🥇
Terra Classic
$40.00B
Most Expensive Crypto Hacks Leaderboard
The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.
-
$91B+
Total Value Lost
-
3595
Incidents Tracked
-
141
Chains Affected
-
65
$100M+ Incidents
Top 10 Biggest Hacks
Where the Largest Losses Concentrate
Top Chains by Losses
Top Techniques by Losses
Full Leaderboard
Showing 601-650 of 3595 ranked incidents
| Rank | Project | Amount Lost | Date | Chain | Technique | Attack Guide | Source |
|---|---|---|---|---|---|---|---|
| 601 | Mirror Protocol | $2.0M | terra | Oracle Issue / Improper Access Control | Access Control Attacks | View → | |
| 602 | Mad Meerkat Finance | $2.0M | cronos | Other / DNS Spoofing / DNS Hijack | — | View → | |
| 603 | OpenSea | $2.0M | ethereum | Access Control / Phishing | Access Control Attacks | View → | |
| 604 | AutoSharkFinance | $2.0M | - | Other | — | View → | |
| 605 | Circle | $2.0M | - | Access Control | Access Control Attacks | View → | |
| 606 | Akropolis | $2.0M | ethereum | Flashloan Reentrancy Attack / Flash Loan Attack / Reentrancy | Flash Loan Attacks | View → | |
| 607 | MintPal | $2.0M | bitcoin | Access Control / Improper Access Control | Access Control Attacks | View → | |
| 608 | PancakeHunny | $2.0M | - | Other | — | View → | |
| 609 | MEV Bot | $2.0M | ethereum | Other / Improper Access Control | Access Control Attacks | View → | |
| 610 | Dough Finance | $2.0M | ethereum | Unvalidated call data exploit / Access Control / Arbitrary External Call | Access Control Attacks | View → | |
| 611 | Titano | $1.9M | bsc | Other / Backdoor Contract | — | View → | |
| 612 | Coinis | $1.9M | - | Access Control | Access Control Attacks | View → | |
| 613 | BTER | $1.9M | - | Rugpull | — | View → | |
| 614 | Dango | $1.9M | dango | Donate Negative Amounts Hack / Missing Input Validation | — | View → | |
| 615 | AARK (Aark Digital) | $1.9M | arbitrum | Decimal Miscalculation | — | — | |
| 616 | XBridge | $1.9M | bsc, ethereum | Access Control / Improper Access Control | Access Control Attacks | View → | |
| 617 | Dolomite | $1.9M | ethereum | Acces Control Exploit / Other / Improper Access Control | Access Control Attacks | View → | |
| 618 | KLAYswap | $1.9M | - | Other | — | View → | |
| 619 | FEG Token | $1.9M | bsc, ethereum | Improper Access Control | Access Control Attacks | — | |
| 620 | CF Token | $1.9M | bsc | Improper Access Control | Access Control Attacks | — | |
| 621 | KlaySwap | $1.9M | klaytn | Frontend Compromise | — | — | |
| 622 | Percent Finance | $1.9M | - | Other | — | View → | |
| 623 | Omm | $1.9M | icon | Redeem Function Exploit / Redeem Logic Flaw / Other | — | View → | |
| 624 | Transit Finance | $1.9M | tron | Other / Improper Access Control | Access Control Attacks | View → | |
| 625 | BT.Finance | $1.9M | ethereum | Flash Loan Attack / Spot Price Manipulation | Flash Loan Attacks | View → | |
| 626 | Concentric | $1.9M | arbitrum | Compromised vault-upgrade authority | Access Control Attacks | View → | |
| 627 | Payy Network | $1.8M | ethereum | Access Control / Bridge Logic Flaw | Access Control Attacks | View → | |
| 628 | IVY | $1.8M | - | Rugpull | — | View → | |
| 629 | Phishing | $1.8M | - | Phishing | Phishing Attacks | View → | |
| 630 | MERLIN DEX | $1.8M | zksync era | Drained Contracts / Access Control / Admin Drain | Access Control Attacks | View → | |
| 631 | Limit Break Payment Processor | $1.8M | apechain, base, ethereum, polygon | Token Approval Abuse | Access Control Attacks | — | |
| 632 | Nexera | $1.8M | ethereum | Compromised management credentials | Access Control Attacks | View → | |
| 633 | BonqDAO | $1.8M | polygon | Price Oracle Attack / Oracle Misconfiguration / Manipulated collateral price | Oracle Manipulation & Price Manipulation | View → | |
| 634 | PancakeSwap | $1.8M | bsc | Alleged lottery-admin abuse | Access Control Attacks | View → | |
| 635 | Ledger | $1.8M | - | Access Control | Access Control Attacks | View → | |
| 636 | CoinTiger | $1.8M | ethereum | Access Control / Key Leaked via Infrastructure | Access Control Attacks | View → | |
| 637 | BTER | $1.8M | bitcoin | Access Control / Private Key Compromised | Access Control Attacks | View → | |
| 638 | Bent Finance | $1.8M | ethereum | User Balances Manually Updated / Other / Backdoor Contract | Access Control Attacks | View → | |
| 639 | Moonwell Lending | $1.8M | base | cbETH Collateral Exploit / Oracle Issue / Oracle Misconfiguration | Oracle Manipulation & Price Manipulation | View → | |
| 640 | USDC Permit Signature Phishing | $1.8M | - | Phishing | Phishing Attacks | View → | |
| 641 | 8ightDAO | $1.8M | harmony | Reported treasury-key exposure | Access Control Attacks | View → | |
| 642 | Verge | $1.8M | verge | Withdrawal Logic Flaw | — | — | |
| 643 | EVODeFi | $1.7M | bsc | Flash Loan Attack / Reward Logic Flaw | Flash Loan Attacks | View → | |
| 644 | Notional Finance | $1.7M | ethereum | Other / Arithmetic Error | — | View → | |
| 645 | DePo | $1.7M | - | Access Control | Access Control Attacks | View → | |
| 646 | Maya Protocol | $1.7M | mayachain | Other / Withdrawal Logic Flaw | — | View → | |
| 647 | Taiko | $1.7M | taiko | Other / Forged Proof | — | View → | |
| 648 | Abracadabra Spell | $1.7M | ethereum | Sequential State Manipulation Exploit / Other / Improper Access Control | Access Control Attacks | View → | |
| 649 | XT Exchange | $1.7M | ethereum | Access Control / Hot Wallet Key Compromised | Access Control Attacks | View → | |
| 650 | Grand Base | $1.7M | base | Private Key Compromised (Unknown Method) / Access Control / Phishing | Access Control Attacks | View → |
Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.
Understanding the Pattern Behind Billion-Dollar Losses
The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.
For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.
Frequently Asked Questions
How is this leaderboard ranked?
Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.
Does this include every attack type?
It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.
How can I learn to prevent these exploits?
Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.
Learn to Prevent High-Impact Smart Contract Hacks
$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.
Start your free security training
Get 25 free lessons and 4 guided exploit exercises.
Onboarding details by email within 2–3 business days.