Web3 Security Trends

Updated 31 Oct 2026About these numbers
More filters
Reset
01 Oct 2025–30 Sep 2026compared with 01 Oct 2024–30 Sep 2025
Reported loss$2.92B ↓ 68% vs prior period 338/356 loss amounts reported
Reported attacks356 ↑ 73% vs prior period
Median incident loss$459K ↓ 30% vs prior period
Largest incident$387.0M13% of known lossBitget

Attacks and losses over time

Scroll to see every period

Reported loss and attack counts from 2025-10-01 to 2026-09-30.Reported loss (USD)Attack count $0 $500M $1B 0 25 50 Oct 2025: $47.9M reported loss; 14 attacksOct 2025Nov 2025: $275.7M reported loss; 16 attacksNov 2025Dec 2025: $75.6M reported loss; 19 attacksDec 2025Jan 2026: $390.2M reported loss; 24 attacksJan 2026Feb 2026: $24.0M reported loss; 12 attacksFeb 2026Mar 2026: $42.3M reported loss; 26 attacksMar 2026Apr 2026: $649.6M reported loss; 35 attacksApr 2026May 2026: $79.7M reported loss; 44 attacksMay 2026Jun 2026: $80.4M reported loss; 36 attacksJun 2026Jul 2026: $250.3M reported loss; 41 attacksJul 2026Aug 2026: $260.9M reported loss; 47 attacksAug 2026Sep 2026: $742.6M reported loss; 42 attacksSep 2026

Top 5 incidents: 54% of loss

View chart as a table
PeriodReported lossAttacksKnown amounts
Oct 2025$47.9M1414 of 14
Nov 2025$275.7M1616 of 16
Dec 2025$75.6M1919 of 19
Jan 2026$390.2M2424 of 24
Feb 2026$24.0M1212 of 12
Mar 2026$42.3M2623 of 26
Apr 2026$649.6M3534 of 35
May 2026$79.7M4442 of 44
Jun 2026$80.4M3636 of 36
Jul 2026$250.3M4140 of 41
Aug 2026$260.9M4740 of 47
Sep 2026$742.6M4238 of 42

What changed

  1. Compared with the previous period, reported loss fell by $6.09B while incident count rose by 150.

    See incidents

  2. Bitget drove 13% of known reported loss in this period.

    Open incidentSource

  3. Spot Price Manipulation was the most frequently recorded attack method, appearing in 16 incidents.

    Open incident

Attack methods

  1. Spot Price Manipulation16
  2. Incorrect Share Accounting12
  3. Improper Access Control11
  4. Phishing8
  5. Private Key Compromised8
  6. Access Control7
  7. Arithmetic Error6
  8. Swap Logic Flaw6
  1. Access Control / Hot Wallet Key Compromised$403.7M
  2. Phishing$360.5M
  3. Other / Unbacked Cross-Chain Mint$323.1M
  4. Access Control / Compromised Admin + Fake Token Price Manipulation / Proxy Upgrade Hijack$295.0M
  5. Access Control / Cross-Chain Message Spoofing$293.0M
  6. Composable Stable Pools Exploit / Access Control / Rounding Error$128.0M
  7. Oracle Issue / Donation Attack$124.5M
  8. Other / Weak Key Generation$116.0M

Affected sectors

207 uncategorized incidents excluded

  1. DeFi applications112
  2. Other17
  3. Bridges14
  4. Centralized services4
  5. Wallets2
  1. DeFi applications$714.0M
  2. Centralized services$389.0M
  3. Other$108.1M
  4. Bridges$59.5M
  5. Wallets$8.6M

Affected chains

38 unnamed-chain incidents excluded. Multi-chain counts and losses overlap.

  1. Ethereum119
  2. BNB Chain64
  3. Base37
  4. Arbitrum29
  5. Solana19
  6. Polygon17
  7. Tron7
  8. Bitcoin7
  9. Sui6
  10. Optimism5
  1. Ethereum$1.13B
  2. Arbitrum$503.4M
  3. Tron$428.0M
  4. Solana$424.0M
  5. zcash$387.0M
  6. XRP$387.0M
  7. liquid$320.0M
  8. Base$203.0M
  9. Bitcoin$144.9M
  10. Polygon$136.0M

Incidents behind this view

356 matching records

Full incident database
DateIncident and attack methodChainReported lossEvidence
20 Apr 2026Juicebox V3Missing Input ValidationEthereum$52K
20 Apr 2026Transit FinanceUnknownEthereum$258K
20 Apr 2026Thetanuts FinanceFirst Depositor AttackEthereum$50K
19 Apr 2026Custom sAVAX RebalancerArbitrary External CallAvalanche$64K
18 Apr 2026Kelp DAOAccess Control / Cross-Chain Message SpoofingArbitrum, Ethereum$293.0MSource
16 Apr 2026GrinexHot Wallet Key CompromisedEthereum, Tron$13.7M
16 Apr 2026Rhea FinanceOther / Spot Price ManipulationNEAR$18.4MSource
14 Apr 2026CoW SwapDNS HijackEthereum$1.2M
14 Apr 2026Zerion WalletHot Wallet Compromise via Social Engineering / PhishingNot recorded$100KSource
13 Apr 2026HyperbridgeFake State Proof / Other / Forged ProofArbitrum, Base, BNB Chain, Ethereum$2.5MSource
13 Apr 2026DangoDonate Negative Amounts Hack / Missing Input Validationdango$1.9MSource
13 Apr 2026MONABurnAddress Accounting Exploit / Incorrect Share AccountingBNB Chain$61KSource
12 Apr 2026SubQuery NetworkAcces Control Exploit / Improper Access ControlBase$134KSource
09 Apr 2026AethirAcces Control Exploit / Other / Improper Access ControlBNB Chain$400KSource
09 Apr 2026HyperliquidOtherNot recorded$1.5MSource
07 Apr 2026SquidMulticall Approval ExploitationAccess Control / Improper Access ControlArbitrum, Avalanche, Base, BNB Chain, Optimism$517KSource
05 Apr 2026DenariaLP accounting rounding asymmetry and unsafe signed-to-unsigned conversionLinea$166KSource
04 Apr 2026BSC TMM/USDTReserve Manipulation Attack / Improper Access ControlBNB Chain$1.7MSource
03 Apr 2026Silo V2Misconfigured Oracle Exploit / Oracle MisconfigurationArbitrum$359KSource
01 Apr 2026Drift ProtocolAccess Control / Compromised Admin + Fake Token Price Manipulation / Proxy Upgrade HijackSolana$295.0MSource
31 Mar 2026WhaleBitSpot Price ManipulationPolygon$10K
31 Mar 2026LML/USDT staking protocolPrice Manipulation Attack / Spot Price ManipulationBNB Chain$950KSource
28 Mar 2026VTSwapHookSwap Logic FlawArbitrumUnknown
28 Mar 2026GoonFiMispricing arbitrage / Swap Logic FlawSolana$254KSource
26 Mar 2026TUR StakingSpot Price ManipulationBNB Chain$133K

About these numbers

Updated 31 Oct 2026, 10:13 UTC

Incident selection

This dashboard covers reported incidents, not every attack or the relative safety of a chain. Each verified canonical incident is counted once. Unverified, rejected, merged duplicate, pending-review, and future-dated records are excluded. Late reports and corrections can change recent periods.

Loss and outliers

Reported loss sums known positive USD amounts. Missing amounts stay unknown, not zero. Median incident loss uses only incidents with a known amount. “Exclude the largest incident” removes the largest known-loss event from both the selected and comparison periods.

Missing classifications

Sector and chain labels come from the incident record. Uncategorized incidents are excluded from sector charts; incidents without a named chain are excluded from chain charts. A multi-chain incident appears under each named chain, so those counts overlap.

Limitations

Reliable malicious-actor attribution is not consistently available, so this page does not rank actor groups. Timing alone cannot show that AI caused an attack, so there is no AI-involvement metric. Confirmed returned funds are too sparsely documented for a recovery trend: 2 of 356 incidents in this view have comparable reviewed accounting, totaling $1.9M.

Cite this view

Smart Contract Hacking (SCH), “Web3 Security Trends: 2025-10-01 to 2026-09-30,” method 2026-09-15.1, view d3093a3f2713, accessed 31 October 2026. https://smartcontractshacking.com/tools/web3-security-trends?page=10

Live view. Figures may change as incident records are updated.