🥇
Terra Classic
$40.00B
Most Expensive Crypto Hacks Leaderboard
The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.
-
$91B+
Total Value Lost
-
3595
Incidents Tracked
-
141
Chains Affected
-
65
$100M+ Incidents
Top 10 Biggest Hacks
Where the Largest Losses Concentrate
Top Chains by Losses
Top Techniques by Losses
Full Leaderboard
Showing 651-700 of 3595 ranked incidents
| Rank | Project | Amount Lost | Date | Chain | Technique | Attack Guide | Source |
|---|---|---|---|---|---|---|---|
| 651 | Goledo Finance | $1.7M | conflux | Flash Loan Attack / Spot Price Manipulation | Flash Loan Attacks | View → | |
| 652 | Reaper Farm | $1.7M | fantom | Other / Improper Access Control | Access Control Attacks | View → | |
| 653 | Rodeo Finance | $1.7M | - | Oracle Issue | Oracle Manipulation & Price Manipulation | View → | |
| 654 | FSL | $1.7M | - | Rugpull | — | View → | |
| 655 | Ethereum Classic | $1.7M | ethereum classic | Forged Proof | — | — | |
| 656 | BSC TMM/USDT | $1.7M | bsc | Reserve Manipulation Attack / Improper Access Control | Access Control Attacks | View → | |
| 657 | PARALUNI | $1.7M | bsc | Other / Flashloan Reentrancy Attack / Reentrancy | Flash Loan Attacks | View → | |
| 658 | Allbridge | $1.6M | solana | Flash Loan Attack / Withdrawal Logic Flaw | Flash Loan Attacks | View → | |
| 659 | Term Finance | $1.6M | ethereum | Oracle Misconfiguration | Oracle Manipulation & Price Manipulation | — | |
| 660 | BTER | $1.6M | bitcoin | Private Key Compromised | Access Control Attacks | — | |
| 661 | Zilliqa | — | zilliqa | Biased Schnorr Nonce / Private Key Recovery | — | View → | |
| 662 | DefiLabs | $1.6M | - | Rugpull | — | View → | |
| 663 | Pike V1 | $1.6M | arbitrum, ethereum, optimism | Storage Misalignment Exploit / Proxy Upgrade Hijack / Other | Access Control Attacks | View → | |
| 664 | SAGA (Fake) | $1.6M | - | Rugpull | — | View → | |
| 665 | INX Digital Company | $1.6M | ethereum | Key Leaked via Infrastructure | — | — | |
| 666 | Flooring Protocol | $1.6M | ethereum | Arbitrary External Call | Access Control Attacks | — | |
| 667 | Tender Finance | $1.6M | arbitrum | Oracle Decimal Scaling Error | Oracle Manipulation & Price Manipulation | View → | |
| 668 | LianGo Protocol | $1.6M | bsc | Access Control / Admin Drain | Access Control Attacks | View → | |
| 669 | Acala Network | $1.6M | acala | Incentives Function Mistake / Infinite Mint | — | View → | |
| 670 | Token of Power | $1.6M | ethereum | Access Control / Malicious Proposal | Access Control Attacks | View → | |
| 671 | Taylor | $1.6M | - | Access Control | Access Control Attacks | View → | |
| 672 | Narwhal | $1.6M | - | Other | — | View → | |
| 673 | Kinto Bridge | $1.6M | arbitrum | ERC1967Proxy Backdoor Hijack / Uninitialized Proxy | Access Control Attacks | View → | |
| 674 | MetaMask Governance | $1.5M | - | Honeypot | — | View → | |
| 675 | Purrlend | $1.5M | hyperliquid l1, megaeth | Access Control / Caller Impersonation | Access Control Attacks | View → | |
| 676 | Shoebill Finance | $1.5M | bob | Oracle Misconfiguration | Oracle Manipulation & Price Manipulation | — | |
| 677 | OneRing | $1.5M | ethereum | Flash Loan Attack / Improper Access Control | Access Control Attacks | View → | |
| 678 | ASI Alliance & SingularityNET | $1.5M | ethereum | Access Control / Private Key Compromised | Access Control Attacks | View → | |
| 679 | Gnosis Pay | $1.5M | gnosis chain | Signature Verification Flaw | — | — | |
| 680 | Hyperliquid | $1.5M | - | Other | — | View → | |
| 681 | Meteora DAMM V2 | $1.5M | solana | Impersonation Scam | Phishing Attacks | — | |
| 682 | YOLO Games | $1.5M | blast | Access Control Exploit / Caller Impersonation | Access Control Attacks | View → | |
| 683 | General Bytes | $1.5M | ethereum | Key Leaked via Infrastructure | — | — | |
| 684 | LV Metaverse | $1.5M | - | Rugpull | — | View → | |
| 685 | FEGtoken | $1.5M | - | Flash Loan Attack | Flash Loan Attacks | View → | |
| 686 | Pragma Money | $1.5M | - | Rugpull | — | View → | |
| 687 | Levyathan | $1.5M | binance, bsc | Private Key Compromised (Stored Publicly) / Other / Key Stored Publicly | Access Control Attacks | View → | |
| 688 | PolyButterfly | $1.5M | polygon | Rugpull | — | View → | |
| 689 | JulSwap | $1.5M | - | Flash Loan Attack | Flash Loan Attacks | View → | |
| 690 | Bitcurex | $1.5M | bitcoin | Other / Hot Wallet Key Compromised | — | View → | |
| 691 | MintPal | $1.5M | - | Access Control | Access Control Attacks | View → | |
| 692 | Moby | $1.5M | arbitrum | Private Key Compromised (Unknown Method) / Private Key Compromised / Access Control | Access Control Attacks | View → | |
| 693 | Minterest | $1.5M | mantle | Reentrancy / Other | Flash Loan Attacks | View → | |
| 694 | Florence Finance | $1.5M | ethereum | Address Poisoning / Phishing | Phishing Attacks | View → | |
| 695 | Universe Token | $1.4M | bsc | Access Control / Improper Access Control | Access Control Attacks | View → | |
| 696 | Float Protocol | $1.4M | ethereum | Oracle Issue / Spot Price Manipulation | Oracle Manipulation & Price Manipulation | View → | |
| 697 | OMNI | $1.4M | ethereum | Reentrancy | Reentrancy | View → | |
| 698 | Rubic | $1.4M | ethereum | Router Exploit / Other / Arbitrary External Call | Access Control Attacks | View → | |
| 699 | Growth DeFi | $1.4M | ethereum | Flashloan Price Oracle Attack / Rugpull / Missing Input Validation | Flash Loan Attacks | View → | |
| 700 | Ekubo Protocol | $1.4M | ethereum | Access Control / Token Approval Abuse | Access Control Attacks | View → |
Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.
Understanding the Pattern Behind Billion-Dollar Losses
The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.
For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.
Frequently Asked Questions
How is this leaderboard ranked?
Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.
Does this include every attack type?
It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.
How can I learn to prevent these exploits?
Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.
Learn to Prevent High-Impact Smart Contract Hacks
$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.
Start your free security training
Get 25 free lessons and 4 guided exploit exercises.
Onboarding details by email within 2–3 business days.