Web3 Hacks in 2021

2021 incident records, sorted by known loss. The strongest mapped pattern is Access Control (46 rows); the largest tracked chain bucket is Ethereum ($1.9B).

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
201 Casper DeFi $172K — Other
202 Alpha Finance Lab $171K — Other
203 Iron Finance $170K polygon Incorrect Share Accounting
204 Alpha Homora $147K ethereum Oracle Manipulation & Price Manipulation
205 Tin Finance $137K binance Rugpull
206 Daedalus DAO $129K — Rugpull
207 MerchDAO $128K ethereum Honeypot
208 MoltenSwap $122K binance Rugpull
209 PancakeHunny $112K bsc Other / Incorrect Share Accounting
210 INFI Governance and Utility Token $110K ethereum Rugpull
211 YZY DAO $106K ethereum Rugpull
212 SushiSwap $104K ethereum Swap Logic Flaw
213 Badger DAO $104K ethereum Swap Logic Flaw
214 Yearn Machine Learning $100K ethereum Rugpull
215 Formation.Fi $100K — Other
216 Aphrodite Protocol $97K ethereum Rugpull
217 Safe Dollar $95K polygon Other
218 Nifity $93K ethereum Rugpull
219 NeedForSpeed Finance $82K ethereum Rugpull
220 OracleSwapToken $77K ethereum Honeypot
221 Sakura DeFi $76K ethereum Rugpull
222 Bio Farm $73K ethereum Rugpull
223 Snowflake Floki $70K — Honeypot
224 Force Dao $66K ethereum Honeypot
225 SLM Token $65K ethereum Honeypot
226 Echelon DAO $63K binance Honeypot
227 Rise Protocol $59K ethereum Rugpull
228 Poz finance $56K binance Rugpull
229 Cryptopia Exchange $45K — Access Control Attacks
230 Cryptopia $45K multiple Hot Wallet Key Compromised
231 DoraFactory $42K — Other
232 DAO ventures $39K — Other
233 Galaxy DeFi $39K ethereum Honeypot
234 OptionRoom $38K — Other
235 Mars Farm $38K binance Rugpull
236 Orbit Swap $36K binance Rugpull
237 Holy Trinity $34K ethereum Rugpull
238 MinterPro $34K binance Rugpull
239 My Farm Pet $31K — Flash Loan Attacks
240 NONAME $30K ethereum Rugpull
241 WOLF Protocol $30K ethereum Rugpull
242 DiceSwap $30K binance Rugpull
243 Dragonswap $29K binance Rugpull
244 DARK DEFI $27K ethereum Honeypot
245 Horizon Finance $25K binance Rugpull
246 NarutoSwap $24K binance Rugpull
247 DefiBox $24K — Other
248 Static $24K ethereum Rugpull
249 Pacific Protocol $24K ethereum Rugpull
250 Game Swap Exchange $23K ethereum Rugpull
251 Zap Finance $22K binance Rugpull
252 Cool Cats $21K — Rugpull
253 CatDog $20K ethereum Rugpull
254 KoiSwap $20K binance Rugpull
255 Thunder Finance $19K binance Rugpull
256 Dipex $17K ethereum Rugpull
257 True Seigniorage Dollar $17K ethereum Rugpull
258 Solend $16K solana Access Control Attacks
259 Slicer Finance $14K ethereum Rugpull
260 Tranquility Defi $13K ethereum Rugpull
261 ChaddyFinance $13K binance Rugpull
262 RFbtc $12K ethereum Rugpull
263 Fractal Defi $12K ethereum Rugpull
264 D4ppdao Token $12K ethereum Rugpull
265 PulldogSwap $11K binance Honeypot
266 Bing Swap $10K binance Rugpull
267 Focus $10K ethereum Rugpull
268 Mantle $10K ethereum Rugpull
269 Mocha Set Dollar $9K ethereum Rugpull
270 Sloth Inu $8K — Rugpull
271 Rfyield Finance $7K ethereum Rugpull
272 Ohohoh.io $6K ethereum Rugpull
273 Banksy $5K — Rugpull
274 Jointventure Finance $4K ethereum Rugpull
275 PUMP $4K ethereum Rugpull
276 Binary Protocol $4K ethereum Rugpull
277 Contribute Protocol $4K ethereum Rugpull
278 Delicacy DeFi $4K binance Rugpull
279 iBLUE $3K ethereum Rugpull
280 Reflect3 Finance $3K ethereum Rugpull
281 EASYPump $3K ethereum Honeypot
282 burn12 $3K ethereum Rugpull
283 Q DAO Governance token v2.0 $3K binance DAO Governance Attacks
284 MetaMoonMars $866 — Other
285 AutobotDefi $797 — Rugpull
286 DAOstreetbets $548 binance Honeypot
287 Internet Computer — binance Honeypot
288 Gelato — — Other
289 ScareCrow — — Abandoned
290 Coinsuper — — Other
291 SkyDog — binance Honeypot
292 ShibaElonMars — binance Honeypot
293 UNIYSWAP — — Rugpull
294 Mystery — — Rugpull
295 FlokiFarmToken — — Rugpull
296 OliveOptions — binance Honeypot
297 Daughter Doge Revenge Token — — Rugpull
298 AwakenedToken — — Rugpull
299 LionKingToken — — Rugpull
300 SaturnBeam — — Rugpull

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.