Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (86 rows); the largest tracked chain bucket is Ethereum ($616.1M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
1 Drift Trade $295M solana Access Control Attacks Details Source
2 Kelp DAO $293M arbitrum, ethereum Access Control Attacks Details Source
3 KelpDao Unverified $290M — Unclassified Details Source
4 Social Engineering Scam $282M — Phishing Attacks Details Source
5 Drift Protocol $280M — Access Control Attacks Details Source
6 Cold Card Unverified $130M — Unclassified Details Source
7 Coldcard $130M bitcoin Other / Weak Key Generation Details Source
8 Blockchain Intelligence Hunger Games Unverified $94.6M — Unclassified Details Source
9 Tectonic Protocol $75.0M cronos Oracle Manipulation & Price Manipulation Details Source
10 Price Impact Kills Unverified $50.0M — Unclassified Details Source
11 Step Finance $40.0M solana Access Control Attacks Details Source
12 Digging for Gold Unverified $39.0M — Unclassified Details Source
13 Humanity Protocol Unverified $36.4M — Unclassified Details Source
14 Humanity Protocol $31.0M bsc, ethereum Access Control Attacks Details Source
15 Aave V3 $27.8M ethereum Oracle Manipulation & Price Manipulation Details Source
16 Truebit $26.5M ethereum Bonding Curve Exploit / Other / Arithmetic Error Details Source
17 Whale Wallet Drain $25.6M — Phishing Attacks Details Source
18 Resolv Labs Unverified $25.0M — Unclassified Details Source
19 Resolv $25.0M ethereum Access Control Attacks Details Source
20 AFX Trade Unverified $24.1M — Unclassified Details Source
21 AFX $24.1M — Access Control Attacks Details Source
22 AFX Bridge $24.1M arbitrum Validator Key Compromised Details
23 Ostium $24.0M arbitrum Access Control Attacks Details Source
24 BonkDAO $21.0M solana Access Control Attacks Details Source
25 BonkDAO Unverified $19.3M — Unclassified Details Source
26 Rhea Finance Unverified $18.4M — Unclassified Details Source
27 Rhea Lend $18.4M near Oracle Manipulation & Price Manipulation Details
28 Rhea Finance $18.4M — Other Details Source
29 SwapNet $17.0M base, ethereum Unlimited Approval Exploit / Other Details Source
30 Matcha $16.8M base, ethereum Unlimited Approval Exploit / Frontend Compromise Details Source
31 SUPERFORTUNE AI $15.2M ethereum Access Control Attacks Details
32 Grinex $13.7M ethereum, tron Hot Wallet Key Compromised Details
33 KITE Foundation $13.3M ethereum Access Control Attacks Details
34 StablR $12.8M — Access Control Attacks Details Source
35 Triple-A $11.8M arbitrum, ethereum, tron Access Control Attacks Details Source
36 Verus $11.6M — Other Details Source
37 Verus-Ethereum Bridge $11.5M verus Forged Proof Details
38 Blend Pools V2 $11.0M stellar Oracle Manipulation & Price Manipulation Details Source
39 Blend Protocol $10.9M — Oracle Manipulation & Price Manipulation Details Source
40 THORChain Unverified $10.7M — Unclassified Details Source
41 THORChain $10.7M base, bitcoin, bsc, ethereum Other / Bridge Logic Flaw Details Source
42 Wanchain $10.0M cardano Other / Signature Verification Flaw Details Source
43 Syscoin Bridge $10.0M syscoin Forged Proof Details
44 Bonzo $9.1M hedera Oracle Manipulation & Price Manipulation Details Source
45 Moonwell Lending $8.7M base Oracle Manipulation & Price Manipulation Details Source
46 Term Labs $8.5M — Other Details Source
47 TermFinance Vaults $8.5M ethereum Flash Loan Attacks Details
48 Crypto DAO $8.2M bsc Access Control Attacks Details
49 Coinsbuy Unverified $8.1M — Unclassified Details Source
50 Coinsbuy $8.1M ethereum, tron Access Control Attacks Details Source
51 IoTeX $8.0M ethereum Access Control Attacks Details Source
52 VerusCoin Unverified $7.5M — Unclassified Details Source
53 Verus-Ethereum Bridge $7.5M verus Forged Proof Details
54 TAC $7.5M tac Withdrawal Logic Flaw Details
55 Verus $7.5M — Other Details Source
56 JaredFromSubway.eth MEV Bot $7.5M ethereum Other / MEV Bot Drained Details Source
57 DxSale Unverified $7.3M — Access Control Attacks Details Source
58 DxSale $7.3M bsc Liquidity Rug Details
59 Saga $7.0M saga Infinite Mint and Dump / Other / Infinite Mint Details Source
60 TrustedVolumes $6.7M ethereum Access Control Attacks Details Source
61 WEMIX $6.2M — Access Control Attacks Details Source
62 Summer Finance Unverified $6.0M — Unclassified Details Source
63 Lazy Summer Protocol $6.0M ethereum Donation Attack Details
64 Summer.fi $6.0M — Flash Loan Attacks Details Source
65 Wasabi Protocol Unverified $5.9M — Unclassified Details Source
66 TrustedVolumes Unverified $5.9M — Unclassified Details Source
67 Wasabi $5.5M base, berachain, blast, ethereum Access Control Attacks Details Source
68 Gravity Bridge Unverified $5.4M — Unclassified Details Source
69 Gravity Bridge $5.4M ethereum Access Control Attacks Details Source
70 Cyrus Finance $5.0M bsc Flash Loan Attacks Details Source
71 Makina $5.0M ethereum Flash Loan Attacks Details Source
72 Secret Network Unverified $4.7M — Unclassified Details Source
73 Secret Network $4.7M secret Unbacked Cross-Chain Mint Details
74 Axelar Secret IBC Bridge $4.7M ethereum, secret Unbacked Cross-Chain Mint Details
75 Across $4.5M solana Other / Spoofed Event Log Details Source
76 New Market Trading $4.0M arbitrum, base, ethereum Access Control Attacks Details Source
77 B² Network $3.8M — Access Control Attacks Details Source
78 YO Protocol $3.7M ethereum Slippage Exploit / Missing Slippage Check Details Source
79 Venus Protocol Unverified $3.7M — Unclassified Details Source
80 Venus Core Pool $3.7M bsc Donation Attack Details Source
81 Yo Yield $3.7M — Other Details Source
82 Aperture Finance $3.7M — Access Control Attacks Details Source
83 Aperture LM $3.7M base, bsc, ethereum Access Control Attacks Details Source
84 Sweat Foundation $3.5M near Withdrawal Logic Flaw Details
85 Volo Unverified $3.5M — Unclassified Details Source
86 Volo $3.5M — Other Details Source
87 Volo Vault $3.5M sui Access Control Attacks Details
88 NYC Memecoin $3.4M — Rugpull Details Source
89 Harmony Unverified $3.2M — Unclassified Details Source
90 Harmony Bridge $3.2M harmony Bridge Logic Flaw Details
91 Third-party SquidRouterModule $3.2M — Access Control Attacks Details Source
92 SquidRouterModule $3.2M base, ethereum Access Control Attacks Details
93 BounceBit $3.0M bouncebit Access Control Attacks Details
94 Polymarket International $3.0M polygon Frontend Compromise Details
95 Polymarket $3.0M — Other Details Source
96 CrossCurve $3.0M — Spoofed Cross-Chain Messages / Other / Cross-Chain Message Spoofing Details Source
97 Zunami Protocol - Case File Unverified $3.0M — Unclassified Details Source
98 TAC Protocol $2.9M tac, ton Proof Verifier Bug Details
99 StablR $2.8M ethereum Access Control Attacks Details
100 Solv Protocol $2.7M — Other Details Source
101 RetoSwap $2.7M monero Malicious Proposal Details
102 RetoSwap $2.7M monero Other / Missing Input Validation Details Source
103 SolvBTC $2.7M ethereum Mint Reserves Logic Exploit / Infinite Mint Details Source
104 TSR $2.5M bsc Infinite Mint Details
105 Hyperbridge Unverified $2.5M — Unclassified Details Source
106 Hyperbridge $2.5M arbitrum, base, bsc, ethereum Fake State Proof / Other / Forged Proof Details Source
107 TesseraDao Unverified $2.5M — Unclassified Details Source
108 Aquifer $2.5M solana Other Details Source
109 SecondFi Unverified $2.4M — Unclassified Details Source
110 SecondFi $2.4M cardano Weak Key Generation Details
111 Tessera DAO $2.4M bsc Access Control Attacks Details Source
112 Aztec Connect Unverified $2.3M — Unclassified Details Source
113 FOOM Cash $2.3M base, ethereum Phishing Attacks Details Source
114 Aztec Bridge Unverified $2.2M — Unclassified Details Source
115 Venus $2.2M — Other Details Source
116 Thetanuts Finance $2.1M ethereum Arithmetic Overflow & Underflow Attacks Details Source
117 Aztec Connect $2.1M ethereum Forged Proof Details
118 Aztec $2.0M — Other Details Source
119 Aztec $2.0M — Other Details Source
120 RRWallet $2.0M bitcoin Weak Key Generation Details
121 Aztec Bridge $2.0M ethereum Bridge Logic Flaw Details
122 Dango $1.9M dango Donate Negative Amounts Hack / Missing Input Validation Details Source
123 Transit Finance $1.9M tron Access Control Attacks Details Source
124 Moonwell Lending $1.8M base Oracle Manipulation & Price Manipulation Details Source
125 USDC Permit Signature Phishing $1.8M — Phishing Attacks Details Source
126 Maya Protocol $1.7M mayachain Other / Withdrawal Logic Flaw Details Source
127 Taiko Bridge $1.7M taiko Forged Proof Details
128 Taiko $1.7M — Other Details Source
129 BSC TMM/USDT $1.7M bsc Access Control Attacks Details Source
130 Allbridge $1.6M solana Flash Loan Attacks Details Source
131 Zilliqa $1.6M zilliqa Weak Key Generation Details
132 Token of Power $1.6M ethereum Access Control Attacks Details Source
133 Purrlend $1.5M hyperliquid l1, megaeth Access Control Attacks Details Source
134 Gnosis Pay $1.5M gnosis chain Signature Verification Flaw Details
135 Hyperliquid $1.5M — Other Details Source
136 Meteora DAMM V2 $1.5M solana Phishing Attacks Details
137 USDGambit and TLP $1.5M arbitrum Deployer Key Compromised Details
138 Ekubo Protocol $1.4M ethereum Access Control Attacks Details Source
139 TMX $1.4M — Other Details Source
140 TMX TRIBE $1.4M arbitrum Mint & Stake Loop Exploit / Arithmetic Error Details Source
141 Cascade Liquidity Strategy $1.3M arbitrum Oracle Manipulation & Price Manipulation Details
142 Cascade $1.3M — Other Details Source
143 Raydium $1.3M solana Other / Infinite Mint Details Source
144 Giddy $1.3M ethereum Access Control Attacks Details Source
145 CoW Swap $1.2M ethereum DNS Hijack Details
146 Aftermath Perps $1.1M sui Withdrawal Logic Flaw Details
147 LABUBU/OLPC $1.1M bsc Decimal Miscalculation Details
148 Oraichain $1.0M oraichain Unbacked Cross-Chain Mint Details
149 Drift Protocol Unverified $1.0M — Unclassified Details Source
150 LML/USDT staking protocol $950K bsc Oracle Manipulation & Price Manipulation Details Source
151 Steakhouse Financial $920K ethereum Risk Parameter Abuse Details
152 42DAO $912K bsc Oracle Manipulation & Price Manipulation Details
153 MOKE $907K bsc Oracle Manipulation & Price Manipulation Details
154 MOKE Token $907K — Access Control Attacks Details Source
155 Solido Cash $900K supra Oracle Manipulation & Price Manipulation Details Source
156 Bisq $850K — Other Details Source
157 Echo Bridge $821K monad Access Control Attacks Details
158 Hinkal $820K ethereum Other / Deposit Logic Flaw Details Source
159 Echo Protocol $816K — Access Control Attacks Details Source
160 Alephium $815K ethereum Other / Forged Proof Details Source
161 Gyroscope $807K — Access Control Attacks Details Source
162 BarnBridge $776K ethereum Malicious Proposal Details
163 WEMIX.FI Lend $737K wemix3 0 Access Control Attacks Details
164 TeleSwap $735K bitcoin Hot Wallet Key Compromised Details
165 CometDEX $717K stellar Incorrect Share Accounting Details
166 XPlayer $717K — Flash Loan Attacks Details Source
167 Polymarket $700K polygon Access Control Attacks Details
168 LOOPSDAO $694K bsc Oracle Manipulation & Price Manipulation Details Source
169 BCE $679K bsc Incorrect Share Accounting Details
170 BCE Token $679K — Other Details Source
171 Fox $678K — Flash Loan Attacks Details Source
172 The Sandbox $675K base, bsc, ethereum Access Control Attacks Details Source
173 RiseX $673K rise Access Control Attacks Details Source
174 ChainConnect $650K avalanche, bsc, ethereum, polygon Access Control Attacks Details
175 Adshares $628K ethereum Forged Proof Details
176 Swan Treasury $625K bsc Access Control Attacks Details
177 Namada Shielded Pools $600K namada Unbacked Cross-Chain Mint Details
178 DeFiTuna $580K solana Other / Swap Logic Flaw Details Source
179 LULA Token $578K — Flash Loan Attacks Details Source
180 LULA $578K bsc Access Control Attacks Details
181 Projekt $560K ethereum Missing Input Validation Details
182 Projekt (GREEN/GOLD) $560K — Flash Loan Attacks Details Source
183 Bisq $550K bitcoin Missing Input Validation Details
184 Lien $542K ethereum Missing Input Validation Details
185 BlueMove DEX $529K sui Incorrect Share Accounting Details
186 SquidMulticall $517K arbitrum, avalanche, base, bsc, optimism Access Control Attacks Details
187 SquidMulticall Approval Exploitation $517K — Access Control Attacks Details Source
188 Avici $501K solana Access Control Attacks Details
189 Flooring Protocol $500K ethereum Infinite Mint Details
190 AFI Protocol $480K ethereum Unknown Details
191 Bankr $480K base Phishing Attacks Details
192 Holdstation $462K — Access Control Attacks Details Source
193 Aurellion $456K arbitrum Access Control Attacks Details Source
194 Garden Finance $450K arbitrum, base, bsc, ethereum Other / Database Breach Details Source
195 Aethir $423K bsc Access Control Attacks Details Source
196 Singularity Finance $413K base Oracle Manipulation & Price Manipulation Details
197 Velar Perps $401K mezo Oracle Manipulation & Price Manipulation Details
198 Syndicate $400K base Access Control Attacks Details Source
199 YieldCore $399K ethereum Access Control Attacks Details
200 FutureSwap $395K arbitrum Withdrawal Logic Flaw Details
201 Silo V2 $392K arbitrum Oracle Manipulation & Price Manipulation Details Source
202 Ploutos Money $390K ethereum Oracle Manipulation & Price Manipulation Details Source
203 Little Boy Plus $367K bsc Arithmetic Error Details
204 Edel Finance $353K ethereum Flash Loan Attacks Details Source
205 SQ Protocol $346K bsc Access Control Attacks Details
206 Fusion by IPOR $336K arbitrum Access Control Attacks Details Source
207 IPOR Fusion $336K arbitrum Access Control Attacks Details Source
208 ZetaChain $334K arbitrum, avalanche, base, bsc, ethereum, polygon Access Control Attacks Details Source
209 mySwap CL $305K starknet Incorrect Share Accounting Details
210 Harmony $300K — Other Details Source
211 AROS $295K bsc Oracle Manipulation & Price Manipulation Details
212 Lumi Finance $270K arbitrum Other / Signature Verification Flaw Details Source
213 Royal.io $263K polygon Incorrect Share Accounting Details
214 Transit Finance $258K ethereum Unknown Details
215 dTRINITY $257K ethereum Flash Loan Attacks Details Source
216 GoonFi $254K solana Oracle Manipulation & Price Manipulation Details Source
217 DGLD $250K base Unchecked Return Value Attacks Details Source
218 SOF Token $249K — Flash Loan Attacks Details Source
219 ATM Token $244K — Other Details Source
220 ATM $243K bsc Swap Logic Flaw Details
221 Movie Token $242K bsc Incorrect Share Accounting Details
222 Curve Lend $240K — Flash Loan Attacks Details Source
223 Curve LlamaLend $240K ethereum Donation Attack Details Source
224 Gondi $230K ethereum Access Control Attacks Details Source
225 PMX $230K — Other Details Source
226 Polycule $230K polygon Key Leaked via Infrastructure Details Source
227 JUDAO $228K bsc Arithmetic Error Details
228 DLMC $223K bsc Oracle Manipulation & Price Manipulation Details
229 Fluid Lending $215K ethereum Key Leaked via Infrastructure Details
230 SKP $212K bsc Incorrect Share Accounting Details
231 CrowdRingCircle $209K bsc Incorrect Share Accounting Details
232 Renegade $209K arbitrum Access Control Attacks Details Source
233 WUSD.fi $207K ethereum Flash Loan Attacks Details Source
234 Coreum Bridge $200K coreum, xrpl Bridge Logic Flaw Details
235 Coreum $200K — Other Details Source
236 BFB $198K bsc Incorrect Share Accounting Details
237 Holdstation $192K — Access Control Attacks Details Source
238 Allbridge $191K base Bridge Logic Flaw Details
239 LAXO Token $191K — Flash Loan Attacks Details Source
240 LAXO $190K bsc Flash Loan Attacks Details
241 BoostHook $187K ethereum Oracle Manipulation & Price Manipulation Details
242 SynapLogic $186K base Access Control Attacks Details Source
243 Stake DAO $176K arbitrum, base Access Control Attacks Details Source
244 Bankr $170K base Session Key Compromised Details
245 Denaria $166K linea Oracle Manipulation & Price Manipulation Details Source
246 Enjin $162K ethereum Access Control Attacks Details
247 SEA Token $153K arbitrum Oracle Manipulation & Price Manipulation Details
248 DBXen $150K ethereum Access Control Attacks Details Source
249 Scallop Lend $142K sui Reward Logic Flaw Details
250 Ink Finance $140K polygon Access Control Attacks Details Source
251 Quant $138K ethereum Access Control Attacks Details
252 USM $136K ethereum Flash Loan Attacks Details
253 SubQuery Network $134K base Access Control Attacks Details Source
254 TUR Staking $133K bsc Oracle Manipulation & Price Manipulation Details
255 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
256 AM $132K bsc Incorrect Share Accounting Details
257 Ocean Protocol $128K polygon Deposit Logic Flaw Details
258 Molt EVM $127K base Access Control Attacks Details Source
259 AIDCToken $121K — Other Details Source
260 AIDC $121K bsc Arithmetic Error Details
261 Fox Market $120K bsc Oracle Manipulation & Price Manipulation Details
262 CCC $117K bsc Swap Logic Flaw Details
263 DIP $111K bsc Swap Logic Flaw Details
264 Ambient $111K ethereum Deposit Logic Flaw Details
265 MAP Protocol $110K bsc, ethereum Infinite Mint Details
266 MetaSea $110K arbitrum Withdrawal Logic Flaw Details
267 NovaBox $107K ethereum Incorrect Share Accounting Details
268 Huma Finance V2 $101K polygon Access Control Attacks Details
269 Zerion Wallet $100K — Phishing Attacks Details Source
270 PGNLZ $100K bsc Incorrect Share Accounting Details
271 PGNLZ token $100K — Flash Loan Attacks Details Source
272 ONTR $98K ethereum Access Control Attacks Details
273 FlashTrade $98K solana Missing Input Validation Details
274 IEXCBP $97K bsc Oracle Manipulation & Price Manipulation Details
275 PRXVT $97K base Sybil Attack with CREATE2 Addresses / Staking Logic Flaw Details Source
276 warp.green $93K chia, ethereum Bridge Logic Flaw Details
277 Stake DAO $91K arbitrum Access Control Attacks Details Source
278 PHX $90K bsc Incorrect Share Accounting Details
279 BYToken $87K — Flash Loan Attacks Details Source
280 CheckoutPool $86K polygon Access Control Attacks Details
281 MoneyMon $85K — Other Details Source
282 HypurrFi $84K — Other Details Source
283 Kipseli $72K base Missing Input Validation Details
284 SmartCredit $72K ethereum Unknown Details
285 Wise Lending V2 $66K arbitrum, ethereum Access Control Attacks Details
286 FlyCow $65K bsc Incorrect Share Accounting Details
287 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
288 Benqi Staked Avax $64K avalanche Access Control Attacks Details
289 Valinity $63K — Oracle Manipulation & Price Manipulation Details Source
290 MONA $61K bsc BurnAddress Accounting Exploit / Incorrect Share Accounting Details Source
291 Ostium Unverified $60K — Unclassified Details Source
292 Juicebox V3 $52K ethereum Missing Input Validation Details
293 JB $50K bsc Oracle Manipulation & Price Manipulation Details
294 Thetanuts Finance $50K ethereum First Depositor Attack Details
295 Revert Lend $50K base Access Control Attacks Details Source
296 V4 Swap Router by z0r0z $42K — Access Control Attacks Details Source
297 Asterix $40K ethereum Access Control Attacks Details
298 Pepe Trump $38K — Rugpull Details Source
299 Sharwa.Finance $33K arbitrum Oracle Manipulation & Price Manipulation Details
300 HermesVault $30K algorand Other / Withdrawal Logic Flaw Details Source
301 BONK Fun $30K solana DNS Hijack Details
302 Atomic Green $30K arbitrum Signature Replay Details
303 Drips Network $25K ethereum Arithmetic Error Details
304 FH Token $20K bsc Flash Loan Attacks Details
305 Unistreets $18K ethereum Access Control Attacks Details
306 ElevateFi $16K polygon Oracle Manipulation & Price Manipulation Details
307 Fractal Protocol $14K arbitrum Reentrancy Details
308 Lixir Finance $12K ethereum Signature Verification Flaw Details
309 Mure $12K ethereum Signature Verification Flaw Details
310 GPU.NET $11K ethereum Unknown Details
311 WhaleBit $10K polygon Oracle Manipulation & Price Manipulation Details
312 Set Protocol $10K ethereum Reentrancy Details
313 Chi Protocol $8K ethereum Redeem Logic Flaw Details
314 Goose Finance $8K bsc Flash Loan Attacks Details Source
315 Panther Protocol $8K base Malicious Proposal Details
316 Arrakis V1 $7K ethereum Oracle Manipulation & Price Manipulation Details
317 Bitmor $6K base Access Control Attacks Details
318 Veil Cash $5K base misconfigured Groth16 verifier / Proof Verifier Bug Details Source
319 Bodega Market $4K cardano Oracle Manipulation & Price Manipulation Details
320 Quicksilver Zone $4K quicksilver Unbacked Mint Details
321 MANTRA Chain — mantra Access Control Attacks Details
322 Ravencoin — ravencoin Missing Input Validation Details
323 Hyperliquid Malaysia — solana Access Control Attacks Details
324 Syscoin Unverified — — Unclassified Details Source
325 Litecoin — litecoin Missing Input Validation Details
326 VTSwapHook — arbitrum Swap Logic Flaw Details
327 Neutrl — ethereum DNS Hijacking Attack / DNS Hijack Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.