Hacks
Crypto hacks in 2026
Data as of 3 October 2026
286 recorded incidents in 2026 took $2.2B in total. The largest was Bitget, $387.0M. That is 22.1% of all incidents in DefiLlama's record and 10.6% of the value lost. Amounts are the losses DefiLlama records, and its record does not say whether they are before or after any recovery. Data as of 3 October 2026.
By class of failure, 2026
- Access Control $369.6M lost52 incidents
- Token & Share Accounting $245.5M lost48 incidents
- Oracle Manipulation $73.4M lost41 incidents
- Protocol Logic $25.2M lost38 incidents
- Bridge & Cross-Chain $699.9M lost31 incidents
- Key Compromise $703.8M lost31 incidents
- Input Validation $19.8M lost19 incidents
- Frontend & Infrastructure $43.2M lost10 incidents
- Governance $42.9M lost8 incidents
- Social Engineering $4.2M lost4 incidents
- Reentrancy $23K lost2 incidents
- Market Manipulation $7.5M lost1 incidents
- Rugpull $7.3M lost1 incidents
Incidents in 2026
| Date | Incident | Class | Technique | Chains | Amount |
|---|---|---|---|---|---|
| 2026-10-01 | NEAR Intents | Bridge & Cross-Chain | Bridge Logic Flaw | BSC | $3.8M |
| 2026-10-01 | FlashLoopAdapter | Access Control | Improper Access Control | Ethereum | $305K |
| 2026-09-30 | SKYDAO | Protocol Logic | Swap Logic Flaw | BSC | $183K |
| 2026-09-27 | Fake GIWA Bridge | Social Engineering | Impersonation Scam | Ethereum | $2.1M |
| 2026-09-24 | Bitget | Key Compromise | Hot Wallet Key Compromised | Ethereum, XRPL, Tron, Zcash | $387.0M |
| 2026-09-24 | Duelbits | Key Compromise | Hot Wallet Key Compromised | Ethereum, BSC, Bitcoin, Tron | $7.0M |
| 2026-09-24 | Payy Network | Bridge & Cross-Chain | Bridge Logic Flaw | Ethereum | $1.8M |
| 2026-09-24 | Limit Break Payment Processor | Access Control | Token Approval Abuse | Ethereum, ApeChain, Polygon, Base | $1.8M |
| 2026-09-22 | Astroport | Governance | Malicious Proposal | Neutron | $4.9M |
| 2026-09-22 | Drop | Governance | Malicious Proposal | Neutron | $4.4M |
| 2026-09-19 | Fetch.ai | Key Compromise | Private Key Compromised | Ethereum | $1.5M |
| 2026-09-19 | NuNet | Key Compromise | Private Key Compromised | Ethereum | $463K |
| 2026-09-17 | Nostra Money Market | Oracle Manipulation | Spot Price Manipulation | Starknet | $3.5M |
| 2026-09-16 | Flamincome | Oracle Manipulation | Spot Price Manipulation | Ethereum | $595K |
| 2026-09-12 | Chainflip AMM | Bridge & Cross-Chain | Bridge Logic Flaw | Tron | $736K |
| 2026-09-10 | Symbiosis | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | BSC, Ethereum | $336K |
| 2026-09-09 | Nomic | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Nomic | $3.1M |
| 2026-09-09 | Zentra Finance | Token & Share Accounting | Rounding Error | Citrea | $140K |
| 2026-09-07 | Cozy V2 | Protocol Logic | Unknown | Optimism | $163K |
| 2026-09-06 | Liquid Network | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Liquid | $320.0M |
| 2026-09-04 | Notional V2 | Token & Share Accounting | Arithmetic Error | Ethereum | $1.7M |
| 2026-08-31 | Aquifer | Access Control | Arbitrary External Call | Solana | $2.5M |
| 2026-08-31 | Radix | Access Control | Improper Access Control | Radix | $1.2M |
| 2026-08-31 | Ankr | Token & Share Accounting | Unbacked Mint | Flow | $410K |
| 2026-08-30 | Tectonic | Token & Share Accounting | Donation Attack | Cronos | $124.5M |
| 2026-08-30 | Balancer V1 | Token & Share Accounting | Rounding Error | Ethereum | $234K |
| 2026-08-28 | Fogo Foundation | Key Compromise | Private Key Compromised | Fogo | $3.0M |
| 2026-08-28 | Virtue | Oracle Manipulation | Oracle Misconfiguration | Iota | $895K |
| 2026-08-28 | Ajna V2 | Protocol Logic | Liquidation Logic Flaw | Ethereum | $775K |
| 2026-08-28 | Avici | Protocol Logic | Withdrawal Logic Flaw | Solana | $501K |
| 2026-08-27 | Moonwell Lending | Oracle Manipulation | Spot Price Manipulation | Base | $8.7M |
| 2026-08-25 | CometDEX | Token & Share Accounting | Incorrect Share Accounting | Stellar | $717K |
| 2026-08-25 | Enjin | Access Control | Ownership Takeover | Ethereum | $162K |
| 2026-08-24 | Nesa | Token & Share Accounting | Arithmetic Error | Nesa | $50.0M |
| 2026-08-23 | TermFinance Vaults | Governance | Malicious Proposal | Ethereum | $8.5M |
| 2026-08-22 | KiiChain | Token & Share Accounting | Arithmetic Error | KiiChain | $9.7M |
| 2026-08-22 | TAC | Protocol Logic | Withdrawal Logic Flaw | TAC | $7.5M |
| 2026-08-22 | The Sandbox | Access Control | Improper Access Control | Base, BSC, Ethereum | $675K |
| 2026-08-19 | BounceBit | Access Control | Improper Access Control | BounceBit | $3.0M |
| 2026-08-19 | Allbridge | Bridge & Cross-Chain | Bridge Logic Flaw | Base | $191K |
| 2026-08-18 | Maya Protocol | Protocol Logic | Withdrawal Logic Flaw | Mayachain | $1.7M |
| 2026-08-11 | Harmony Bridge | Bridge & Cross-Chain | Bridge Logic Flaw | Harmony | $3.2M |
| 2026-08-09 | Coinsbuy | Access Control | Improper Access Control | Ethereum, Tron | $7.9M |
| 2026-08-09 | Coreum Bridge | Bridge & Cross-Chain | Bridge Logic Flaw | XRPL, Coreum | $200K |
| 2026-08-08 | Oraichain | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Oraichain | $1.0M |
| 2026-08-06 | RRWallet | Key Compromise | Weak Key Generation | Bitcoin | $2.0M |
| 2026-08-05 | KITE Foundation | Key Compromise | Private Key Compromised | Ethereum | $13.3M |
| 2026-08-03 | RISEx | Access Control | Improper Access Control | RISE | $673K |
| 2026-08-02 | MOKE | Oracle Manipulation | Spot Price Manipulation | BSC | $907K |
| 2026-08-02 | LOOPSDAO | Oracle Manipulation | Spot Price Manipulation | BSC | $694K |
| 2026-07-31 | COLDCARD | Key Compromise | Weak Key Generation | Bitcoin | $116.0M |
| 2026-07-30 | Swan Treasury | Key Compromise | Private Key Compromised | BSC | $625K |
| 2026-07-28 | Crypto DAO | Access Control | Improper Access Control | BSC | $8.2M |
| 2026-07-28 | LULA | Access Control | Improper Access Control | BSC | $578K |
| 2026-07-26 | WEMIX.FI Lend | Access Control | Improper Access Control | Wemix | $737K |
| 2026-07-26 | ChainConnect | Access Control | Improper Access Control | Ethereum, BSC, Avalanche, Polygon | $650K |
| 2026-07-26 | Garden | Frontend & Infrastructure | Database Breach | Ethereum, Base, Arbitrum, BSC | $450K |
| 2026-07-25 | Projekt | Input Validation | Missing Input Validation | Ethereum | $560K |
| 2026-07-25 | Bankr | Social Engineering | Social Account Takeover | Base | $480K |
| 2026-07-24 | Triple-A | Key Compromise | Hot Wallet Key Compromised | Ethereum, Tron, Arbitrum | $9.7M |
| 2026-07-23 | Solido Cash | Oracle Manipulation | Oracle Misconfiguration | Supra | $900K |
| 2026-07-23 | Lien | Input Validation | Missing Input Validation | Ethereum | $542K |
| 2026-07-22 | AFX Bridge | Key Compromise | Validator Key Compromised | Arbitrum | $24.1M |
| 2026-07-22 | Verus-Ethereum Bridge | Bridge & Cross-Chain | Forged Proof | Verus | $7.5M |
| 2026-07-22 | Zilliqa | Key Compromise | Weak Key Generation | Zilliqa | $1.6M |
| 2026-07-21 | Wanchain | Input Validation | Signature Verification Flaw | Cardano | $10.0M |
| 2026-07-21 | 42DAO | Oracle Manipulation | Spot Price Manipulation | BSC | $912K |
| 2026-07-19 | Allbridge Core | Protocol Logic | Withdrawal Logic Flaw | Solana | $1.6M |
| 2026-07-17 | Across | Bridge & Cross-Chain | Spoofed Event Log | Solana | $4.5M |
| 2026-07-16 | DefiTuna Lending | Protocol Logic | Swap Logic Flaw | Solana | $580K |
| 2026-07-16 | CrowdRingCircle | Token & Share Accounting | Incorrect Share Accounting | BSC | $209K |
| 2026-07-15 | Ostium | Key Compromise | Private Key Compromised | Arbitrum | $23.8M |
| 2026-07-15 | Cascade Liquidity Strategy | Oracle Manipulation | Spot Price Manipulation | Arbitrum | $1.3M |
| 2026-07-15 | TeleSwap | Key Compromise | Hot Wallet Key Compromised | Bitcoin | $735K |
| 2026-07-14 | BarnBridge | Governance | Malicious Proposal | Ethereum | $776K |
| 2026-07-13 | Lumi Finance | Input Validation | Signature Verification Flaw | Arbitrum | $270K |
| 2026-07-11 | Bonzo Lend | Oracle Manipulation | Spot Price Manipulation | Hedera | $9.1M |
| 2026-07-11 | BlueMove DEX | Token & Share Accounting | Incorrect Share Accounting | Sui | $529K |
| 2026-07-08 | BFB | Token & Share Accounting | Incorrect Share Accounting | BSC | $198K |
| 2026-07-06 | BonkDAO | Governance | Malicious Proposal | Solana | $20.0M |
| 2026-07-05 | Lazy Summer Protocol | Token & Share Accounting | Donation Attack | Ethereum | $6.0M |
| 2026-07-02 | Hinkal | Protocol Logic | Deposit Logic Flaw | Ethereum | $820K |
| 2026-06-30 | Edel | Oracle Manipulation | Spot Price Manipulation | Ethereum | $403K |
| 2026-06-25 | Polymarket International | Frontend & Infrastructure | Frontend Compromise | Polygon | $3.0M |
| 2026-06-24 | DLMC | Oracle Manipulation | Spot Price Manipulation | BSC | $223K |
| 2026-06-23 | SecondFi | Key Compromise | Weak Key Generation | Cardano | $2.4M |
| 2026-06-23 | Royal.io | Token & Share Accounting | Incorrect Share Accounting | Polygon | $263K |
| 2026-06-21 | Taiko Bridge | Bridge & Cross-Chain | Forged Proof | Taiko | $1.7M |
| 2026-06-20 | JaredFromSubway MEV Bot | Market Manipulation | MEV Bot Drained | Ethereum | $7.5M |
| 2026-06-20 | LABUBU/OLPC | Token & Share Accounting | Decimal Miscalculation | BSC | $1.1M |
| 2026-06-19 | Secret Network | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Secret | $4.7M |
| 2026-06-19 | Namada Shielded Pools | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Namada | $600K |
| 2026-06-19 | mySwap CL | Token & Share Accounting | Incorrect Share Accounting | Starknet | $305K |
| 2026-06-17 | Aztec Bridge | Bridge & Cross-Chain | Bridge Logic Flaw | Ethereum | $2.0M |
| 2026-06-17 | Little Boy Plus | Token & Share Accounting | Arithmetic Error | BSC | $367K |
| 2026-06-16 | RetoSwap | Governance | Malicious Proposal | Monero | $2.7M |
| 2026-06-14 | Aztec Connect | Bridge & Cross-Chain | Forged Proof | Ethereum | $2.1M |
| 2026-06-10 | Axelar Secret IBC Bridge | Bridge & Cross-Chain | Unbacked Cross-Chain Mint | Ethereum, Secret | $4.7M |
| 2026-06-10 | Raydium AMM | Token & Share Accounting | Infinite Mint | Solana | $1.3M |
| 2026-06-09 | Token of Power | Governance | Malicious Proposal | Ethereum | $1.6M |
| 2026-06-08 | Humanity | Key Compromise | Private Key Compromised | Ethereum, BSC | $32.0M |
| 2026-06-08 | Flooring Protocol | Token & Share Accounting | Infinite Mint | Ethereum | $500K |
| 2026-06-07 | Syscoin Bridge | Bridge & Cross-Chain | Forged Proof | Syscoin | $10.0M |
| 2026-06-03 | ATM | Protocol Logic | Swap Logic Flaw | BSC | $243K |
| 2026-06-01 | TSR | Token & Share Accounting | Infinite Mint | BSC | $2.5M |
| 2026-06-01 | TesseraDAO | Access Control | Improper Access Control | BSC | $2.4M |
| 2026-06-01 | Gnosis Pay | Input Validation | Signature Verification Flaw | Gnosis Chain | $1.5M |
| 2026-05-31 | AROS | Oracle Manipulation | Spot Price Manipulation | BSC | $295K |
| 2026-05-31 | Fluid Lending | Frontend & Infrastructure | Key Leaked via Infrastructure | Ethereum | $215K |
| 2026-05-30 | Gravity Bridge | Key Compromise | Validator Key Compromised | Ethereum | $5.4M |
| 2026-05-30 | Alephium Bridge | Bridge & Cross-Chain | Forged Proof | Ethereum | $815K |
| 2026-05-30 | AFI Protocol | Protocol Logic | Unknown | Ethereum | $480K |
| 2026-05-28 | DxSale | Rugpull | Liquidity Rug | BSC | $7.3M |
| 2026-05-27 | SUPERFORTUNE AI | Access Control | Improper Access Control | Ethereum | $15.2M |
| 2026-05-26 | SKP | Token & Share Accounting | Incorrect Share Accounting | BSC | $212K |
| 2026-05-25 | New Market Trading | Access Control | Improper Access Control | Ethereum, Base, Arbitrum | $4.0M |
| 2026-05-25 | WUSD.fi/Glove | Protocol Logic | Reward Logic Flaw | Ethereum | $200K |
| 2026-05-23 | StablR | Key Compromise | Private Key Compromised | Ethereum | $2.8M |
| 2026-05-22 | Polymarket | Key Compromise | Private Key Compromised | Polygon | $700K |
| 2026-05-20 | RetoSwap | Input Validation | Missing Input Validation | Monero | $2.7M |
| 2026-05-19 | Bankr | Frontend & Infrastructure | Session Key Compromised | Base | $170K |
| 2026-05-18 | Echo Bridge | Key Compromise | Private Key Compromised | Monad | $821K |
| 2026-05-17 | Verus-Ethereum Bridge | Bridge & Cross-Chain | Forged Proof | Verus | $11.5M |
| 2026-05-17 | SEA Token | Oracle Manipulation | Spot Price Manipulation | Arbitrum | $153K |
| 2026-05-16 | Adshares | Bridge & Cross-Chain | Forged Proof | Ethereum | $628K |
| 2026-05-15 | THORChain DEX | Bridge & Cross-Chain | Bridge Logic Flaw | Bitcoin, Ethereum, Base, BSC | $10.7M |
| 2026-05-13 | Transit Finance | Access Control | Improper Access Control | Tron | $1.9M |
| 2026-05-12 | Aurellion | Access Control | Uninitialized Proxy | Arbitrum | $456K |
| 2026-05-12 | SQ Protocol | Access Control | Improper Access Control | BSC | $346K |
| 2026-05-12 | BoostHook | Oracle Manipulation | Spot Price Manipulation | Ethereum | $187K |
| 2026-05-11 | TAC Protocol | Bridge & Cross-Chain | Proof Verifier Bug | TON, TAC | $2.9M |
| 2026-05-11 | INK Finance | Access Control | Caller Impersonation | Polygon | $140K |
| 2026-05-10 | Renegade | Access Control | Uninitialized Proxy | Arbitrum | $209K |
| 2026-05-07 | TrustedVolumes | Access Control | Caller Impersonation | Ethereum | $6.7M |
| 2026-05-05 | Ekubo | Access Control | Token Approval Abuse | Ethereum | $1.4M |
| 2026-05-04 | SquidRouterModule | Access Control | Improper Access Control | Ethereum, Base | $3.2M |
| 2026-05-01 | Bisq | Input Validation | Missing Input Validation | Bitcoin | $550K |
| 2026-04-30 | Wasabi Perps | Key Compromise | Deployer Key Compromised | Ethereum, Base, Berachain, Blast | $5.5M |
| 2026-04-29 | Sweat Foundation | Protocol Logic | Withdrawal Logic Flaw | NEAR | $3.5M |
| 2026-04-29 | Aftermath Perps | Protocol Logic | Withdrawal Logic Flaw | Sui | $1.1M |
| 2026-04-29 | Syndicate | Bridge & Cross-Chain | Bridge Logic Flaw | Base | $380K |
| 2026-04-28 | YieldCore-3rd-deal | Access Control | Improper Access Control | Ethereum | $399K |
| 2026-04-28 | JUDAO | Token & Share Accounting | Arithmetic Error | BSC | $228K |
| 2026-04-28 | Quant | Access Control | Arbitrary External Call | Ethereum | $138K |
| 2026-04-27 | Singularity Finance | Oracle Manipulation | Oracle Misconfiguration | Base | $413K |
| 2026-04-27 | ZetaChain | Access Control | Token Approval Abuse | Ethereum, Base, Polygon, Arbitrum, Avalanche, BSC | $334K |
| 2026-04-26 | Scallop Lend | Protocol Logic | Reward Logic Flaw | Sui | $142K |
| 2026-04-25 | Purrlend | Access Control | Caller Impersonation | MegaETH, Hyperliquid L1 | $1.5M |
| 2026-04-23 | Giddy | Input Validation | Incomplete Signature Coverage | Ethereum | $1.3M |
| 2026-04-21 | Volo Vault | Key Compromise | Private Key Compromised | Sui | $3.5M |
| 2026-04-20 | Transit Finance | Protocol Logic | Unknown | Ethereum | $258K |
| 2026-04-18 | Kelp | Bridge & Cross-Chain | Cross-Chain Message Spoofing | Ethereum, Arbitrum | $293.0M |
| 2026-04-16 | Rhea Lend | Oracle Manipulation | Spot Price Manipulation | NEAR | $18.4M |
| 2026-04-16 | Grinex | Key Compromise | Hot Wallet Key Compromised | Tron, Ethereum | $13.7M |
| 2026-04-14 | CoW Swap | Frontend & Infrastructure | DNS Hijack | Ethereum | $1.2M |
| 2026-04-13 | Dango | Input Validation | Missing Input Validation | Dango | $1.9M |
| 2026-04-12 | Hyperbridge | Bridge & Cross-Chain | Forged Proof | Ethereum, Base, BSC, Arbitrum | $2.5M |
| 2026-04-09 | Aethir | Access Control | Improper Access Control | BSC | $400K |
| 2026-04-07 | SquidMulticall | Access Control | Improper Access Control | Arbitrum, BSC, Avalanche, Optimism, Base | $517K |
| 2026-04-05 | Denaria vAMM | Oracle Manipulation | Spot Price Manipulation | Linea | $166K |
| 2026-04-04 | BSC TMM/USDT | Access Control | Improper Access Control | BSC | $1.7M |
| 2026-04-03 | Silo V2 | Oracle Manipulation | Oracle Misconfiguration | Arbitrum | $359K |
| 2026-04-01 | Drift Trade | Access Control | Proxy Upgrade Hijack | Solana | $295.0M |
| 2026-03-31 | LML/USDT staking protocol | Oracle Manipulation | Spot Price Manipulation | BSC | $950K |
| 2026-03-28 | GoonFi | Protocol Logic | Swap Logic Flaw | Solana | $254K |
| 2026-03-23 | BCE | Token & Share Accounting | Incorrect Share Accounting | BSC | $679K |
| 2026-03-22 | Cyrus Finance | Oracle Manipulation | Spot Price Manipulation | BSC | $5.0M |
| 2026-03-21 | Resolv USR | Frontend & Infrastructure | Key Leaked via Infrastructure | Ethereum | $24.5M |
| 2026-03-17 | dTRINITY dLEND | Token & Share Accounting | First Depositor Attack | Ethereum | $257K |
| 2026-03-15 | Venus Core Pool | Token & Share Accounting | Donation Attack | BSC | $3.7M |
| 2026-03-12 | Aave V3 | Oracle Manipulation | Oracle Misconfiguration | Ethereum | $862K |
| 2026-03-12 | Stake DAO Yield | Access Control | Caller Impersonation | Arbitrum, Base | $176K |
| 2026-03-11 | DBXen | Input Validation | Missing Input Validation | Ethereum | $150K |
| 2026-03-10 | Movie Token | Token & Share Accounting | Incorrect Share Accounting | BSC | $242K |
| 2026-03-09 | Gondi V3 | Access Control | Token Approval Abuse | Ethereum | $230K |
| 2026-03-06 | SolvBTC | Token & Share Accounting | Infinite Mint | Ethereum | $2.7M |
| 2026-03-02 | FOOM Cash | Bridge & Cross-Chain | Forged Proof | Ethereum, Base | $2.3M |
| 2026-03-02 | Curve LlamaLend | Token & Share Accounting | Donation Attack | Ethereum | $240K |
| 2026-02-26 | Ploutos Money | Oracle Manipulation | Oracle Misconfiguration | Ethereum | $390K |
| 2026-02-23 | DGLD | Token & Share Accounting | Infinite Mint | Base | $250K |
| 2026-02-22 | Blend Pools V2 | Oracle Manipulation | Spot Price Manipulation | Stellar | $11.0M |
| 2026-02-22 | LAXO | Token & Share Accounting | Incorrect Share Accounting | BSC | $190K |
| 2026-02-21 | IoTeX | Key Compromise | Validator Key Compromised | Ethereum | $4.4M |
| 2026-02-19 | Velar Perps | Oracle Manipulation | Predictable Oracle Update | Mezo | $401K |
| 2026-02-15 | Moonwell Lending | Oracle Manipulation | Oracle Misconfiguration | Base | $1.8M |
| 2026-02-01 | CrossCurve | Bridge & Cross-Chain | Cross-Chain Message Spoofing | — | $3.0M |
| 2026-01-31 | Step Finance | Key Compromise | Private Key Compromised | Solana | $40.0M |
| 2026-01-25 | Matcha | Frontend & Infrastructure | Frontend Compromise | Base, Ethereum | $13.4M |
| 2026-01-25 | Aperture LM | Access Control | Token Approval Abuse | Ethereum, Base, BSC | $3.7M |
| 2026-01-21 | Saga | Token & Share Accounting | Infinite Mint | Saga | $7.0M |
| 2026-01-20 | SynapLogic | Protocol Logic | Unknown | Base | $144K |
| 2026-01-19 | Makina | Oracle Manipulation | Spot Price Manipulation | Ethereum | $4.2M |
| 2026-01-17 | Meteora DAMM V2 | Social Engineering | Impersonation Scam | Solana | $1.5M |
| 2026-01-13 | YO Protocol | Protocol Logic | Missing Slippage Check | Ethereum | $3.6M |
| 2026-01-10 | FutureSwap | Protocol Logic | Withdrawal Logic Flaw | Arbitrum | $395K |
| 2026-01-08 | Truebit | Token & Share Accounting | Arithmetic Error | Ethereum | $26.4M |
| 2026-01-07 | Polycule | Frontend & Infrastructure | Key Leaked via Infrastructure | Polygon | $230K |
| 2026-01-06 | Fusion by IPOR | Access Control | Arbitrary External Call | Arbitrum | $336K |
| 2026-01-05 | USDGambit and TLP | Key Compromise | Deployer Key Compromised | Arbitrum | $1.5M |
| 2026-01-05 | TMX TRIBE | Token & Share Accounting | Arithmetic Error | Arbitrum | $1.4M |
Source: DefiLlama, retrieved 3 October 2026, under its open methodology. Figures are a dated snapshot, not a live feed.