Most Expensive Crypto Hacks Leaderboard

The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.

  • $91B+

    Total Value Lost

  • 3595

    Incidents Tracked

  • 141

    Chains Affected

  • 65

    $100M+ Incidents

Top 10 Biggest Hacks

Jump to full leaderboard
  2. 🥈

    Mantra

    $5.50B

  4. #4

    LuBian

    $3.50B

    bitcoin

  7. #7

    Thodex

    $2.00B

  9. #9

    Finiko

    $1.50B

  10. #10

    Bybit

    $1.40B

    ethereum

Where the Largest Losses Concentrate

Top Chains by Losses

  • ethereum $9,830M
  • bitcoin $5,404M
  • bsc $3,037M
  • solana $1,697M
  • polygon $1,539M

Top Techniques by Losses

  • Other $52,517M
  • Rugpull $15,631M
  • Private Key Compromised (Brute Force) / Weak Key Generation $3,500M
  • Safe Multisig wallet Phishing Exploit / Access Control / Signer Phishing $1,635M
  • Access Control / Hot Wallet Key Compromised $1,027M

Full Leaderboard

Showing 451-500 of 3595 ranked incidents

Largest Web3 incidents by USD amount lost
Rank Project Amount Lost Date Chain Technique Attack Guide Source
451 dForce $3.6M arbitrum, optimism Oracle Issue / Reentrancy / Read-Only Reentrancy Oracle Manipulation & Price Manipulation View →
452 Bogged Finance $3.6M binance, bsc Flash Loan Attack / Arithmetic Error Flash Loan Attacks View →
453 MANTRA Chain $3.6M mantra Unsigned Integer Underflow Access Control Attacks View →
454 HyperVault $3.6M hyperliquid l1 Drain Vaults / Rugpull / Admin Drain — View →
455 Hayden Adams Phishing $3.6M - Phishing Phishing Attacks View →
456 Luke Dashjr $3.6M - Access Control Access Control Attacks View →
457 SushiSwap $3.5M arbitrum, bsc, ethereum, optimism Missing Input Validation / Other — View →
458 Nostra Finance $3.5M starknet Oracle Issue / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
459 Sweat Foundation $3.5M near Withdrawal Logic Flaw — —
460 Volo Vault $3.5M sui Private Key Compromised / Other Access Control Attacks View →
461 Sportsbet.io $3.5M - Access Control Access Control Attacks View →
462 Dragoma $3.5M polygon Drain Vaults / Rugpull / Admin Drain — View →
463 Nirvana V1 $3.5M solana Flashloan Price Oracle Attack / Spot Price Manipulation / Flash Loan Attack Flash Loan Attacks View →
464 PokeMoney $3.5M - Rugpull — View →
465 Siren $3.5M polygon Reentrancy Reentrancy View →
466 NYC Memecoin $3.4M - Rugpull — View →
467 EraLend $3.4M zksync era Reentrancy / Read-Only Reentrancy Reentrancy View →
468 Vesper Finance $3.4M ethereum Oracle Manipulation / Other / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
469 Shido $3.3M ethereum Private Key Compromised / Access Control Access Control Attacks View →
470 Socket $3.3M ethereum Other / Missing Input Validation Access Control Attacks View →
471 Raft $3.3M ethereum Infinite Mint and Dump / Other / Infinite Mint — View →
472 Conic Finance $3.3M ethereum Flashloan Reentrancy Attack / Reentrancy / Read-Only Reentrancy Flash Loan Attacks View →
473 Hundred Finance $3.3M - Other — View →
474 Livecoin $3.3M multiple API Key Compromised — —
475 Cheese Bank $3.3M ethereum Flash Loan Attack / Flashloan Price Oracle Attack / Spot Price Manipulation Flash Loan Attacks View →
476 Coinsecure $3.3M bitcoin Custodial loss; cause disputed Access Control Attacks View →
477 HoneySwap.Fi $3.3M binance Rugpull — View →
478 Typus Perp $3.3M sui Missing Oracle Authorization Oracle Manipulation & Price Manipulation View →
479 Ref Finance $3.2M near LP balance not debited — View →
480 Third-party SquidRouterModule $3.2M base, ethereum Access Control / Improper Access Control Access Control Attacks View →
481 Zabu Finance $3.2M avalanche Flashloan Exploit / Other / Deposit Logic Flaw Flash Loan Attacks View →
482 Nomic nBTC Bridge $3.1M nomic Other / Unbacked Cross-Chain Mint — View →
483 GANA Payment $3.1M bsc Private Key Compromised / Other / Phishing Access Control Attacks View →
484 Cashaa $3.1M bitcoin Custodial wallet compromise Access Control Attacks View →
485 Phishing $3.0M - Phishing Phishing Attacks View →
486 DEUS Finance $3.0M fantom Flash Loan Attack / Spot Price Manipulation / Flashloan Price Oracle Attack Flash Loan Attacks View →
487 Gain $3.0M ethereum Infinite Mint — —
488 Fogo Foundation $3.0M fogo Private Key Compromised Access Control Attacks —
489 BounceBit $3.0M bouncebit Improper Access Control Access Control Attacks View →
490 Polymarket $3.0M polygon Other / Frontend Compromise — View →
491 CrossCurve $3.0M - Spoofed Cross-Chain Messages / Other / Cross-Chain Message Spoofing — View →
492 Beets $3.0M - Access Control Access Control Attacks View →
493 GriffinAI $3.0M bsc False Peer Exploit / Access Control / Cross-Chain Message Spoofing Access Control Attacks View →
494 EOA Token Theft $3.0M - Other — View →
495 Banana Gun $3.0M ethereum Suspected messaging-oracle vulnerability Oracle Manipulation & Price Manipulation View →
496 FixedFloat $3.0M - Key Leaked via Infrastructure — —
497 NFPrompt $3.0M ethereum Private Key Compromised Access Control Attacks —
498 Nft Trader $3.0M ethereum Reentrancy Reentrancy View →
499 Swaprum $3.0M arbitrum Drained Contracts / Rugpull / Backdoor Contract — View →
500 Orion Protocol $3.0M bsc Reentrancy Reentrancy View →

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding the Pattern Behind Billion-Dollar Losses

The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.

For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.

Frequently Asked Questions

How is this leaderboard ranked?

Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.

Does this include every attack type?

It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.

How can I learn to prevent these exploits?

Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.

Learn to Prevent High-Impact Smart Contract Hacks

$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial → View Full Course