Web3 Hacks in 2021

2021 incident records, sorted by known loss. The strongest mapped pattern is Access Control (43 rows); the largest tracked chain bucket is Ethereum ($1.9B).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 Africrypt $3.6B — Rugpull Details Source 1Source 2
2 Thodex $2.0B — Rugpull Details Source 1Source 2
3 Finiko $1.5B — Rugpull Details Source
4 Poly Network $611M bsc, ethereum, polygon Access Control Attacks Details Source
5 Bitmart $196M bsc, ethereum Access Control Attacks Details Source
6 Vulcan Forged $140M ethereum, polygon Access Control Attacks Details Source
7 Boy X Highspeed $139M bsc Access Control Attacks Details Source 1Source 2
8 Cream Finance $130M ethereum Flash Loan Attacks Details Source 1Source 2
9 Badger DAO $120M ethereum Phishing Attacks Details Source
10 Liquid $97.0M ethereum Access Control Attacks Details Source
11 Mirror $90.0M terra Access Control Attacks Details Source
12 AscenDEX $77.7M bsc, ethereum, polygon Access Control Attacks Details Source
13 Venus $77.0M bsc Oracle Manipulation & Price Manipulation Details Source
14 StakeHound / Fireblocks $72.0M ethereum Access Control Attacks Details Source 1Source 2
15 AnubisDAO $60.0M ethereum Drained Contracts / Rugpull / Admin Drain Details Source
16 EasyFi $59.0M ethereum, polygon Access Control Attacks Details Source
17 Uranium Finance $57.2M binance, bsc Arithmetic Overflow & Underflow Attacks Details Source
18 bZx $47.6M bsc, polygon Access Control Attacks Details Source
19 PancakeBunny $45.0M binance, bsc Flash Loan Attacks Details Source 1Source 2Source 3
20 Grim Finance $40.0M fantom Flash Loan Attacks Details Source
21 Alpha Finance $37.5M ethereum Flash Loan Attacks Details Source
22 Cream Finance $36.2M ethereum Flash Loan Attacks Details Source 1Source 2
23 Vee Finance $36.0M avalanche Flash Loan Attacks Details Source
24 DEFI100 $32.0M — Rugpull Details Source 1Source 2
25 Meerkat Finance $32.0M binance, bsc Drained Contracts / Rugpull / Admin Drain Details Source
26 MonoX $31.4M ethereum, polygon Oracle Manipulation & Price Manipulation Details Source
27 Spartan Protocol $30.5M binance, bsc Flash Loan Attacks Details Source 1Source 2Source 3Source 4
28 SnowdogDAO $30.0M avalanche Rugpull / Drained Contracts / Liquidity Rug Details Source 1Source 2
29 Paid Network $27.4M ethereum Infinite Mint and Dump / Other / Infinite Mint Details Source
30 StableMagnet $27.0M binance, bsc Drained Contracts and User Wallets / Rugpull / Backdoor Contract Details Source
31 xToken $24.0M ethereum Flash Loan Attacks Details Source
32 Bilaxy $21.7M ethereum Access Control Attacks Details Source 1Source 2Source 3
33 Popsicle Finance $20.7M ethereum Flash Loan Attacks Details Source
34 Indexed Finance $16.0M ethereum Flash Loan Attacks Details Source
35 Rari Capital $15.7M ethereum Access Control Attacks Details Source
36 Furucombo $14.0M ethereum Access Control Attacks Details Source
37 pNetwork $13.0M bitcoin, bsc Cross-Chain Bridge Attacks Details Source
38 flash.sx / vaults.sx $13.0M eos Reentrancy Details
39 ValueDefi $11.0M bsc, ethereum Access Control Attacks Details Source
40 Yearn Finance $11.0M ethereum Flash Loan Attacks Details Source
41 BearnFi $10.9M binance, bsc Flash Loan Attacks Details Source
42 Pizza $9.9M eos Other / Arithmetic Error Details Source
43 Punk Protocol $8.9M ethereum Access Control Attacks Details Source
44 Gamma $8.2M ethereum Access Control Attacks Details Source
45 Thorchain DEX $8.0M ethereum Refund Logic Exploit / Other / Withdrawal Logic Flaw Details Source
46 Anyswap $7.9M bsc, ethereum, fantom Access Control Attacks Details Source
47 BurgerSwap $7.2M binance, bsc Flash Loan Attacks Details Source
48 DAO Maker Vesting $7.0M ethereum Access Control Attacks Details Source
49 FinNexus $7.0M bsc, ethereum Access Control Attacks Details Source 1Source 2
50 Bondly $6.8M ethereum Access Control Attacks Details Source
51 Luna Yield $6.7M solana Rugpull Details Source 1Source 2Source 3
52 Alchemix $6.5M ethereum Accidental debt forgiveness Details Source
53 Belt Finance $6.3M binance, bsc Flash Loan Attacks Details Source
54 Squid Game $5.7M bsc Rugpull / Drained Liquidity Pool / Liquidity Rug Details Source 1Source 2Source 3Source 4
55 Roll $5.7M ethereum Access Control Attacks Details Source
56 XSURGE $5.6M — Flash Loan Attacks Details Source 1Source 2
57 SurgeBNB $5.0M bsc Flash Loan Attacks Details Source
58 Thorchain DEX $5.0M ethereum Over-ride Logic Exploit / Other / Bridge Logic Flaw Details Source
59 XDX Swap $5.0M huobi eco chain Other / Bridge Logic Flaw Details Source 1Source 2Source 3
60 xToken $4.5M ethereum Flash Loan Attacks Details Source
61 Eleven Finance $4.5M bsc Flash Loan Attacks Details Source
62 ChainSwap $4.4M bsc, ethereum Access Control Attacks Details Source
63 ChainSwap $4.4M bsc, ethereum Other / Bridge Logic Flaw Details Source 1Source 2
64 DAO Maker Vesting $4.0M ethereum Access Control Attacks Details Source
65 Maze Protocol $4.0M — Other Details Source
66 DODO AMM $3.8M ethereum Access Control Attacks Details Source
67 Bogged Finance $3.6M binance, bsc Flash Loan Attacks Details Source 1Source 2Source 3
68 Siren $3.5M polygon Reentrancy Details Source
69 Vesper Finance $3.4M ethereum Oracle Manipulation & Price Manipulation Details Source
70 HoneySwap.Fi $3.3M binance Rugpull Details Source
71 Ref Finance $3.2M near LP balance not debited Details Source
72 Zabu Finance $3.2M avalanche Flash Loan Attacks Details Source
73 PolkaTrain $3.0M polkadot Other / Reward Logic Flaw Details Source 1Source 2
74 SushiSwap $3.0M ethereum Other / Redirected Deposits / Frontend Compromise Details Source
75 Wallstreetswap Finance $2.9M binance Rugpull Details Source
76 MetaDAO $2.8M — Honeypot Details Source
77 Fetch.ai $2.6M multiple Access Control Attacks Details Source
78 Zapper $2.5M — Delegatecall & Call Injection Attacks Details Source 1Source 2
79 PancakeBunny $2.4M bsc Flash Loan Attacks Details Source 1Source 2Source 3Source 4
80 Evolved Apes $2.3M — Rugpull Details Source
81 Turtledex $2.3M binance, bsc Rugpull / Drained Contracts / Liquidity Rug Details Source
82 Fairmoon $2.3M — Rugpull Details Source
83 PopcornSwap $2.2M binance Rugpull Details Source
84 NEKO $2.2M bsc Access Control Attacks Details
85 stazie $2.1M — Access Control Attacks Details Source
86 Polygon $2.0M polygon Access Control Attacks Details
87 AFKSystems Finance $2.0M — Rugpull Details Source
88 AutoSharkFinance $2.0M — Other Details Source 1Source 2
89 Circle $2.0M — Access Control Attacks Details Source
90 PancakeHunny $2.0M — Other Details Source 1Source 2
91 BT.Finance $1.9M ethereum Flash Loan Attacks Details Source 1Source 2
92 PancakeSwap $1.8M bsc Access Control Attacks Details Source 1Source 2
93 Bent Finance $1.8M ethereum Access Control Attacks Details Source
94 8ightDAO $1.8M harmony Access Control Attacks Details Source
95 EVODeFi $1.7M bsc Flash Loan Attacks Details Source
96 Acala Network $1.6M acala Incentives Function Mistake / Infinite Mint Details Source
97 MetaMask Governance $1.5M — Honeypot Details Source
98 Levyathan $1.5M binance, bsc Access Control Attacks Details Source
99 PolyButterfly $1.5M polygon Rugpull Details Source
100 JulSwap $1.5M — Flash Loan Attacks Details Source 1Source 2Source 3

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.