Smart-contract flaw
An attacker exploits a coding error, such as incorrect balance accounting, repeat withdrawals, or inadequate signature and permission checks. The contract executes an operation that the project’s rules should have rejected.
Crypto hacks and exploits
Crypto Hacks & Exploits Database
Find a crypto hack by project, year or chain. The database covers attacks on DeFi protocols, centralized exchanges, bridges, wallets and other crypto services. Detailed case studies explain how each attack worked and what happened to the funds.
Recorded incidents1 335
Sum of known estimates$21.3BBefore recoveries and reimbursements
With an amount estimate1 278
Without an amount estimate57
Incident database
Find a crypto incident
Compare dates, amounts, affected services and attack mechanisms. Search includes project names and known aliases.
| Date | Project | Amount, USD | Chains | Affected service | Mechanism |
|---|---|---|---|---|---|
| Fegex | $1.1M | Ethereum, BNB Smart Chain, Base | DeFi protocol Bridge | Bridges and cross-chain messages | |
| Bizness | $16K | Base | DeFi protocol | Reentrancy | |
| HarryPotterObamaSonic10Inu | $243K | Ethereum | Token | Oracle manipulation | |
| SlurpyCoin | $3K | Binance | Token | Protocol logic flaw | |
| GemPad | $1.9M | Ethereum, Base, BNB Smart Chain | DeFi protocol | Reentrancy | |
| BTC24H | $86K | Polygon | DeFi protocol | Access control flaw | |
| JHY Token | $12K | Binance | Token | Token and share accounting | |
| BNBS | $20K | Binance | Token | Reentrancy | |
| Clober Liquidity Vault | $500K | Base | DeFi protocol | Reentrancy | |
| LABUBU Token | $12K | Binance | Token | Token and share accounting | |
| MAAT Protocol | $168K | Binance | DeFi protocol | Protocol logic flaw | |
| Vestra DAO | $500K | Ethereum | DeFi protocol | Protocol logic flaw | |
| BYC Token | $100K | Binance | Token | Token and share accounting | |
| Clipper | $450K | Optimism, Base | DeFi protocol | Protocol logic flaw | |
| Spectral Labs | $250K | Ethereum | DeFi protocol | Access control flaw | |
| XT Exchange | $1.7M | Ethereum | Centralized exchange | Key compromise | |
| NFTG | $10K | BNB Chain | DeFi protocol | Access control flaw | |
| Proxy_b7e1 | $9K | BNB Chain | DeFi protocol | Protocol logic flaw | |
| AK1111 | $32K | BNB Chain | DeFi protocol | Access control flaw | |
| Matez | $80K | BNB Chain | DeFi protocol | Token and share accounting | |
| MainnetSettler | $66K | Ethereum | DeFi protocol | Access control flaw | |
| Tectonic | No estimate | Cronos | DeFi protocol | Protocol logic flaw | |
| MFT | $34K | BNB Chain | DeFi protocol | Protocol logic flaw | |
| DEXX | $21.0M | Solana | Wallet | Key compromise | |
| Polter Finance | $8.7M | Fantom | DeFi protocol | Oracle manipulation | |
| ThalaSwap | $25.5M | Aptos | DeFi protocol | Input validation | |
| vETH | $447K | Ethereum | DeFi protocol | Oracle manipulation | |
| DeltaPrime | $4.8M | Arbitrum, Avalanche | DeFi protocol | Input validation | |
| zkFinance | $200K | zkSync Era | DeFi protocol | Protocol logic flaw | |
| BGM | $450K | BNB Chain | DeFi protocol | Oracle manipulation | |
| X319 | $13K | BNB Chain | DeFi protocol | Access control flaw | |
| CoinPoker | $2.0M | Ethereum | Game | Key compromise | |
| ChiSale | $16K | Ethereum | DeFi protocol | Protocol logic flaw | |
| CoW | $59K | Ethereum | DeFi protocol | Access control flaw | |
| VRug | $8K | Ethereum | Token | Team fund withdrawal | |
| RPP | $14K | BNB Chain | DeFi protocol | Protocol logic flaw | |
| MetaWin | $4.4M | Ethereum, Solana | Game | Frontend and infrastructure | |
| 1inch | $720K | Avalanche | DeFi protocol | Ecosystem services | |
| 1inch Swap | $723K | Avalanche | DeFi protocol | Frontend and infrastructure | |
| M2 Exchange | $13.7M | Ethereum, Solana, Bitcoin | Centralized exchange | Key compromise | |
| Shoebill Finance | $1.5M | BOB | DeFi protocol | Oracle manipulation | |
| SUNRAY·FINANCE | $2.9M | Arbitrum | DeFi protocol | Key compromise | |
| BUBAI | $131K | Ethereum | Token | Team fund withdrawal | |
| AARK (Aark Digital) | $1.9M | Arbitrum | DeFi protocol | Token and share accounting | |
| Base Lending | $1.0M | Base | DeFi protocol | Protocol logic flaw | |
| Cryptobottle | $490K | Polygon | Token | Oracle manipulation | |
| Ramses Exchange | $93K | Arbitrum | DeFi protocol | Protocol logic flaw | |
| US Government Crypto Wallet | $20.0M | Ethereum | Other service | Key compromise | |
| Erc20transfer | $15K | Ethereum | Token | Access control flaw | |
| Vista Finance | $28K | BNB Smart Chain | DeFi protocol | Token and share accounting |
Annual figures
Crypto incidents by year
Each year shows the incident count, the sum of known estimates and the number of incidents with an estimate. The current year covers the period through 23 Oct 2026.
| Year | Incidents | Known estimates, USD | With an estimate | Without an estimate |
|---|---|---|---|---|
| 2026 ↗Through 23 Oct 2026 | 319 | $2.4B | 305 | 14 |
| 2025 ↗ | 148 | $2.8B | 147 | 1 |
| 2024 ↗ | 220 | $1.7B | 208 | 12 |
| 2023 ↗ | 197 | $1.6B | 196 | 1 |
| 2022 ↗ | 187 | $3.6B | 177 | 10 |
| 2021 ↗ | 128 | $2.9B | 123 | 5 |
| 2020 ↗ | 47 | $4.0B | 46 | 1 |
| 2019 ↗ | 27 | $277.3M | 21 | 6 |
| 2018 ↗ | 31 | $1.1B | 25 | 6 |
| 2017 ↗ | 8 | $288.9M | 7 | 1 |
| 2016 ↗ | 5 | $135.7M | 5 | 0 |
| 2015 ↗ | 6 | $9.9M | 6 | 0 |
| 2014 ↗ | 6 | $486.7M | 6 | 0 |
| 2013 ↗ | 2 | $1.3M | 2 | 0 |
| 2012 ↗ | 3 | $568K | 3 | 0 |
| 2011 ↗ | 1 | $8.8M | 1 | 0 |
Each incident is counted once in annual totals, including incidents affecting several chains.
Causes and outcomes
The affected service and the attack mechanism
The service type identifies who was affected; the mechanism explains how funds became accessible. An exchange may lose control of a wallet, a bridge may accept a forged cross-chain message, and a DeFi protocol may contain faulty contract calculations.
Keys and interfaces
A stolen private key lets an attacker sign operations as its owner. A compromised interface works differently: it displays an expected action while submitting another operation for the user to sign.
Cross-chain bridge flaw
A bridge accepts a message about an event on another chain. If message verification can be bypassed, an attacker may withdraw assets or mint tokens without a genuine deposit on the originating side.
Rug pull
Project creators use their privileges to take liquidity or user funds. The loss results from the actions of people who controlled the project.
The role of a flash loan
A flash loan provides funds for a single transaction and must be repaid before it ends. During an attack, it can amplify price or governance manipulation; a flaw in the protocol’s calculations or rules makes the theft possible.
Stolen, returned, frozen and reimbursed
The original estimate describes the scale of an attack. Returns, freezes and reimbursements describe subsequent actions involving the funds. Each measure has a distinct meaning.
- Original amount
- The US dollar estimate of assets drained or created during an attack. For a bridge exploit, this may include tokens minted without backing.
- Returned
- Funds have been transferred back to the affected project or its users. The recipient and return date establish this outcome.
- Frozen
- Funds have been blocked from transfer or use, for example by a token issuer or exchange.
- Reimbursed
- The project, insurer or another party paid affected users to cover their losses.
- Backing replenished
- Assets have been contributed to a bridge or protocol to replace missing backing. For Wormhole, Jump Crypto restored the backing of the issued tokens.
Methodology and data
How to read the incident data
The database covers hacks and other crypto-asset incidents affecting DeFi, exchanges, bridges, wallets and related services. The year follows the event date; chains identify where affected assets or contracts were located.
All amounts are expressed in US dollars using the estimate for the incident. The total adds known original estimates before recoveries and reimbursements. Token price changes can explain differences between estimates of the same event.
Amounts are known for 1278 of 1335 incidents; 57 have no established estimate. “No estimate” preserves that distinction. A zero amount is shown separately as 0 USD.
One event may have several names, such as Wormhole and Portal. Search connects these names to one incident page. An incident affecting several chains is counted once in annual figures.
The database is updated hourly. The data update time appears above the summary; detailed case studies carry a separate review date.
Detailed case studies link to project reports, technical research and other sources. These links document the attack mechanism, amount estimate and subsequent outcome.
Telegram-first analytics
Live data. Instant alerts. Zero noise.
Access live comparison tools and Telegram bot alerts — premium crypto analytics experience.
Open Telegram Bot