Web3 Hacks in 2026

2026 incident records, sorted by known loss. The strongest mapped pattern is Access Control (98 rows); the largest tracked chain bucket is Ethereum ($952.4M).

Open full database

Incident records

Sorted by known reported loss first, then recency. Open the source before treating any summary as final.

Links
301 Juicebox V3 $52K ethereum Missing Input Validation Details
302 Nimiq $50K polygon Signature Verification Flaw Details
303 JB $50K bsc Oracle Manipulation & Price Manipulation Details
304 Thetanuts Finance $50K ethereum First Depositor Attack Details
305 Revert Lend $50K base Access Control Attacks Details Source
306 Bonfire $47K bsc Access Control Attacks Details Source
307 Weft V2 $47K radix Oracle Manipulation & Price Manipulation Details
308 ether.fi Liquid $43K ethereum Access Control Attacks Details
309 V4 Swap Router by z0r0z $42K — Access Control Attacks Details Source
310 Asterix $40K ethereum Access Control Attacks Details
311 Pepe Trump $38K — Rugpull Details Source
312 DoinGud $35K polygon Swap Logic Flaw Details
313 Sharwa.Finance $33K arbitrum Oracle Manipulation & Price Manipulation Details
314 HermesVault $30K algorand Other / Withdrawal Logic Flaw Details Source
315 BONK Fun $30K solana DNS Hijack Details
316 Atomic Green $30K arbitrum Signature Replay Details Source
317 Float Protocol $28K ethereum Oracle Manipulation & Price Manipulation Details
318 WealthManagementV2 $26K bsc Access Control Attacks Details
319 Drips Network $25K ethereum Arithmetic Error Details Source
320 Reddio RedSonic $23K ethereum Incorrect Share Accounting Details
321 FH Token $20K bsc Flash Loan Attacks Details Source
322 Unistreets $18K ethereum Access Control Attacks Details Source
323 Internet Token INT $16K base Access Control Attacks Details Source
324 ElevateFi $16K polygon Oracle Manipulation & Price Manipulation Details
325 Fractal Protocol $14K arbitrum Reentrancy Details
326 Lixir Finance $12K ethereum Signature Verification Flaw Details
327 Mure $12K ethereum Signature Verification Flaw Details
328 GPU.NET $11K ethereum Unknown Details
329 WhaleBit $10K polygon Oracle Manipulation & Price Manipulation Details
330 Set Protocol $10K ethereum Reentrancy Details Source
331 Chi Protocol $8K ethereum Redeem Logic Flaw / Peg Check Bypass Details Source
332 Goose Finance $8K bsc Flash Loan Attacks Details Source
333 Arrakis V1 $7K ethereum Oracle Manipulation & Price Manipulation Details Source
334 Bitmor $6K base Access Control Attacks Details
335 Veil Cash $5K base misconfigured Groth16 verifier / Proof Verifier Bug Details Source
336 Quicksilver Zone $4K quicksilver Unbacked Mint Details
337 Startale $3K ethereum Access Control Attacks Details
338 TAC — tac Integer Underflow / Overflow Details Source
339 Meter — bsc, ethereum, meter Unknown Details
340 MultiversX — multiversx Unknown Details
341 Dominion — solana Access Control Attacks Details
342 Permapod — zigchain Unknown Details
343 Full Sail — sui Oracle Manipulation & Price Manipulation Details
344 Surf Lending — cardano Access Control Attacks Details
345 Ravencoin — ravencoin Consensus Validation Failure Details Source
346 Hyperliquid Malaysia — solana Wallet Compromise (entry point unconfirmed) Details Source
347 Panther Protocol — base Malicious Proposal Details Source
348 Syscoin Unverified — — Unclassified Details Source
349 StablR — ethereum Access Control Attacks Details Source
350 Bisq — bitcoin Other / Missing Input Validation Details Source
351 Litecoin — litecoin Missing Input Validation Details
352 VTSwapHook — arbitrum Swap Logic Flaw Details
353 Neutrl — ethereum DNS Hijacking Attack / DNS Hijack Details Source

Notes

Loss totals use parsed USD values only; unknown or unparseable losses are not guessed. Attack-class links are added only when the root cause is clear enough to map.

Full hack database Filter every tracked incident by chain, date, loss size, and technique. Attack class library Move from incident examples to exploit mechanics and review checklists. Largest crypto hacks Compare this year against the highest-loss incidents in the database.