Data
Crypto hacks and exploits, classified
Data as of 3 October 2026
DefiLlama's incident record lists 1,293 crypto hacks and exploits between 2011 and 2026, with $21.1B recorded as lost. The largest single incident is LuBian, $3.5B in 2020. The most common class of failure is Access Control, with 226 incidents. Yearly pages start at 2018. Data as of 3 October 2026; the record does not say whether amounts are before or after any recovery.
About this record
Every crypto hack and exploit DefiLlama has recorded, classified by the kind of failure, the technique used, the chain it happened on and the year, with the amount DefiLlama records for each, in US dollars. The record runs from 2011; the yearly pages start at 2018. Classification is DefiLlama's own: access control failures, price and oracle manipulation, key compromises, logic flaws, and so on. These pages aggregate the record rather than retell each incident; the value is in the shape of the whole, which is why there is a page per year, per class, per chain with at least twenty incidents and per technique with at least twenty, and none per incident. Amounts are the losses the record lists; it does not say whether they are before or after any funds were returned.
Value lost by year
- 2018 31 incidents1,124 million US dollars
- 2019 26 incidents277 million US dollars
- 2020 46 incidents3,977 million US dollars
- 2021 127 incidents2,868 million US dollars
- 2022 184 incidents3,634 million US dollars
- 2023 197 incidents1,626 million US dollars
- 2024 217 incidents1,670 million US dollars
- 2025 148 incidents2,715 million US dollars
- 2026 286 incidents2,242 million US dollars
2018 · 2019 · 2020 · 2021 · 2022 · 2023 · 2024 · 2025 · 2026
By class of failure
All 13 classes DefiLlama uses.
| Class of failure | Incidents | Value lost |
|---|---|---|
| Access Control | 226 | $2.0B |
| Protocol Logic | 173 | $252.4M |
| Oracle Manipulation | 161 | $892.8M |
| Token & Share Accounting | 160 | $1.4B |
| Key Compromise | 158 | $8.9B |
| Frontend & Infrastructure | 95 | $1.0B |
| Input Validation | 70 | $755.4M |
| Reentrancy | 63 | $458.1M |
| Social Engineering | 61 | $3.1B |
| Bridge & Cross-Chain | 53 | $1.5B |
| Rugpull | 42 | $284.7M |
| Governance | 20 | $245.2M |
| Market Manipulation | 11 | $135.1M |
By chain
Chains with at least 20 recorded incidents. A multi-chain incident counts its full amount on each chain it touched, so chain totals overlap and together exceed the overall total.
| Chain | Incidents | Value lost |
|---|---|---|
| Ethereum | 538 | $10.1B |
| BSC | 313 | $3.2B |
| Arbitrum | 98 | $1.2B |
| Bitcoin | 64 | $5.4B |
| Base | 62 | $436.1M |
| Polygon | 62 | $1.6B |
| Solana | 54 | $1.7B |
| Optimism | 30 | $405.0M |
| Avalanche | 26 | $414.6M |
| Tron | 23 | $994.7M |
By technique
Techniques with at least 20 recorded incidents.
| Technique | Incidents | Value lost |
|---|---|---|
| Improper Access Control | 141 | $1.2B |
| Spot Price Manipulation | 133 | $833.8M |
| Private Key Compromised | 69 | $1.3B |
| Hot Wallet Key Compromised | 58 | $3.1B |
| Reentrancy | 58 | $385.3M |
| Missing Input Validation | 52 | $330.5M |
| Incorrect Share Accounting | 44 | $68.4M |
| Key Leaked via Infrastructure | 37 | $343.5M |
| Infinite Mint | 36 | $211.0M |
| Swap Logic Flaw | 36 | $52.3M |
| Arithmetic Error | 34 | $561.0M |
| Arbitrary External Call | 30 | $37.1M |
| Withdrawal Logic Flaw | 30 | $58.4M |
| Phishing | 29 | $1.0B |
| Reward Logic Flaw | 28 | $37.5M |
| Token Approval Abuse | 23 | $28.9M |
| Admin Drain | 21 | $180.7M |
The 25 largest incidents
| Date | Incident | Class | Technique | Chains | Amount |
|---|---|---|---|---|---|
| 2020-12-28 | LuBian | Key Compromise | Weak Key Generation | Bitcoin | $3.5B |
| 2025-02-21 | Bybit | Social Engineering | Signer Phishing | Ethereum | $1.4B |
| 2022-03-23 | Ronin Bridge | Key Compromise | Validator Key Compromised | Ethereum | $624.0M |
| 2021-08-10 | Poly Network | Access Control | Improper Access Control | Ethereum, BSC, Polygon | $611.0M |
| 2022-10-06 | Binance Bridge | Bridge & Cross-Chain | Proof Verifier Bug | BSC | $570.0M |
| 2018-01-26 | Coincheck | Key Compromise | Hot Wallet Key Compromised | NEM | $534.0M |
| 2014-02-07 | Mt. Gox | Key Compromise | Private Key Compromised | Bitcoin | $470.0M |
| 2022-11-12 | FTX | Social Engineering | Phishing | Ethereum, Solana | $450.0M |
| 2026-09-24 | Bitget | Key Compromise | Hot Wallet Key Compromised | Ethereum, XRPL, Tron, Zcash | $387.0M |
| 2022-02-02 | Portal | Input Validation | Signature Verification Flaw | Solana | $326.0M |
| 2026-09-06 | Liquid Network | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Liquid | $320.0M |
| 2024-05-31 | DMM Bitcoin | Social Engineering | Phishing | Bitcoin | $305.0M |
| 2026-04-01 | Drift Trade | Access Control | Proxy Upgrade Hijack | Solana | $295.0M |
| 2026-04-18 | Kelp | Bridge & Cross-Chain | Cross-Chain Message Spoofing | Ethereum, Arbitrum | $293.0M |
| 2024-02-09 | PlayDapp | Key Compromise | Hot Wallet Key Compromised | Ethereum | $290.0M |
| 2020-09-29 | KuCoin | Key Compromise | Hot Wallet Key Compromised | Ethereum | $281.0M |
| 2018-04-21 | Gate | Key Compromise | Private Key Compromised | — | $235.0M |
| 2024-07-18 | WazirX: India | Social Engineering | Signer Phishing | Ethereum | $234.9M |
| 2025-05-22 | Cetus CLMM | Token & Share Accounting | Arithmetic Error | Sui | $223.0M |
| 2023-09-23 | Mixin Network | Frontend & Infrastructure | Database Breach | Mixin | $200.0M |
| 2023-03-13 | Euler V1 | Token & Share Accounting | Donation Attack | Ethereum | $197.0M |
| 2021-12-04 | Bitmart | Key Compromise | Hot Wallet Key Compromised | Ethereum, BSC | $196.0M |
| 2022-08-01 | Nomad | Bridge & Cross-Chain | Forged Proof | Ethereum | $190.0M |
| 2022-04-17 | Beanstalk | Governance | Flashloan Governance Attack | Ethereum | $181.0M |
| 2018-02-12 | BitGrail | Access Control | Improper Access Control | Nano | $170.0M |
Source: DefiLlama, retrieved 3 October 2026, under its open methodology. Figures are a dated snapshot, not a live feed.