Most Expensive Crypto Hacks Leaderboard

The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.

  • $91B+

    Total Value Lost

  • 3595

    Incidents Tracked

  • 141

    Chains Affected

  • 65

    $100M+ Incidents

Top 10 Biggest Hacks

Jump to full leaderboard
  2. 🥈

    Mantra

    $5.50B

  4. #4

    LuBian

    $3.50B

    bitcoin

  7. #7

    Thodex

    $2.00B

  9. #9

    Finiko

    $1.50B

  10. #10

    Bybit

    $1.40B

    ethereum

Where the Largest Losses Concentrate

Top Chains by Losses

  • ethereum $9,830M
  • bitcoin $5,404M
  • bsc $3,037M
  • solana $1,697M
  • polygon $1,539M

Top Techniques by Losses

  • Other $52,517M
  • Rugpull $15,631M
  • Private Key Compromised (Brute Force) / Weak Key Generation $3,500M
  • Safe Multisig wallet Phishing Exploit / Access Control / Signer Phishing $1,635M
  • Access Control / Hot Wallet Key Compromised $1,027M

Full Leaderboard

Showing 1301-1350 of 3595 ranked incidents

Largest Web3 incidents by USD amount lost
Rank Project Amount Lost Date Chain Technique Attack Guide Source
1301 dYdX $211K - Other — View →
1302 Santa Coin $211K - Rugpull — View →
1303 Convergence $210K ethereum Missing Input Validation / Other — View →
1304 Swello Finance $210K - Rugpull — View →
1305 CrowdRingCircle $209K bsc Incorrect Share Accounting — View →
1306 Renegade $209K arbitrum Access Control / Uninitialized Proxy Access Control Attacks View →
1307 Celestia $209K - Rugpull — View →
1308 Elastic Staking $209K ethereum Rugpull — View →
1309 Sifchain Finance $208K ethereum Honeypot — —
1310 DeFi WZ Token $208K - Rugpull — View →
1311 ArchWay Fake $207K - Rugpull — View →
1312 WUSD.fi $207K ethereum Flash Loan Attack / Reward Logic Flaw Flash Loan Attacks View →
1313 Peapods Finance $207K ethereum Oracle manipulation in user-created Pods / Other / Oracle Misconfiguration Oracle Manipulation & Price Manipulation View →
1314 Elon Pepe $206K - Honeypot — View →
1315 Rare Bears $206K - Access Control Access Control Attacks View →
1316 stoicDAO $205K - Rugpull — View →
1317 ArenaPlayAPC $204K - Rugpull — View →
1318 RANT $204K bsc Incorrect Fee Accounting — —
1319 MaximusDAO $204K - Phishing Phishing Attacks View →
1320 Santa DAO $204K ethereum Rugpull — View →
1321 Bare Bear $202K - Rugpull — View →
1322 Automated Assassins $202K - Rugpull — View →
1323 Bitmit $202K - Access Control Access Control Attacks View →
1324 zkSync Copycat $202K - Rugpull — View →
1325 Coreum $200K coreum, xrpl Deposit Verification Flaw — View →
1326 Unilend V2 $200K ethereum Redeem Process Exploit / Other / Redeem Logic Flaw — View →
1327 zkFinance $200K zksync era Oracle Misconfiguration Exploit / Unknown Oracle Manipulation & Price Manipulation View →
1328 DefiPlaza $200K ethereum Swap Logic Flaw — —
1329 Time $200K ethereum Other / Missing Input Validation — View →
1330 Keep3r Network $200K ethereum Private Key Compromised (Vanity Address) / Weak Key Generation Access Control Attacks View →
1331 Hex Trust Token $200K - Rugpull — View →
1332 Doglands $200K - Rugpull — View →
1333 Quixotic $200K optimism Other / Signature Verification Flaw — View →
1334 X2Y2 $200K ethereum Phishing Phishing Attacks View →
1335 Pinecone Finance $200K bsc Other / Incorrect Share Accounting — View →
1336 DAFI Protocol $200K - Other — View →
1337 EOSBet $200K eos Infinite Mint — —
1338 Not Found $200K - Rugpull — View →
1339 DistX $198K ethereum Rugpull — View →
1340 BFB $198K bsc Incorrect Share Accounting — View →
1341 SNOOKER $198K bsc Other / Improper Access Control Access Control Attacks View →
1342 Sui Network $197K - Rugpull — View →
1343 User $196K - Phishing Phishing Attacks View →
1344 Rabby Wallet $194K - Other Access Control Attacks View →
1345 DollarDoge $194K - Rugpull — View →
1346 Holdstation $192K - Access Control Access Control Attacks View →
1347 MOL $192K - Rugpull — View →
1348 Demex Perp $192K bsc, demex, ethereum Cross-Chain Message Spoofing — —
1349 NWT Token $191K - Rugpull — View →
1350 Allbridge $191K base Cross-Chain Message Validation Flaw — View →

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding the Pattern Behind Billion-Dollar Losses

The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.

For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.

Frequently Asked Questions

How is this leaderboard ranked?

Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.

Does this include every attack type?

It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.

How can I learn to prevent these exploits?

Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.

Learn to Prevent High-Impact Smart Contract Hacks

$91B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial → View Full Course