All capabilities

Security exploits

A structured incident database of on-chain exploits and hacks, with a written record of what happened on every entry.

190incident records

Every record carries a written incident description (100% coverage). 78% carry an attack type, 14% a loss figure, 2% a chain. The page does not quote a loss total or a chain breakdown — the backfill has not kept pace with the corpus it is backfilling.

What's in a record

Every field the corpus returns for one record. Real shape — walked corpus-wide, not sampled.

  • id
  • hash
  • title
  • url
  • short_description
  • description
  • protocol
  • amount_usd
  • chain
  • attack_type
  • date
  • source
  • tags
{ "id": 119, "hash": "81a2bf2ed34bd2844369da6ba9371e4b", "title": "Wanchain bridge on Cardano exploited for more than $9 million", "url": "https://web3isgoinggreat.com/single/cardano-midnight-bridge-exploit", "short_description": "The Wanchain bridge on Cardano was exploited, resulting in losses exceeding $9 million. This attack highlights vulnerabilities in cross-chain protocols and raises concerns for users relying on such bridges.", "description": "On July 22, 2026, the Wanchain bridge operating on the Cardano blockchain was exploited by attackers. The incident involved a security breach that allowed hackers to drain funds from the bridge. Wanchain is a protocol designed to enable cross-chain asset transfers, and this exploit targeted its Cardano implementation. The exact attack technique has not been disclosed, but the breach led to an estimated loss of over $9 million USD.", "protocol": "Wanchain", "amount_usd": "9.00", "chain": "Cardano", "attack_type": null, "date": "2026-07-22", "source": { "name": "web3isgoinggreat.com", "slug": "web3isgoinggreat-com" }, "tags": [ { "id": 236392, "name": "Bridge", "slug": "bridge" }, { "id": 177, "name": "cardano", "slug": "cardano" }, { "id": 130, "name": "wanchain", "slug": "wanchain" } ] }

Get it

A curl that runs against the live API right now, plus the MCP tool names for the same data.

curl https://api.alphaday.com/security/exploits/?limit=3

MCP tools

get_security_exploitsget_security_exploits_detail

What it's for

Three concrete questions this capability answers that a general crypto API does not.

  • A risk team that wants every recorded exploit on a protocol — feed tags=wormhole into the corpus and pull its incident history, no manual scraper required.
  • A research agent that needs a one-sentence description of what actually happened on each event, not a headline. The description field is the lead with a full sentence per record.
  • Per-protocol timeline reconstruction without re-crawling news: the corpus is sorted newest-first, has a date on every record, and resolves to a stable hash.

Known limits

Required, not optional. Coverage gaps, staleness and parameter traps that were observed by running the curl above against the live server on 2026-09-18.

Coverage on amount_usd, chain and attack_type is partial.

Walked corpus-wide on 18 Sep 2026: description 190/190, attack_type 149/190 (78%), amount_usd 27/190 (14%), chain 4/190 (2%). The page does not roll up a single summed loss, a chain breakdown or an attack-type distribution as if it were complete — those numbers would be false on 190 records of which 14% carry a loss figure.

The loss backfill is regressing, not just outstanding.

Against the 31 Aug baseline in scripts/audit-exploit-backfill.mjs (164 records, 25 with amount_usd, 4 with chain), coverage moved from 15.2% → 14.2% on amount_usd and 2.4% → 2.1% on chain as the corpus grew to 190. The script's own header warns a backfill can add rows and still lose ground — it is losing ground against a dated go/no-go gate.

amount_usd is a string, not a number.

It is returned as a quoted decimal ("9.00") on most records. Parse defensively and do not assume a numeric type, even where the value looks like one.

Figures and payloads verified against the live API on 2026-09-18. The API needs no key and no signup — see the full endpoint reference and the MCP server.