Smart-contract flaw
An attacker exploits a coding error, such as incorrect balance accounting, repeat withdrawals, or inadequate signature and permission checks. The contract executes an operation that the project’s rules should have rejected.
Crypto hacks and exploits
Crypto Hacks & Exploits Database
Find a crypto hack by project, year or chain. The database covers attacks on DeFi protocols, centralized exchanges, bridges, wallets and other crypto services. Detailed case studies explain how each attack worked and what happened to the funds.
Recorded incidents1 335
Sum of known estimates$21.3BBefore recoveries and reimbursements
With an amount estimate1 278
Without an amount estimate57
Incident database
Find a crypto incident
Compare dates, amounts, affected services and attack mechanisms. Search includes project names and known aliases.
| Date | Project | Amount, USD | Chains | Affected service | Mechanism |
|---|---|---|---|---|---|
| Initia | $2.6M | Initia | Blockchain | Token and share accounting | |
| WAX Multi-Chain Bridge | $91K | Solana, Ethereum, WAX | DeFi protocol Bridge | Input validation | |
| CoinDCX | $16.0M | TRON | Centralized exchange | Key compromise | |
| Swell | No estimate | Ethereum, Arbitrum, Base, Hyperliquid L1 | DeFi protocol | Key compromise | |
| AlpsCon AI Trade Hub | $153K | BNB Smart Chain | DeFi protocol | Token and share accounting | |
| Coffer | No estimate | Solana | DeFi protocol | Token and share accounting | |
| Qubic | $1.3M | Qubic | Wallet | Key compromise | |
| Affluent | $1.1M | TON | DeFi protocol | Token and share accounting | |
| Pirate Chain | No estimate | Pirate Chain | Blockchain | Token and share accounting | |
| UNCX Network V2 | $86K | Ethereum, Base, BNB Smart Chain, Robinhood Chain | DeFi protocol | Token and share accounting | |
| Gamdom | $4.2M | Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Solana, TRON, Bitcoin | Gambling platform | Frontend and infrastructure | |
| Papertrade | $1.3M | Hyperliquid L1 | DeFi protocol | Oracle manipulation | |
| Ledger (Supply Chain) | $93.0M | Not specified | Wallet | Frontend and infrastructure | |
| BitBay | $15K | Polygon | DeFi protocol | Protocol logic flaw | |
| Ethervista | $19K | Ethereum | DeFi protocol | Token and share accounting | |
| Locus Finance | $18K | Arbitrum | DeFi protocol | Not established | |
| MakerDAO ETH-A Liquidation Keeper Bot | $538K | Ethereum | DeFi protocol | Access control flaw | |
| Set Protocol | $22K | Ethereum | DeFi protocol | Token and share accounting | |
| GoldPesa | $115K | Base | DeFi protocol | Token and share accounting | |
| FlashLoopAdapter | $305K | Ethereum | DeFi protocol | Access control flaw | |
| NEAR Intents | $3.8M | BNB Smart Chain | DeFi protocol Bridge | Bridges and cross-chain messages | |
| SKYDAO | $183K | BNB Smart Chain | DeFi protocol | Protocol logic flaw | |
| Fake GIWA bridge scam Source ↗ | $2.1M | Ethereum | DeFi protocol Bridge | Social engineering | |
| Demex Perp | $192K | Demex, Ethereum, BNB Smart Chain | DeFi protocol Bridge | Bridges and cross-chain messages | |
| Bitget | $387.0M | Ethereum, XRP, Tron, Zcash | Centralized exchange | Key compromise | |
| Duelbits | $7.0M | Ethereum, BNB Smart Chain, Bitcoin, Tron | Gambling platform | Key compromise | |
| Limit Break Payment Processor | $1.8M | Ethereum, ApeChain, Polygon, Base | NFT finance service | Access control flaw | |
| Payy Network | $1.8M | Ethereum | DeFi protocol Bridge | Bridges and cross-chain messages | |
| Meter | No estimate | Meter, BNB Smart Chain, Ethereum | Blockchain | Protocol logic flaw | |
| Astroport | $4.9M | Neutron | DeFi protocol | Protocol governance | |
| Drop | $4.4M | Neutron | DeFi protocol | Protocol governance | |
| DoinGud | $35K | Polygon | NFT finance service | Protocol logic flaw | |
| The Internet Token | $16K | Base | Token | Access control flaw | |
| Fetch.ai | $1.5M | Ethereum | DeFi protocol Bridge | Key compromise | |
| MultiversX | $0 | MultiversX | Blockchain | Protocol logic flaw | |
| NuNet | $463K | Ethereum | Token | Key compromise | |
| Nostra Money Market | $3.5M | Starknet | DeFi protocol | Oracle manipulation | |
| Flamincome | $595K | Ethereum | DeFi protocol | Oracle manipulation | |
| Nimiq | $50K | Polygon | DeFi protocol | Input validation | |
| Startale | $3K | Ethereum | DeFi protocol | Access control flaw | |
| Bonfire | $47K | BNB Smart Chain | DeFi protocol | Access control flaw | |
| Chainflip Source ↗ | $736K | Tron | DeFi protocol Bridge | Bridges and cross-chain messages | |
| ether.fi Liquid | $43K | Ethereum | DeFi protocol | Access control flaw | |
| Dominion | No estimate | Solana | DeFi protocol | Key compromise | |
| Symbiosis | $336K | BNB Smart Chain, Ethereum | DeFi protocol Bridge | Bridges and cross-chain messages | |
| Balancer V1 | $250K | Ethereum | DeFi protocol | Protocol logic flaw | |
| BeatXswap | $78K | BNB Smart Chain | DeFi protocol | Oracle manipulation | |
| Nomic | $3.2M | Nomic | DeFi protocol Bridge | Bridges and cross-chain messages | |
| Zentra Finance | $140K | Citrea | DeFi protocol | Token and share accounting | |
| WealthManagementV2 | $26K | BNB Smart Chain | DeFi protocol | Key compromise |
Annual figures
Crypto incidents by year
Each year shows the incident count, the sum of known estimates and the number of incidents with an estimate. The current year covers the period through 23 Oct 2026.
| Year | Incidents | Known estimates, USD | With an estimate | Without an estimate |
|---|---|---|---|---|
| 2026 ↗Through 23 Oct 2026 | 319 | $2.4B | 305 | 14 |
| 2025 ↗ | 148 | $2.8B | 147 | 1 |
| 2024 ↗ | 220 | $1.7B | 208 | 12 |
| 2023 ↗ | 197 | $1.6B | 196 | 1 |
| 2022 ↗ | 187 | $3.6B | 177 | 10 |
| 2021 ↗ | 128 | $2.9B | 123 | 5 |
| 2020 ↗ | 47 | $4.0B | 46 | 1 |
| 2019 ↗ | 27 | $277.3M | 21 | 6 |
| 2018 ↗ | 31 | $1.1B | 25 | 6 |
| 2017 ↗ | 8 | $288.9M | 7 | 1 |
| 2016 ↗ | 5 | $135.7M | 5 | 0 |
| 2015 ↗ | 6 | $9.9M | 6 | 0 |
| 2014 ↗ | 6 | $486.7M | 6 | 0 |
| 2013 ↗ | 2 | $1.3M | 2 | 0 |
| 2012 ↗ | 3 | $568K | 3 | 0 |
| 2011 ↗ | 1 | $8.8M | 1 | 0 |
Each incident is counted once in annual totals, including incidents affecting several chains.
Causes and outcomes
The affected service and the attack mechanism
The service type identifies who was affected; the mechanism explains how funds became accessible. An exchange may lose control of a wallet, a bridge may accept a forged cross-chain message, and a DeFi protocol may contain faulty contract calculations.
Keys and interfaces
A stolen private key lets an attacker sign operations as its owner. A compromised interface works differently: it displays an expected action while submitting another operation for the user to sign.
Cross-chain bridge flaw
A bridge accepts a message about an event on another chain. If message verification can be bypassed, an attacker may withdraw assets or mint tokens without a genuine deposit on the originating side.
Rug pull
Project creators use their privileges to take liquidity or user funds. The loss results from the actions of people who controlled the project.
The role of a flash loan
A flash loan provides funds for a single transaction and must be repaid before it ends. During an attack, it can amplify price or governance manipulation; a flaw in the protocol’s calculations or rules makes the theft possible.
Stolen, returned, frozen and reimbursed
The original estimate describes the scale of an attack. Returns, freezes and reimbursements describe subsequent actions involving the funds. Each measure has a distinct meaning.
- Original amount
- The US dollar estimate of assets drained or created during an attack. For a bridge exploit, this may include tokens minted without backing.
- Returned
- Funds have been transferred back to the affected project or its users. The recipient and return date establish this outcome.
- Frozen
- Funds have been blocked from transfer or use, for example by a token issuer or exchange.
- Reimbursed
- The project, insurer or another party paid affected users to cover their losses.
- Backing replenished
- Assets have been contributed to a bridge or protocol to replace missing backing. For Wormhole, Jump Crypto restored the backing of the issued tokens.
Methodology and data
How to read the incident data
The database covers hacks and other crypto-asset incidents affecting DeFi, exchanges, bridges, wallets and related services. The year follows the event date; chains identify where affected assets or contracts were located.
All amounts are expressed in US dollars using the estimate for the incident. The total adds known original estimates before recoveries and reimbursements. Token price changes can explain differences between estimates of the same event.
Amounts are known for 1278 of 1335 incidents; 57 have no established estimate. “No estimate” preserves that distinction. A zero amount is shown separately as 0 USD.
One event may have several names, such as Wormhole and Portal. Search connects these names to one incident page. An incident affecting several chains is counted once in annual figures.
The database is updated hourly. The data update time appears above the summary; detailed case studies carry a separate review date.
Detailed case studies link to project reports, technical research and other sources. These links document the attack mechanism, amount estimate and subsequent outcome.
Telegram-first analytics
Live data. Instant alerts. Zero noise.
Access live comparison tools and Telegram bot alerts — premium crypto analytics experience.
Open Telegram Bot