Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (98 rows); the largest tracked chain bucket is Ethereum ($952.4M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
201 FutureSwap $395K arbitrum Withdrawal Logic Flaw Details
202 Silo V2 $392K arbitrum Oracle Manipulation & Price Manipulation Details Source
203 Ploutos Money $390K ethereum Oracle Manipulation & Price Manipulation Details Source
204 Little Boy Plus $367K bsc Arithmetic Error Details
205 Edel Finance $353K ethereum Flash Loan Attacks Details Source
206 SQ Protocol $346K bsc Access Control Attacks Details
207 Symbiosis $336K bsc, ethereum Unbacked Cross-Chain Mint Details
208 Fusion by IPOR $336K arbitrum Access Control Attacks Details Source
209 IPOR Fusion $336K arbitrum Access Control Attacks Details Source
210 ZetaChain $334K arbitrum, avalanche, base, bsc, ethereum, polygon Access Control Attacks Details Source
211 mySwap CL $305K starknet Incorrect Share Accounting Details
212 Harmony $300K — Other Details Source
213 AROS $295K bsc Oracle Manipulation & Price Manipulation Details
214 Lumi Finance $270K arbitrum Other / Signature Verification Flaw Details Source
215 Royal.io $263K polygon Incorrect Share Accounting Details
216 Transit Finance $258K ethereum Unknown Details
217 dTRINITY $257K ethereum Flash Loan Attacks Details Source
218 GoonFi $254K solana Oracle Manipulation & Price Manipulation Details Source
219 DGLD $250K base Unchecked Return Value Attacks Details Source
220 SOF Token $249K — Flash Loan Attacks Details Source
221 ATM Token $244K — Other Details Source
222 ATM $243K bsc Swap Logic Flaw Details
223 Movie Token $242K bsc Incorrect Share Accounting Details
224 Curve Lend $240K — Flash Loan Attacks Details Source
225 Curve LlamaLend $240K ethereum Donation Attack Details Source
226 Balancer V1 $234K ethereum Rounding Error Details
227 Gondi $230K ethereum Access Control Attacks Details Source
228 PMX $230K — Other Details Source
229 Polycule $230K polygon Key Leaked via Infrastructure Details Source
230 JUDAO $228K bsc Arithmetic Error Details
231 DLMC $223K bsc Oracle Manipulation & Price Manipulation Details
232 Fluid Lending $215K ethereum Key Leaked via Infrastructure Details
233 SKP $212K bsc Incorrect Share Accounting Details
234 CrowdRingCircle $209K bsc Incorrect Share Accounting Details Source
235 Renegade $209K arbitrum Access Control Attacks Details Source
236 WUSD.fi $207K ethereum Flash Loan Attacks Details Source
237 Coreum $200K coreum, xrpl Deposit Verification Flaw Details Source
238 BFB $198K bsc Incorrect Share Accounting Details Source
239 Holdstation $192K — Access Control Attacks Details Source
240 Allbridge $191K base Cross-Chain Message Validation Flaw Details Source
241 LAXO Token $191K — Flash Loan Attacks Details Source
242 LAXO $190K bsc Flash Loan Attacks Details
243 BoostHook $187K ethereum Oracle Manipulation & Price Manipulation Details
244 SynapLogic $186K base Access Control Attacks Details Source
245 Stake DAO $176K arbitrum, base Access Control Attacks Details Source
246 Bankr $170K base Session Key Compromised Details
247 Denaria $166K linea Oracle Manipulation & Price Manipulation Details Source
248 Cozy Finance $163K optimism Oracle Manipulation & Price Manipulation Details Source
249 Enjin $162K ethereum Access Control Attacks Details Source
250 SEA Token $153K arbitrum Oracle Manipulation & Price Manipulation Details
251 DBXen $150K ethereum Access Control Attacks Details Source
252 Scallop Lend $142K sui Reward Logic Flaw Details
253 Zentra Finance $140K citrea Rounding Error Details
254 Ink Finance $140K polygon Access Control Attacks Details Source
255 Quant $138K ethereum Access Control Attacks Details
256 USM $136K ethereum Flash Loan Attacks Details Source
257 SubQuery Network $134K base Access Control Attacks Details Source
258 TUR Staking $133K bsc Oracle Manipulation & Price Manipulation Details
259 ShapeShift FOX Colony $133K arbitrum Access Control Attacks Details
260 AM $132K bsc Incorrect Share Accounting Details
261 Ocean Protocol $128K polygon Deposit Logic Flaw Details
262 Molt EVM $127K base Access Control Attacks Details Source
263 AIDC $121K bsc Arithmetic Error / Other Details Source
264 Fox Market $120K bsc Flash Loan Attacks Details Source
265 CCC $117K bsc Swap Logic Flaw Details Source
266 Amnext $116K — Reentrancy Details Source
267 DIP $111K bsc Swap Logic Flaw Details
268 Ambient $111K ethereum Deposit Logic Flaw Details
269 MAP Protocol $110K bsc, ethereum Infinite Mint Details
270 MetaSea $110K arbitrum Withdrawal Logic Flaw Details
271 RWC Token $109K — Other Details Source
272 NovaBox $107K ethereum Incorrect Share Accounting Details
273 Secured Finance Lending $104K ethereum Oracle Manipulation & Price Manipulation Details
274 Huma Finance V2 $101K polygon Access Control Attacks Details
275 Zerion Wallet $100K — Phishing Attacks Details Source
276 PGNLZ $100K bsc Incorrect Share Accounting Details
277 PGNLZ token $100K — Flash Loan Attacks Details Source
278 ONTR $98K ethereum Access Control Attacks Details
279 FlashTrade $98K solana Missing Input Validation Details Source
280 IEXCBP $97K bsc Oracle Manipulation & Price Manipulation Details
281 PRXVT $97K base Sybil Attack with CREATE2 Addresses / Staking Logic Flaw Details Source
282 warp.green $93K chia, ethereum Bridge Logic Flaw Details Source
283 Stake DAO $91K arbitrum Access Control Attacks Details Source
284 PacaSwap DEX $91K constellation Arithmetic Error Details
285 PHX $90K bsc Incorrect Share Accounting Details Source
286 BYToken $87K — Flash Loan Attacks Details Source
287 CheckoutPool $86K polygon Access Control Attacks Details
288 MoneyMon $85K — Other Details Source
289 HypurrFi $84K — Other Details Source
290 BeatXswap $78K bsc Oracle Manipulation & Price Manipulation Details
291 Kipseli $72K base Missing Input Validation Details
292 SmartCredit $72K ethereum Unknown Details
293 Dream Health Chain $72K bsc Reward Logic Flaw Details
294 Wise Lending V2 $66K arbitrum, ethereum Access Control Attacks Details
295 FlyCow $65K bsc Incorrect Share Accounting Details Source
296 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
297 Benqi Staked Avax $64K avalanche Access Control Attacks Details
298 Valinity $63K — Oracle Manipulation & Price Manipulation Details Source
299 MONA $61K bsc BurnAddress Accounting Exploit / Incorrect Share Accounting Details Source
300 Crypto DAO $52K bsc Access Control Attacks Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.