Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (106 rows); the largest tracked chain bucket is Ethereum ($7.4B).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
201 TENDRIL/USDT Pool $309K — Flash Loan Attacks Details Source
202 FlashLoopAdapter $305K ethereum Access Control Attacks Details
203 mySwap CL $305K starknet Incorrect Share Accounting Details
204 Ankr Bridge $304K ethereum Cross-Chain Message Spoofing Details
205 Ankr $304K — Other Details Source2
206 Edel $300K ethereum Unknown / Other Details Source
207 Harmony $300K — Other Details Source234
208 AROS $295K bsc Oracle Manipulation & Price Manipulation Details
209 Rocket Perp $288K rocket Risk Parameter Abuse Details
210 Sonic ICP $276K icp Withdrawal Logic Flaw Details
211 Lumi Finance $270K arbitrum Other / Signature Verification Flaw Details Source
212 Royal.io $263K polygon Incorrect Share Accounting Details
213 Transit Finance $258K ethereum Unknown Details
214 dTRINITY $257K ethereum Flash Loan Attacks Details Source23
215 GoonFi $254K solana Oracle Manipulation & Price Manipulation Details Source
216 Balancer V1 $250K ethereum Swap Logic Flaw Details
217 DGLD $250K base Unchecked Return Value Attacks Details Source
218 SOF Token $249K — Flash Loan Attacks Details Source
219 ATM Token $243K bsc Other / Swap Logic Flaw Details Source
220 Movie Token $242K bsc Incorrect Share Accounting Details
221 Curve LlamaLend $240K ethereum Flash Loan Attacks Details Source
222 Balancer V1 $234K ethereum Rounding Error Details
223 Gondi $230K ethereum Access Control Attacks Details Source2
224 Polycule $230K polygon Key Leaked via Infrastructure / Other Details Source
225 JUDAO $228K bsc Arithmetic Error Details
226 DLMC $223K bsc Oracle Manipulation & Price Manipulation Details
227 Fluid Lending $215K ethereum Access Control Attacks Details
228 SKP $212K bsc Incorrect Share Accounting Details
229 CrowdRingCircle $209K bsc Incorrect Share Accounting Details Source
230 Renegade $209K arbitrum Access Control Attacks Details Source2
231 Rujira AMM Strategies $200K thorchain Swap Logic Flaw Details
232 Coreum $200K coreum, xrpl Deposit Verification Flaw Details Source2
233 WUSD.fi $200K ethereum Flash Loan Attacks Details Source2
234 BFB $198K bsc Incorrect Share Accounting Details Source
235 Holdstation $192K — Access Control Attacks Details Source2
236 Demex Perp $192K bsc, demex, ethereum Cross-Chain Message Spoofing Details
237 Allbridge $191K base Cross-Chain Message Validation Flaw Details Source
238 LAXO Token $190K bsc Flash Loan Attacks Details Source
239 BoostHook $187K ethereum Oracle Manipulation & Price Manipulation Details
240 SKYDAO $183K bsc Swap Logic Flaw Details
241 Stake DAO $176K arbitrum, base Access Control Attacks Details Source
242 Bankr $170K base Session Key Compromised Details
243 Denaria $166K linea Oracle Manipulation & Price Manipulation Details Source2
244 BiFi $165K — Other Details Source2
245 Cozy Finance $163K optimism Oracle Manipulation & Price Manipulation Details Source
246 Enjin $162K ethereum Access Control Attacks Details Source
247 MetaSea $153K arbitrum Oracle Manipulation & Price Manipulation Details
248 AlpsCon AI Trade Hub $153K bsc Incorrect Share Accounting Details
249 DBXen $150K ethereum Access Control Attacks Details Source
250 SynapLogic $144K base Access Control Attacks Details Source23
251 Scallop Lend $142K sui Reward Logic Flaw Details
252 Zentra Finance $140K citrea Rounding Error Details
253 Ink Finance $140K polygon Access Control Attacks Details Source2
254 Quant $138K ethereum Access Control Attacks Details
255 USM $136K ethereum Flash Loan Attacks Details Source
256 SubQuery Network $134K base Access Control Attacks Details Source
257 TUR Staking $133K bsc Oracle Manipulation & Price Manipulation Details
258 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
259 AM $132K bsc Incorrect Share Accounting Details
260 Ocean Protocol $128K polygon Deposit Logic Flaw Details
261 Molt EVM $127K base Access Control Attacks Details Source
262 AIDC $121K bsc Arithmetic Error / Other Details Source
263 Fox Market $120K bsc Flash Loan Attacks Details Source2
264 CCC $117K bsc Swap Logic Flaw Details Source
265 Amnext $116K — Reentrancy Details Source
266 GoldPesa $115K base Other / Incorrect Share Accounting Details Source
267 InsurancePool / CoreVault Oracle $112K — Flash Loan Attacks Details Source
268 DIP $111K bsc Swap Logic Flaw Details
269 Ambient $111K ethereum Deposit Logic Flaw Details
270 MAP Protocol $110K bsc, ethereum Infinite Mint Details
271 RWC Token $109K — Other Details Source
272 NovaBox $107K ethereum Incorrect Share Accounting Details
273 Thetanuts Finance $105K ethereum Arithmetic Overflow & Underflow Attacks Details Source
274 Secured Finance Lending $104K ethereum Oracle Manipulation & Price Manipulation Details
275 Huma Finance V2 $101K polygon Access Control Attacks Details
276 Zerion Wallet $100K — Phishing Attacks Details Source
277 PGNLZ token $100K bsc Flash Loan Attacks Details Source
278 ONTR $98K ethereum Access Control Attacks Details
279 FlashTrade $98K solana Missing Input Validation Details Source
280 IEXCBP $97K bsc Oracle Manipulation & Price Manipulation Details
281 PRXVT $97K base Sybil Attack with CREATE2 Addresses / Staking Logic Flaw Details Source
282 warp.green $93K chia, ethereum Bridge Logic Flaw Details Source
283 MCN Labs $93K — Other Details Source
284 FastSwap $93K — Other Details Source
285 Stake DAO $91K arbitrum Access Control Attacks Details Source2
286 PacaSwap DEX $91K constellation Arithmetic Error Details
287 WAX Multi-Chain Bridge $90K ethereum, solana, wax Missing Input Validation Details
288 PHX $90K bsc Incorrect Share Accounting Details Source
289 BYToken $87K — Flash Loan Attacks Details Source
290 UNCX Network V2 $86K base, bsc, ethereum +1 Incorrect Share Accounting Details
291 CheckoutPool $86K polygon Access Control Attacks Details
292 MoneyMon $85K — Other Details Source
293 HypurrFi $84K — Other Details Source
294 BeatXswap $78K bsc Oracle Manipulation & Price Manipulation Details
295 Kipseli $72K base Missing Input Validation Details
296 SmartCredit $72K ethereum Unknown Details
297 MALT $72K — Other Details Source
298 Dream Health Chain $72K bsc Reward Logic Flaw Details
299 Wise Lending V2 $66K arbitrum, ethereum Access Control Attacks Details
300 FlyCow $65K bsc Incorrect Share Accounting Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.