Web3 Security Trends
Updated 15 Sep 2026About these numbers
01 Sep 2025–31 Aug 2026compared with 01 Sep 2024–31 Aug 2025
Attacks and losses over time
Scroll to see every period
View chart as a table
| Period | Reported loss | Attacks | Known amounts |
|---|---|---|---|
| Sep 2025 | $176.5M | 22 | 22 of 22 |
| Oct 2025 | $51.6M | 15 | 15 of 15 |
| Nov 2025 | $288.4M | 18 | 18 of 18 |
| Dec 2025 | $79.5M | 20 | 20 of 20 |
| Jan 2026 | $405.4M | 30 | 30 of 30 |
| Feb 2026 | $36.8M | 14 | 14 of 14 |
| Mar 2026 | $77.8M | 30 | 28 of 30 |
| Apr 2026 | $951.7M | 39 | 38 of 39 |
| May 2026 | $112.5M | 50 | 50 of 50 |
| Jun 2026 | $93.9M | 41 | 41 of 41 |
| Jul 2026 | $299.4M | 42 | 42 of 42 |
| Aug 2026 | $145.2M | 33 | 29 of 33 |
What changed
Compared with the previous period, reported loss fell by $6.50B while incident count rose by 125.
See incidentsDrift Trade drove 11% of known reported loss in this period.
Open incidentSourceIncorrect Share Accounting was the most frequently recorded attack method, appearing in 14 incidents.
Open incidentSource
Attack methods
-
Incorrect Share Accounting14
-
Access Control13
-
Spot Price Manipulation13
-
Improper Access Control11
-
Phishing7
-
Forged Proof6
-
Oracle Issue6
-
Private Key Compromised6
-
Phishing$372.9M
-
Access Control$352.0M
-
Compromised Admin + Fake Token Price Manipulation / Proxy Upgrade Hijack$295.0M
-
Access Control / Cross-Chain Message Spoofing$293.0M
-
Other / Weak Key Generation$130.0M
-
Composable Stable Pools Exploit / Access Control / Rounding Error$128.0M
-
Oracle Issue / Donation Attack$75.0M
-
Delegatecall Exploit / Access Control / Delegatecall Hijack$48.0M
Affected sectors
200 uncategorized incidents excluded
-
DeFi applications115
-
Other21
-
Bridges12
-
Centralized services4
-
Wallets2
-
DeFi applications$788.7M
-
Other$167.5M
-
Bridges$60.1M
-
Centralized services$43.5M
-
Wallets$8.6M
Affected chains
68 unnamed-chain incidents excluded. Multi-chain counts and losses overlap.
-
Ethereum102
-
BNB Chain61
-
Base35
-
Arbitrum33
-
Solana20
-
Polygon14
-
Bitcoin7
-
Sui6
-
Avalanche6
-
Optimism4
-
Ethereum$849.4M
-
Arbitrum$555.7M
-
Solana$474.1M
-
Base$204.8M
-
Bitcoin$176.5M
-
Polygon$134.2M
-
Optimism$130.2M
-
Sonic$128.1M
-
BNB Chain$96.4M
-
Cronos$75.0M
Incidents behind this view
22 matching records · 2025-09 selected · Clear selection
| Date | Incident and attack method | Chain | Reported loss | Evidence |
|---|---|---|---|---|
| 28 Sep 2025 | dTRINITYImproper Access Control | Sonic | $56K | |
| 27 Sep 2025 | Hyperdrive HLRouter Exploit / Other / Arbitrary External Call | hyperliquid l1 | $782K | Source |
| 26 Sep 2025 | HyperVaultDrain Vaults / Rugpull / Admin Drain | hyperliquid l1 | $3.6M | Source |
| 24 Sep 2025 | GriffinAIFalse Peer Exploit / Access Control / Cross-Chain Message Spoofing | BNB Chain | $3.0M | Source |
| 24 Sep 2025 | SBI CryptoAccess Control / Hot Wallet Key Compromised | Bitcoin, bitcoincash, doge, Ethereum, Litecoin | $24.0M | Source |
| 23 Sep 2025 | SeedifyInfinite Mint and Dump / Access Control / Private Key Compromised | Avalanche, BNB Chain | $1.2M | Source |
| 23 Sep 2025 | CorepoundDrained Contracts / Admin Drain | core | $430K | Source |
| 22 Sep 2025 | UXLINKDelegatecall Exploit / Access Control / Delegatecall Hijack | Arbitrum, Ethereum | $48.0M | Source |
| 18 Sep 2025 | New Gold ProtocolFlash Loan Attack / Spot Price Manipulation | BNB Chain | $2.0M | Source |
| 15 Sep 2025 | ShibariumAccess Control | Not recorded | $2.4M | Source |
| 14 Sep 2025 | YalaDeployer Key Compromised | Ethereum, Solana | $7.6M | |
| 13 Sep 2025 | ShibariumValidator Stake Manipulation by Flashloan / Validator Key Compromised | shibarium | $4.1M | Source |
| 12 Sep 2025 | Kame Aggregatorswap() Function Flaw / Swap Logic Flaw | sei | $1.3M | Source |
| 11 Sep 2025 | EOA Token TheftOther | Not recorded | $3.0M | Source |
| 10 Sep 2025 | Evoq FinanceAdvanced Persistent Threat (APT) attack / Access Control / Private Key Compromised | BNB Chain | $420K | Source |
| 09 Sep 2025 | AquaRugpull | Not recorded | $4.7M | Source |
| 09 Sep 2025 | SwissBorgThird-party API compromise / Other / API Key Compromised | Solana | $41.5M | Source |
| 08 Sep 2025 | NemoOracle Issue | Not recorded | $2.4M | Source |
| 07 Sep 2025 | Nemo Yield TradingPrice Oracle Manipulation / Improper Access Control | Sui | $2.6M | Source |
| 02 Sep 2025 | VenusPhishing | Not recorded | $13.0M | Source |
| 02 Sep 2025 | Bunni V2Withdrawal Rounding Error | Ethereum, Unichain | $8.4M | Source |
| 01 Sep 2025 | OlaXBTMultisig wallet Social Engineering Exploit / Access Control / Signer Phishing | BNB Chain | $2.0M | Source |
About these numbers
Incident selection
This dashboard covers reported incidents, not every attack or the relative safety of a chain. Each verified canonical incident is counted once. Unverified, rejected, merged duplicate, pending-review, and future-dated records are excluded. Late reports and corrections can change recent periods.
Loss and outliers
Reported loss sums known positive USD amounts. Missing amounts stay unknown, not zero. Median incident loss uses only incidents with a known amount. “Exclude the largest incident” removes the largest known-loss event from both the selected and comparison periods.
Missing classifications
Sector and chain labels come from the incident record. Uncategorized incidents are excluded from sector charts; incidents without a named chain are excluded from chain charts. A multi-chain incident appears under each named chain, so those counts overlap.
Limitations
Reliable malicious-actor attribution is not consistently available, so this page does not rank actor groups. Timing alone cannot show that AI caused an attack, so there is no AI-involvement metric. Confirmed returned funds are too sparsely documented for a recovery trend: 2 of 354 incidents in this view have comparable reviewed accounting, totaling $1.9M.