Real Delegatecall & Call Injection Hacks

Real incidents mapped to delegatecall & call injection. Start with the records, open the source, then use the attack guide when an incident matches the code you are reviewing.

Open full database Read attack guide

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 UXLINK $48.0M arbitrum, ethereum Access Control Attacks Details Source
2 Curio $16.0M ethereum Access Control Attacks Details Source
3 Rari Capital $15.7M ethereum Access Control Attacks Details Source
4 Furucombo $14.0M ethereum Access Control Attacks Details Source
5 LiFi Finance $11.6M linea, metis, zksync era Access Control Attacks Details Source
6 Punk Protocol $8.9M ethereum Access Control Attacks Details Source
7 Seneca $6.5M arbitrum, ethereum Access Control Attacks Details Source
8 1inch $5.0M ethereum Access Control Attacks Details Source
9 Socket $3.3M ethereum Access Control Attacks Details Source
10 Zapper $2.5M — Delegatecall & Call Injection Attacks Details Source 1Source 2
11 Pond0x $2.2M ethereum Access Control Attacks Details
12 Unizen $2.1M ethereum Access Control Attacks Details Source
13 Dexible $2.0M arbitrum, ethereum Access Control Attacks Details Source 1Source 2Source 3Source 4
14 Hope Finance $2.0M arbitrum Access Control Attacks Details Source
15 Dough Finance $2.0M ethereum Access Control Attacks Details Source
16 Flooring Protocol $1.6M ethereum Access Control Attacks Details
17 Rubic $1.4M ethereum Access Control Attacks Details Source
18 BasketDAO $1.2M ethereum Access Control Attacks Details Source
19 BasketDAO $1.2M ethereum Access Control Attacks Details
20 Hyperdrive HL $782K hyperliquid l1 Access Control Attacks Details Source
21 Auctus $726K ethereum Access Control Attacks Details
22 Chainge Finance $716K bsc Access Control Attacks Details Source 1Source 2
23 Maestro $500K ethereum Access Control Attacks Details Source
24 IPOR Fusion $336K arbitrum Access Control Attacks Details Source
25 OlympusDAO $315K ethereum Delegatecall & Call Injection Attacks Details Source 1Source 2
26 Rabby Wallet $194K — Access Control Attacks Details Source
27 CoW Swap $180K ethereum Access Control Attacks Details Source 1Source 2
28 Quant $138K ethereum Access Control Attacks Details
29 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
30 Brahma Finance $90K ethereum Access Control Attacks Details Source 1Source 2
31 Spectra Finance $73K ethereum Access Control Attacks Details
32 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
33 Aave $56K ethereum Access Control Attacks Details Source
34 ether.fi Liquid $43K ethereum Access Control Attacks Details
35 Revert Finance $30K ethereum Access Control Attacks Details Source 1Source 2
36 VeloraDEX $20K — Delegatecall & Call Injection Attacks Details Source
37 Unistreets $18K ethereum Access Control Attacks Details Source
38 Internet Token INT $16K base Access Control Attacks Details Source
39 MixedSwapRouter $16K arbitrum Access Control Attacks Details
40 Rico — arbitrum Access Control Attacks Details

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Delegatecall & Call Injection Attacks guide Understand the exploit pattern behind these incidents. Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists.