Most Expensive Crypto Hacks Leaderboard

The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.

  • $91B+

    Total Value Lost

  • 3595

    Incidents Tracked

  • 141

    Chains Affected

  • 65

    $100M+ Incidents

Top 10 Biggest Hacks

Jump to full leaderboard
  2. 🥈

    Mantra

    $5.50B

  4. #4

    LuBian

    $3.50B

    bitcoin

  7. #7

    Thodex

    $2.00B

  9. #9

    Finiko

    $1.50B

  10. #10

    Bybit

    $1.40B

    ethereum

Where the Largest Losses Concentrate

Top Chains by Losses

  • ethereum $9,830M
  • bitcoin $5,404M
  • bsc $3,037M
  • solana $1,697M
  • polygon $1,539M

Top Techniques by Losses

  • Other $52,517M
  • Rugpull $15,631M
  • Private Key Compromised (Brute Force) / Weak Key Generation $3,500M
  • Safe Multisig wallet Phishing Exploit / Access Control / Signer Phishing $1,635M
  • Access Control / Hot Wallet Key Compromised $1,027M

Full Leaderboard

Showing 851-900 of 3595 ranked incidents

Largest Web3 incidents by USD amount lost
Rank Project Amount Lost Date Chain Technique Attack Guide Source
851 Sturdy V1 $775K ethereum Flashloan Reentrancy Attack / Read-Only Reentrancy / Oracle Issue Flash Loan Attacks View →
852 Cryptoburgers $770K bsc Other / Flash Loan Attack / Improper Access Control Access Control Attacks View →
853 BearnDAO $768K - Other — View →
854 Ledger Live Web3 $768K - Phishing Phishing Attacks View →
855 Polyhedra Network $760K bsc Private Key Compromised Access Control Attacks —
856 Mercenary $760K - Rugpull — View →
857 SAI Pro $752K - Rugpull — View →
858 Phishing $750K - Phishing Phishing Attacks View →
859 MOBOX $750K optimism Borrow Logic Flaw — —
860 RESDAO $750K - Rugpull — View →
861 Azuki $750K - Phishing Phishing Attacks View →
862 Altilly $750K multiple Rugpull / API Key Compromised — View →
863 Yam DAO $750K - Other — View →
864 LINEA $741K - Rugpull — View →
865 WEMIX $737K wemix3 0 Contract Authority Compromise Access Control Attacks View →
866 WebKeyDao $737K bsc Other / Improper Access Control Access Control Attacks View →
867 Chainflip $736K tron Other / Bridge Logic Flaw — View →
868 TeleSwap $735K bitcoin Hot Wallet Key Compromised — View →
869 Mother $734K - Rugpull — View →
870 Forest Tiger Pro $733K - Rugpull — View →
871 SuperRare $730K ethereum updateMerkleRoot Access Control Exploit / Access Control / Merkle Proof Forgery Access Control Attacks View →
872 ElectronDAO $729K - Rugpull — View →
873 DungeonSwap $728K bsc Improper Access Control Access Control Attacks —
874 Kipcoin $728K bitcoin Access Control / Private Key Compromised Access Control Attacks View →
875 Auctus $726K ethereum Arbitrary External Call Access Control Attacks —
876 1inch $723K avalanche Private Key Compromised (Supply Chain Attack) / Supply Chain Attack Access Control Attacks View →
877 CometDEX $718K stellar Incorrect Share Accounting — View →
878 XPlayer $717K - Flash Loan Attack Flash Loan Attacks View →
879 Chainge Finance $716K bsc Other / Arbitrary External Call Access Control Attacks View →
880 CS $714K - Stale accounting and liquidity-pair burn manipulation using flash-loan funding Flash Loan Attacks View →
881 UniCat.farm $713K ethereum Rugpull — View →
882 Meta Pets $709K - Rugpull — —
883 QANX Bridge $707K ethereum Private Key Compromised / Other Access Control Attacks View →
884 Polymarket $700K polygon Private Key Compromised Access Control Attacks —
885 Aerodrome V1 $700K ethereum, optimism DNS Hijack — —
886 Vicuna $700K sonic Oracle Issue / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
887 ReHold $700K ethereum Admin Drain — —
888 FilDA $700K elastos, rei network Bridge Logic Flaw — —
889 LaunchZone $700K bsc Access Control Exploit / Other / Improper Access Control Access Control Attacks View →
890 Umbrella Network $700K bsc, ethereum Other / Improper Access Control Access Control Attacks View →
891 Meebits $700K - Other — View →
892 ProTradeX $698K - Rugpull — View →
893 LOOPSDAO $694K bsc Oracle Issue / Spot Price Manipulation Oracle Manipulation & Price Manipulation View →
894 BitDao $686K ethereum Honeypot — View →
895 BCE Token $679K bsc Other / Incorrect Share Accounting — View →
896 The Sandbox $675K base, bsc, ethereum Access Control / Improper Access Control Access Control Attacks View →
897 fcdep $675K - Rugpull — View →
898 Unibot $673K ethereum Token approval exploit / Other / Token Approval Abuse Access Control Attacks View →
899 RiseX $673K rise Other / Improper Access Control Access Control Attacks View →
900 Zerogoki $670K ethereum Other / Oracle Misconfiguration Oracle Manipulation & Price Manipulation View →

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding the Pattern Behind Billion-Dollar Losses

The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.

For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.

Frequently Asked Questions

How is this leaderboard ranked?

Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.

Does this include every attack type?

It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.

How can I learn to prevent these exploits?

Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.

Learn to Prevent High-Impact Smart Contract Hacks

$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial → View Full Course