Most Expensive Crypto Hacks Leaderboard

The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.

  • $104B+

    Total Value Lost

  • 3836

    Incidents Tracked

  • 124

    Chains Affected

  • 88

    $100M+ Incidents

Top 10 Biggest Hacks

Jump to full leaderboard
  2. 🥈

    Mantra

    $5.50B

  4. #4

    LuBian

    $3.50B

    bitcoin

  8. #8

    Thodex

    $2.00B

  10. #10

    Finiko

    $1.50B

Where the Largest Losses Concentrate

Top Chains by Losses

  • ethereum $9,731M
  • bitcoin $5,447M
  • bsc $2,997M
  • solana $1,694M
  • polygon $1,539M

Top Techniques by Losses

  • Other $61,131M
  • Rugpull $15,643M
  • Private Key Compromised (Brute Force) / Weak Key Generation $3,500M
  • Access Control $3,077M
  • Safe Multisig wallet Phishing Exploit / Access Control / Signer Phishing $1,635M

Full Leaderboard

Showing 101-150 of 3836 ranked incidents

Largest Web3 incidents by USD amount lost
Rank Project Amount Lost Date Chain Technique Attack Guide Source
101 Orbit Bridge $81.7M ethereum Signature Exploit / Signature Verification Flaw — View →
102 Orbit Chain $81.6M - Access Control Access Control Attacks View →
103 Rari Capital $80.0M arbitrum, ethereum Flashloan Reentrancy Attack / Reentrancy Flash Loan Attacks View →
104 Qubit $80.0M bsc Transfer Logic Exploit / Missing Input Validation — View →
105 Qubit Finance $80.0M - Other — View →
106 Rari Fuse $79.7M - Reentrancy Reentrancy View →
107 AscenDEX $77.7M bsc, ethereum, polygon Private Key Compromised / Access Control / Hot Wallet Key Compromised Access Control Attacks View →
108 Venus $77.0M - Oracle Issue Oracle Manipulation & Price Manipulation View →
109 Fireblocks $75.0M - Access Control Access Control Attacks View →
110 StakeHound / Fireblocks $72.0M ethereum Key Brute Forced — —
111 Bitfinex $72.0M bitcoin Access Control / Hot Wallet Key Compromised Access Control Attacks View →
112 Compound Labs $71.1M - Other — View →
113 UPCX $70.0M ethereum Upgraded ProxyAdmin + withdrawByAdmin Hack / Access Control / Proxy Upgrade Hijack Access Control Attacks View →
114 EvoDeFi Bridge $66.0M - Other — View →
115 NiceHash $64.0M bitcoin Other / Key Leaked via Infrastructure — View →
116 Munchables $62.5M blast Storage Slot Exploit / Access Control / Proxy Upgrade Hijack Access Control Attacks View →
117 Mining Capital Coin $62.0M - Rugpull — View →
118 Curve DEX $61.7M ethereum Vyper Compiler Bug Reentrancy View →
119 AlphaPo $60.0M ethereum, tron Private Key Compromised (Unknown Method) / Hot Wallet Key Compromised Access Control Attacks View →
120 Freeway $60.0M - Rugpull — View →
121 AnubisDAO $60.0M ethereum Drained Contracts / Rugpull / Admin Drain — View →
122 Zaif $60.0M bitcoin Access Control / Hot Wallet Key Compromised Access Control Attacks View →
123 The DAO $60.0M ethereum Reentrancy / Other Reentrancy View →
124 EasyFi $59.0M ethereum, polygon Private Key Compromised (Unknown Method) / Access Control / Malware Access Control Attacks View →
125 Radiant Capital $58.0M - Access Control Access Control Attacks View →
126 Uranium Finance $57.2M binance, bsc Math Mistake Exploit / Other / Arithmetic Error Arithmetic Overflow & Underflow Attacks View →
127 BitForex $56.0M - Rugpull — View →
128 AAX $56.0M - Other — View →
129 Phishing $55.0M - Phishing Phishing Attacks View →
130 CoinEx $55.0M arbitrum, bitcoin, bitcoincash, bsc, dagger, ethereum, kadena, polygon, solana, stellar, tron, xrp Private Key Compromised (Unknown Method) / Access Control / Hot Wallet Key Compromised Access Control Attacks View →
131 Ooki $55.0M bsc, polygon Private Key Compromised (Phishing) / Phishing Phishing Attacks View →
132 BtcTurk $54.0M - Private Key Compromised (Unknown Method) / Access Control / Hot Wallet Key Compromised Access Control Attacks View →
133 Radiant V2 $53.0M arbitrum, bsc Access Control Exploit / Blind Signing Access Control Attacks View →
134 Cashio $52.8M solana Collateral Validation Exploit / Other / Missing Input Validation — View →
135 BingX $52.0M ethereum Hot wallet hack / Other / Hot Wallet Key Compromised Access Control Attacks View →
136 Upbit $51.2M ethereum Access Control / Hot Wallet Key Compromised Access Control Attacks View →
137 Vyper $50.5M - Reentrancy Reentrancy View →
138 Price Impact Kills $50.0M - - — View →
139 Address Poisoning Attack $50.0M - Phishing Phishing Attacks View →
140 Infini $50.0M ethereum Dev Privilege Oversight Exploit / Access Control / Private Key Compromised Access Control Attacks View →
141 Blockchain.com $50.0M - Access Control Access Control Attacks View →
142 UXLINK $48.0M arbitrum, ethereum Delegatecall Exploit / Access Control / Delegatecall Hijack Access Control Attacks View →
143 BtcTurk $48.0M arbitrum, avalanche, base, ethereum, mantle, optimism, polygon Private Key Compromised / Access Control / Hot Wallet Key Compromised Access Control Attacks View →
144 KyberSwap Elastic $48.0M arbitrum, base, ethereum, optimism, polygon Flashloan Swap Logic Exploit / Flash Loan Attack / Rounding Error Flash Loan Attacks View →
145 bZx $47.6M - Access Control Access Control Attacks View →
146 CoinDeal $45.0M - Other — View →
147 PancakeBunny $45.0M binance Flash Loan Attack Flash Loan Attacks View →
148 Bunny $45.0M bsc Flashloan Price Oracle Attack / Spot Price Manipulation Flash Loan Attacks View →
149 CoinBene $45.0M ethereum Access Control / Improper Access Control Access Control Attacks View →
150 Hedgey $44.7M arbitrum, ethereum Claim Contract Flashloan Exploit / Flash Loan Attack / Missing Input Validation Flash Loan Attacks View →

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding the Pattern Behind Billion-Dollar Losses

The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.

For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.

Frequently Asked Questions

How is this leaderboard ranked?

Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.

Does this include every attack type?

It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.

How can I learn to prevent these exploits?

Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.

Learn to Prevent High-Impact Smart Contract Hacks

$104B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial → View Full Course