Annual Hack Dataset - Live Year

Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (34 rows); the largest tracked chain bucket is Solana ($325.3M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 Kelp DAO $292M — Access Control Attacks Details Source
2 KelpDao Unverified $290M — Unclassified Details Source
3 Drift Trade $285M solana Compromised Admin + Fake Token Price Manipulation Details Source
4 Social Engineering Scam $282M — Phishing Attacks Details Source
5 Drift Protocol $280M — Access Control Attacks Details Source
6 Price Impact Kills Unverified $50.0M — Unclassified Details Source
7 Step Finance $40.0M solana Access Control Attacks Details Source
8 Digging for Gold Unverified $39.0M — Unclassified Details Source
9 Humanity Protocol Unverified $36.4M — Unclassified Details Source
10 Humanity Protocol $31.0M — Access Control Attacks Details Source
11 Aave V3 $27.8M ethereum Oracle Manipulation & Price Manipulation Details Source
12 Truebit $26.5M ethereum Bonding Curve Exploit / Other Details Source
13 Resolv Labs Unverified $25.0M — Unclassified Details Source
14 Resolv $25.0M ethereum Access Control Attacks Details Source
15 Ostium $24.0M — Oracle Manipulation & Price Manipulation Details Source
16 BonkDAO $21.0M — Access Control Attacks Details Source
17 BonkDAO Unverified $19.3M — Unclassified Details Source
18 Rhea Finance Unverified $18.4M — Unclassified Details Source
19 Rhea Finance $18.4M — Other Details Source
20 SwapNet $17.0M base, ethereum Unlimited Approval Exploit / Other Details Source
21 Matcha $16.8M base, ethereum Unlimited Approval Exploit Details Source
22 StablR $12.8M — Access Control Attacks Details Source
23 Verus $11.6M — Other Details Source
24 Blend Pools V2 $11.0M stellar Oracle Manipulation & Price Manipulation Details Source
25 Blend Protocol $10.9M — Oracle Manipulation & Price Manipulation Details Source
26 THORChain Unverified $10.7M — Unclassified Details Source
27 THORChain $10.7M — Other Details Source
28 Bonzo Finance Unverified $9.1M — Unclassified Details Source
29 Bonzo $9.0M — Oracle Manipulation & Price Manipulation Details Source
30 IoTeX $8.0M ethereum Access Control Attacks Details Source
31 JaredFromSubway.eth MEV Bot $7.5M — Other Details Source
32 DxSale Unverified $7.3M — Access Control Attacks Details Source
33 Saga $7.0M saga Infinite Mint and Dump / Other Details Source
34 TrustedVolumes $6.7M — Other Details Source
35 Summer Finance Unverified $6.0M — Unclassified Details Source
36 Summer.fi $6.0M — Flash Loans Attacks Details Source
37 Wasabi Protocol Unverified $5.9M — Unclassified Details Source
38 TrustedVolumes Unverified $5.9M — Unclassified Details Source
39 Wasabi $5.5M — Access Control Attacks Details Source
40 Gravity Bridge Unverified $5.4M — Unclassified Details Source
41 Gravity Bridge $5.4M — Access Control Attacks Details Source
42 Cyrus Finance $5.0M bsc Flash Loans Attacks Details Source
43 Makina $5.0M ethereum Flash Loans Attacks Details Source
44 Secret Network Unverified $4.7M — Unclassified Details Source
45 New Market Trading Unverified $4.0M — Unclassified Details Source
46 YO Protocol $3.7M ethereum Slippage Exploit Details Source
47 Venus Protocol Unverified $3.7M — Unclassified Details Source
48 Venus Core Pool $3.7M bsc Donation Attack Details Source
49 Yo Yield $3.7M — Other Details Source
50 Aperture Finance $3.7M — Other Details Source
51 Volo Unverified $3.5M — Unclassified Details Source
52 Volo $3.5M — Other Details Source
53 NYC Memecoin $3.4M — Rugpull Details Source
54 Third-party SquidRouterModule $3.2M — Access Control Attacks Details Source
55 Aperture LM $3.2M base, bsc, ethereum Unclassified Details Source
56 Polymarket $3.0M — Other Details Source
57 CrossCurve $3.0M — Spoofed Cross-Chain Messages / Other Details Source
58 Zunami Protocol - Case File Unverified $3.0M — Unclassified Details Source
59 Solv Protocol $2.7M — Other Details Source
60 RetoSwap $2.7M — Other Details Source
61 SolvBTC $2.7M ethereum Mint Reserves Logic Exploit Details Source
62 Hyperbridge Unverified $2.5M — Unclassified Details Source
63 TesseraDao Unverified $2.5M — Unclassified Details Source
64 SecondFi Unverified $2.4M — Unclassified Details Source
65 Tessera DAO $2.4M — Access Control Attacks Details Source
66 Aztec Connect Unverified $2.3M — Unclassified Details Source
67 FOOM Cash $2.3M base, ethereum Phishing Attacks Details Source
68 Aztec Bridge Unverified $2.2M — Unclassified Details Source
69 Venus $2.2M — Other Details Source
70 Aztec $2.0M — Other Details Source
71 Aztec $2.0M — Other Details Source
72 Transit Finance $1.9M — Other Details Source
73 Moonwell Lending $1.8M base Oracle Manipulation & Price Manipulation Details Source
74 USDC Permit Signature Phishing $1.8M — Phishing Attacks Details Source
75 Taiko $1.7M — Other Details Source
76 BSC TMM/USDT $1.7M bsc Reserve Manipulation Attack Details Source
77 Allbridge $1.6M — Flash Loan Attack Details Source
78 Purrlend $1.5M — Access Control Attacks Details Source
79 Hyperliquid $1.5M — Other Details Source
80 Ekubo Protocol $1.4M — Access Control Attacks Details Source
81 TMX $1.4M — Other Details Source
82 TMX TRIBE $1.4M arbitrum Mint & Stake Loop Exploit Details Source
83 Cascade $1.3M — Other Details Source
84 Raydium $1.3M — Other Details Source
85 Giddy $1.3M — Access Control Attacks Details Source
86 Drift Protocol Unverified $1.0M — Unclassified Details Source
87 LML/USDT staking protocol $950K bsc Oracle Manipulation & Price Manipulation Details Source
88 Bisq $850K — Other Details Source
89 Hinkal $820K — Other Details Source
90 Echo Protocol $816K — Access Control Attacks Details Source
91 Alephium $815K — Other Details Source
92 Gyroscope $807K — Other Details Source
93 XPlayer $717K — Flash Loans Attacks Details Source
94 BCE Token $679K — Other Details Source
95 DeFiTuna $570K — Other Details Source
96 SquidMulticall Approval Exploitation $517K — Access Control Attacks Details Source
97 Token of Power $472K — Access Control Attacks Details Source
98 Holdstation $462K — Access Control Attacks Details Source
99 Aurellion $456K — Access Control Attacks Details Source
100 Aethir $423K bsc Access Control Attacks Details Source
101 Dango $410K dango Donate Negative Amounts Hack Details Source
102 Syndicate $400K — Access Control Attacks Details Source
103 Silo V2 $392K arbitrum Oracle Manipulation & Price Manipulation Details Source
104 Ploutos Money $390K ethereum Oracle Manipulation & Price Manipulation Details Source
105 Edel Finance $353K — Oracle Manipulation & Price Manipulation Details Source
106 Fusion by IPOR $336K arbitrum EIP-7702 Delegation Exploit Details Source
107 IPOR Fusion $336K arbitrum Access Control Attacks Details Source
108 ZetaChain $334K — Access Control Attacks Details Source
109 Lumi Finance $264K — Other Details Source
110 dTRINITY $257K ethereum Flash Loans Attacks Details Source
111 GoonFi $254K solana Mispricing arbitrage Details Source
112 SOF Token $249K — Flash Loans Attacks Details Source
113 ATM Token $244K — Other Details Source
114 Curve Lend $240K — Oracle Manipulation & Price Manipulation Details Source
115 Curve LlamaLend $240K ethereum Donation Attack Details Source
116 Hyperbridge $237K ethereum Fake State Proof / Other Details Source
117 Gondi $230K ethereum Access Control Attacks Details Source
118 PMX $230K — Other Details Source
119 Polycule $230K polygon Unclassified Details Source
120 Renegade $209K — Access Control Attacks Details Source
121 WUSD.fi $207K — Flash Loans Attacks Details Source
122 Holdstation $192K — Access Control Attacks Details Source
123 LAXO Token $191K — Flash Loans Attacks Details Source
124 SynapLogic $186K — Access Control Attacks Details Source
125 Stake DAO $176K arbitrum, base Oracle Manipulation & Price Manipulation Details Source
126 Denaria $165K — Other Details Source
127 DBXen $150K — Access Control Attacks Details Source
128 Ink Finance $140K — Access Control Attacks Details Source
129 Molt EVM $127K base onlySpawnerToken Modifier Hack Details Source
130 AIDCToken $121K — Other Details Source
131 Thetanuts Finance $105K — Flash Loans Attacks Details Source
132 Zerion Wallet $100K — Hot Wallet Compromise via Social Engineering Details Source
133 PGNLZ token $100K — Flash Loans Attacks Details Source
134 PRXVT $97K base Sybil Attack with CREATE2 Addresses Details Source
135 Stake DAO $91K — Access Control Attacks Details Source
136 BYToken $87K — Flash Loans Attacks Details Source
137 MoneyMon $85K — Other Details Source
138 HypurrFi $84K — Other Details Source
139 Wise Lending V2 $66K arbitrum, ethereum Flash Loans Attacks Details
140 Valinity $63K — Oracle Manipulation & Price Manipulation Details Source
141 MONA $61K bsc BurnAddress Accounting Exploit Details Source
142 SubQuery Network $60K base Access Control Attacks Details Source
143 Revert Lend $50K base Staked Collateral Exploit / Other Details Source
144 V4 Swap Router by z0r0z $42K — Access Control Attacks Details Source
145 Pepe Trump $38K — Rugpull Details Source
146 HermesVault $30K — Other Details Source
147 Goose Finance $8K bsc Share Accounting Flaw Details Source
148 Veil Cash $5K base misconfigured Groth16 verifier Details Source
149 Syscoin Unverified — — Unclassified Details Source
150 Neutrl — ethereum DNS Hijacking Attack Details Source
151 DGLD — base Infinite Mint and Dump Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.