cryptonist

Data

Crypto hacks and exploits, classified

Data as of 3 October 2026

DefiLlama's incident record lists 1,293 crypto hacks and exploits between 2011 and 2026, with $21.1B recorded as lost. The largest single incident is LuBian, $3.5B in 2020. The most common class of failure is Access Control, with 226 incidents. Yearly pages start at 2018. Data as of 3 October 2026; the record does not say whether amounts are before or after any recovery.

About this record

Every crypto hack and exploit DefiLlama has recorded, classified by the kind of failure, the technique used, the chain it happened on and the year, with the amount DefiLlama records for each, in US dollars. The record runs from 2011; the yearly pages start at 2018. Classification is DefiLlama's own: access control failures, price and oracle manipulation, key compromises, logic flaws, and so on. These pages aggregate the record rather than retell each incident; the value is in the shape of the whole, which is why there is a page per year, per class, per chain with at least twenty incidents and per technique with at least twenty, and none per incident. Amounts are the losses the record lists; it does not say whether they are before or after any funds were returned.

Value lost by year

  • 2018 31 incidents
    1,124 million US dollars
  • 2019 26 incidents
    277 million US dollars
  • 2020 46 incidents
    3,977 million US dollars
  • 2021 127 incidents
    2,868 million US dollars
  • 2022 184 incidents
    3,634 million US dollars
  • 2023 197 incidents
    1,626 million US dollars
  • 2024 217 incidents
    1,670 million US dollars
  • 2025 148 incidents
    2,715 million US dollars
  • 2026 286 incidents
    2,242 million US dollars
Value lost per year in millions of US dollars, 2018–2026, with incident counts. Source: DefiLlama, retrieved 3 October 2026.

2018 · 2019 · 2020 · 2021 · 2022 · 2023 · 2024 · 2025 · 2026

By class of failure

All 13 classes DefiLlama uses.

By class of failure: incidents and value lost. Source: DefiLlama, 3 October 2026.
Class of failureIncidentsValue lost
Access Control226$2.0B
Protocol Logic173$252.4M
Oracle Manipulation161$892.8M
Token & Share Accounting160$1.4B
Key Compromise158$8.9B
Frontend & Infrastructure95$1.0B
Input Validation70$755.4M
Reentrancy63$458.1M
Social Engineering61$3.1B
Bridge & Cross-Chain53$1.5B
Rugpull42$284.7M
Governance20$245.2M
Market Manipulation11$135.1M

By chain

Chains with at least 20 recorded incidents. A multi-chain incident counts its full amount on each chain it touched, so chain totals overlap and together exceed the overall total.

By chain: incidents and value lost. Source: DefiLlama, 3 October 2026.
ChainIncidentsValue lost
Ethereum538$10.1B
BSC313$3.2B
Arbitrum98$1.2B
Bitcoin64$5.4B
Base62$436.1M
Polygon62$1.6B
Solana54$1.7B
Optimism30$405.0M
Avalanche26$414.6M
Tron23$994.7M

By technique

Techniques with at least 20 recorded incidents.

By technique: incidents and value lost. Source: DefiLlama, 3 October 2026.
TechniqueIncidentsValue lost
Improper Access Control141$1.2B
Spot Price Manipulation133$833.8M
Private Key Compromised69$1.3B
Hot Wallet Key Compromised58$3.1B
Reentrancy58$385.3M
Missing Input Validation52$330.5M
Incorrect Share Accounting44$68.4M
Key Leaked via Infrastructure37$343.5M
Infinite Mint36$211.0M
Swap Logic Flaw36$52.3M
Arithmetic Error34$561.0M
Arbitrary External Call30$37.1M
Withdrawal Logic Flaw30$58.4M
Phishing29$1.0B
Reward Logic Flaw28$37.5M
Token Approval Abuse23$28.9M
Admin Drain21$180.7M

The 25 largest incidents

The 25 largest incidents by value lost, of 1,293 recorded, $21.1B in total. Largest first. Source: DefiLlama.
DateIncidentClass TechniqueChainsAmount
2020-12-28 LuBian Key Compromise Weak Key Generation Bitcoin $3.5B
2025-02-21 Bybit Social Engineering Signer Phishing Ethereum $1.4B
2022-03-23 Ronin Bridge Key Compromise Validator Key Compromised Ethereum $624.0M
2021-08-10 Poly Network Access Control Improper Access Control Ethereum, BSC, Polygon $611.0M
2022-10-06 Binance Bridge Bridge & Cross-Chain Proof Verifier Bug BSC $570.0M
2018-01-26 Coincheck Key Compromise Hot Wallet Key Compromised NEM $534.0M
2014-02-07 Mt. Gox Key Compromise Private Key Compromised Bitcoin $470.0M
2022-11-12 FTX Social Engineering Phishing Ethereum, Solana $450.0M
2026-09-24 Bitget Key Compromise Hot Wallet Key Compromised Ethereum, XRPL, Tron, Zcash $387.0M
2022-02-02 Portal Input Validation Signature Verification Flaw Solana $326.0M
2026-09-06 Liquid Network Bridge & Cross-Chain Unbacked Cross-Chain Mint Liquid $320.0M
2024-05-31 DMM Bitcoin Social Engineering Phishing Bitcoin $305.0M
2026-04-01 Drift Trade Access Control Proxy Upgrade Hijack Solana $295.0M
2026-04-18 Kelp Bridge & Cross-Chain Cross-Chain Message Spoofing Ethereum, Arbitrum $293.0M
2024-02-09 PlayDapp Key Compromise Hot Wallet Key Compromised Ethereum $290.0M
2020-09-29 KuCoin Key Compromise Hot Wallet Key Compromised Ethereum $281.0M
2018-04-21 Gate Key Compromise Private Key Compromised — $235.0M
2024-07-18 WazirX: India Social Engineering Signer Phishing Ethereum $234.9M
2025-05-22 Cetus CLMM Token & Share Accounting Arithmetic Error Sui $223.0M
2023-09-23 Mixin Network Frontend & Infrastructure Database Breach Mixin $200.0M
2023-03-13 Euler V1 Token & Share Accounting Donation Attack Ethereum $197.0M
2021-12-04 Bitmart Key Compromise Hot Wallet Key Compromised Ethereum, BSC $196.0M
2022-08-01 Nomad Bridge & Cross-Chain Forged Proof Ethereum $190.0M
2022-04-17 Beanstalk Governance Flashloan Governance Attack Ethereum $181.0M
2018-02-12 BitGrail Access Control Improper Access Control Nano $170.0M

Source: DefiLlama, retrieved 3 October 2026, under its open methodology. Figures are a dated snapshot, not a live feed.