Most Expensive Crypto Hacks Leaderboard

The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.

  • $91B+

    Total Value Lost

  • 3595

    Incidents Tracked

  • 141

    Chains Affected

  • 65

    $100M+ Incidents

Top 10 Biggest Hacks

Jump to full leaderboard
  2. 🥈

    Mantra

    $5.50B

  4. #4

    LuBian

    $3.50B

    bitcoin

  7. #7

    Thodex

    $2.00B

  9. #9

    Finiko

    $1.50B

  10. #10

    Bybit

    $1.40B

    ethereum

Where the Largest Losses Concentrate

Top Chains by Losses

  • ethereum $9,830M
  • bitcoin $5,404M
  • bsc $3,037M
  • solana $1,697M
  • polygon $1,539M

Top Techniques by Losses

  • Other $52,517M
  • Rugpull $15,631M
  • Private Key Compromised (Brute Force) / Weak Key Generation $3,500M
  • Safe Multisig wallet Phishing Exploit / Access Control / Signer Phishing $1,635M
  • Access Control / Hot Wallet Key Compromised $1,027M

Full Leaderboard

Showing 801-850 of 3595 ranked incidents

Largest Web3 incidents by USD amount lost
Rank Project Amount Lost Date Chain Technique Attack Guide Source
801 Mars Perps $960K neutron Thin-Market Skew Exploit / Funding Rate Arbitrage — View →
802 LML/USDT staking protocol $950K bsc Price Manipulation Attack / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
803 Nitron Demex $950K arbitrum Oracle Issue / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
804 Electrum $949K - Access Control Access Control Attacks View →
805 Harvest Keeper $933K ethereum Rugpull / Admin Drain — View →
806 42DAO $912K bsc Spot Price / Oracle Manipulation with Instant Liquidation Oracle Manipulation & Price Manipulation View →
807 MOKE Token $907K bsc Access Control / Spot Price Manipulation Access Control Attacks View →
808 Venus Core Pool $902K zksync era Donation Attack — View →
809 Solido Cash $900K supra Oracle Issue / Oracle Misconfiguration Oracle Manipulation & Price Manipulation View →
810 FEG (Feed Every Gorilla) $900K - Other — View →
811 Condom $900K - Rugpull — View →
812 Palm USD $900K bsc Flash Loan Attack / Inflationary Accounting Manipulation / Incorrect Share Accounting Flash Loan Attacks View →
813 Virtue $894K iota Oracle Misconfiguration Oracle Manipulation & Price Manipulation —
814 SudoRare $883K ethereum Drained Contracts / Rugpull / Liquidity Rug — View →
815 NORMIE $882K base Unknown — —
816 Crosswise $879K bsc Other / Improper Access Control Access Control Attacks View →
817 VPANDAO DAO $869K - Rugpull — View →
818 RocketSwap Base $869K base Private Key Compromised (Brute Force) / Access Control / Key Leaked via Infrastructure Access Control Attacks View →
819 BiSwap $865K bsc Other / Improper Access Control Access Control Attacks View →
820 ElasticSwap $854K avalanche, ethereum Price Oracle Attack / Other / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
821 Armor.Fi $850K - Other — View →
822 Xai $846K ethereum Impersonation Scam Phishing Attacks —
823 Orange Finance $840K arbitrum Private Key Compromised (Unknown Method) / Access Control / Private Key Compromised Access Control Attacks View →
824 Hope Lend $835K ethereum Other / Arithmetic Error — View →
825 SyncSpace $830K - Other — View →
826 AutoShark $823K bsc Flashloan Incentive Rewards Exploit / Flash Loan Attack / Reward Logic Flaw Flash Loan Attacks View →
827 Astera.fi $822K linea Oracle Price Feed Manipulation / Flash Loan Attack / Incorrect Share Accounting Flash Loan Attacks View →
828 EigenLayer $821K - Rugpull — View →
829 Hinkal $820K ethereum Other / Deposit Logic Flaw — View →
830 Pawnfi $820K ethereum Other / Incorrect Share Accounting — View →
831 MetaPoint $820K bsc Access Control / Token Approval Abuse Access Control Attacks View →
832 ApeCoin $820K ethereum Flashloan Governance Attack Flash Loan Attacks —
833 Echo Protocol $816K monad Access Control / Private Key Compromised Access Control Attacks View →
834 Alephium $815K ethereum Other / Forged Proof — View →
835 GMBL.COMPUTER $815K arbitrum Referral Claims Logic Exploit / Other / Signature Verification Flaw — View →
836 Gyroscope $807K - Other Access Control Attacks View →
837 BitBot $805K ethereum Rugpull — View →
838 Aragon DAO $800K - Phishing Phishing Attacks View →
839 Balancer V2 $800K ethereum Spot Price Manipulation / Flash Loan Attack Flash Loan Attacks View →
840 Anchor $800K terra Stale Oracle Price Oracle Manipulation & Price Manipulation —
841 Wault Finance $800K binance, bsc Flash Loan Attack / Risk Parameter Abuse Flash Loan Attacks View →
842 ChainSwap $800K bsc, ethereum Other / Bridge Logic Flaw — View →
843 Eco DeFi $794K - Access Control Access Control Attacks View →
844 The R0AR $790K ethereum Access Control / Improper Access Control Access Control Attacks View →
845 EthBread Token $787K - Rugpull — View →
846 TIGER $784K - Rugpull — View →
847 Hyperdrive HL $782K hyperliquid l1 Router Exploit / Other / Arbitrary External Call Access Control Attacks View →
848 DataDAO Finance $782K - Rugpull — View →
849 BarnBridge $777K ethereum Malicious Proposal — View →
850 Ajna V2 $775K ethereum Liquidation Logic Flaw — —

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding the Pattern Behind Billion-Dollar Losses

The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.

For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.

Frequently Asked Questions

How is this leaderboard ranked?

Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.

Does this include every attack type?

It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.

How can I learn to prevent these exploits?

Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.

Learn to Prevent High-Impact Smart Contract Hacks

$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial → View Full Course