Web3 Hacks in 2025

2025 incident records, sorted by known loss. The strongest mapped pattern is Access Control (74 rows); the largest tracked chain bucket is Ethereum ($2.1B).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
101 Silo Finance $546K ethereum fillQuote silo.borrow() Exploit / Missing Input Validation / Other Details Source
102 Agentic FoF $531K ethereum Malicious Insider Details
103 0G Labs $516K 0g emergencyWithdraw Function Exploit / Withdrawal Logic Flaw Details Source
104 NumaMoney $506K arbitrum Flash Loan Attacks Details Source2
105 Polymarket $500K ethereum, polygon Phishing Attacks Details
106 Zunami Protocol $500K ethereum Access Control Attacks Details Source
107 Fake LAYER $465K — Rugpull Details Source
108 WaveX $430K — Other Details Source
109 Cozy V2 $427K optimism Access Control Attacks Details Source
110 Evoq Finance $420K bsc Access Control Attacks Details Source
111 Corepound $400K core Drained Contracts / Admin Drain Details Source
112 Cardex $400K abstract Access Control Attacks Details Source
113 phishing $394K — Phishing Attacks Details Source
114 Impermax V3 $380K base Zero-Rate Hack / Other / Liquidation Logic Flaw Details Source
115 SIR $355K ethereum Access Control Attacks Details Source
116 EIP-7702 Delegation Contract Exploit $336K — Other Details Source
117 Goldfinch Finance $330K ethereum Access Control Attacks Details Source2
118 The Idols NFT $324K ethereum Other / Reward Logic Flaw Details Source23
119 Voltage V3 $322K fuse Access Control Attacks Details
120 numa. $313K sonic NumaVault Exploit / Incorrect Share Accounting Details Source
121 Yearn Finance $300K ethereum Flash Loan Attacks Details Source
122 Coinbase $300K ethereum Access Control Attacks Details Source
123 Dexodus Finance $300K base Oracle Manipulation & Price Manipulation Details Source
124 Impermax V3 $300K base Flash Loan Attacks Details Source
125 MoonHacker $300K optimism Access Control Attacks Details Source2
126 Zoth $285K ethereum Oracle Manipulation & Price Manipulation Details Source
127 Malda (prev. Mendi Finance) $273K — Other Details Source2
128 FutureSwap $270K ethereum Flash Loan Attacks Details Source
129 Zerobase $250K bsc Access Control Attacks Details Source2
130 Hacken Token $250K — Access Control Attacks Details Source
131 Peapods Finance $207K ethereum Oracle Manipulation & Price Manipulation Details Source
132 RANT $204K bsc Incorrect Fee Accounting Details
133 Unilend V2 $198K ethereum Redeem Process Exploit / Other / Redeem Logic Flaw Details Source
134 four.meme $183K bsc Liquidity Pool Exploit / Other / Swap Logic Flaw Details Source
135 DoodiPals $171K solana Access Control Attacks Details
136 FilDA $167K elastos Oracle Manipulation & Price Manipulation Details
137 Port3 Network $166K bsc Infinite Mint and Dump / Infinite Mint Details Source
138 MAID $166K — Access Control Attacks Details Source
139 Sharwa.Finance $146K arbitrum Oracle Manipulation & Price Manipulation Details Source
140 Pond.fun $145K linea Admin Drain Details
141 Dexmax AI $130K ethereum Access Control Attacks Details
142 Meta Pool $130K ethereum Infinite Mint / Other Details Source2
143 MSCST $130K bsc Access Control Attacks Details Source
144 DMi $124K — Flash Loan Attacks Details Source
145 Anome $120K — Other Details Source
146 ModelpiToken $107K — Other Details Source
147 DRLVaultV3 $100K ethereum Oracle Manipulation & Price Manipulation Details
148 QuantMaster $100K ethereum Backdoor Contract Details
149 Alkimiya $96K ethereum Arithmetic Error Details
150 Squid $90K — Other Details Source
151 Berally $90K berachain Access Control Attacks Details Source
152 StepHeroNFTs $90K bsc Reentrancy Details Source
153 Tailverse $88K — Other Details Source2
154 OracleBNB $80K — Rugpull Details Source2
155 four.meme $80K bsc Access Control Attacks Details
156 Hegic(old contract) $80K ethereum Unlimited repeated withdrawal exploit / Withdrawal Logic Flaw Details Source
157 WebKeyDao $73K bsc Access Control Attacks Details Source
158 IRYS AI $70K bsc Backdoor Contract Details
159 Bankroll $65K bsc Other / Arithmetic Error Details Source
160 AST Token $65K — Other Details Source
161 Grizzifi $61K bsc Reward Logic Flaw Details
162 dTRINITY $56K sonic Access Control Attacks Details
163 MUBARA $55K — Phishing Attacks Details Source2
164 Eden Network $54K — Access Control Attacks Details Source
165 LAURA $48K — Other Details Source2
166 Stepp2p $43K bsc Unknown Details
167 Usual $43K ethereum Arbitration Exploit / Other / Missing Input Validation Details Source
168 Sorra Finance $41K ethereum Reward Logic Flaw Details
169 DIMO $40K ethereum Access Control Attacks Details Source
170 Mosca2 $38K bsc Incorrect Share Accounting Details
171 Mosca $38K binance Other / Incorrect Share Accounting Details Source
172 AIRWA $34K bsc Access Control Attacks Details Source2
173 TokenHolder $26K bsc Access Control Attacks Details
174 ACB $23K bsc Oracle Manipulation & Price Manipulation Details Source
175 OpenOcean $22K — Other Details Source
176 VeloraDEX $20K — Delegatecall & Call Injection Attacks Details Source
177 Raga Finance $18K hyperliquid l1 HyperEVM Delta Neutral Exploit / Unknown Details Source
178 BIGO $18K — Other Details Source2
179 402bridge $18K base Access Control Attacks Details Source
180 BBX Token $12K bsc Oracle Manipulation & Price Manipulation Details Source
181 Tenderize V2 $11K ethereum Proxy Upgrade Skim / Unknown Details Source
182 Aventa $7K ethereum Unknown Details
183 Unverified_35bc $7K bsc Reentrancy Details
184 Arcade $5K — Access Control Attacks Details Source
185 Peapods Finance $4K — Other Details Source
186 FixedTokenBSwap $2K ethereum Oracle Manipulation & Price Manipulation Details
187 Panoptic V1.1 — base, ethereum, unichain Hash Collision Details Source
188 Arcadia V2 — base Reentrancy Details Source
189 Zapper — arbitrum, base, ethereum +2 DNS Hijack Details
190 DogWifTools — solana Compromised Software Release Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.