Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (106 rows); the largest tracked chain bucket is Ethereum ($7.4B).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
301 Custom sAVAX Rebalancer $64K avalanche Access Control Attacks Details
302 Valinity $63K — Oracle Manipulation & Price Manipulation Details Source
303 MONA $61K bsc BurnAddress Accounting Exploit / Incorrect Share Accounting Details Source
304 Crypto DAO $52K bsc Access Control Attacks Details Source
305 Juicebox V3 $52K ethereum Missing Input Validation Details
306 Nimiq $50K polygon Signature Verification Flaw Details
307 JB $50K bsc Oracle Manipulation & Price Manipulation Details
308 Thetanuts Finance $50K ethereum First Depositor Attack Details
309 Revert Lend $50K base Access Control Attacks Details Source
310 Bonfire $47K bsc Access Control Attacks Details Source
311 Weft V2 $47K radix Oracle Manipulation & Price Manipulation Details
312 ether.fi Liquid $43K ethereum Access Control Attacks Details
313 V4 Swap Router by z0r0z $42K — Access Control Attacks Details Source2
314 Slice Protocol $41K — Other Details Source2
315 Asterix $40K ethereum Access Control Attacks Details
316 Pepe Trump $38K — Rugpull Details Source
317 DoinGud $35K polygon Swap Logic Flaw Details
318 Sharwa.Finance $33K arbitrum Oracle Manipulation & Price Manipulation Details
319 HermesVault $30K algorand Other / Withdrawal Logic Flaw Details Source2
320 BONK Fun $30K solana DNS Hijack Details
321 Atomic Green $30K arbitrum Signature Replay Details Source
322 Float Protocol $28K ethereum Oracle Manipulation & Price Manipulation Details
323 WealthManagementV2 $26K bsc Access Control Attacks Details
324 Drips Network $25K ethereum Arithmetic Error Details Source
325 Reddio RedSonic $23K ethereum Incorrect Share Accounting Details
326 Yapeswap $22K ethereum Malicious Proposal Details
327 Set Protocol $22K ethereum Rounding Error Details
328 FH Token $20K bsc Flash Loan Attacks Details Source
329 Ethervista $19K ethereum Arithmetic Error Details
330 Locus Finance $18K arbitrum Unclassified Details
331 Unistreets $18K ethereum Access Control Attacks Details Source
332 X7 Finance $16K — Abandoned Details Source
333 Internet Token INT $16K base Access Control Attacks Details Source
334 ElevateFi $16K polygon Oracle Manipulation & Price Manipulation Details
335 BitBay $15K polygon Other / Withdrawal Logic Flaw Details Source
336 Fractal Protocol $14K arbitrum Reentrancy Details
337 Vara Bridge $13K ethereum Proof Verifier Bug Details
338 Lixir Finance $12K ethereum Signature Verification Flaw Details
339 Mure $12K ethereum Signature Verification Flaw Details
340 GPU.NET $11K ethereum Unknown Details
341 WhaleBit $10K polygon Oracle Manipulation & Price Manipulation Details
342 Set Protocol $10K ethereum Reentrancy Details Source
343 Chi Protocol $8K ethereum Redeem Logic Flaw / Peg Check Bypass Details Source
344 Goose Finance $8K bsc Flash Loan Attacks Details Source
345 Arrakis V1 $7K ethereum Oracle Manipulation & Price Manipulation Details Source
346 Bitmor $6K base Access Control Attacks Details
347 Pennysia $5K ethereum Access Control Attacks Details
348 Veil Cash $5K base misconfigured Groth16 verifier / Proof Verifier Bug Details Source
349 Quicksilver Zone $4K quicksilver Unbacked Mint Details
350 Startale $3K ethereum Access Control Attacks Details
351 Coffer $1 solana Rounding Error Details
352 TAC — tac Integer Underflow / Overflow Details Source
353 Across — plasma DNS Hijack Details
354 LNbits — bitcoin, lightning network Unknown Details
355 Keplr Wallet (Web3Auth) — — Supply Chain Attack / Key Leaked via Infrastructure Details
356 Loopscale Lending — solana Unknown Details
357 BTCPay Server — bitcoin, litecoin Key Leaked via Infrastructure Details
358 Hifi Finance — ethereum Malicious Proposal Details
359 Zilliqa X-Bridge — zilliqa Access Control Attacks Details
360 Myriad Markets — bsc Key Leaked via Infrastructure Details
361 Swell — arbitrum, base, ethereum +1 Hot Wallet Key Compromised Details
362 GarudaDefi — terra classic Access Control Attacks Details
363 Pirate Chain — pirate chain Unbacked Mint Details
364 Meter — bsc, ethereum, meter Unknown Details
365 BV-7X — robinhood chain Phishing Attacks Details
366 MultiversX — multiversx Unknown Details
367 Dominion — solana Access Control Attacks Details
368 Permapod — zigchain Unknown Details
369 Full Sail — sui Oracle Manipulation & Price Manipulation Details
370 Surf Lending — cardano Access Control Attacks Details
371 Ravencoin — ravencoin Consensus Validation Failure Details Source
372 Hyperliquid Malaysia — solana Wallet Compromise (entry point unconfirmed) Details Source
373 Panther Protocol — base Malicious Proposal Details Source
374 Sonic DEX — — Unclassified Details
375 StablR — ethereum Access Control Attacks Details Source2
376 Bisq — bitcoin Other / Missing Input Validation Details Source2
377 Litecoin — litecoin Missing Input Validation Details
378 VTSwapHook — arbitrum Swap Logic Flaw Details
379 UdonFi Lending — chromia Withdrawal Logic Flaw Details
380 Neutrl — ethereum DNS Hijacking Attack / DNS Hijack Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.