Web3 Hacks & DeFi Exploit Intelligence

  • $104B+Lost
  • 3836Incidents
  • 124Chains
  • 16Classes
# Project Date Amount Lost Chain Technique Links
31 Ploutos Money Oracle Manipulation & Price Manipulation $390K ethereum Rugpull / Oracle Misconfiguration Exploit / Misconfigured Oracle Exploit / Oracle Misconfiguration
32 Blend Protocol Oracle Manipulation & Price Manipulation $10.9M Oracle Issue
33 Blend Pools V2 Oracle Manipulation & Price Manipulation $11.0M stellar Price Oracle Manipulation / Spot Price Manipulation
34 Velar Perps Oracle Manipulation & Price Manipulation $401K mezo Predictable Oracle Update
35 Moonwell Lending Oracle Manipulation & Price Manipulation $1.8M base cbETH Collateral Exploit / Oracle Issue / Oracle Misconfiguration
36 Makina Flash Loan Attacks $5.0M ethereum Flashloan Price Oracle Attack / Flash Loan Attack / Spot Price Manipulation
37 Valinity Oracle Manipulation & Price Manipulation $63K Oracle Issue
38 DRLVaultV3 Oracle Manipulation & Price Manipulation $100K ethereum Spot Price Manipulation
39 Moonwell Lending Oracle Manipulation & Price Manipulation $1.0M base, optimism Oracle Price Feed Manipulation / Spot Price Manipulation
40 Moonwell Oracle Manipulation & Price Manipulation $3.7M Oracle Issue
41 Sharwa.Finance Oracle Manipulation & Price Manipulation $147K arbitrum Price Manipulation Attack / Swap Logic Flaw
42 Typus Perp Oracle Manipulation & Price Manipulation $3.4M sui TLP Contract Exploit / Oracle Misconfiguration
43 Typus Finance Oracle Manipulation & Price Manipulation $3.4M Oracle Issue
44 Astera.fi Flash Loan Attacks $822K linea Oracle Price Feed Manipulation / Flash Loan Attack / Incorrect Share Accounting
45 New Gold Protocol Flash Loan Attacks $2.0M bsc Flash Loan Attack / Spot Price Manipulation
46 Nemo Oracle Manipulation & Price Manipulation $2.4M Oracle Issue
47 Nemo Yield Trading Access Control Attacks $2.6M sui Price Oracle Manipulation / Improper Access Control
48 Odin.Fun Oracle Manipulation & Price Manipulation $7.0M icp Liquidity Manipulation Exploit / Oracle Issue / Spot Price Manipulation
49 Peapods Finance Oracle Manipulation & Price Manipulation $207K ethereum Oracle manipulation in user-created Pods / Oracle Misconfiguration
50 Resupply Oracle Manipulation & Price Manipulation $9.6M ethereum Price Oracle Manipulation / Donation Attack
51 FixedTokenBSwap Oracle Manipulation & Price Manipulation $2K ethereum Spot Price Manipulation
52 Dexodus Finance Oracle Manipulation & Price Manipulation $300K base Price Manipulation Attack / Stale Oracle Price
53 Dexodus Oracle Manipulation & Price Manipulation $300K Oracle Issue
54 Nitron Demex Oracle Manipulation & Price Manipulation $950K Oracle Issue
55 Demex Oracle Manipulation & Price Manipulation $951K arbitrum Spot Price Manipulation
56 Term Finance Oracle Manipulation & Price Manipulation $1.6M ethereum Oracle Misconfiguration
57 Loopscale Oracle Manipulation & Price Manipulation $5.8M solana Price Oracle Manipulation / Spot Price Manipulation
58 ACB Oracle Manipulation & Price Manipulation $23K bsc Spot Price Manipulation
59 Numa Oracle Manipulation & Price Manipulation $506K arbitrum Spot Price Manipulation
60 KiloEx Access Control Attacks $7.5M base, bsc… Price Oracle Manipulation / Access Control / Spot Price Manipulation

Data sourced from DefiLlama & SunWeb3Sec/DeFiHackLabs . Thank you for keeping Web3 security data open.

Understanding Smart Contract Vulnerabilities

Smart contract vulnerabilities remain the leading cause of DeFi protocol losses, with over $10 billion stolen since 2016. Understanding attack vectors like reentrancy, flash loans, and oracle manipulation is essential for every blockchain developer and security researcher.

Each incident in our database is categorized by attack class and linked to our in-depth vulnerability guides, making this the most educational Web3 hacks tracker available. Want a quick ranking? See the most expensive crypto hacks leaderboard.

Learn how these hacks actually worked

Study the exploit patterns behind the incidents in this database, then practice finding them before attackers do.