YFarmX logoYFarmXIntelligence for an accelerating worldBriefings
YFarmX logoYFarmX
YFarmX
Security Desk · live log

Crypto Exploit Tracker

$5.87bn in recorded losses across 165 logged incidents

Crypto security incidents we log: what was hit, the reported loss estimate, and how the attack actually worked, with the on-chain references and sources attached. Maintained by the Security Desk; updated as incidents are verified. Estimates include theft and investor losses, as identified in each record, and may change as evidence develops.

Updated 25 Oct 2026 · 165 incidents · 22 months tracked

Showing 165 of 165 incidents · $5.87bn in view

Overview
Total lossAll time$5.87bnCumulative, Jan 2025 to date
2026 so farYear to date$2.45bn111 incidents · 2025 total $3.42bn
Biggest single hitAll time$1.40bnBybit Multisig Cold-Wallet Hack · 24% of all losses
Major incidentsAll time165Logged per month, Jan 2025 to date
Most common vectorAll timeAccess Control41 of 165 incidents
Days since last hackLogged–Days between the last 25 hacks

Where the money went · by vector

  1. Access Control$2.40bn40.8%
  2. Phishing$800M13.6%
  3. Other$686M11.7%
  4. Third-party security appliance compromise$388M6.6%
  5. Software Bug$330M5.6%
  6. Bridge Exploit$328M5.6%
  7. Rugpull$298M5.1%
  8. Oracle Manipulation$207M3.5%
  9. Private Key Compromise$204M3.5%
  10. Under investigation$103M1.8%
  11. Smart Contract Bug$41M0.7%
  12. Governance Attack$34M0.6%
  13. Flash Loan$20M0.3%
  14. Private key compromise$13M0.2%
  15. Bridge$7.5M0.1%
  16. Unauthorised server access$3M0.1%
  17. Supply Chain$3M0.1%
  18. MoveVM state validation$2.7M0.0%
  19. Vesting contract exploit$1.5M0.0%
  20. Weak key generation$1.3M0.0%
  21. Logic Flaw$316k0.0%
  22. Compromised wallet extension$0k0.0%
  23. Malicious server and fee-bump deception$0k0.0%

Losses · last 12 months

Loss severity · all time

165total
LowUnder $10M
11469.1%
Medium$10M – $50M
3219.4%
High$50M and above
1911.5%
  1. Yapeswap governance attack redirects vault depositsNewGovernance AttackEthereumDEX$22k
  2. X100 governance capture and treasury withdrawalsNewGovernance AttackEthereumTreasury$4.8M
  3. Initia security incident and chain haltNewMoveVM state validationInitiaLayer 1$2.7M
  4. Arkadiko governance attack drains vault assetsNewGovernance AttackStacksStablecoin$1.1M
  5. WAX bridge incident releases assets without the matching debitNewBridge ExploitMultichainBridge$91k
  6. NemTokenV2 liquidity accounting lets an attacker drain reservesNewSmart Contract BugBSCToken$822k
  7. Fearless browser extension exposed wallet keysNewCompromised wallet extensionPolkadotWallet–
  8. Slice withdrawals use assets that were never receivedNewSmart Contract BugBasePayments$41k
  9. Qubic wallet fixes weak random seed generationNewWeak key generationQubicWallet$1.3M
  10. Malicious Electrum servers trick users into signing paymentsNewMalicious server and fee-bump deceptionBitcoinWallet–
  11. UNCX vesting contracts lose about $1.49mVesting contract exploitMultichainDeFi$1.5M
  12. Gamdom reports more than $3m lost from hot walletsUnauthorised server accessUnknownGambling$3M
  13. Ledger reseller customers lose an estimated $103.4mUnder investigationMultichainWallet$103M, high severity
  14. 79th Vault reports a key compromise and returned fundsPrivate key compromiseBNB ChainDeFi$13M, medium severity
  15. Legacy auction keeper loses 200 ETH through exposed permissionsAccess ControlEthereumDeFi$543k
  16. Base vault loses $6m after malicious contract approvalAccess ControlBaseDeFi$6M
  17. MALT swap flaw causes a reported $72,000 lossLogic FlawPolygonDeFi$72k
  18. GoldPesa accounting flaw causes a reported $114,900 lossLogic FlawBaseDeFi$115k
  19. NEAR Intents recovers $3.8m taken in bridge incidentBridge ExploitMultichainCross-chain$3.8M
  20. Flaw in a Safe wallet add-on lets attacker take $307,000Access ControlEthereumWallet$307k
  21. MUSystem pays deposit bonuses twice, losing about $36,900Logic FlawEthereumDeFi$37k
  22. MCN Labs reward flaw causes a reported $92,600 lossLogic FlawBNB ChainDeFi$93k
  23. Fake Upbit GIWA bridge drains $2.07m from early usersPhishingEthereumBridge$2.1M
  24. Payy's Ethereum bridge contract drained of $1.83m in USDCBridge ExploitEthereumPayments$1.8M
  25. Stolen hot-wallet keys let an attacker empty crypto casino Duelbits on five blockchainsPrivate Key CompromiseMultichainGaming$6.1M
  26. Bitget hack: $387.5 million taken through compromised security appliancesThird-party security appliance compromiseMultichainCentralised Exchange$388M, high severity
  27. Old Magic Eden approvals let attacker take $1.77m in WETHAccess ControlMultichainNFT$1.8M
  28. Inflated NSTR oracle price lets one account borrow $3.5m from NostraOracle ManipulationStarknetLending$3.5M
  29. MEV bot captures 2,900 rsETH drained through a Safe module flawAccess ControlEthereumWallet$7.7M
  30. Signing flaw in D'CENT's app wallet lets attackers move user fundsSoftware BugMultichainWallet$6.6M
  31. Chainflip pays out twice on replayed Tron memosSoftware BugTronCross-chain$736k
  32. Unbacked nBTC minted on Nomic reaches Osmosis poolsSoftware BugCosmos / OsmosisBridge$3.1M
  33. Elements bug sends 4,000 BTC out of Liquid's reserve, 3,400 returnedSoftware BugLiquid / BitcoinBridge$320M, high severity
  34. GoodDollar publishes loss accounting for its September incidentSmart Contract BugMultichainStablecoin$125k
  35. Injective Binary-Options Exploit and Emergency UpgradeSmart Contract BugInjectiveDerivatives–
  36. Ontology Mainnet Halt After Malicious Attack ActivityOtherOntologyLayer 1–
  37. More Markets Lending Reserve Drain on Flow EVMSmart Contract BugFlowLending$410k
  38. Aquifer AMM Exploit on SolanaAccess ControlSolanaAMM$2.5M
  39. Balancer V1 Legacy Pool Rounding ErrorSmart Contract BugEthereumAMM$234k
  40. Tectonic Oracle Manipulation and Cronos HaltOracle ManipulationCronosLending$120M, high severity
  41. Avici Card Contract DrainAccess ControlSolanaPayments$501k
  42. Moonwell MAMO Market ExploitOracle ManipulationBaseBorrowing$8.7M
  43. CometDEX Backstop Pool DrainSmart Contract BugStellarAMM$718k
  44. Term Finance Vault Governance TakeoverGovernance AttackEthereumLending$8.5M
  45. TAC Cosmos EVM Balance Underflow DrainOtherTACLayer 1$7.5M
  46. The Sandbox OFT Bridge MintAccess ControlMultichainGaming$1.5M
  47. BounceBit Authorisation Exploit and L1 ShutdownAccess ControlBounceBitRestaking$3M
  48. Coldcard Mk3 Seed Entropy SweepPrivate Key CompromiseBitcoinWallet$116M, high severity
  49. Crypto DAO Vault DrainAccess ControlBNB ChainDeFi$52k
  50. WEMIX$ Stablecoin Contract TakeoverAccess ControlWEMIX3.0Stablecoin$731k
  51. Triple-A Hot Wallet DrainOtherMultichainPayments$9.7M
  52. AFX Trade Bridge ExploitAccess ControlArbitrumDerivatives$24M, medium severity
  53. Verus Ethereum Bridge Exploit (second)BridgeEthereumBridge$7.5M
  54. B² Network Staking ExploitAccess ControlBitcoin L2Staking$3.9M
  55. CascadeSmart Contract BugArbitrumPerps$1.3M
  56. OstiumOracle ManipulationArbitrumPerps$24M, medium severity
  57. Bonzo LendOracle ManipulationHederaLending$9M
  58. Summer.fiFlash LoanEthereumYield$6M
  59. BonkDAOGovernance AttackSolanaDeFi$20M, medium severity
  60. PolymarketSupply ChainPolygonDeFi$3M
  61. SecondFiPrivate Key CompromiseCardanoWallet$2.4M
  62. Taiko BridgeBridge ExploitEthereumBridge$1.7M
  63. JaredFromSubway MEV BotPhishingEthereumInfrastructure$7.5M
  64. Aztec Private Rollup BridgeSmart Contract BugEthereumBridge$2.2M
  65. Aztec ConnectSmart Contract BugEthereumInfrastructure$2.1M
  66. RaydiumSmart Contract BugSolanaDEX$1.3M
  67. Secret NetworkBridge ExploitSecret NetworkBridge$4.7M
  68. Humanity ProtocolPrivate Key CompromiseEthereumInfrastructure$31M, medium severity
  69. Syscoin BridgeBridge ExploitSyscoinBridge$10M, medium severity
  70. Gravity BridgePrivate Key CompromiseEthereumBridge$5.4M
  71. DxSaleAccess ControlBNB ChainDeFi$7.3M
  72. Ill Bloom Wallet VulnerabilityPrivate Key CompromiseMultichainWallet$5.2M
  73. New Market TradingAccess ControlEthereumDeFi$4M
  74. StablRPrivate Key CompromiseEthereumStablecoin$2.8M
  75. RetoSwapSmart Contract BugMoneroDEX$2.7M
  76. Verus–Ethereum BridgeBridge ExploitEthereumBridge$12M, medium severity
  77. Echo ProtocolPrivate Key CompromiseMonadYield$816k
  78. THORChainPrivate Key CompromiseMultichainDEX$11M, medium severity
  79. Transit FinanceSmart Contract BugTronDEX$1.9M
  80. TrustedVolumesAccess ControlEthereumDeFi$5.9M
  81. EkuboSmart Contract BugEthereumDEX$1.4M
  82. Wasabi ProtocolPrivate Key CompromiseEthereumPerps$5M
  83. Aftermath PerpsSmart Contract BugSuiPerps$1.1M
  84. Sweat EconomySmart Contract BugNEARDeFi$3.5M
  85. PurrlendSmart Contract BugHyperliquidLending$1.5M
  86. GiddySmart Contract BugEthereumWallet$1.3M
  87. VoloPrivate Key CompromiseSuiYield$3.5M
  88. Kelp DAOBridge ExploitMultichainYield$292M, high severity
  89. Rhea FinanceSmart Contract BugNEARLending$18M, medium severity
  90. GrinexPrivate Key CompromiseTronCEX$15M, medium severity
  91. CoW SwapPhishingEthereumDEX$1.2M
  92. HyperbridgeBridge ExploitEthereumBridge$2.5M
  93. Drift ProtocolAccess ControlSolanaPerps$286M, high severity
  94. Resolv LabsAccess ControlEthereumStablecoin$25M, medium severity
  95. VenusOtherBNB ChainBorrowing$2.2M
  96. USDC Permit Signature PhishPhishingEthereumWallet$1.8M
  97. Solv ProtocolOtherEthereumVault$2.7M
  98. Blend ProtocolOracle ManipulationStellarBorrowing$11M, medium severity
  99. IoTeX ioTube BridgeAccess ControlEthereumBridge$4.4M
  100. Moonwell cbETH Oracle IncidentOracle ManipulationBaseBorrowing$1.8M
  101. CrossCurveOtherMultichainBridge$2.9M
  102. Step Finance Treasury BreachAccess ControlSolanaTreasury$30M, medium severity
  103. SwapNetOtherMultichainExchange$17M, medium severity
  104. Aperture FinanceOtherMultichainRouting$3.7M
  105. SagaEVMOtherSagaEVMChainlet$7M
  106. Makina FinanceFlash LoanEthereumYield Aggregator$5M
  107. NYC MemecoinRugpullSolanaToken$3.4M
  108. Yo YieldOtherEthereumYield Aggregator$3.7M
  109. Social Engineering TheftPhishingMultichainWallet$282M, high severity
  110. TruebitOtherEthereumToken$27M, medium severity
  111. TMXOtherArbitrumExchange$1.4M
  112. Unleash ProtocolAccess ControlStoryGovernance$3.9M
  113. Flow NetworkOtherFlowExecution Layer$3.9M
  114. Trust Wallet Browser ExtensionAccess ControlMultichainWallet$7M
  115. Address Poisoning AttackPhishingEthereumWallet$50M, high severity
  116. Yearn Finance Legacy yETH ExploitFlash LoanEthereumYield Aggregator$8.9M
  117. Upbit Solana Hot-Wallet BreachAccess ControlSolanaExchange$36M, medium severity
  118. GANA Payment Liquidity DrainOtherBNB ChainToken$3.1M
  119. Moonwell wrsETH Oracle MeltdownOracle ManipulationBaseBorrowing$3.7M
  120. Stream Finance External Manager Blow-UpOtherMultichainSynthetic / Credit$93M, high severity
  121. Beets Fi Balancer V2 Sonic IncidentOtherSonicAMM$3M
  122. Balancer V2 Stable Pool ExploitOtherMultichainAMM$116M, high severity
  123. Garden Finance Multi-Chain Liquidity DrainOtherMultichainCross-chain$11M, medium severity
  124. Typus Finance Oracle ManipulationOracle ManipulationSuiBorrowing$3.4M
  125. Hyperliquid Private Key CompromiseAccess ControlHyperliquidWallet$21M, medium severity
  126. Hypervault Suspected RugpullRugpullHyperliquidYield$3.6M
  127. GriffinAI GAIN Cross-Chain Peer ExploitAccess ControlBNB ChainToken$3M
  128. SBI Crypto Hot-Wallet HeistAccess ControlMultichainExchange$24M, medium severity
  129. UXLINK Multi-Sig & Mint AbuseAccess ControlArbitrumToken$48M, medium severity
  130. Aqua Solana Presale RugRugpullSolanaToken$4.7M
  131. SwissBorg SOL Earn BreachAccess ControlSolanaStaking$42M, medium severity
  132. Bunni v4 Hooks Liquidity DrainOtherEthereumAMM$8.4M
  133. Venus Protocol Delegate PhishPhishingBNB ChainBorrowing$13M, medium severity
  134. Better Bank Bonus-Mint ExploitOtherPulseChainBorrowing$5M
  135. Phishing: 783 BTC DrainedPhishingBitcoinWallet$91M, high severity
  136. BtcTurk HackAccess ControlMultichainExchange$48M, medium severity
  137. Odin.fun ExploitOtherBitcoinAMM$7M
  138. Phishing USDT TheftPhishingEthereumWallet$3M
  139. CrediX ExploitAccess ControlSonicBorrowing$4.5M
  140. WOO X Phishing BreachPhishingMultichainExchange$14M, medium severity
  141. CoinDCX BreachAccess ControlMultichainExchange$44M, medium severity
  142. BigONE Exchange HackAccess ControlMultichainExchange$28M, medium severity
  143. Arcadia Finance ExploitOtherBaseRebalancing$2.5M
  144. GMX ExploitOtherArbitrumPerps$42M, medium severity
  145. Resupply ExploitOracle ManipulationEthereumBorrowing$9.5M
  146. Nobitex HackAccess ControlMultichainExchange$82M, high severity
  147. AlexLab ExploitAccess ControlStacksDeFi$16M, medium severity
  148. Nervos ForceBridge ExploitAccess ControlMultichainBridge$3.7M
  149. Cork Protocol wstETH ExploitOtherEthereumYield$12M, medium severity
  150. Cetus Protocol ExploitOtherSuiAMM$260M, high severity
  151. Bitcoin TheftPhishingBitcoinWallet$331M, high severity
  152. Loopscale HackOracle ManipulationSolanaBorrowing$5.8M
  153. ZKsync Airdrop Contract ExploitAccess ControlZKsyncAirdrop$5M
  154. KiloEx Oracle ManipulationOracle ManipulationEthereumPerps$7M
  155. UPCX ProxyAdmin Take-OverAccess ControlEthereumToken$70M, high severity
  156. Abracadabra GMX-Cauldron BugOtherArbitrumBorrowing$13M, medium severity
  157. Zoth Logic-Contract SwapAccess ControlEthereumRWA$8.3M
  158. 1inch Fusion v1 Re-entrancyOtherEthereumDEX Aggregation$2.6M
  159. Suji Yan Wallet HackPhishingEthereumWallet$4M
  160. Infini Insider DrainAccess ControlEthereumTreasury$50M, high severity
  161. Bybit Multisig Cold-Wallet HackAccess ControlEthereumExchange$1.40bn, high severity
  162. LIBRA Rug PullRugpullSolanaToken$286M, high severity
  163. zkLend ExploitOtherStarknetBorrowing$9.5M
  164. DogWifTools ExploitOtherMultichainTooling$10M, medium severity
  165. Phemex ExploitAccess ControlMultichainExchange$37M, medium severity

Each row opens the incident's own record page, with the on-chain references and sources. Download the data: CSV ·JSON ·RSS · CC BY 4.0 with attribution to YFarmX.

All losses in USD, best public estimate at the time of logging, verified against on-chain analysis and named sources. Losses are coloured by severity band: green under $10M, gold $10M to $50M, red $50M and above. Attribution claims are reported as claims, not findings.Last update · 25 Oct 2026