Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (96 rows); the largest tracked chain bucket is Ethereum ($957.1M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 Bitget $352M ethereum, tron, xrp, zcash Access Control Attacks Details Source 1Source 2Source 3Source 4
2 Liquid Network $320M liquid Other / Unbacked Cross-Chain Mint Details Source 1Source 2Source 3
3 Kelp DAO $293M arbitrum, ethereum Access Control Attacks Details Source 1Source 2Source 3
4 Social Engineering Scam $282M — Phishing Attacks Details Source 1Source 2Source 3
5 Drift Protocol $280M solana Access Control Attacks Details Source 1Source 2Source 3
6 Coldcard $130M bitcoin Other / Weak Key Generation Details Source 1Source 2Source 3
7 Blockchain Intelligence Hunger Games Unverified $94.6M — Unclassified Details Source
8 Ledger (Supply Chain) $93.0M — Supply Chain Attack Details
9 Tectonic Protocol $75.0M cronos Oracle Manipulation & Price Manipulation Details Source 1Source 2Source 3Source 4
10 Nesa $50.0M nesa Arithmetic Error Details
11 Price Impact Kills Unverified $50.0M — Unclassified Details Source
12 Step Finance $40.0M solana Access Control Attacks Details Source
13 Digging for Gold Unverified $39.0M — Unclassified Details Source
14 Humanity Protocol $31.0M bsc, ethereum Access Control Attacks Details Source 1Source 2Source 3
15 Aave V3 $27.8M ethereum Oracle Manipulation & Price Manipulation Details Source
16 Truebit $26.5M ethereum Bonding Curve Exploit / Other / Arithmetic Error Details Source
17 Whale Wallet Drain $25.6M — Phishing Attacks Details Source 1Source 2
18 Resolv $25.0M ethereum Access Control Attacks Details Source
19 AFX $24.1M arbitrum Access Control Attacks Details Source 1Source 2Source 3
20 Ostium $24.0M arbitrum Access Control Attacks Details Source 1Source 2
21 BonkDAO $21.0M solana Access Control Attacks Details Source 1Source 2Source 3Source 4
22 Rhea Finance $18.4M near Oracle Manipulation & Price Manipulation Details Source 1Source 2
23 SwapNet $17.0M base, ethereum Unlimited Approval Exploit / Other / Frontend Compromise Details Source
24 SUPERFORTUNE AI $15.2M ethereum Access Control Attacks Details
25 Grinex $13.7M ethereum, tron Hot Wallet Key Compromised Details
26 79thVault $12.5M — Access Control Attacks Details Source 1Source 2
27 Triple-A $11.8M arbitrum, ethereum, tron Access Control Attacks Details Source 1Source 2
28 Verus $11.6M verus Other / Forged Proof Details Source 1Source 2
29 Blend Protocol $10.9M stellar Oracle Manipulation & Price Manipulation Details Source 1Source 2Source 3
30 THORChain $10.7M base, bitcoin, bsc, ethereum Other / Bridge Logic Flaw Details Source 1Source 2Source 3
31 Wanchain $10.0M cardano Other / Signature Verification Flaw Details Source 1Source 2Source 3
32 Syscoin Bridge $10.0M syscoin Forged Proof Details Source
33 KiiChain $9.7M kiichain Arithmetic Error Details
34 Bonzo $9.1M hedera Oracle Manipulation & Price Manipulation Details Source 1Source 2
35 Moonwell Lending $8.7M base Oracle Manipulation & Price Manipulation Details Source 1Source 2Source 3
36 Term Labs $8.5M ethereum Flash Loan Attacks Details Source
37 Coinsbuy $8.1M ethereum, tron Access Control Attacks Details Source 1Source 2Source 3
38 IoTeX $8.0M ethereum Access Control Attacks Details Source
39 Verus-Ethereum Bridge $7.5M verus Cross-Chain Bridge Attacks Details Source
40 JaredFromSubway.eth MEV Bot $7.5M ethereum Other / MEV Bot Drained Details Source
41 DxSale $7.3M bsc Access Control Attacks Details Source
42 Duelbits $7.0M bitcoin, bsc, ethereum, tron Access Control Attacks Details Source 1Source 2
43 Saga $7.0M saga Infinite Mint and Dump / Other / Infinite Mint Details Source
44 TrustedVolumes $6.7M ethereum Access Control Attacks Details Source 1Source 2
45 Summer.fi $6.0M ethereum Flash Loan Attacks Details Source
46 Adapter Vault Drain $6.0M — Access Control Attacks Details Source 1Source 2
47 Wasabi $5.5M base, berachain, blast, ethereum Access Control Attacks Details Source 1Source 2Source 3
48 Gravity Bridge $5.4M ethereum Access Control Attacks Details Source 1Source 2
49 Cyrus Finance $5.0M bsc Flash Loan Attacks Details Source
50 Astroport $4.9M neutron Access Control Attacks Details Source 1Source 2
51 Secret Network $4.7M ethereum, secret Unbacked Cross-Chain Mint Details Source
52 Across $4.5M solana Other / Spoofed Event Log Details Source
53 Drop $4.4M neutron Malicious Proposal Details
54 Gamdom $4.2M arbitrum, bitcoin, bsc, ethereum, optimism, polygon, solana, tron Access Control Attacks Details Source
55 Makina $4.2M ethereum Flash Loan Attacks Details Source
56 New Market Trading $4.0M arbitrum, base, ethereum Access Control Attacks Details Source
57 NEAR Intents $3.8M bsc Bridge Logic Flaw / Other Details Source 1Source 2Source 3
58 B² Network $3.8M — Access Control Attacks Details Source 1Source 2Source 3
59 Yo Yield $3.7M ethereum Other / Slippage Exploit / Missing Slippage Check Details Source 1Source 2
60 Aperture Finance $3.7M base, bsc, ethereum Access Control Attacks Details Source 1Source 2
61 MANTRA Chain $3.6M mantra Access Control Attacks Details Source
62 Nostra Finance $3.5M starknet Oracle Manipulation & Price Manipulation Details Source 1Source 2Source 3
63 Sweat Foundation $3.5M near Withdrawal Logic Flaw Details
64 Volo Vault $3.5M sui Access Control Attacks Details Source
65 NYC Memecoin $3.4M — Rugpull Details Source 1Source 2
66 Third-party SquidRouterModule $3.2M base, ethereum Access Control Attacks Details Source 1Source 2
67 Nomic nBTC Bridge $3.1M nomic Other / Unbacked Cross-Chain Mint Details Source 1Source 2
68 Fogo Foundation $3.0M fogo Access Control Attacks Details
69 BounceBit $3.0M bouncebit Access Control Attacks Details Source
70 Polymarket $3.0M polygon Other / Frontend Compromise Details Source
71 CrossCurve $3.0M — Spoofed Cross-Chain Messages / Other / Cross-Chain Message Spoofing Details Source
72 Zunami Protocol - Case File Unverified $3.0M — Unclassified Details Source
73 TAC Protocol $2.9M tac, ton Proof Verifier Bug Details
74 Solv Protocol $2.7M ethereum Other / Mint Reserves Logic Exploit / Infinite Mint Details Source 1Source 2
75 RetoSwap $2.7M monero Other / Missing Input Validation / Malicious Proposal Details Source 1Source 2
76 Hyperbridge $2.5M arbitrum, base, bsc, ethereum Fake State Proof / Other / Forged Proof Details Source
77 Aquifer $2.5M solana Other Details Source 1Source 2
78 SecondFi $2.4M cardano Weak Key Generation Details Source
79 Tessera DAO $2.4M bsc Access Control Attacks Details Source 1Source 2
80 FOOM Cash $2.3M base, ethereum Phishing Attacks Details Source
81 Aztec Bridge $2.2M ethereum Bridge Logic Flaw / Other Details Source
82 Venus $2.2M bsc Other / Donation Attack Details Source 1Source 2
83 Fake GIWA Bridge $2.1M ethereum Phishing Attacks Details
84 Aztec $2.0M ethereum Other / Forged Proof Details Source 1Source 2Source 3
85 DYORSWAP $2.0M ethereum Phishing Attacks Details Source
86 RRWallet $2.0M bitcoin Weak Key Generation Details Source
87 Dango $1.9M dango Donate Negative Amounts Hack / Missing Input Validation Details Source
88 Transit Finance $1.9M tron Access Control Attacks Details Source 1Source 2
89 Payy Network $1.8M ethereum Access Control Attacks Details Source
90 Limit Break Payment Processor $1.8M apechain, base, ethereum, polygon Access Control Attacks Details
91 Moonwell Lending $1.8M base Oracle Manipulation & Price Manipulation Details Source
92 USDC Permit Signature Phishing $1.8M — Phishing Attacks Details Source
93 Notional Finance $1.7M ethereum Other / Arithmetic Error Details Source 1Source 2Source 3
94 Maya Protocol $1.7M mayachain Other / Withdrawal Logic Flaw Details Source 1Source 2
95 Taiko $1.7M taiko Other / Forged Proof Details Source
96 BSC TMM/USDT $1.7M bsc Access Control Attacks Details Source
97 Allbridge $1.6M solana Flash Loan Attacks Details Source 1Source 2Source 3
98 Zilliqa — zilliqa Biased Schnorr Nonce / Private Key Recovery Details Source
99 Token of Power $1.6M ethereum Access Control Attacks Details Source 1Source 2Source 3
100 Purrlend $1.5M hyperliquid l1, megaeth Access Control Attacks Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.