |
| Astrid Finance | $228K | Ethereum | DeFi protocol | Input validation | |
| Maestro | $500K | Ethereum | DeFi protocol | Access control flaw | |
| Synthetify | $230K | Solana | DeFi protocol | Protocol governance | |
| HOPE Lend | $825K | Ethereum | DeFi protocol | Token and share accounting | |
| MicDao | $13K | BNB Smart Chain | DeFi protocol | Oracle manipulation | |
| Beluga | $175K | Arbitrum | DeFi protocol | Oracle manipulation | |
| Platypus Finance | $2.2M | Avalanche | DeFi protocol | Oracle manipulation | |
| WiseLending | $260K | Ethereum | DeFi protocol | Token and share accounting | |
| BlackHole Token | $1.3M | BNB Smart Chain | Token | Oracle manipulation | |
| Arena SocialFi | $3.0M | Avalanche | Other service | Reentrancy | |
| Galxe | $270K | Ethereum | Other service | Frontend and infrastructure | |
| HTX | $8.0M | Ethereum | Centralized exchange | Key compromise |
Annual figures
Crypto incidents by year
Each year shows the incident count, the sum of known estimates and the number of incidents with an estimate. The current year covers the period through 23 Oct 2026.
| Year | Incidents | Known estimates, USD | With an estimate | Without an estimate |
|---|---|---|---|---|
| 2026 ↗Through 23 Oct 2026 | 319 | $2.4B | 305 | 14 |
| 2025 ↗ | 148 | $2.8B | 147 | 1 |
| 2024 ↗ | 220 | $1.7B | 208 | 12 |
| 2023 ↗ | 197 | $1.6B | 196 | 1 |
| 2022 ↗ | 187 | $3.6B | 177 | 10 |
| 2021 ↗ | 128 | $2.9B | 123 | 5 |
| 2020 ↗ | 47 | $4.0B | 46 | 1 |
| 2019 ↗ | 27 | $277.3M | 21 | 6 |
| 2018 ↗ | 31 | $1.1B | 25 | 6 |
| 2017 ↗ | 8 | $288.9M | 7 | 1 |
| 2016 ↗ | 5 | $135.7M | 5 | 0 |
| 2015 ↗ | 6 | $9.9M | 6 | 0 |
| 2014 ↗ | 6 | $486.7M | 6 | 0 |
| 2013 ↗ | 2 | $1.3M | 2 | 0 |
| 2012 ↗ | 3 | $568K | 3 | 0 |
| 2011 ↗ | 1 | $8.8M | 1 | 0 |
Each incident is counted once in annual totals, including incidents affecting several chains.
Causes and outcomes
The affected service and the attack mechanism
The service type identifies who was affected; the mechanism explains how funds became accessible. An exchange may lose control of a wallet, a bridge may accept a forged cross-chain message, and a DeFi protocol may contain faulty contract calculations.
Keys and interfaces
A stolen private key lets an attacker sign operations as its owner. A compromised interface works differently: it displays an expected action while submitting another operation for the user to sign.
Cross-chain bridge flaw
A bridge accepts a message about an event on another chain. If message verification can be bypassed, an attacker may withdraw assets or mint tokens without a genuine deposit on the originating side.
Rug pull
Project creators use their privileges to take liquidity or user funds. The loss results from the actions of people who controlled the project.
The role of a flash loan
A flash loan provides funds for a single transaction and must be repaid before it ends. During an attack, it can amplify price or governance manipulation; a flaw in the protocol’s calculations or rules makes the theft possible.
Stolen, returned, frozen and reimbursed
The original estimate describes the scale of an attack. Returns, freezes and reimbursements describe subsequent actions involving the funds. Each measure has a distinct meaning.
- Original amount
- The US dollar estimate of assets drained or created during an attack. For a bridge exploit, this may include tokens minted without backing.
- Returned
- Funds have been transferred back to the affected project or its users. The recipient and return date establish this outcome.
- Frozen
- Funds have been blocked from transfer or use, for example by a token issuer or exchange.
- Reimbursed
- The project, insurer or another party paid affected users to cover their losses.
- Backing replenished
- Assets have been contributed to a bridge or protocol to replace missing backing. For Wormhole, Jump Crypto restored the backing of the issued tokens.
Methodology and data
How to read the incident data
The database covers hacks and other crypto-asset incidents affecting DeFi, exchanges, bridges, wallets and related services. The year follows the event date; chains identify where affected assets or contracts were located.
All amounts are expressed in US dollars using the estimate for the incident. The total adds known original estimates before recoveries and reimbursements. Token price changes can explain differences between estimates of the same event.
Amounts are known for 1278 of 1335 incidents; 57 have no established estimate. “No estimate” preserves that distinction. A zero amount is shown separately as 0 USD.
One event may have several names, such as Wormhole and Portal. Search connects these names to one incident page. An incident affecting several chains is counted once in annual figures.
The database is updated hourly. The data update time appears above the summary; detailed case studies carry a separate review date.
Detailed case studies link to project reports, technical research and other sources. These links document the attack mechanism, amount estimate and subsequent outcome.
Telegram-first analytics
Live data. Instant alerts. Zero noise.
Access live comparison tools and Telegram bot alerts — premium crypto analytics experience.
Open Telegram Bot