Major crypto exploits, year-to-date
Aggregated incidents across DeFi, CEX, bridges, and wallets. Filter to spot emerging attack trends.
Total stolen
$9.09B
62 incidents
Recovered
$2942M
32.4% recovery rate
Largest single loss
$1460.0M
Chains affected
10
across active filters
Chain
Category
Cumulative losses · last 10 years
$9.09B totalLosses by year
11 yearsAttack vectors by $ lost
Private Key Compromise$3924.7M · 43%
Bridge Exploit$2098.4M · 23%
Social Engineering$1535.2M · 17%
Access Control$361.7M · 4%
Flash Loan$309.0M · 3%
Smart Contract Bug$289.8M · 3%
Reentrancy$194.5M · 2%
Phishing$159.4M · 2%
Frontend Hijack$132.0M · 1%
Oracle Manipulation$83.5M · 1%
Incident log · 62 events
live feed| Chain | Category | Vulnerability | Recovery | Source | |||
|---|---|---|---|---|---|---|---|
| May 21 | BaseLend Deprecated multisig retained owner privileges. | Base | DeFi | Access Control | $18.60M +$7.5M back | Partial | CertiK |
| May 13 | BNBVault Single-source Chainlink fallback manipulated via low liq. | BNB Chain | DeFi | Oracle Manipulation | $22.10M | Lost | PeckShield |
| May 05 | SolanaSwapr Atomic arb reverted by validator coordination. | Solana | DeFi | Flash Loan | $9.80M +$9.8M back | Recovered | Immunefi |
| Apr 27 | BinarisCEX Cold storage breach attributed to nation-state actor. | Ethereum | CEX | Private Key Compromise | $198.40M +$45.0M back | Partial | SlowMist |
| Apr 18 | HyperBridge Light-client proof verifier accepted malformed headers. | Arbitrum | Bridge | Bridge Exploit | $76.90M +$3.0M back | Ongoing | CertiK |
| Apr 10 | ApeNFT Market Discord admin compromise → fake mint stole assets. | Ethereum | NFT | Social Engineering | $11.20M | Lost | PeckShield |
| Apr 02 | OptiYield Cross-function reentrancy in reward distributor. | Optimism | DeFi | Reentrancy | $27.60M +$9.0M back | Partial | Immunefi |
| Mar 25 | AvaxKingdom DNS hijack served malicious approval prompts. | Avalanche | Gaming | Frontend Hijack | $4.80M | Lost | CertiK |
| Mar 17 | PolyLend Rounding error patched; funds returned via bounty. | Polygon | DeFi | Smart Contract Bug | $14.30M +$14.3M back | Recovered | PeckShield |
| Mar 09 | Tronix Exchange Insider exfiltration of multisig signer keys. | Tron | CEX | Private Key Compromise | $88.00M +$22.0M back | Partial | SlowMist |
| Mar 01 | BasedPerps Unprotected admin function set fee recipient to attacker. | Base | DeFi | Access Control | $33.10M +$1.5M back | Ongoing | Immunefi |
| Feb 19 | MetaVaultX Mass phishing kit drained delegated approvals. | Ethereum | Wallet | Phishing | $6.70M | Lost | CertiK |
| Feb 11 | SolFlare Pools Pyth feed lag exploited for arbitrage drain. | Solana | DeFi | Oracle Manipulation | $19.40M +$4.2M back | Partial | PeckShield |
| Feb 03 | Krakenize Hot wallet keys exfiltrated via supply-chain attack. | Bitcoin | CEX | Private Key Compromise | $312.00M | Lost | SlowMist |
| Jan 22 | ZenithSwap Whitehat returned funds after reentrancy in claim(). | BNB Chain | DeFi | Reentrancy | $8.90M +$8.9M back | Recovered | Immunefi |
| Jan 14 | NovaBridge Signature verification flaw allowed forged withdrawal proofs. | Ethereum | Bridge | Bridge Exploit | $124.50M | Ongoing | CertiK |
| Jan 08 | OrbitDEX Flash loan-driven price manipulation drained LP pools. | Arbitrum | DeFi | Flash Loan | $47.20M +$12.0M back | Partial | PeckShield |
| Nov 02 | GMX v2 Sequencer-induced oracle skew exploited for perps PnL. | Arbitrum | DeFi | Oracle Manipulation | $42.00M +$5.0M back | Partial | PeckShield |
| Sep 14 | Aerodrome Frontend DNS hijack injected malicious swap router. | Base | DeFi | Frontend Hijack | $7.20M +$2.1M back | Partial | CertiK |
| Jun 18 | Nobitex Politically motivated burn of Iranian exchange reserves. | Bitcoin | CEX | Private Key Compromise | $81.00M | Lost | SlowMist |
| Apr 09 | ZkLend Rounding error in collateralization check. | Ethereum | DeFi | Smart Contract Bug | $9.50M +$3.0M back | Partial | PeckShield |
| Feb 21 | Bybit Safe{Wallet} UI spoofed during signing — largest crypto hack ever. | Ethereum | CEX | Social Engineering | $1460.00M +$42.0M back | Partial | SlowMist |
| Nov 21 | DEXX Private keys stored client-side; mass drain. | Solana | DeFi | Smart Contract Bug | $21.00M | Lost | CertiK |
| Oct 16 | Radiant Capital Malware-laced PDF compromised 3 multisig signers. | Arbitrum | DeFi | Private Key Compromise | $50.00M | Lost | PeckShield |
| Jul 18 | WazirX Multisig signer device compromise by Lazarus. | Ethereum | CEX | Private Key Compromise | $230.00M | Lost | Chainalysis |
| May 31 | DMM Bitcoin 4,500 BTC moved out of Japanese exchange. | Bitcoin | CEX | Private Key Compromise | $305.00M | Lost | SlowMist |
| Jan 30 | Ripple Co-founder Wallet Personal XRP wallet drained via phishing. | Ethereum | Wallet | Phishing | $112.00M | Lost | SlowMist |
| Nov 22 | KyberSwap Concentrated-liquidity tick math exploited. | Ethereum | DeFi | Smart Contract Bug | $48.00M +$4.7M back | Partial | PeckShield |
| Sep 22 | Mixin Network Cloud database breach exposed deposit keys. | Ethereum | Bridge | Bridge Exploit | $200.00M +$20.0M back | Partial | CertiK |
| Sep 12 | CoinEx Hot wallets across 11 chains drained by Lazarus. | Ethereum | CEX | Private Key Compromise | $70.00M | Lost | SlowMist |
| Jul 30 | Curve Finance Vyper compiler bug enabled reentrancy across stable pools. | Ethereum | DeFi | Reentrancy | $73.00M +$52.0M back | Partial | PeckShield |
| Jun 03 | Atomic Wallet Mass desktop wallet compromise attributed to Lazarus. | Ethereum | Wallet | Private Key Compromise | $100.00M | Lost | Chainalysis |
| Mar 13 | Euler Finance Donation function bypassed health checks; attacker returned funds. | Ethereum | DeFi | Smart Contract Bug | $197.00M +$197.0M back | Recovered | PeckShield |
| Nov 11 | FTX Mass outflow during bankruptcy; insider attribution suspected. | Ethereum | CEX | Private Key Compromise | $477.00M +$100.0M back | Partial | Chainalysis |
| Oct 06 | BNB Chain Bridge IAVL proof forgery; validators paused chain to stop attacker. | BNB Chain | Bridge | Bridge Exploit | $570.00M +$430.0M back | Partial | CertiK |
| Aug 03 | Slope Wallets Seed phrases logged to Sentry leaked thousands of wallets. | Solana | Wallet | Private Key Compromise | $8.00M | Lost | SlowMist |
| Aug 02 | Nomad Bridge Faulty Merkle root init turned bridge into a free-for-all. | Ethereum | Bridge | Bridge Exploit | $190.00M +$36.0M back | Partial | CertiK |
| Apr 17 | Beanstalk Flash-loaned governance vote drained the protocol. | Ethereum | DeFi | Flash Loan | $182.00M | Lost | PeckShield |
| Mar 23 | Ronin Bridge Lazarus social-engineered 5/9 validator keys. | Ethereum | Bridge | Private Key Compromise | $624.00M +$30.0M back | Partial | Chainalysis |
| Feb 02 | Wormhole Signature verification bypass; Jump backstopped loss. | Solana | Bridge | Bridge Exploit | $326.00M +$326.0M back | Recovered | CertiK |
| Dec 05 | BitMart Hot wallets drained across ETH and BSC. | Ethereum | CEX | Private Key Compromise | $196.00M | Lost | SlowMist |
| Dec 02 | BadgerDAO Malicious Cloudflare worker injected approval prompts. | Ethereum | DeFi | Frontend Hijack | $120.00M +$9.0M back | Partial | PeckShield |
| Aug 19 | Liquid Global Warm wallet compromise across multiple assets. | Ethereum | CEX | Private Key Compromise | $97.00M +$16.0M back | Partial | SlowMist |
| Aug 10 | Poly Network Cross-chain manager keeper hijacked; whitehat returned all. | Ethereum | Bridge | Bridge Exploit | $611.00M +$611.0M back | Recovered | CertiK |
| May 19 | PancakeBunny Flash loan inflated BUNNY mint, then dumped. | BNB Chain | DeFi | Flash Loan | $45.00M | Lost | CertiK |
| Oct 26 | Harvest Finance Curve y-pool price manipulated via flash loan. | Ethereum | DeFi | Flash Loan | $24.00M +$2.5M back | Partial | PeckShield |
| Sep 26 | KuCoin Hot wallet keys leaked; most assets frozen by issuers. | Ethereum | CEX | Private Key Compromise | $281.00M +$240.0M back | Recovered | SlowMist |
| Apr 18 | Lendf.Me ERC-777 reentrancy; attacker returned funds. | Ethereum | DeFi | Reentrancy | $25.00M +$25.0M back | Recovered | PeckShield |
| Feb 15 | bZx First major flash loan price manipulation. | Ethereum | DeFi | Flash Loan | $0.98M | Lost | PeckShield |
| Nov 26 | Upbit 342k ETH moved from hot wallet. | Ethereum | CEX | Private Key Compromise | $49.00M | Lost | SlowMist |
| May 07 | Binance API keys + 2FA phished from users; SAFU covered losses. | Bitcoin | CEX | Phishing | $40.70M +$40.7M back | Recovered | SlowMist |
| Jan 15 | Cryptopia Wallet server keys stolen; exchange later liquidated. | Ethereum | CEX | Private Key Compromise | $16.00M +$4.0M back | Partial | PeckShield |
| Sep 14 | Zaif Hot wallet keys exfiltrated from Japanese exchange. | Bitcoin | CEX | Private Key Compromise | $60.00M | Lost | SlowMist |
| Jun 20 | Bithumb Insider-aided wallet compromise. | Ethereum | CEX | Private Key Compromise | $31.00M +$14.0M back | Partial | SlowMist |
| Jun 10 | Coinrail Korean exchange hot wallet drained. | Ethereum | CEX | Private Key Compromise | $40.00M +$16.0M back | Partial | PeckShield |
| Jan 26 | Coincheck NEM hot wallet keys stolen via spear phishing. | Ethereum | CEX | Private Key Compromise | $534.00M +$425.0M back | Partial | Chainalysis |
| Dec 07 | NiceHash Engineer credentials phished; mining payouts diverted. | Bitcoin | CEX | Social Engineering | $64.00M +$64.0M back | Recovered | SlowMist |
| Nov 06 | Parity Library Suicide call on shared library froze 513k ETH forever. | Ethereum | Wallet | Access Control | $280.00M | Lost | CertiK |
| Jul 19 | Parity Multisig Unprotected initWallet allowed ownership takeover. | Ethereum | Wallet | Access Control | $30.00M +$12.0M back | Partial | PeckShield |
| Apr 22 | Yapizon Hot wallets emptied from Korean exchange. | Bitcoin | CEX | Private Key Compromise | $5.30M | Lost | SlowMist |
| Aug 02 | Bitfinex Multisig hot wallet keys compromised; 120k BTC stolen. | Bitcoin | CEX | Private Key Compromise | $72.00M +$18.0M back | Partial | SlowMist |
| Jun 17 | The DAO Recursive call drained the DAO; chain forked to restore funds. | Ethereum | DeFi | Reentrancy | $60.00M +$60.0M back | Recovered | PeckShield |