🥇
Terra Classic
$40.00B
Most Expensive Crypto Hacks Leaderboard
The biggest Web3 and DeFi exploits ranked by amount lost. Track high-impact incidents, study attack patterns, and learn how security failures scale into multi-million dollar losses.
-
$104B+
Total Value Lost
-
3836
Incidents Tracked
-
124
Chains Affected
-
88
$100M+ Incidents
Top 10 Biggest Hacks
Where the Largest Losses Concentrate
Top Chains by Losses
Top Techniques by Losses
Full Leaderboard
Showing 251-300 of 3836 ranked incidents
| Rank | Project | Amount Lost | Date | Chain | Technique | Attack Guide | Source |
|---|---|---|---|---|---|---|---|
| 251 | Auros | $20.0M | - | Other | — | View → | |
| 252 | 3Commas | $20.0M | multi chain | Other / Database Breach | — | View → | |
| 253 | Superfluid | $20.0M | polygon | CTX Exploit / Other / Missing Input Validation | — | View → | |
| 254 | Pickle | $19.7M | ethereum | Vault Swap Exploit / Missing Input Validation | — | View → | |
| 255 | Pickle Finance | $19.7M | ethereum | Other | — | View → | |
| 256 | BonkDAO | $19.3M | - | - | — | View → | |
| 257 | Bithumb | $19.2M | ethereum, ripple | Access Control / Hot Wallet Key Compromised | Access Control Attacks | View → | |
| 258 | CREAM Lending | $18.8M | ethereum | Flashloan Reentrancy Attack / Reentrancy | Flash Loan Attacks | View → | |
| 259 | Lympo | $18.7M | ethereum | Access Control / Hot Wallet Key Compromised | Access Control Attacks | View → | |
| 260 | Pando | $18.6M | - | Access Control | Access Control Attacks | View → | |
| 261 | Rhea Finance | $18.4M | - | - | — | View → | |
| 262 | Rhea Lend | $18.4M | near | Spot Price Manipulation | Oracle Manipulation & Price Manipulation | — | |
| 263 | Rhea Finance | $18.4M | - | Other | — | View → | |
| 264 | Snowdog | $18.1M | avalanche | Drained Contracts / Liquidity Rug | — | View → | |
| 265 | BearnFi | $18.0M | bsc | Flashloan Withdraw Logic Exploit / Withdrawal Logic Flaw | Flash Loan Attacks | View → | |
| 266 | Bitcoin Gold | $18.0M | bitcoin gold | Forged Proof | — | — | |
| 267 | DEUS Finance | $17.9M | fantom | Flashloan Price Oracle Attack / Flash Loan Attack / Spot Price Manipulation | Flash Loan Attacks | View → | |
| 268 | Electrum | $17.7M | - | Access Control | Access Control Attacks | View → | |
| 269 | Flare Token | $17.0M | - | Rugpull | — | View → | |
| 270 | SwapNet | $17.0M | base, ethereum | Unlimited Approval Exploit / Other | — | View → | |
| 271 | Matcha | $16.8M | base, ethereum | Unlimited Approval Exploit / Frontend Compromise | — | View → | |
| 272 | Monkey Drainer | $16.5M | - | Phishing | Phishing Attacks | View → | |
| 273 | GAMEE | $16.4M | - | Access Control | Access Control Attacks | View → | |
| 274 | AlexLab | $16.1M | - | Other | — | View → | |
| 275 | Curio | $16.0M | ethereum | Voting Power Inflation / Delegatecall Hijack | Access Control Attacks | View → | |
| 276 | Indexed Finance | $16.0M | ethereum | Flashloan Price Oracle Attack / Other / Spot Price Manipulation | Flash Loan Attacks | View → | |
| 277 | Cryptopia | $16.0M | ethereum | Hot Wallet Key Compromised | — | — | |
| 278 | Team Finance | $15.8M | ethereum | Migrate Function Mistake Exploit / Other / Missing Input Validation | — | View → | |
| 279 | Rari Capital | $15.7M | ethereum | Price Oracle Attack / Flash Loan Attack / Arbitrary External Call | Access Control Attacks | View → | |
| 280 | Inverse Finance Frontier | $15.6M | ethereum | Price Oracle Attack / Oracle Issue / Spot Price Manipulation | Oracle Manipulation & Price Manipulation | View → | |
| 281 | Dego Finance | $15.4M | - | Access Control | Access Control Attacks | View → | |
| 282 | SUPERFORTUNE AI | $15.2M | ethereum | Improper Access Control | Access Control Attacks | — | |
| 283 | Eminence | $15.1M | ethereum | Flashloan Price Oracle Attack / Flash Loan Attack / Spot Price Manipulation | Flash Loan Attacks | View → | |
| 284 | PEPE | $15.1M | ethereum | Admin Drain | — | — | |
| 285 | Floating Point Group | $15.0M | - | Key Leaked via Infrastructure | — | — | |
| 286 | Starstream / Agora | $15.0M | - | Other | — | View → | |
| 287 | Electrum | $15.0M | - | Access Control | Access Control Attacks | View → | |
| 288 | Rain | $14.8M | bitcoin, ethereum, solana, xrp | Other / Private Key Compromised | Access Control Attacks | View → | |
| 289 | Drift Trade | $14.5M | solana | realized PnL withdrawal bug / Risk Parameter Abuse | — | View → | |
| 290 | Holograph | $14.4M | ethereum | Infinite Mint and Dump / Other / Infinite Mint | — | View → | |
| 291 | GDAC | $14.3M | - | Hot wallet hack / Access Control / Hot Wallet Key Compromised | Access Control Attacks | View → | |
| 292 | WOO X | $14.0M | arbitrum, bitcoin, bsc, ethereum | Social Engineering / Phishing | Phishing Attacks | View → | |
| 293 | Furucombo | $14.0M | ethereum | Delegatecall Exploit / Other / Delegatecall Hijack | Access Control Attacks | View → | |
| 294 | Grinex | $13.7M | ethereum, tron | Hot Wallet Key Compromised | — | — | |
| 295 | M2 | $13.7M | - | Access Control | Access Control Attacks | View → | |
| 296 | M2 Exchange | $13.7M | bitcoin, ethereum, solana | Access Control Exploit / Hot Wallet Key Compromised | Access Control Attacks | View → | |
| 297 | Venus | $13.0M | - | Phishing | Phishing Attacks | View → | |
| 298 | Abracadabra Spell | $13.0M | arbitrum | Other / Liquidation Logic Flaw | — | View → | |
| 299 | Bored Ape Yacht Club | $13.0M | - | Other | — | View → | |
| 300 | pNetwork | $13.0M | bitcoin, bsc | Log Spoofing / Spoofed Event Log | — | View → |
Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.
Understanding the Pattern Behind Billion-Dollar Losses
The most expensive crypto hacks are not random. They cluster around repeating vulnerability patterns: access-control failures, flash-loan manipulation, oracle abuse, and unsafe external calls. Studying large-loss incidents helps security researchers prioritize high-impact threat models first.
For deeper context, explore the full Web3 Hacks Dashboard and our Smart Contract Attack Library for hands-on exploit and mitigation breakdowns.
Frequently Asked Questions
How is this leaderboard ranked?
Incidents are ranked by parsed USD amount lost in descending order. Records without parseable loss values are excluded from this ranking.
Does this include every attack type?
It includes all incidents with known loss values in the database. Use the full dashboard for broader filtering and lower-severity incidents.
How can I learn to prevent these exploits?
Study attack-class pages first, then practice in guided exercises inside the Smart Contract Hacking course.
Learn to Prevent High-Impact Smart Contract Hacks
$104B+ lost to preventable vulnerabilities. Master real exploit patterns and defense techniques with hands-on Web3 security training.