Security incidents
Hacks, exploits and protocol failures recorded by the desk, with the date, the reported amount where a source states one, and a link to the record.
Reported losses by year
Sums use only amounts a source stated. Incidents without a reported figure are excluded.
- 2026: 280 incidents, $20.53bn reported
- 2025: 122 incidents, $2.80bn reported
- 2024: 158 incidents, $1.67bn reported
- 2023: 161 incidents, $1.62bn reported
- 2022: 141 incidents, $3.63bn reported
- 2021: 119 incidents, $2.86bn reported
| Incident | Date | Reported amount | Status |
|---|---|---|---|
| BoostHook: Spot Price Manipulation | 12 May 2026 | $187.0k | Reported |
| Aurellion: Uninitialized Proxy | 12 May 2026 | $456.4k | Reported |
| INK Finance: Caller Impersonation | 11 May 2026 | $140.0k | Reported |
| Huma: Improper Access Control | 11 May 2026 | $101.4k | Reported |
| TAC Protocol: Proof Verifier Bug | 11 May 2026 | $2.85m | Reported |
| Renegade: Uninitialized Proxy | 10 May 2026 | $209.0k | Recovered |
| TrustedVolumes: Caller Impersonation | 7 May 2026 | $6.70m | Reported |
| Ekubo: Token Approval Abuse | 5 May 2026 | $1.40m | Reported |
| SquidRouterModule: Improper Access Control | 4 May 2026 | $3.20m | Reported |
| Bisq: Missing Input Validation | 1 May 2026 | $550.0k | Reported |
| Wasabi Perps: Deployer Key Compromised | 30 Apr 2026 | $5.50m | Reported |
| Sweat Foundation: Withdrawal Logic Flaw | 29 Apr 2026 | $3.50m | Reported |
| Syndicate: Bridge Logic Flaw | 29 Apr 2026 | $380.0k | Recovered |
| Aftermath Perps: Withdrawal Logic Flaw | 29 Apr 2026 | $1.14m | Reported |
| JUDAO: Arithmetic Error | 28 Apr 2026 | $228.0k | Reported |
| YieldCore-3rd-deal: Improper Access Control | 28 Apr 2026 | $398.8k | Reported |
| Quant: Arbitrary External Call | 28 Apr 2026 | $138.0k | Reported |
| Singularity Finance: Oracle Misconfiguration | 27 Apr 2026 | $413.0k | Reported |
| ZetaChain: Token Approval Abuse | 27 Apr 2026 | $333.9k | Reported |
| Scallop Lend: Reward Logic Flaw | 26 Apr 2026 | $142.0k | Reported |
| Purrlend: Caller Impersonation | 25 Apr 2026 | $1.50m | Reported |
| Giddy: Incomplete Signature Coverage | 23 Apr 2026 | $1.30m | Reported |
| Volo Vault: Private Key Compromised | 21 Apr 2026 | $3.50m | Reported |
| Transit Finance: Unknown | 20 Apr 2026 | $257.8k | Reported |
| Kelp: Cross-Chain Message Spoofing | 18 Apr 2026 | $293.00m | Reported |
Download this dataset
The files contain the recorded rows, including incidents without a reported amount.