Real Delegatecall & Call Injection Hacks

Real incidents mapped to delegatecall & call injection. Start with the records, open the source, then use the attack guide when an incident matches the code you are reviewing.

Open full database Read attack guide

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 UXLINK $48.0M arbitrum, ethereum Access Control Attacks Details Source
2 Curio $16.0M ethereum Access Control Attacks Details Source
3 Rari Capital $15.7M ethereum Access Control Attacks Details Source
4 Furucombo $14.0M ethereum Access Control Attacks Details Source
5 LiFi Finance $9.7M linea, metis, zksync era Access Control Attacks Details Source
6 Punk Protocol $8.9M ethereum Access Control Attacks Details Source
7 LI.FI $8.0M — Delegatecall & Call Injection Attacks Details Source
8 Seneca $6.5M arbitrum, ethereum Access Control Attacks Details Source
9 1inch $5.0M ethereum Access Control Attacks Details Source
10 Bungee $3.3M ethereum Access Control Attacks Details Source
11 Zapper $2.5M — Delegatecall & Call Injection Attacks Details Source
12 Pond0x $2.2M ethereum Access Control Attacks Details
13 Unizen $2.1M ethereum Access Control Attacks Details Source
14 Dexible $2.0M arbitrum, ethereum Access Control Attacks Details Source
15 Hope Finance $2.0M arbitrum Access Control Attacks Details Source
16 Dough Finance $2.0M ethereum Access Control Attacks Details Source
17 Flooring Protocol $1.6M ethereum Access Control Attacks Details
18 Rubic $1.4M ethereum Access Control Attacks Details Source
19 BasketDAO $1.2M ethereum Access Control Attacks Details Source
20 BasketDAO $1.2M ethereum Access Control Attacks Details
21 Hyperdrive HL $782K hyperliquid l1 Access Control Attacks Details Source
22 Auctus $726K ethereum Access Control Attacks Details
23 Chainge Finance $716K bsc Access Control Attacks Details Source
24 Maestro $500K ethereum Access Control Attacks Details Source
25 Fusion by IPOR $336K arbitrum Access Control Attacks Details Source
26 Bond Protocol $300K ethereum Delegatecall & Call Injection Attacks Details Source
27 Rabby Wallet $194K — Access Control Attacks Details Source
28 CoW Swap $180K ethereum Access Control Attacks Details Source
29 Quant $138K ethereum Access Control Attacks Details
30 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
31 Brahma Finance $90K ethereum Access Control Attacks Details Source
32 Spectra Finance $73K ethereum Access Control Attacks Details
33 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
34 Benqi Staked Avax $64K avalanche Access Control Attacks Details
35 Aave $56K ethereum Access Control Attacks Details Source
36 Revert Finance $30K ethereum Access Control Attacks Details Source
37 VeloraDEX $20K — Delegatecall & Call Injection Attacks Details Source
38 Unistreets $18K ethereum Access Control Attacks Details
39 MixedSwapRouter $16K arbitrum Access Control Attacks Details
40 Rico — arbitrum Access Control Attacks Details

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Delegatecall & Call Injection Attacks guide Understand the exploit pattern behind these incidents. Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists.