Security
Crypto exploits, and how each one happened.
175 incidents researched and written up here: what happened, how, the figures as each source reported them, and every source listed.
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Dates are UTC, and are when the incident happened where its sources say so.
Reported incidents
Hacks, thefts and exploits reported in the press.
CryptoBilis exploit analysis
Tampered Ledger hardware wallets distributed by Southeast Asian reseller CryptoBilis carried hidden cellular implants that siphoned private keys, draining an estimated $86 million to $93 million from more than 300 victims across Bitcoin, Ethereum and Tron.
$86M reported lost
Bitget exploit analysis
Bitget disclosed a 87.5 million loss on 24 September 2026, with CEO Gracy Chen attributing the attack to a North Korean group. The exchange paused withdrawals and said reserves are sufficient to cover the loss.
$388M reported lost
Duelbits exploit analysis
On 24 September 2026, attackers drained roughly $7 million from the hot wallets of crypto casino Duelbits across Ethereum, BNB Chain, Tron and Bitcoin. The company has not disclosed the root cause; Scam Sniffer's working assessment is a compromised private key. The site was taken offline and reopened with $8M staged for customer withdrawals about four days later.
$7.0M reported lost
Magic Eden exploit analysis
On 24 September 2026, an attacker exploited a vulnerability in Limit Break's Payment Processor V2 to drain 660 wETH (~$1.78M) and several NFT collections from wallets that had approved the old Magic Eden EVM marketplace. A whitehat operation by 0xQuit rescued 23,155 NFTs worth more than $5.7 million before the attacker could reach them.
$1.8M reported lost
Payy Network exploit analysis
Payy Network's bridge contract was fully drained of .8 million on 24 September 2026. The company has not disclosed the mechanism but says it was not a key, social-engineering or off-chain compromise.
$1.8M reported lost
Meter exploit analysis
An attacker exploited a block-validation flaw in Meter's cross-chain bridge on 23 September 2026 and minted around $2.3 million of unbacked wrapped MTR and MTRG on BNB Chain, crashing both tokens before the project paused its mainnet and bridge.
Neutron exploit analysis
An attacker spent about $20,200 to swing a Neutron governance vote on 22 September 2026, used chain-level authority to reassign admin rights of ten Astroport and Drop contracts, and drained an estimated $9.4 million, of which roughly $1.8 to $1.96 million was bridged to Ethereum before chain pauses took effect.
$1.8M reported lostCosmos
Artificial Superintelligence Alliance exploit analysis
A single on-chain actor drained assets and minted tokens across all three Artificial Superintelligence Alliance projects over one weekend, using privileged keys held by the alliance. Realised profit was reported at around $2.25 million.
$2.3M reported lost
Liquid Network exploit analysis
An unauthorised withdrawal of 3,998.5 BTC (~20 million) from the Liquid Network on 6 September 2026 prompted a network halt. The funds were largely returned after negotiation; the attacker kept 600 BTC (~8 million) as a bounty.
$320M reported lost
More Markets exploit analysis
DeFi lending project More Markets lost .3 million on 31 August 2026 after an attacker tricked the protocol's logic and emptied the reserve. The team acknowledged the theft while stating that 'MORE's contracts are secure'.
$9.3M reported lost
Cronos exploit analysis
The Cronos blockchain was halted for nearly 24 hours on 30 August 2026 after a price-manipulation attack on the Tectonic lending platform let an attacker borrow around 20 million against inflated TONIC collateral and bridge .19 million to Ethereum before the chain stopped.
Rain exploit analysis
A vulnerability in Rain's card-spending contract on 28 August 2026 drained .1 million from users of several self-custodial neobanks, including Avici (~00,000) and Tria (~30,000). Avici later confirmed full refunds.
Moonwell August 2026 exploit analysis
An attacker stole around .7 million from Moonwell on 27 August 2026 by pumping the price of the thinly-traded MAMO token and borrowing real assets against the inflated collateral. The attack was Moonwell's fourth exploit in less than a year.
$8.7M reported lost
Term Finance exploit analysis
An attacker bought a majority of Term Finance's governance token on 23 August 2026, voted themselves in as vault controller, and withdrew about .5 million (2,843 ETH plus .68 million USDC). The protocol's timelock and veto did not engage.
$8.5M reported lost
KiiChain exploit analysis
Several Cosmos-based blockchains were exploited on 22 August 2026 after Cosmos Labs publicly disclosed a Cosmos EVM vulnerability. KiiChain lost about .6 million, TAC about .5 million; KiiChain's postmortem accused Cosmos Labs of negligent disclosure.
Cosmos
BounceBit exploit analysis
An attacker exploited a bug in the authorization logic of BounceBit on 20 August 2026, transferring around 286.5 million BB (~ million) from nine wallets. The chain was halted and the team announced a permanent shutdown and migration to BNB Chain.
$3.0M reported lost
MAYAChain exploit analysis
Maya Protocol disclosed on 18 August 2026 that an attacker stole .76 million by chaining six separate bugs. The protocol's founder noted that the chained vulnerability was not caught by either a Halborn audit or an AI audit using Anthropic's Fable 5.
$1.8M reported lost
Harmony exploit analysis
An attacker exploited the Harmony blockchain on 11 August 2026 to mint 4 billion , dropping the token's value 40%. Harmony paused its bridge and later announced a migration of to Ethereum and a mainnet shutdown.
Ravencoin exploit analysis
Attackers exploited a consensus-level vulnerability in Ravencoin on 11 August 2026 to mine invalid blocks. Two mining pools began coordinating a rollback of roughly four days of history to restore the chain's rules.
Coinsbuy exploit analysis
Crypto platform Coinsbuy lost around million on 9 August 2026 after an attacker exploited a vulnerability affecting eight wallets across Ethereum and Tron. The wallets were later replenished by the company, which offered a 00,000 bounty for the return of funds.
$8.0M reported lost
Coldcard exploit analysis
A firmware flaw in Coldcard hardware wallets caused by weak entropy in seed generation led to at least 2,055 BTC (~30 million) in losses across thousands of devices, disclosed on 31 July 2026. The 2021 firmware skipped the hardware random number generator and used the device serial and clock as seeds.
$130M reported lost
Triple-A exploit analysis
Singapore-based stablecoin payments company Triple-A disclosed on 25 July 2026 that an attacker stole an estimated 1.8 million from its treasury wallets across Bitcoin and Tron. The company said reserves would cover the loss.
$12M reported lost
Balance Coin exploit analysis
Balance Coin, a small algorithmic stablecoin on BNB Chain, lost its peg and fell to fractions of a cent after an attacker exploited a flaw in its pricing logic on 21 July 2026. The attacker's profit was around 12,000, taken from the 42DAO-run protocol.
$912K reported lost
Wanchain exploit analysis
An attacker exploited the Wanchain bridge on 20 July 2026, stealing 515 million NIGHT tokens (then worth -10 million) that had been bridged from Cardano to BNB. The NIGHT token price fell 43% in the immediate aftermath.
$9.0M reported lostCardano
Allbridge exploit analysis
The Allbridge blockchain bridge was exploited for .66 million in a flash-loan attack on 19 July 2026. The attacker exploited a flaw in the protocol's internal pricing logic that repriced assets against themselves even when borrowing an asset against collateral denominated in the same token.
$1.7M reported lost
Across Protocol exploit analysis
The Solana deployment of Across was hacked for around .35 million on 17 July 2026. The protocol said the stolen funds belonged to Risk Labs, the foundation supporting the project, and that no user funds were lost.
$3.4M reported lost
Ostium exploit analysis
On 15 July 2026, Ostium lost about $23.75 million in USDC after an attacker used an off-chain breach of its price-signer to submit fabricated BTC-USD oracle reports, draining the OLP vault before trading resumed on 23 July.
$24M reported lost
Bonzo Lend exploit analysis
On 10 July 2026, Bonzo Lend lost about $9 million after a Supra oracle verifier accepted a manipulated SAUCE price update, allowing the attacker to borrow against inflated collateral on Hedera; the protocol pledged reimbursement with Hedera Foundation support.
$9.0M reported lost
Summer Finance exploit analysis
A flash-loan-funded deposit and withdrawal on Summer Finance's Lazy Summer vault exploited a price-manipulation bug for about $6 million, after which the team announced it would wind down operations.
$6.0M reported lost
Polymarket exploit analysis
On 25 June 2026, Polymarket lost about $2.94 million after a third-party vendor compromise injected a malicious script into its frontend, phishing wallet signatures that authorised the transfer of user pUSD balances; Polymarket pledged refunds.
$3.0M reported lost
SecondFi exploit analysis
A vulnerability in SecondFi's wallet generation software allowed three separate attacks to drain 16 million ADA from 374 wallets. The team moved 129 million ADA to a third-party custodian before attackers could reach it.
$2.4M reported lostCardano
Taiko exploit analysis
An attacker forged source-signal proofs that the Taiko bridge contract accepted as legitimate, extracting about $1.7 million from the ERC-20 vault before the protocol team halted block production.
jaredfromsubway.eth exploit analysis
An attacker set up imitation tokens and trading routes that induced one of Ethereum's most active MEV bots to grant allowances on attacker-controlled contracts, draining roughly $7.5 million in a single sweep.
$7.7M reported lostEthereum
Aztec Connect second exploit analysis
Three days after Aztec Connect's first drain, an attacker used escape-hatch proofs on the same RollupProcessor to withdraw ETH, DAI and renBTC worth a combined $2.1 million from the contract's reserves.
Aztec Connect exploit analysis
Aztec Labs' deprecated Aztec Connect bridge was drained of $2.1 million after an attacker exploited the immutable RollupProcessor contract. Funds had remained in the four-year-old system after the project was shut down.
$2.1M reported lost
Raydium exploit analysis
A deprecated Raydium AMM V3 program on Solana was tricked into accepting fake LP tokens and paid out about $1.34 million in pool assets, with Raydium committing to cover affected users from the treasury.
$1.3M reported lost
Secret bridge exploit analysis
An infinite-mint bug in the Secret-to-Axelar bridge contract went unnoticed for a week, allowing an attacker to mint unbacked wrapped assets and redeem them for around $4.67 million before the loss showed up as a failed transaction.
$4.7M reported lost
Humanity Protocol exploit analysis
An employee laptop infected with malware yielded enough multisig bridge keys to drain or mint more than $36 million of H token and crash the price by 80 to 90 percent, with on-chain sleuths later linking the attacker to a similar exploit on Kelp DAO.
$36M reported lost
The Kiss exploit analysis
Roughly 7,200 unsold Klimt NFT certificates held in the Belvedere Museum's wallet were transferred out without authorization, exposing a long-standing supply problem in the museum's 2021 NFT rollout.
Gravity Bridge exploit analysis
A suspected validator signing-key compromise drained roughly $5.4 million from Gravity Bridge between Ethereum and Cosmos, with most of the loss in USDC. Validators halted the bridge within hours but the interface stayed offline for weeks.
$5.4M reported lost
DxSale exploit analysis
A 2021 DxSale liquidity locker on BNB Chain was drained of roughly $7.3 million after ownership of the locker contract quietly moved through dozens of wallets and a one-wei fee reset was applied, affecting around 1,400 liquidity pools.
$7.3M reported lost
Flare Network exploit analysis
On 30 July 2026, South Korean police reported that a fake staking website impersonating the Flare Network took 3.4 million XRP (~$8.5 million) from 71 investors over a week in October 2025. The real Flare Network was not compromised; the incident was a phishing scam, not an exploit.
$8.5M reported lost
Reproduced exploits
Exploits rebuilt as runnable proof-of-concept code by DeFiHackLabs, each explained from the code: the vulnerable function, the missing check, and the order of the attack.
DAOstack exploit analysis
On 2026-09-26, the Genesis Alpha DAO's Avatar was drained of its 4.025 ETH treasury after a permissionless newOrganization call let an attacker mint reputation against the existing Reputation contract and self-install as a full-permission scheme.
4.025 ETH (full Genesis Alpha treasury); attacker minted 20,000 REP against the victim's real Reputation contract (supply 9,738.6 to 29,738.6, ~67% majority after a 200 REP GenesisProtocol vote-cost burn) and used it to self-install as a full-permission scheme, per DeFiHackLabs
DoinGud exploit analysis
On 2026-09-21, a Polygon marketplace facet accepted two byte-identical acceptOffer calls and paid out the escrow twice for one offer, netting the helper 35,380 USDC.
35,380.154566 USDC net (two byte-identical acceptOffer calls each paid out 35,486.935717 USDC from escrow; funded via a UniV2 flash swap, repaid 35,593.716868 USDC), per DeFiHackLabs
GaslessReservoirEnabler exploit analysis
On 2026-09-21, an attacker on Polygon drained 8.72 WETH across 466 victims who had standing WETH approvals to the GaslessReservoirEnabler, by passing the live WETH token as a whitelisted 'module'.
8.72 WETH (~$23.8K) across 466 victims with standing approvals to the Enabler; PoC reproduces 3 victims, 2.3546 WETH (~$6.4K, ~27% of the WETH-leg loss), per DeFiHackLabs
InternetToken exploit analysis
On 2026-09-21, an attacker on Base minted 925.41M INT against a permissionless swapV3 entry, then sold 161.27M of it into the real INT/WETH pool for 5.85 WETH.
764,145,702 INT + 5.846988 WETH (attacker minted 925.41M INT total, dumped 161.27M into the real INT/WETH pool for the WETH, reproduced to the wei), per DeFiHackLabs
Likwid exploit analysis
On 2026-09-18, Likwid on BNB Chain paid 74.31 BNB into a frozen AMM after leverage-0 margin borrows left pairDelta unchanged.
74.31 BNB (reproduced to within 3 wei), per DeFiHackLabs
Flamincome exploit analysis
On 2026-09-16, an attacker inflated Flamincome's NAV by ~$595K through a permissionless Convex stakeFor call, then withdrew all from VaultYUSDT for ~$345.9K net profit.
~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT), per DeFiHackLabs
Nimiq exploit analysis
On 2026-09-16, an attacker on Polygon used an OpenGSN forwarder+paymaster mismatch to open a forged HTLC in a victim's name and redeem it, draining ~$50,463 across USDC, USDT0, and USDC.e.
~$50,463.79 (USDC, USDT0, USDC.e drained from a swap-liquidity wallet's standing approvals), per DeFiHackLabs
PrimeFinance exploit analysis
On 2026-09-16, Prime Finance's lending pool on HyperEVM was drained of 425.5 WHYPE after a permissionless oracle allowed a stale signed report to overwrite the live one.
~425.5 WHYPE (~$33.4K) drained from the lending pool reserve, per DeFiHackLabs
Startale exploit analysis
On 2026-09-16, a single contract-creation transaction re-initialized sixty-thousand pre-funded Startale ERC-7579 smart accounts and swept 427.55 USDC across them, with the wider campaign aggregate reaching ~$2,876 across ~41 known batches.
427.551160 USDC drained in this batch tx (32.555561 USDC reproduced across 3 of 23 victim accounts; ~$2,876 USDC+USDT aggregate across 41 known batches), per DeFiHackLabs
BonfireSwap exploit analysis
On 2026-09-15, an attacker on BNB Chain force-sold ~65 holders' BONFIRE positions through BonfireSwap's transfer() and skim, netting ~66 BNB (~$47-50K).
~66 BNB (~$47-50K); 58.78 BNB reproduced from a 5-victim subset (~98.7% of tokens drained), per DeFiHackLabs
RsETHSafeModule exploit analysis
On 2026-09-15, an unprivileged contract drained a Gnosis Safe of 2,900 aEthrsETH (~$7.8M gross) by wrapping a module call in a self-referential multicall on a private DeFi-Saver-style Router.
2,900 aEthrsETH (~$7.8M gross; 2,882.37 rsETH / ~$7.73M net to the MEV frontrunner), per DeFiHackLabs
SpiralHookV2 exploit analysis
On 2026-09-12, an attacker manipulated SpiralHookV2's Uniswap V4 spot-price oracle within a single block and bypassed its noSameBlockSwap re-use guard by rotating tx.origin across six EOAs, netting ~10.7 ETH.
~10.70728 ETH (reproduced exact to the wei), per DeFiHackLabs
YamFinance exploit analysis
On 2026-09-12, an attacker bought 3.3% of YAM supply, self-delegated it to clear the proposal and passage quorum on the dormant DAO, and walked away with admin control of the legacy UMA farming contracts to drain ~$121K.
~$121K (48.085 WETH + 763.101 UMA), per DeFiHackLabs
GDC exploit analysis
On 2026-09-11, an attacker chained four bugs in GDC's GDCToken to drain 35.34 BNB from the PancakeSwap pair reserve in a single transaction.
~35.34 BNB (35.337151495976986490 BNB reproduced exact to the wei), per DeFiHackLabs
ORB exploit analysis
On 2026-09-11, an attacker drained ~44.9-45 BNB (~$32.6K) from ORB's burned-LP reserve by re-entering ORBCore's refund-before-sell path after leveraging through Venus and Moolah.
~44.9-45 BNB (~$32,610.72), per DeFiHackLabs
BeatXswap exploit analysis
On 2026-09-09, an attacker drained ~2.98M BTX (~$77.5K) from two BeatSwap vesting contracts by crashing the spot price on the PancakeSwap V3 USDT/BTX pool the contracts used as their price oracle, realizing ~$63.7K USDT profit.
~$63.7K USDT net profit (2,984,557 BTX / ~$77.5K drained from two vesting reserves), per DeFiHackLabs
EnsoFinance exploit analysis
On 2026-09-09, an attacker inflated an Enso Finance strategy vault's deposit-share mint by ~9x through a short-window Uniswap V3 TWAP oracle, withdrawing ~5.6 ETH in blue-chip tokens from the strategy.
~5.6 ETH (5.277 ETH realized in this PoC after slippage selling looted UNI/AAVE/MKR back to WETH), per DeFiHackLabs
EtherFiAtomicQueue exploit analysis
On 2026-09-09, an attacker drained 15.45 ETH of liquidETH from 9 ether.fi AtomicQueue users by replaying their pre-existing allowances through an attacker-chosen solver.
~15.45 ETH (9 real victims' standing liquidETH allowances drained), per DeFiHackLabs
OMNI404 exploit analysis
On 2026-09-09, an attacker exploited OMNI404's dual ID/amount interpretation in transfer() against a Uniswap V3 exact-output swap on Ethereum, netting 2.427 WETH in the run() tx.
2.427 WETH (run() leg reproduced here; ~3.02 ETH across the full 4-tx block), per DeFiHackLabs
UnifiProtocol exploit analysis
On 2026-09-09, an attacker on BNB Chain drained 5.859 BNB from Unifi Protocol's reward manager by injecting a fake pool as msg.sender.
~5.86 BNB (treasury still holds ~9.17 BNB, contract unpaused — bug remains re-exploitable), per DeFiHackLabs
ZentraFinance exploit analysis
On 2026-09-09, an attacker on Citrea drained Zentra Finance's lending pool of ~140,000 ctUSD and 30 USDC.e by exploiting a boundary in Zentra's aToken accounting, not the March-2026 Aave V3 upstream bug.
~140,000 ctUSD + 30 USDC.e (~$143K), per DeFiHackLabs
OrderFactory exploit analysis
On 2026-09-08, an attacker on Ethereum used a permissionless `createOrderForBuyer` entry on an Order Factory contract to drain five buyers for ~20.247 ETH in a single transaction, part of a ~24.7 ETH reported incident.
~20.247 ETH this tx (5 buyers drained; reported incident total ~24.7 ETH), per DeFiHackLabs
CozyFinance exploit analysis
On 2026-09-07, an attacker on Optimism drove an unverified answer through the UMA Optimistic Oracle against a Cozy Finance protection market and claimed ~160,776 USDC.e from the Set's reserve after the dispute window passed unchallenged.
~160,776 USDC.e (~$160K), per DeFiHackLabs
RouterDrain exploit analysis
On 2026-09-07, an attacker on BNB Chain used a DEX router with an unset factory address to drain ~62.28 WBNB across 29 victims through fake Uniswap V3-style pool callbacks.
~62.28 WBNB across 29 victims (3 reconstructed here: OCEAN, Kandura, SATURN), per DeFiHackLabs
DHC exploit analysis
On 2026-09-05, an attacker on BNB Chain re-claimed a fixed reward from a DHC award proxy by looping `participateAward` + `claimAward`, draining the proxy's DHC balance and netting ~71,851 USDT.
~$71.8K USDT, per DeFiHackLabs
Reddio exploit analysis
On 2026-09-05, an attacker on Ethereum exploited a missing per-share-class accounting in the Reddio RedSonic Vault by registering stETH as a second asset, inflating the rsvETH share price, and redeeming rsvETH for ~9.25 ETH profit.
~9.25 ETH, per DeFiHackLabs
SecuredFi exploit analysis
On 2026-09-05, an attacker on Ethereum drove Secured Finance's `getMarketUnitPrice` to par with same-block self-trades and borrowed against the inflated fake collateral, draining ~0.9 WBTC (~$72K) from the TokenVault in a single transaction.
~0.9 WBTC (~$72K single-drain; ~$104K across all actors exploiting the same public bug), per DeFiHackLabs
NotionalFinance exploit analysis
On 2026-09-03, an attacker on Ethereum minted overflowing fCash against the Notional V1 escrow to settle ~69,257 DAI + ~1,658,524 USDC (~$1.73M) out of the protocol in two transactions.
~69,257.37 DAI + ~1,658,524.86 USDC (~$1.73M), per DeFiHackLabs
ReflexerGEB exploit analysis
On 2026-09-01, an attacker on Ethereum called the public `quitSystem` function on Reflexer's GebProxyActions library to migrate ~5.7 ETH of free collateral out of four dormant SAFEs in Global Settlement.
~5.9436 ETH (~$14K, drained from 4 SAFEs in one tx: IDs 3, 5, 8, 18), per DeFiHackLabs
BalancerV1BPool exploit analysis
On 2026-08-31, an attacker on Ethereum drained a Balancer V1 BPool of ~$110,839 by compressing the WBTC reserve and looping single-asset joins for one satoshi at a time, part of an aggregate ~$234K drain across five pools.
~$110,839 for this DPI/USDC/WETH/WBTC pool (~$234K aggregate across all 5 vulnerable pools), per DeFiHackLabs
FloatProtocol exploit analysis
On 2026-08-31, an attacker on Ethereum manipulated Uniswap V3 spot prices on the Float Protocol Hypervisor vault's underlying pool and netted ~10.71 ETH (~$28K) by deposit-and-mit shares at the skewed valuation.
~$28,000 (10.71 ETH), per DeFiHackLabs
AjnaFinance exploit analysis
On 2026-08-28, an attacker on Ethereum ran the same Dutch-auction manipulation against seven Ajna Finance ERC-20 pools the same day, draining ~$775K in total, with the cbETH pool alone losing ~$124.8K.
~$124.8K for this cbETH pool (1 of 7 pools hit by the same bug the same day, ~$775K aggregate), per DeFiHackLabs
CashCowCoin exploit analysis
On 2026-08-27, an attacker on BNB Chain looped 80 public sell calls on the CashCowCoin trading proxy to drain ~165.47 WBNB (~$117.4K) from the CCC/WBNB PancakeSwap pair.
~165.47 WBNB (~$117.4K), per DeFiHackLabs
EnjinCryptoItems exploit analysis
On 2026-08-26, an attacker on Ethereum re-initialised the Enjin Crypto Items platform's contract registries and registered a malicious item-adapter body, melting ~5,231,353 ENJ (~$142K) out of the item reserve in a single transaction.
5,231,353 ENJ (~$142K), per DeFiHackLabs
FHToken exploit analysis
On 2026-08-25, an attacker on BNB Chain drained FHToken's FH/USDT pair of ~19,999.02 USDT over 25 buy/sell cycles by exploiting a sell-tax reserve mismatch and a premature `pair.sync()`.
19,999.018106552928530404 USDT (~$20K), per DeFiHackLabs
ArrakisGUNI exploit analysis
On 2026-08-23, an attacker on Ethereum manipulated the underlying Uniswap V3 ENS/WETH pool's slot0 price on the Arrakis V1 G-UNI vault, minting and burning shares at the skewed valuation to net ~2.94 ETH in a single transaction.
~2.9414 ETH net attacker surplus (Arrakis V1 / G-UNI ENS-WETH vault), per DeFiHackLabs
TermFinance exploit analysis
On 2026-08-23, an attacker on Ethereum wrapped a TermMax vault deposit into a near-empty governance token to single-handedly pass a 17-action proposal, draining ~2,841.74 WETH from the ETH meta-vault via Zodiac Roles and Delay.
2,841.743535791961701401 WETH (attacker net gain, ETH meta-vault), per DeFiHackLabs
SandboxOFT exploit analysis
On 2026-08-22, an attacker on Base hijacked the SAND OFT's LayerZero delegate role through `approveAndCall`, minted 10,000,000 unbacked SAND per tx, and ran ~400+ txs of an ongoing campaign totalling roughly $49B face value at report time.
10,000,000 SAND minted unbacked (~$517,170 face value, one of 400+ repeated txs in an ongoing campaign), per DeFiHackLabs
AllbridgeCCTP exploit analysis
On 2026-08-19, an attacker on Base presented a forged CCTP v2 message attested off-chain to the Allbridge Core Router's messenger and extracted ~189,751.55 USDC in a single transaction funded by an Aave V3 flash loan.
~189,751.554381 USDC, per DeFiHackLabs
USM exploit analysis
On 2026-08-09, an attacker on Ethereum drained ~70.83 ETH from USM by minting FUM with a Morpho flash loan and redeeming it across 64 small `defund` slices instead of one large redemption.
~70.83 ETH, per DeFiHackLabs
UnistreetLaunchpad exploit analysis
On Ethereum mainnet a permissionless `launch()` forwarded caller-supplied `modifyCalldata` straight into Uniswap V4's PositionManager as the factory, letting an attacker run `setApprovalForAll(attacker, true)` against every factory-custodied LP position and then sweep the underlying tokens via `BURN_POSITION + TAKE_PAIR`. DeFiHackLabs reconstructs a single-tx loss of about 17,743.91 USDC and 0.0072 WETH (~$17.75K).
~17,743.91 USDC + ~0.0072 WETH (~$17.75K), per DeFiHackLabs
StrongBlock exploit analysis
An attacker used StrongBlock's own Governor proposal to install itself as Upgrader.admin, then upgraded StrongPoolV5 to a minimal implementation that swept the proxy's STRONG and STRNGR balances. Crypto.news reports a roughly $72K loss; DeFiHackLabs reconstructs the in-tx sequence against the live Governor and Upgrader state at block 25683560.
32,695.761681 STRONG + 383,447.167299 STRNGR (~$72K), per DeFiHackLabs
AIC exploit analysis
The attacker flashed the AIC reserve out of the USDC/AIC pair, then skim-synced the NEX/AIC pair to a wrecked ratio and bought back essentially the entire AIC reserve with a small NEX sliver. DeFiHackLabs reconstructs about 32.36 BNB (~$21.5K) net in a single transaction on BNB Chain.
~32.36 BNB (~$21.5K), per DeFiHackLabs
MOKE exploit analysis
An EIP-7702 self-delegation let a quota holder crash the MOKE spot, settle a manipulated price, and over-mint roughly 41.68 million MOKE.
~1546.54 BNB (~41.68M MOKE over-minted), per DeFiHackLabs
CrowdRingCircle exploit analysis
A sell-destroy branch in the CRC token contract let an attacker burn the pair's CRC reserve to zero and drain the entire USDT side of the CRC/USDT pool.
~201.36K USDT, per DeFiHackLabs
Perpetual Protocol exploit analysis
An unguarded OrderBook function let a trader poison their own cached funding growth on Perpetual Protocol v2, then withdraw the inflated balance from two vaults.
~3,062.21 USDC, per DeFiHackLabs
SummerFi exploit analysis
SummerFi's FleetA counted a depegged underlying (xUSD) at par through its Silo-managed vgUSDC Ark, so an attacker minted cheap vgUSDC, deposited it into the empty Ark, and redeemed inflated shares for the real contributors' DAI and USDC. DeFiHackLabs reconstructs a loss of 6.02M DAI.
~$6M (DAI + LVUSDC shares), per DeFiHackLabs
edel-xstock exploit analysis
edel-xstock priced its token against a thin Pancake V3 USDC/EDEL pool with no TWAP guard, so a flash loan moved spot and the next read was inflated. DeFiHackLabs reconstructs the in-pool USDC drain on BNB Chain.
204,215.57 USDC, per DeFiHackLabs
Vault4626 exploit analysis
Vault4626 quoted idle WETH into USDC-deposit NAV while redeeming in the actual mix, so a USDC flash plus a WETH donation and a single redeem swept the donated WETH. DeFiHackLabs reconstructs about 13.53 WETH on Base at block 47,958,574.
13.53 WETH, per DeFiHackLabs
AIDC exploit analysis
An AIDC token transfer hook burned AIDC out of the AMM pair whenever the sender was a PancakeSwap V2 helper, collapsing the pair's recorded AIDC reserve under a sync, then a router swap drained the WBNB side. DeFiHackLabs reconstructs about 220.13 WBNB.
220.13 WBNB, per DeFiHackLabs
CookFinanceIssuance exploit analysis
Cook Finance's `issueWithSingleToken2` issued CKToken through a Pancake V2 swap adapter that took caller-supplied weightings with a zero minimum-out, so a thin-pool seed plus two issues drained the underlying components. DeFiHackLabs reconstructs about $50K.
~$50K, per DeFiHackLabs
LixirPermitDrain exploit analysis
Lixir vault tokens' `permit()` accepted a permit whose `ecrecover` returned a random nonzero address, then `transferFrom()` drained each holder's vault-token balance. DeFiHackLabs reconstructs losses of about 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, and 24,182.56 LIX across six vaults.
2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX, per DeFiHackLabs
OceanBPoolSideStaking exploit analysis
Ocean BPool's join/exit is asymmetric, and SideStaking mirrored every single-sided mOCEAN join/exit with a datatoken stake/unstake, so repeated single-sided BPT moves returned more mOCEAN than they deposited. DeFiHackLabs reconstructs about 127,860 mOCEAN across eight victim BPool positions on Polygon.
127.86K mOCEAN, per DeFiHackLabs
DLMC exploit analysis
DLMC's `livePrice()` was computed live from the DLMC/USDT Pancake pair, so a flash through two registered buy/sell contracts let the second buy inflate the price the first contract sold against. DeFiHackLabs reconstructs about 222,560.22 USDT drained on BNB Chain.
222,560.22 USDT, per DeFiHackLabs
RoyalRoyalties exploit analysis
Royal1155LDA updated a tier-balance mapping on every ERC1155 batch item, including zero-amount items, letting a zero-balance sender inflate a fresh receiver's `tierBalanceOf`. DeFiHackLabs reconstructs about 261,162.93 USDC drained against royalty deposits.
261,162.93 USDC, per DeFiHackLabs
ATM exploit analysis
After a user transferred LP tokens back into the ATM/WBNB Pancake pair by mistake, anyone could call `burn` against the pair's own LP balance. A bot executed a single-tx burn that netted about 1,603.99 WBNB.
1,603.99 WBNB, per DeFiHackLabs
OLPC exploit analysis
OLPC's owner set `decimalsValue` to an out-of-range value, and the token's transfer hook used that value to scale a Pancake V2 pair's reserves. A supporting-fee swap with `amountIn = 0` then read the inflated balance and released the LABUBU side, which was routed to USDT for about 1,115,903.66 USDT.
1,115,903.66 USDT, per DeFiHackLabs
JB exploit analysis
A flash-funded, Venus-collateralised JB helper ran sell/burn/sync cycles against an unverified JB/USDT helper until the pair's USDT was drained. DeFiHackLabs reconstructs about 49,958.06 USDT over roughly 13 cycles.
49,958.06 USDT, per DeFiHackLabs
Aztec V1 exploit analysis
An attacker called Aztec V1 rollup's `escapeHatch` directly with proofs that the on-chain TurboVerifier accepted, draining about 1,158 ETH plus 150,000 DAI plus 0.4696 renBTC (~$2.2M total) across three transactions against a previously emptied privacy-pool rollup.
~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC), per DeFiHackLabs
LBP exploit analysis
LBPHashrate staged hashrate reward credit through Moolah and Pancake Vault flash liquidity, the attacker sold the inflated LBP balance against the WBNB-side pair, and the USDT was swapped to BNB for about 610.56 BNB.
610.56 BNB, per DeFiHackLabs
WHALE exploit analysis
WHALE staged LP credit and hashrate reward settlement under a Moolah USDT flash plus a Pancake Vault lock, leaving the WHALE/USDT pair's recorded balance higher than its actual token balance. The attacker swapped about 3,460.41 USDT out of the pair.
3,460.41 USDT, per DeFiHackLabs
DIP exploit analysis
DIP's sell-fee hook double-burned DIP on a single router transfer, shrinking the DIP/AIC Pancake pair's DIP reserve under a skim/sync. DeFiHackLabs reconstructs about 111,097.59 USDC drained against the AIC side.
111,097.59 USDC, per DeFiHackLabs
Thetanuts exploit analysis
Thetanuts' index-share mint accepted a zero-amount component transfer as proof of deposit, letting the attacker mint unbacked index shares in a loop and repay Aave with them. DeFiHackLabs reconstructs about 105,471.50 USDC drained plus residual component shares.
105471.50 USDC, per DeFiHackLabs
Aztec Connect exploit proof of concept
Aztec Connect's RollupProcessorV3 had a numRealTxs mismatch between proof coverage and L1 settlement: the proof committed full inner-rollup chunks but the contract settled only numRealTxs entries. DeFiHackLabs reconstructs about $2.19M drained (908.99 ETH plus 270.5K DAI plus 167.9 wstETH plus yvDAI/yvWETH/LUSD/yvLUSD).
~$2.19M (this PoC reproduces the 908.99 ETH leg), per DeFiHackLabs
NovaBox exploit analysis
NovaBox's constructor dividend checkpoint was readable from storage without a corresponding mint constraint, so the attacker reset the checkpoint at a manipulated rate and redeemed dividends against it. DeFiHackLabs reconstructs about 56.73 ETH drained on Ethereum.
56.73 ETH, per DeFiHackLabs
TOPBPool exploit analysis
A governance-controlled mint on a Balancer pool handed the owner the power to mint shares and `exitPool` them against the real reserves. DeFiHackLabs reconstructs about 944.20 WETH drained in one tx on Ethereum.
944.20 WETH, per DeFiHackLabs
AmbientCrocSwapDex exploit analysis
AmbientCrocSwapDex quoted native surplus into the LP token's `totalAssets()` while the redeem path paid the surplus back. DeFiHackLabs reconstructs about 67.85 ETH drained on Ethereum.
67.85 ETH, per DeFiHackLabs
BOSS exploit analysis
BOSS's helper contract mixed mint/burn and transfer-tax pool reads, so repeated helper cycles inflated one side of the pool's reserves. DeFiHackLabs reconstructs 10,207.54 USDT drained on BNB Chain.
10,207.54 USDT, per DeFiHackLabs
AISOTHPresale exploit analysis
AISOTHPresale's fixed-price deposit paid a bonus that exceeded the actual deposit, then closed out against an unincremented accrued-balance. DeFiHackLabs reconstructs 30,314.76 USDT drained on BNB Chain.
30,314.76 USDT, per DeFiHackLabs
DTXT exploit analysis
DTXT's liquidity-fee classification missed a call shape that returned uncharged tokens, so the attacker extracted the missing-fee share from the in-pair balance. DeFiHackLabs reconstructs 35,041.11 USDT drained.
35,041.11 USDT, per DeFiHackLabs
ATM Token exploit analysis
ATM Token's `transferFrom` ran a hidden auto-swap inside the same call, crediting the receiver with an inflated stable while the attacker retained the in-pair token. DeFiHackLabs reconstructs about $243,543 USDT drained from the ATM/USDT PancakeSwap pair.
~$243,543 USDT, per DeFiHackLabs
BYToken exploit analysis
BYToken's permissionless `triggerAutoBurn` collapsed the BY reserve to near-zero once the attacker met the trading threshold, letting a tiny BY swap drain the entire WBNB side. DeFiHackLabs reconstructs about 146.60 WBNB drained.
~$87,402 (146.60 WBNB), per DeFiHackLabs
AROS exploit analysis
AROS's router-skim path paid the caller the pair's WBNB surplus at an inflated AROS reserve. DeFiHackLabs reconstructs about $295K drained on BNB Chain.
~$295K, per DeFiHackLabs
YSDAO exploit analysis
YSDAO's reward multiplier reset against an inflated total supply, so a single mint drove the multiplier in the attacker's favour and the wrong-multiplier reward was harvested. DeFiHackLabs reconstructs about 19.49K USDT drained.
~19.49K USDT, per DeFiHackLabs
DxSale exploit proof of concept
DxSale's deployer shifted the DxLocker ownership through 89 wallets over 269 days; the final owner called the privileged `DXLOCKERLP()` owner-only backdoor to drain all 1,400+ locked LP positions, roughly $7.3M total.
~7.3M USD, per DeFiHackLabs
LegendaryMoneyMonNft exploit analysis
LegendaryMoneyMonNft's `cliamRewred()` trusted a verify() predicate and paid out the requested ERC20 amount without checking it against the user's recorded balance. DeFiHackLabs reconstructs about $85.5K USDT drained.
~$85.5K USD (85,519 USDT), per DeFiHackLabs
Joe Agent exploit analysis
Joe Agent's `removeLiquidityViaContract(liquidity, ...)` accepted any caller-supplied `liquidity` value, including one owned by another user. DeFiHackLabs reconstructs about $45K USD drained (62.5 BNB plus 1.2M JOE).
~$45K USD (62.5 BNB + ~1.196M JOE), per DeFiHackLabs
SKP Token exploit analysis
SKP Token's deposit/stake/getReward triple could be repeated in one block, harvesting all rewards at once against the inflated stake weight. DeFiHackLabs reconstructs the in-tx reward drain on BNB Chain.
New Market Trading exploit analysis
New Market Trading had an unprotected perimeter function that let any caller reset user balances. DeFiHackLabs reconstructs about $3.98M drained across 88 Gnosis Safes on Ethereum, Base, and Arbitrum.
~$3.98M USD, per DeFiHackLabs
SquidRouterModule exploit analysis
SquidRouterModule, a Gnosis Safe module wrapping Axelar's `AxelarExpressExecutableWithToken`, accepted a crafted Squid message whose `validateProof` allowed arbitrary approve/transfer. DeFiHackLabs reconstructs the in-tx drain of 0.25 WBTC plus 0.29 wTAO plus 0.02 WETH.
0.25 WBTC + 0.29 wTAO + 0.02 WETH, per DeFiHackLabs
WUSD.fi exploit analysis
WUSD.fi's `wrap()` read the caller's GLOVE balance at wrap-time, so an attacker could transfer GLOVE in just before wrapping to inflate the reward accounting. DeFiHackLabs reconstructs about $200K (USDC plus USDT) drained from Uniswap V3 GLO pools.
~$200K USD (GLOVE emissions + LP drain), per DeFiHackLabs
FractalProtocol exploit analysis
FractalProtocol's `redeem(fee)` accepted a caller-supplied fee, and a negative-fee shape credited the caller with the LP while the contract paid out the pool's reserve. DeFiHackLabs reconstructs about $13.7K drained on Arbitrum.
~$13.7K, per DeFiHackLabs
MureDistribution exploit analysis
MureDistribution's `claim()` aggregated rewards against an inflated stake weight without debiting the recorded stake, so a single block claimed the whole accrued reward. DeFiHackLabs reconstructs about 5.45 ETH drained.
~5.45 ETH, per DeFiHackLabs
MAPProtocol exploit analysis
MAPProtocol's bridge fee was recorded at the moment of the next call, so multiple micro-deposits inflated the recorded fee and the reward was harvested against it. DeFiHackLabs reconstructs about $180K drained.
~$180K, per DeFiHackLabs
ElevateFi exploit analysis
ElevateFi's stake/un-stake cycle restaked the same recorded balance against consecutive reward windows without claiming the prior window. DeFiHackLabs reconstructs about $16,000 drained on Polygon.
~16,000 USD, per DeFiHackLabs
TesseraSwap exploit analysis
TesseraSwap's callback repayment priced itself from the swap's own post-state, so the attacker moved the same-block price and kept the spread. DeFiHackLabs reconstructs about $20K drained on Base.
~$20K, per DeFiHackLabs
SEAToken exploit analysis
SEAToken's `transferWithFee` returned its fee from the receiver's debited amount, not from the contract's fee pool. DeFiHackLabs reconstructs about $110K drained on Arbitrum.
~$110K, per DeFiHackLabs
VerusBridge exploit analysis
VerusBridge's precommit verified against a source-chain root while settling against the destination's full bridge balance, allowing a forged precommit to drain about $11.58M in one transaction.
~$11.58M, per DeFiHackLabs
AdsharesBridge exploit analysis
AdsharesBridge's verifier set still accepted a deprecated rotated-out key, and the attacker used that key to sign a destination burn. DeFiHackLabs reconstructs about $628K drained on Ethereum.
~$628K, per DeFiHackLabs
SQTokenStaking exploit analysis
SQTokenStaking's `unstake` reward share was computed at claim time against the live total supply, so a same-block stake/unstake captured the next window's share. DeFiHackLabs reconstructs about $346.1K drained.
~$346.1K, per DeFiHackLabs
HumaFinance exploit analysis
HumaFinance's credit-token redeem priced its payoff against an oracle that the attacker had flash-moved, so the redemption captured the inflated payoff. DeFiHackLabs reconstructs the in-pool USDT balance drained.
~$101K (82,315 USDC + 19,074 USDC.e), per DeFiHackLabs
INKFinance exploit analysis
INKFinance's lending pool priced collateral against a manipulable oracle, so a flash-loan-driven price drop let the attacker borrow against the inflated collateral. DeFiHackLabs reconstructs about $140K drained on Polygon.
~$140K, per DeFiHackLabs
Renegade exploit analysis
Renegade's match-engine verifier accepted a replayed recorded signature to settle against an order the signer had cancelled. DeFiHackLabs reconstructs the in-settlement replay against the Ethereum live state.
~$209K, per DeFiHackLabs
TrustedVolumes exploit analysis
TrustedVolumes credited user rewards from a caller-supplied volume report. DeFiHackLabs reconstructs the credit-and-claim sequence against the on-chain behaviour.
~$5.87M, per DeFiHackLabs
Ekubo exploit analysis
Ekubo's concentrated-liquidity pool paid same-block TWAP fees against a pre-swap accumulator reading. DeFiHackLabs reconstructs the in-tx fee-claim against the Starknet live state.
~$1.4M, per DeFiHackLabs
SharwaMarginTrading exploit analysis
SharwaMarginTrading's `liquidate(debtor)` accepted any caller's debtor argument, so the attacker walked collateral out of any open position. DeFiHackLabs reconstructs the on-chain sequence.
32.85K USDC, per DeFiHackLabs
JUDAO exploit analysis
JUDAO's `withdraw` did not update `stakedSupply` in the same call, so the attacker double-withdrew against the same recorded stake. DeFiHackLabs reconstructs the on-chain drain.
205K USDT + 36 BNB, per DeFiHackLabs
RWAVault exploit analysis
RWAVault's `refresh` read a price that any caller could update through a public `updatePrice()`. DeFiHackLabs reconstructs the in-tx refresh-and-borrow against the on-chain behaviour.
398,655.47 USDC, per DeFiHackLabs
Unverified_a152 exploit analysis
A forwarder relayed unsigned requests naming seven victims as the sender, and an unverified Ethereum contract spent their standing approvals to an AllowanceTarget. DeFiHackLabs records a loss of 229K USDT.
229K USDT, per DeFiHackLabsEthereum
SingularityDynaVault exploit analysis
SingularityDynaVault priced a deposit at the pre-rebase ratio and a withdrawal at the post-rebase ratio, allowing the attacker to walk the difference. DeFiHackLabs reconstructs the on-chain drain.
413.13K USDC, per DeFiHackLabs
GiddyVaultV3 exploit analysis
GiddyVaultV3's `redeem` rounded the payout in the caller's favour, so the attacker accumulated the rounding error over many `redeem`s. DeFiHackLabs reconstructs the rounding-skim drain.
$1.3M, per DeFiHackLabs
KipseliPropAMM exploit analysis
KipseliPropAMM's TWAP anchored its trailing sample at block-end, so the attacker moved the trailing anchor via a flash into the pool. DeFiHackLabs reconstructs the in-block TWAP-move drain.
0.93 cbBTC, per DeFiHackLabs
JuiceboxREVLoans exploit analysis
JuiceboxREVLoans' `cashOut` weight was amplified by a same-block queue side-effect, letting the attacker queue in one call and redeem in the next. DeFiHackLabs reconstructs the on-chain drain.
21.77 ETH, per DeFiHackLabs
ThetanutsVaultShareRounding exploit analysis
ThetanutsVault rounded the first-deposit mint up, and the attacker walked the inflated share out before the vault's ratio settled. DeFiHackLabs reconstructs the first-deposit share-skim drain.
0.15 WBTC, per DeFiHackLabs
AaveRebalancerCreditDelegation exploit analysis
AaveRebalancer's `creditDelegation` accepted a delegatee registered through a public register function, so the attacker registered themselves and walked an arbitrary account's debt out. DeFiHackLabs reconstructs the drain.
6,999.91 WAVAX, per DeFiHackLabs
XLootStaking exploit analysis
XLootStaking's reward share used the live `totalSupply()` at claim time, so the attacker minted and burned staking tokens around the claim. DeFiHackLabs reconstructs the drain.
6.21 ETH, per DeFiHackLabs
MONA LisaVault exploit analysis
MONA LisaVault's `redeem` debited `msg.sender`'s share regardless of the supplied `recipient`. The attacker called `redeem(victim)` and walked the victim's shares out.
Saturn Protocol exploit analysis
Saturn Protocol's `release` was paid from a treasury held in a token whose supply cap the attacker had inflated. DeFiHackLabs reconstructs the cap-inflate-and-release drain.
0 (Disclosure only; no exploit occurred), per DeFiHackLabs
SubQuerySettings exploit analysis
SubQuerySettings' `updateFee` accepted any caller-supplied fee, so the attacker inflated the fee, drained a fixed-price withdrawal, then restored the original. DeFiHackLabs reconstructs the drain.
218.07M SQT, per DeFiHackLabs
SquidMulticallAllowanceDrain exploit analysis
SquidMulticall aggregated token approvals across users, and an attacker-supplied target called `transferFrom` against the aggregated allowance. DeFiHackLabs reconstructs the on-chain drain.
1 ETH, per DeFiHackLabs
PerpPair exploit analysis
PerpPair applied a funding update against a same-block caller-supplied `oraclePrice`. DeFiHackLabs reconstructs the funding-manipulation drain against the on-chain behaviour.
165K USDC, per DeFiHackLabs
WhalebitOracleManipulation exploit analysis
Whalebit's collateral liquidation priced a thin LP pool that the attacker had flash-loaned and manipulated. DeFiHackLabs reconstructs the in-tx borrow-and-drain against the on-chain price.
824K USD, per DeFiHackLabs
VTSwapHook exploit analysis
VTSwapHook's Uniswap V4 hook priced the swap from the underlying pool's spot, which the attacker moved via a flash loan. DeFiHackLabs reconstructs the in-hook pricing drain.
4,507,034.03 vATH + 2,007,935.14 ATH, per DeFiHackLabs
EST Token exploit analysis
EST Token's transfer hook credited the receiver with the pre-fee amount, so a same-block deposit-and-receive captured the fee. DeFiHackLabs reconstructs the fee-credit drain.
150.2 WBNB, per DeFiHackLabs
Univ3CollateralToken exploit analysis
Univ3CollateralToken priced its collateral from a Uniswap V3 spot pool with no TWAP guard, and the attacker borrowed against a flash-inflated collateral price. DeFiHackLabs reconstructs the on-chain drain.
57K USD, per DeFiHackLabs
XocolatlLiquidator exploit analysis
XocolatlLiquidator's `liquidate(debtor)` accepted any caller's debtor, so the attacker walked arbitrary collateral out. DeFiHackLabs reconstructs the on-chain drain.
3.25 cbETH and 0.22 WETH, per DeFiHackLabs
BCE exploit analysis
BCE's per-block emission credit was readable from the miner's stamp, so the attacker walked the credit out by mining biased timestamps. DeFiHackLabs reconstructs the in-tx mining credit drain.
~800,000 USDT, per DeFiHackLabs
ATMBlindBox exploit analysis
ATMBlindBox derived randomness from the previous block's `blockhash`, which the attacker could pre-mine to predict the prize. DeFiHackLabs reconstructs the predictable-prize drain.
99K USD, per DeFiHackLabs
Revamp exploit analysis
Revamp's `claim(_amount, _token)` released the requested tokens without debiting the user's recorded balance. DeFiHackLabs reconstructs the on-chain reserve-drain.
2.99 BNB, per DeFiHackLabs
Fun.xyz CheckoutPool exploit analysis
An outdated bridge operator contract that anyone could call let an attacker trigger a payout from Fun.xyz's CheckoutPool on Polygon, funded partly from the pool's surplus. DeFiHackLabs records a loss of 85,730 USDC.
$86K reported lostPolygon
StakeOnMe exploit analysis
StakeOnMe's stake/unstake cycle let the attacker move principal across blocks without waiting out the reward window. DeFiHackLabs reconstructs the in-block move-and-claim drain.
0.28 ETH, per DeFiHackLabs
Venus THE exploit analysis
Venus THE's liquidation bonus was priced from a thin XVS spot pool that the attacker manipulated via flash-loan. DeFiHackLabs reconstructs the on-chain liquidateBorrow drain.
913,858.263360521396654198 CAKE + 1,972.530910582753621682 WBNB, per DeFiHackLabs
AlkemiEarn exploit analysis
AlkemiEarn's `borrow` accepted a flash-loaned balance and priced the utilisation at the flash-low state. DeFiHackLabs reconstructs the on-chain in-block borrow drain.
43.45 ETH, per DeFiHackLabs
Curve LlamaLend exploit analysis
Curve LlamaLend's fee-share rounding slippage let the attacker walk the slippage out across many small withdrawals. DeFiHackLabs reconstructs the on-chain drain.
~240,000 US$, per DeFiHackLabs
LAXO Token exploit analysis
LAXO Token's `_burn(_from, _value)` accepted a caller-supplied `_from`, and the attacker under-reported it to keep surplus tokens after the burn. DeFiHackLabs reconstructs the on-chain drain.
~137,000 US$, per DeFiHackLabs
XDKRecycle exploit analysis
XDKRecycle's recycle reward was amplifiable via a pre-incremented per-block counter, letting the attacker claim both the reward and the recycled balance. DeFiHackLabs reconstructs the drain.
6.84 WBNB, per DeFiHackLabs
Moonwell February 2026 exploit analysis
Moonwell's `redeemUnderlying` priced against the live utilisation, so the attacker redeemed from a thin liquidation collateral address and walked the inflated redemption out. DeFiHackLabs reconstructs the on-chain drain.
1.78M USD, per DeFiHackLabs
Makina exploit analysis
Makina priced its collateral against a thin Curve pool that the attacker moved via flash-loan, and the lending market's `borrow` walked the inflated balance out. DeFiHackLabs reconstructs about $5.1M drained.
5.1M USD, per DeFiHackLabs
SynapLogic exploit analysis
SynapLogic's deployer-set `migrate` function let the deployer pull every depositor's principal at the moment of a large deposit. DeFiHackLabs reconstructs about 27.6 ETH plus 3,450 USDC drained.
MTToken exploit analysis
MTToken's transfer fee was computed against the receiver's pre-funded `balanceOf`, so the attacker pre-funded a receiver, transferred MT in, and walked the inflated fee-balance out via a refund. DeFiHackLabs reconstructs about $37K drained.
37K USD, per DeFiHackLabs
FutureSwap exploit analysis
FutureSwap's wrapped-underlying mismatch gave the attacker a settlement unit-count that exceeded the actual underlyings. DeFiHackLabs reconstructs about $433K drained.
433K USD, per DeFiHackLabs
Truebit exploit analysis
Truebit's dispute-game bond calculation had an arithmetic overflow that let the attacker post a sub-cent bond and walk the full dispute reward out. DeFiHackLabs reconstructs the on-chain drain.
8540ETH, per DeFiHackLabs
PRXVT exploit analysis
PRXVT's business-logic flaw let the attacker route a `skim` call against the in-pair reserve and walk the freed balance out. DeFiHackLabs reconstructs about 32.8 ETH drained.
32.8 ETH, per DeFiHackLabs
Method, and what this does not cover
- Written up since 15 Oct 2025, not all time
- These are the incidents logged since our feed started, each researched from its original report and further sources. For an all-time table with loss figures on everything, DefiLlama is the better source and this page will not pretend otherwise.
- Losses are as reported, and 33 carry a dollar figure
- Of the 42 reported incidents, 33 have a loss in dollars as their sources reported it, $1.1B between them; none is independently verified, and where outlets disagree each write-up says so. The others are collapses and shutdowns with no total, or thefts whose total was never published. The 133 reproductions state their loss as DeFiHackLabs measured it, in tokens or ETH as often as dollars, and sometimes as the attacker’s gain rather than the protocol’s loss. Those figures are quoted, never converted.
- Every source is listed
- Each write-up is Alphaday’s own, drafted from the sources and reviewed by a person before it is published. Every page links the original report and lists every outside page it was written from, so a figure or a date can be checked in one click.
Same data, other shapes
- Security incidents API
Every incident record behind these write-ups, including the ones not written up yet.
- News API
Full-text search across the crypto press, for the coverage around any incident.
- Recipes
Wire incident alerts into an agent, a bot or a security dashboard.
The crypto data layer for humans, apps, and AI agents.
