Web3 Hacks in 2019
2019 incident records, sorted by known loss. The strongest mapped pattern is Access Control (15 rows); the largest tracked chain bucket is Ethereum ($161.1M).
Incident records
Sorted by known reported loss first, then recency. Open the source before treating any summary as final.
| Links | ||||||
|---|---|---|---|---|---|---|
| 1 | PlusToken | $2.9B | — | Rugpull | Details Source23 | |
| 2 | Token.Store | $160M | — | Rugpull | Details Source | |
| 3 | QuadrigaCX | $147M | — | Access Control Attacks | Details Source2 | |
| 4 | Upbit | $49.3M | ethereum | Access Control Attacks | Details Source | |
| 5 | Binance | $40.0M | bitcoin | Access Control Attacks | Details Source2 | |
| 6 | Bitpoint | $27.6M | bitcoin, ethereum, litecoin +1 | Access Control Attacks | Details Source | |
| 7 | Bitmarket | $27.1M | — | Rugpull | Details Source2 | |
| 8 | Coinbin | $26.0M | ethereum | Access Control Attacks | Details Source2 | |
| 9 | Bithumb | $19.0M | ethereum, ripple | Access Control Attacks | Details Source23 | |
| 10 | Cryptopia | $16.0M | ethereum | Suspected private-key compromise | Details | |
| 11 | Kraken | $10.4M | bitcoin | Access Control Attacks | Details Source23 | |
| 12 | GateHub | $9.5M | ripple | Access Control Attacks | Details Source2 | |
| 13 | CoinTiger | $9.2M | ethereum | Access Control Attacks | Details Source2 | |
| 14 | DragonEx | $7.0M | bitcoin, eos, etc +3 | Rugpull / Key Leaked via Infrastructure | Details Source | |
| 15 | VeChain | $6.5M | vechain | Access Control Attacks | Details | |
| 16 | Chain Fusion | $6.4M | ethereum | Access Control Attacks | Details | |
| 17 | Bitrue | $4.7M | cardano, ripple | Access Control Attacks | Details Source23 | |
| 18 | TronBank | $4.3M | tron | Backdoor Contract | Details | |
| 19 | BitoPro | $2.2M | — | Other | Details Source23 | |
| 20 | Soxex | $1.0M | — | Rugpull | Details Source | |
| 21 | Bitcoin Norway | $1.0M | — | Other | Details Source2 | |
| 22 | Bitsane | $570K | — | Rugpull | Details Source | |
| 23 | VinDAX | $500K | ethereum, multiple | Other / Key Leaked via Infrastructure | Details Source | |
| 24 | Nuls | $480K | nuls | Signature Verification Flaw | Details | |
| 25 | Ethereum Classic | $220K | ethereum classic | Forged Proof | Details | |
| 26 | Netbox | $132K | bitcoin, ethereum | Rugpull / Key Leaked via Infrastructure | Details Source | |
| 27 | Biki | $123K | — | Access Control Attacks | Details Source2 | |
| 28 | Coinbase | $100K | — | Access Control Attacks | Details Source | |
| 29 | LocalBitcoins | $27K | bitcoin | Other / Key Leaked via Infrastructure | Details Source | |
| 30 | Vertcoin | $29 | vertcoin | Validator Key Compromised | Details | |
| 31 | Synthetix | — | ethereum | Oracle Manipulation & Price Manipulation | Details | |
| 32 | Coinroom | — | — | Rugpull | Details Source | |
| 33 | Poker EOS | — | eos | Access Control Attacks | Details | |
| 34 | Qubicle | — | ethereum | Honeypot | Details Source2 | |
| 35 | TronWow | — | tron | Unknown | Details | |
| 36 | TronBank | — | tron | Infinite Mint | Details | |
| 37 | TronCrush | — | tron | Infinite Mint | Details | |
| 38 | CoinBene | — | ethereum | Suspected wallet compromise; cause unconfirmed | Details Source2 |
Notes
Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.
Start your free security training
Get 25 free lessons and 4 guided exploit exercises.
Onboarding details by email within 2–3 business days.