Web3 Hacks in 2022

2022 incident records, sorted by known loss. The strongest mapped pattern is Access Control (78 rows); the largest tracked chain bucket is Ethereum ($2.1B).

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
201 FileSystemVideo $304K — Rugpull
202 Lymex $302K — Rugpull
203 ShadowFi $301K bsc Access Control Attacks
204 Amun $300K ethereum, polygon Access Control Attacks
205 OlympusDAO $300K ethereum Delegatecall & Call Injection Attacks
206 Seth Green NFTs $300K ethereum Phishing Attacks
207 Flurry Finance $293K bsc Other / Incorrect Share Accounting
208 RES Token $290K bsc Oracle Manipulation & Price Manipulation
209 Metaland DAO $287K — Rugpull
210 LOO $275K — Rugpull
211 Omni Bridge $272K — Replay Attacks
212 KyberSwap Classic $265K polygon Cloudflare Key Compromised / CDN Compromise / Other
213 SherLOCK $262K — Rugpull
214 TTTT $261K — Rugpull
215 Ethereum alarm clock $260K ethereum Other / Reward Logic Flaw
216 BAYC & OtherSide $257K ethereum Phishing Attacks
217 PoW ETH $256K — Phishing Attacks
218 SuperStep $256K — Rugpull
219 BNQ Token $256K — Rugpull
220 ULME Token $250K bsc Access Control Attacks
221 GOAT $250K — Rugpull
222 EarnHub $245K — Other
223 Celer Bridge $240K multi chain Other / DNS Hijack
224 QuickSwap $220K polygon Flash Loan Attacks
225 NFTflow $216K — Rugpull
226 MMFinance $215K — Rugpull
227 Brand New Quest Metaverse $214K — Rugpull
228 Santa Coin $211K — Rugpull
229 Swello Finance $210K — Rugpull
230 DeFi WZ Token $208K — Rugpull
231 Rare Bears $206K — Access Control Attacks
232 ArenaPlayAPC $204K — Rugpull
233 MaximusDAO $204K — Phishing Attacks
234 Automated Assassins $202K — Rugpull
235 X2Y2 $200K ethereum Phishing Attacks
236 Rabby Wallet $194K — Access Control Attacks
237 DollarDoge $194K — Rugpull
238 NWT Token $191K — Rugpull
239 Layer2DAO $190K optimism Access Control Attacks
240 DMCToken $190K — Rugpull
241 Meta Apes $183K — Rugpull
242 SHIDAO $180K — Rugpull
243 Bill Muray Wallet Hack $178K — Access Control Attacks
244 PAK REVOLUTION $175K — Rugpull
245 Cryptovoxels $171K ethereum Phishing Attacks
246 Stobox Exchange $166K — Access Control Attacks
247 Stader.Near $165K — Other
248 FDO $160K — Other
249 Sport Move $160K — Rugpull
250 SkyLands $159K — Rugpull
251 DappNode $158K — Access Control Attacks
252 BTDOG $157K — Rugpull
253 ADAF $156K — Rugpull
254 Artificial intelligence robot $152K — Rugpull
255 LlamaCoin $151K — Rugpull
256 DeeKay $150K — Phishing Attacks
257 SkyVerse $150K — Other
258 FlokiMoon $148K — Rugpull
259 DDCX $148K — Rugpull
260 Deri Protocol $145K — Other
261 HPD $143K — Rugpull
262 DHE $142K — Rugpull
263 Giant Divine Shield $141K — Rugpull
264 MooCakeCTX $140K bsc Flash Loan Attacks
265 Ratz Club $140K — Access Control Attacks
266 Dark Light $134K — Rugpull
267 World Cup $132K — Rugpull
268 GST Token $131K — Rugpull
269 Quint $130K — Other
270 pandorachainDAO $128K bsc Oracle Manipulation & Price Manipulation
271 DeFi Safe $127K — Rugpull
272 Journey of Awakening $127K — Other
273 MAD $122K — Other
274 Elron Token $122K — Rugpull
275 Trust Bridge $120K — Rugpull
276 ACC TOKEN $120K — Rugpull
277 Kaoya Swap $118K bsc Flash Loan Attacks
278 Easier $116K — Rugpull
279 FOMO DAO $114K — Rugpull
280 FlokiChain $111K — Rugpull
281 Abracadabra Money $111K — Oracle Manipulation & Price Manipulation
282 F*ck The Merge $110K — Rugpull
283 Banana Swap $110K — Other
284 NWN $110K — Rugpull
285 QuickSwap $108K polygon Other / DNS Hijack
286 TetherShiba $105K — Honeypot
287 DarkPool $104K — Other
288 FDB $104K — Rugpull
289 Ranger $100K — Rugpull
290 Quixotic $100K optimism Other / Signature Verification Flaw
291 CityDAO $95K ethereum Access Control Attacks
292 Citizen Finance $94K bsc, polygon Access Control Attacks
293 APE $94K — Rugpull
294 Marvel Metauniverse $94K — Rugpull
295 Cryptos Tribe $91K — Rugpull
296 RedRubyDAO $91K — Other
297 GDAO $90K — Rugpull
298 CryptoBatz $90K — Other
299 Cashera $90K — Rugpull
300 Klein Bottle $90K — Rugpull

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.