Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (86 rows); the largest tracked chain bucket is Ethereum ($616.1M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 Drift Trade $295M solana Access Control Attacks Details Source
2 Kelp DAO $293M arbitrum, ethereum Access Control Attacks Details Source
3 KelpDao Unverified $290M — Unclassified Details Source
4 Social Engineering Scam $282M — Phishing Attacks Details Source
5 Drift Protocol $280M — Access Control Attacks Details Source
6 Cold Card Unverified $130M — Unclassified Details Source
7 Coldcard $130M bitcoin Other / Weak Key Generation Details Source
8 Blockchain Intelligence Hunger Games Unverified $94.6M — Unclassified Details Source
9 Tectonic Protocol $75.0M cronos Oracle Manipulation & Price Manipulation Details Source
10 Price Impact Kills Unverified $50.0M — Unclassified Details Source
11 Step Finance $40.0M solana Access Control Attacks Details Source
12 Digging for Gold Unverified $39.0M — Unclassified Details Source
13 Humanity Protocol Unverified $36.4M — Unclassified Details Source
14 Humanity Protocol $31.0M bsc, ethereum Access Control Attacks Details Source
15 Aave V3 $27.8M ethereum Oracle Manipulation & Price Manipulation Details Source
16 Truebit $26.5M ethereum Bonding Curve Exploit / Other / Arithmetic Error Details Source
17 Whale Wallet Drain $25.6M — Phishing Attacks Details Source
18 Resolv Labs Unverified $25.0M — Unclassified Details Source
19 Resolv $25.0M ethereum Access Control Attacks Details Source
20 AFX Trade Unverified $24.1M — Unclassified Details Source
21 AFX $24.1M — Access Control Attacks Details Source
22 AFX Bridge $24.1M arbitrum Validator Key Compromised Details
23 Ostium $24.0M arbitrum Access Control Attacks Details Source
24 BonkDAO $21.0M solana Access Control Attacks Details Source
25 BonkDAO Unverified $19.3M — Unclassified Details Source
26 Rhea Finance Unverified $18.4M — Unclassified Details Source
27 Rhea Lend $18.4M near Oracle Manipulation & Price Manipulation Details
28 Rhea Finance $18.4M — Other Details Source
29 SwapNet $17.0M base, ethereum Unlimited Approval Exploit / Other Details Source
30 Matcha $16.8M base, ethereum Unlimited Approval Exploit / Frontend Compromise Details Source
31 SUPERFORTUNE AI $15.2M ethereum Access Control Attacks Details
32 Grinex $13.7M ethereum, tron Hot Wallet Key Compromised Details
33 KITE Foundation $13.3M ethereum Access Control Attacks Details
34 StablR $12.8M — Access Control Attacks Details Source
35 Triple-A $11.8M arbitrum, ethereum, tron Access Control Attacks Details Source
36 Verus $11.6M — Other Details Source
37 Verus-Ethereum Bridge $11.5M verus Forged Proof Details
38 Blend Pools V2 $11.0M stellar Oracle Manipulation & Price Manipulation Details Source
39 Blend Protocol $10.9M — Oracle Manipulation & Price Manipulation Details Source
40 THORChain Unverified $10.7M — Unclassified Details Source
41 THORChain $10.7M base, bitcoin, bsc, ethereum Other / Bridge Logic Flaw Details Source
42 Wanchain $10.0M cardano Other / Signature Verification Flaw Details Source
43 Syscoin Bridge $10.0M syscoin Forged Proof Details
44 Bonzo $9.1M hedera Oracle Manipulation & Price Manipulation Details Source
45 Moonwell Lending $8.7M base Oracle Manipulation & Price Manipulation Details Source
46 Term Labs $8.5M — Other Details Source
47 TermFinance Vaults $8.5M ethereum Flash Loan Attacks Details
48 Crypto DAO $8.2M bsc Access Control Attacks Details
49 Coinsbuy Unverified $8.1M — Unclassified Details Source
50 Coinsbuy $8.1M ethereum, tron Access Control Attacks Details Source
51 IoTeX $8.0M ethereum Access Control Attacks Details Source
52 VerusCoin Unverified $7.5M — Unclassified Details Source
53 Verus-Ethereum Bridge $7.5M verus Forged Proof Details
54 TAC $7.5M tac Withdrawal Logic Flaw Details
55 Verus $7.5M — Other Details Source
56 JaredFromSubway.eth MEV Bot $7.5M ethereum Other / MEV Bot Drained Details Source
57 DxSale Unverified $7.3M — Access Control Attacks Details Source
58 DxSale $7.3M bsc Liquidity Rug Details
59 Saga $7.0M saga Infinite Mint and Dump / Other / Infinite Mint Details Source
60 TrustedVolumes $6.7M ethereum Access Control Attacks Details Source
61 WEMIX $6.2M — Access Control Attacks Details Source
62 Summer Finance Unverified $6.0M — Unclassified Details Source
63 Lazy Summer Protocol $6.0M ethereum Donation Attack Details
64 Summer.fi $6.0M — Flash Loan Attacks Details Source
65 Wasabi Protocol Unverified $5.9M — Unclassified Details Source
66 TrustedVolumes Unverified $5.9M — Unclassified Details Source
67 Wasabi $5.5M base, berachain, blast, ethereum Access Control Attacks Details Source
68 Gravity Bridge Unverified $5.4M — Unclassified Details Source
69 Gravity Bridge $5.4M ethereum Access Control Attacks Details Source
70 Cyrus Finance $5.0M bsc Flash Loan Attacks Details Source
71 Makina $5.0M ethereum Flash Loan Attacks Details Source
72 Secret Network Unverified $4.7M — Unclassified Details Source
73 Secret Network $4.7M secret Unbacked Cross-Chain Mint Details
74 Axelar Secret IBC Bridge $4.7M ethereum, secret Unbacked Cross-Chain Mint Details
75 Across $4.5M solana Other / Spoofed Event Log Details Source
76 New Market Trading $4.0M arbitrum, base, ethereum Access Control Attacks Details Source
77 B² Network $3.8M — Access Control Attacks Details Source
78 YO Protocol $3.7M ethereum Slippage Exploit / Missing Slippage Check Details Source
79 Venus Protocol Unverified $3.7M — Unclassified Details Source
80 Venus Core Pool $3.7M bsc Donation Attack Details Source
81 Yo Yield $3.7M — Other Details Source
82 Aperture Finance $3.7M — Access Control Attacks Details Source
83 Aperture LM $3.7M base, bsc, ethereum Access Control Attacks Details Source
84 Sweat Foundation $3.5M near Withdrawal Logic Flaw Details
85 Volo Unverified $3.5M — Unclassified Details Source
86 Volo $3.5M — Other Details Source
87 Volo Vault $3.5M sui Access Control Attacks Details
88 NYC Memecoin $3.4M — Rugpull Details Source
89 Harmony Unverified $3.2M — Unclassified Details Source
90 Harmony Bridge $3.2M harmony Bridge Logic Flaw Details
91 Third-party SquidRouterModule $3.2M — Access Control Attacks Details Source
92 SquidRouterModule $3.2M base, ethereum Access Control Attacks Details
93 BounceBit $3.0M bouncebit Access Control Attacks Details
94 Polymarket International $3.0M polygon Frontend Compromise Details
95 Polymarket $3.0M — Other Details Source
96 CrossCurve $3.0M — Spoofed Cross-Chain Messages / Other / Cross-Chain Message Spoofing Details Source
97 Zunami Protocol - Case File Unverified $3.0M — Unclassified Details Source
98 TAC Protocol $2.9M tac, ton Proof Verifier Bug Details
99 StablR $2.8M ethereum Access Control Attacks Details
100 Solv Protocol $2.7M — Other Details Source
101 RetoSwap $2.7M monero Malicious Proposal Details
102 RetoSwap $2.7M monero Other / Missing Input Validation Details Source
103 SolvBTC $2.7M ethereum Mint Reserves Logic Exploit / Infinite Mint Details Source
104 TSR $2.5M bsc Infinite Mint Details
105 Hyperbridge Unverified $2.5M — Unclassified Details Source
106 Hyperbridge $2.5M arbitrum, base, bsc, ethereum Fake State Proof / Other / Forged Proof Details Source
107 TesseraDao Unverified $2.5M — Unclassified Details Source
108 Aquifer $2.5M solana Other Details Source
109 SecondFi Unverified $2.4M — Unclassified Details Source
110 SecondFi $2.4M cardano Weak Key Generation Details
111 Tessera DAO $2.4M bsc Access Control Attacks Details Source
112 Aztec Connect Unverified $2.3M — Unclassified Details Source
113 FOOM Cash $2.3M base, ethereum Phishing Attacks Details Source
114 Aztec Bridge Unverified $2.2M — Unclassified Details Source
115 Venus $2.2M — Other Details Source
116 Thetanuts Finance $2.1M ethereum Arithmetic Overflow & Underflow Attacks Details Source
117 Aztec Connect $2.1M ethereum Forged Proof Details
118 Aztec $2.0M — Other Details Source
119 Aztec $2.0M — Other Details Source
120 RRWallet $2.0M bitcoin Weak Key Generation Details
121 Aztec Bridge $2.0M ethereum Bridge Logic Flaw Details
122 Dango $1.9M dango Donate Negative Amounts Hack / Missing Input Validation Details Source
123 Transit Finance $1.9M tron Access Control Attacks Details Source
124 Moonwell Lending $1.8M base Oracle Manipulation & Price Manipulation Details Source
125 USDC Permit Signature Phishing $1.8M — Phishing Attacks Details Source
126 Notional Finance $1.7M — Other Details Source
127 Maya Protocol $1.7M mayachain Other / Withdrawal Logic Flaw Details Source
128 Taiko Bridge $1.7M taiko Forged Proof Details
129 Taiko $1.7M — Other Details Source
130 BSC TMM/USDT $1.7M bsc Access Control Attacks Details Source
131 Allbridge $1.6M solana Flash Loan Attacks Details Source
132 Zilliqa $1.6M zilliqa Weak Key Generation Details
133 Token of Power $1.6M ethereum Access Control Attacks Details Source
134 Purrlend $1.5M hyperliquid l1, megaeth Access Control Attacks Details Source
135 Gnosis Pay $1.5M gnosis chain Signature Verification Flaw Details
136 Hyperliquid $1.5M — Other Details Source
137 Meteora DAMM V2 $1.5M solana Phishing Attacks Details
138 USDGambit and TLP $1.5M arbitrum Deployer Key Compromised Details
139 Ekubo Protocol $1.4M ethereum Access Control Attacks Details Source
140 TMX $1.4M — Other Details Source
141 TMX TRIBE $1.4M arbitrum Mint & Stake Loop Exploit / Arithmetic Error Details Source
142 Cascade Liquidity Strategy $1.3M arbitrum Oracle Manipulation & Price Manipulation Details
143 Cascade $1.3M — Other Details Source
144 Raydium $1.3M solana Other / Infinite Mint Details Source
145 Giddy $1.3M ethereum Access Control Attacks Details Source
146 CoW Swap $1.2M ethereum DNS Hijack Details
147 Aftermath Perps $1.1M sui Withdrawal Logic Flaw Details
148 LABUBU/OLPC $1.1M bsc Decimal Miscalculation Details
149 Oraichain $1.0M oraichain Unbacked Cross-Chain Mint Details
150 Drift Protocol Unverified $1.0M — Unclassified Details Source
151 LML/USDT staking protocol $950K bsc Oracle Manipulation & Price Manipulation Details Source
152 Steakhouse Financial $920K ethereum Risk Parameter Abuse Details
153 42DAO $912K bsc Oracle Manipulation & Price Manipulation Details
154 MOKE $907K bsc Oracle Manipulation & Price Manipulation Details
155 MOKE Token $907K — Access Control Attacks Details Source
156 Solido Cash $900K supra Oracle Manipulation & Price Manipulation Details Source
157 Bisq $850K — Other Details Source
158 Echo Bridge $821K monad Access Control Attacks Details
159 Hinkal $820K ethereum Other / Deposit Logic Flaw Details Source
160 Echo Protocol $816K — Access Control Attacks Details Source
161 Alephium $815K ethereum Other / Forged Proof Details Source
162 Gyroscope $807K — Access Control Attacks Details Source
163 BarnBridge $776K ethereum Malicious Proposal Details
164 WEMIX.FI Lend $737K wemix3 0 Access Control Attacks Details
165 TeleSwap $735K bitcoin Hot Wallet Key Compromised Details
166 CometDEX $717K stellar Incorrect Share Accounting Details
167 XPlayer $717K — Flash Loan Attacks Details Source
168 Polymarket $700K polygon Access Control Attacks Details
169 LOOPSDAO $694K bsc Oracle Manipulation & Price Manipulation Details Source
170 BCE $679K bsc Incorrect Share Accounting Details
171 BCE Token $679K — Other Details Source
172 Fox $678K — Flash Loan Attacks Details Source
173 The Sandbox $675K base, bsc, ethereum Access Control Attacks Details Source
174 RiseX $673K rise Access Control Attacks Details Source
175 ChainConnect $650K avalanche, bsc, ethereum, polygon Access Control Attacks Details
176 Adshares $628K ethereum Forged Proof Details
177 Swan Treasury $625K bsc Access Control Attacks Details
178 Namada Shielded Pools $600K namada Unbacked Cross-Chain Mint Details
179 DeFiTuna $580K solana Other / Swap Logic Flaw Details Source
180 LULA Token $578K — Flash Loan Attacks Details Source
181 LULA $578K bsc Access Control Attacks Details
182 Projekt $560K ethereum Missing Input Validation Details
183 Projekt (GREEN/GOLD) $560K — Flash Loan Attacks Details Source
184 Bisq $550K bitcoin Missing Input Validation Details
185 Lien $542K ethereum Missing Input Validation Details
186 BlueMove DEX $529K sui Incorrect Share Accounting Details
187 SquidMulticall $517K arbitrum, avalanche, base, bsc, optimism Access Control Attacks Details
188 SquidMulticall Approval Exploitation $517K — Access Control Attacks Details Source
189 Avici $501K solana Access Control Attacks Details
190 Flooring Protocol $500K ethereum Infinite Mint Details
191 AFI Protocol $480K ethereum Unknown Details
192 Bankr $480K base Phishing Attacks Details
193 Holdstation $462K — Access Control Attacks Details Source
194 Aurellion $456K arbitrum Access Control Attacks Details Source
195 Garden Finance $450K arbitrum, base, bsc, ethereum Other / Database Breach Details Source
196 Aethir $423K bsc Access Control Attacks Details Source
197 Singularity Finance $413K base Oracle Manipulation & Price Manipulation Details
198 Velar Perps $401K mezo Oracle Manipulation & Price Manipulation Details
199 Syndicate $400K base Access Control Attacks Details Source
200 YieldCore $399K ethereum Access Control Attacks Details
201 FutureSwap $395K arbitrum Withdrawal Logic Flaw Details
202 Silo V2 $392K arbitrum Oracle Manipulation & Price Manipulation Details Source
203 Ploutos Money $390K ethereum Oracle Manipulation & Price Manipulation Details Source
204 Little Boy Plus $367K bsc Arithmetic Error Details
205 Edel Finance $353K ethereum Flash Loan Attacks Details Source
206 SQ Protocol $346K bsc Access Control Attacks Details
207 Fusion by IPOR $336K arbitrum Access Control Attacks Details Source
208 IPOR Fusion $336K arbitrum Access Control Attacks Details Source
209 ZetaChain $334K arbitrum, avalanche, base, bsc, ethereum, polygon Access Control Attacks Details Source
210 mySwap CL $305K starknet Incorrect Share Accounting Details
211 Harmony $300K — Other Details Source
212 AROS $295K bsc Oracle Manipulation & Price Manipulation Details
213 Lumi Finance $270K arbitrum Other / Signature Verification Flaw Details Source
214 Royal.io $263K polygon Incorrect Share Accounting Details
215 Transit Finance $258K ethereum Unknown Details
216 dTRINITY $257K ethereum Flash Loan Attacks Details Source
217 GoonFi $254K solana Oracle Manipulation & Price Manipulation Details Source
218 DGLD $250K base Unchecked Return Value Attacks Details Source
219 SOF Token $249K — Flash Loan Attacks Details Source
220 ATM Token $244K — Other Details Source
221 ATM $243K bsc Swap Logic Flaw Details
222 Movie Token $242K bsc Incorrect Share Accounting Details
223 Curve Lend $240K — Flash Loan Attacks Details Source
224 Curve LlamaLend $240K ethereum Donation Attack Details Source
225 Gondi $230K ethereum Access Control Attacks Details Source
226 PMX $230K — Other Details Source
227 Polycule $230K polygon Key Leaked via Infrastructure Details Source
228 JUDAO $228K bsc Arithmetic Error Details
229 DLMC $223K bsc Oracle Manipulation & Price Manipulation Details
230 Fluid Lending $215K ethereum Key Leaked via Infrastructure Details
231 SKP $212K bsc Incorrect Share Accounting Details
232 CrowdRingCircle $209K bsc Incorrect Share Accounting Details
233 Renegade $209K arbitrum Access Control Attacks Details Source
234 WUSD.fi $207K ethereum Flash Loan Attacks Details Source
235 Coreum Bridge $200K coreum, xrpl Bridge Logic Flaw Details
236 Coreum $200K — Other Details Source
237 BFB $198K bsc Incorrect Share Accounting Details
238 Holdstation $192K — Access Control Attacks Details Source
239 Allbridge $191K base Bridge Logic Flaw Details
240 LAXO Token $191K — Flash Loan Attacks Details Source
241 LAXO $190K bsc Flash Loan Attacks Details
242 BoostHook $187K ethereum Oracle Manipulation & Price Manipulation Details
243 SynapLogic $186K base Access Control Attacks Details Source
244 Stake DAO $176K arbitrum, base Access Control Attacks Details Source
245 Bankr $170K base Session Key Compromised Details
246 Denaria $166K linea Oracle Manipulation & Price Manipulation Details Source
247 Enjin $162K ethereum Access Control Attacks Details
248 SEA Token $153K arbitrum Oracle Manipulation & Price Manipulation Details
249 DBXen $150K ethereum Access Control Attacks Details Source
250 Scallop Lend $142K sui Reward Logic Flaw Details
251 Ink Finance $140K polygon Access Control Attacks Details Source
252 Quant $138K ethereum Access Control Attacks Details
253 USM $136K ethereum Flash Loan Attacks Details
254 SubQuery Network $134K base Access Control Attacks Details Source
255 TUR Staking $133K bsc Oracle Manipulation & Price Manipulation Details
256 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
257 AM $132K bsc Incorrect Share Accounting Details
258 Ocean Protocol $128K polygon Deposit Logic Flaw Details
259 Molt EVM $127K base Access Control Attacks Details Source
260 AIDCToken $121K — Other Details Source
261 AIDC $121K bsc Arithmetic Error Details
262 Fox Market $120K bsc Oracle Manipulation & Price Manipulation Details
263 CCC $117K bsc Swap Logic Flaw Details
264 DIP $111K bsc Swap Logic Flaw Details
265 Ambient $111K ethereum Deposit Logic Flaw Details
266 MAP Protocol $110K bsc, ethereum Infinite Mint Details
267 MetaSea $110K arbitrum Withdrawal Logic Flaw Details
268 NovaBox $107K ethereum Incorrect Share Accounting Details
269 Huma Finance V2 $101K polygon Access Control Attacks Details
270 Zerion Wallet $100K — Phishing Attacks Details Source
271 PGNLZ $100K bsc Incorrect Share Accounting Details
272 PGNLZ token $100K — Flash Loan Attacks Details Source
273 ONTR $98K ethereum Access Control Attacks Details
274 FlashTrade $98K solana Missing Input Validation Details
275 IEXCBP $97K bsc Oracle Manipulation & Price Manipulation Details
276 PRXVT $97K base Sybil Attack with CREATE2 Addresses / Staking Logic Flaw Details Source
277 warp.green $93K chia, ethereum Bridge Logic Flaw Details
278 Stake DAO $91K arbitrum Access Control Attacks Details Source
279 PHX $90K bsc Incorrect Share Accounting Details
280 BYToken $87K — Flash Loan Attacks Details Source
281 CheckoutPool $86K polygon Access Control Attacks Details
282 MoneyMon $85K — Other Details Source
283 HypurrFi $84K — Other Details Source
284 Kipseli $72K base Missing Input Validation Details
285 SmartCredit $72K ethereum Unknown Details
286 Wise Lending V2 $66K arbitrum, ethereum Access Control Attacks Details
287 FlyCow $65K bsc Incorrect Share Accounting Details
288 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
289 Benqi Staked Avax $64K avalanche Access Control Attacks Details
290 Valinity $63K — Oracle Manipulation & Price Manipulation Details Source
291 MONA $61K bsc BurnAddress Accounting Exploit / Incorrect Share Accounting Details Source
292 Ostium Unverified $60K — Unclassified Details Source
293 Juicebox V3 $52K ethereum Missing Input Validation Details
294 JB $50K bsc Oracle Manipulation & Price Manipulation Details
295 Thetanuts Finance $50K ethereum First Depositor Attack Details
296 Revert Lend $50K base Access Control Attacks Details Source
297 V4 Swap Router by z0r0z $42K — Access Control Attacks Details Source
298 Asterix $40K ethereum Access Control Attacks Details
299 Pepe Trump $38K — Rugpull Details Source
300 Sharwa.Finance $33K arbitrum Oracle Manipulation & Price Manipulation Details
301 HermesVault $30K algorand Other / Withdrawal Logic Flaw Details Source
302 BONK Fun $30K solana DNS Hijack Details
303 Atomic Green $30K arbitrum Signature Replay Details
304 Drips Network $25K ethereum Arithmetic Error Details
305 FH Token $20K bsc Flash Loan Attacks Details
306 Unistreets $18K ethereum Access Control Attacks Details
307 ElevateFi $16K polygon Oracle Manipulation & Price Manipulation Details
308 Fractal Protocol $14K arbitrum Reentrancy Details
309 Lixir Finance $12K ethereum Signature Verification Flaw Details
310 Mure $12K ethereum Signature Verification Flaw Details
311 GPU.NET $11K ethereum Unknown Details
312 WhaleBit $10K polygon Oracle Manipulation & Price Manipulation Details
313 Set Protocol $10K ethereum Reentrancy Details
314 Chi Protocol $8K ethereum Redeem Logic Flaw Details
315 Goose Finance $8K bsc Flash Loan Attacks Details Source
316 Panther Protocol $8K base Malicious Proposal Details
317 Arrakis V1 $7K ethereum Oracle Manipulation & Price Manipulation Details
318 Bitmor $6K base Access Control Attacks Details
319 Veil Cash $5K base misconfigured Groth16 verifier / Proof Verifier Bug Details Source
320 Bodega Market $4K cardano Oracle Manipulation & Price Manipulation Details
321 Quicksilver Zone $4K quicksilver Unbacked Mint Details
322 MANTRA Chain — mantra Access Control Attacks Details
323 Ravencoin — ravencoin Missing Input Validation Details
324 Hyperliquid Malaysia — solana Access Control Attacks Details
325 Syscoin Unverified — — Unclassified Details Source
326 Litecoin — litecoin Missing Input Validation Details
327 VTSwapHook — arbitrum Swap Logic Flaw Details
328 Neutrl — ethereum DNS Hijacking Attack / DNS Hijack Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.