A structured incident database of on-chain exploits and hacks, with a written record of what happened on every entry.
Every record carries a written incident description (100% coverage). 78% carry an attack type, 14% a loss figure, 2% a chain. The page does not quote a loss total or a chain breakdown — the backfill has not kept pace with the corpus it is backfilling.
Every field the corpus returns for one record. Real shape — walked corpus-wide, not sampled.
A curl that runs against the live API right now, plus the MCP tool names for the same data.
MCP tools
get_security_exploitsget_security_exploits_detailThree concrete questions this capability answers that a general crypto API does not.
tags=wormhole into the corpus and pull its incident history, no manual scraper required.description field is the lead with a full sentence per record.date on every record, and resolves to a stable hash.Required, not optional. Coverage gaps, staleness and parameter traps that were observed by running the curl above against the live server on 2026-09-18.
Coverage on amount_usd, chain and attack_type is partial.
Walked corpus-wide on 18 Sep 2026: description 190/190, attack_type 149/190 (78%), amount_usd 27/190 (14%), chain 4/190 (2%). The page does not roll up a single summed loss, a chain breakdown or an attack-type distribution as if it were complete — those numbers would be false on 190 records of which 14% carry a loss figure.
The loss backfill is regressing, not just outstanding.
Against the 31 Aug baseline in scripts/audit-exploit-backfill.mjs (164 records, 25 with amount_usd, 4 with chain), coverage moved from 15.2% → 14.2% on amount_usd and 2.4% → 2.1% on chain as the corpus grew to 190. The script's own header warns a backfill can add rows and still lose ground — it is losing ground against a dated go/no-go gate.
amount_usd is a string, not a number.
It is returned as a quoted decimal ("9.00") on most records. Parse defensively and do not assume a numeric type, even where the value looks like one.