Find a crypto hack by project, year or chain. The database covers attacks on DeFi protocols, centralized exchanges, bridges, wallets and other crypto services. Detailed case studies explain how each attack worked and what happened to the funds.
Recorded incidents1 335
Sum of known estimates$21.3BBefore recoveries and reimbursements
Each year shows the incident count, the sum of known estimates and the number of incidents with an estimate. The current year covers the period through 23 Oct 2026.
Each incident is counted once in annual totals, including incidents affecting several chains.
Case studies
How major crypto hacks happened
Each case explains the attack mechanism, the basis for its dollar estimate and what happened to the funds.
≈ $1 460 000 000
Bybit: a compromised wallet interface
In February 2025, attackers compromised Safe infrastructure and altered the interface used to sign a Bybit transfer. Signers approved a malicious operation, allowing funds to be drained from the exchange’s cold wallet.
Affected service
Centralized exchange
Chains
Ethereum
Estimate basis
Bybit’s historical estimate was approximately $1.46 billion. The FBI rounded the amount to $1.5 billion.
Outcome
Bybit replenished client-asset backing through loans, deposits and ETH purchases. The exchange reported $42.89 million frozen as of 23 February 2025.
The download contains source-checked data from the selected case studies: dates, amount estimates, mechanisms, outcomes and source links. Use CSV in a spreadsheet or JSON for programmatic analysis.
The service type identifies who was affected; the mechanism explains how funds became accessible. An exchange may lose control of a wallet, a bridge may accept a forged cross-chain message, and a DeFi protocol may contain faulty contract calculations.
Smart-contract flaw
An attacker exploits a coding error, such as incorrect balance accounting, repeat withdrawals, or inadequate signature and permission checks. The contract executes an operation that the project’s rules should have rejected.
Keys and interfaces
A stolen private key lets an attacker sign operations as its owner. A compromised interface works differently: it displays an expected action while submitting another operation for the user to sign.
Cross-chain bridge flaw
A bridge accepts a message about an event on another chain. If message verification can be bypassed, an attacker may withdraw assets or mint tokens without a genuine deposit on the originating side.
Rug pull
Project creators use their privileges to take liquidity or user funds. The loss results from the actions of people who controlled the project.
The role of a flash loan
A flash loan provides funds for a single transaction and must be repaid before it ends. During an attack, it can amplify price or governance manipulation; a flaw in the protocol’s calculations or rules makes the theft possible.
Stolen, returned, frozen and reimbursed
The original estimate describes the scale of an attack. Returns, freezes and reimbursements describe subsequent actions involving the funds. Each measure has a distinct meaning.
Original amount
The US dollar estimate of assets drained or created during an attack. For a bridge exploit, this may include tokens minted without backing.
Returned
Funds have been transferred back to the affected project or its users. The recipient and return date establish this outcome.
Frozen
Funds have been blocked from transfer or use, for example by a token issuer or exchange.
Reimbursed
The project, insurer or another party paid affected users to cover their losses.
Backing replenished
Assets have been contributed to a bridge or protocol to replace missing backing. For Wormhole, Jump Crypto restored the backing of the issued tokens.
Methodology and data
How to read the incident data
The database covers hacks and other crypto-asset incidents affecting DeFi, exchanges, bridges, wallets and related services. The year follows the event date; chains identify where affected assets or contracts were located.
All amounts are expressed in US dollars using the estimate for the incident. The total adds known original estimates before recoveries and reimbursements. Token price changes can explain differences between estimates of the same event.
Amounts are known for 1278 of 1335 incidents; 57 have no established estimate. “No estimate” preserves that distinction. A zero amount is shown separately as 0 USD.
One event may have several names, such as Wormhole and Portal. Search connects these names to one incident page. An incident affecting several chains is counted once in annual figures.
The database is updated hourly. The data update time appears above the summary; detailed case studies carry a separate review date.
Detailed case studies link to project reports, technical research and other sources. These links document the attack mechanism, amount estimate and subsequent outcome.
Related sections
Explore how crypto services work in Yieldo’s dedicated sections.