YFarmX logoYFarmXIntelligence for an accelerating worldBriefings
YFarmX logoYFarmX
YFarmX
Security Desk · live log

Crypto Exploit Tracker

$5.81bn drained across 149 logged incidents

Every major crypto exploit we log: what was hit, how much was lost, and how the attack actually worked, with the on-chain references and sources attached. Maintained by the Security Desk; updated as incidents are verified.

Updated 05 Oct 2026 · 149 incidents · 22 months tracked

Showing 149 of 149 incidents · $5.81bn in view

Overview
Total lossAll time$5.81bnCumulative, Jan 2025 to date
2026 so farYear to date$2.39bn95 incidents · 2025 total $3.42bn
Biggest single hitAll time$1.40bnBybit Multisig Cold-Wallet Hack · 24% of all losses
Major incidentsAll time149Logged per month, Jan 2025 to date
Most common vectorAll timeAccess Control40 of 149 incidents
Days since last hackLogged–Days between the last 25 hacks

Where the money went · by vector

  1. Access Control$2.40bn41.2%
  2. Phishing$800M13.8%
  3. Other$686M11.8%
  4. Third-party security appliance compromise$388M6.7%
  5. Software Bug$330M5.7%
  6. Bridge Exploit$328M5.6%
  7. Rugpull$298M5.1%
  8. Private Key Compromise$280M4.8%
  9. Oracle Manipulation$207M3.6%
  10. Smart Contract Bug$40M0.7%
  11. Governance Attack$29M0.5%
  12. Flash Loan$20M0.3%
  13. Bridge$7.5M0.1%
  14. Supply Chain$3M0.1%
  15. Logic Flaw$316k0.0%

Losses · last 12 months

Loss severity · all time

149total
LowUnder $10M
9966.4%
Medium$10M – $50M
3120.8%
High$50M and above
1912.8%
  1. Base vault loses $6m after malicious contract approvalNewAccess ControlBaseDeFi$6M
  2. MALT swap flaw causes a reported $72,000 lossNewLogic FlawPolygonDeFi$72k
  3. GoldPesa accounting flaw causes a reported $114,900 lossNewLogic FlawBaseDeFi$115k
  4. NEAR Intents recovers $3.8m taken in bridge incidentNewBridge ExploitMultichainCross-chain$3.8M
  5. Flaw in a Safe wallet add-on lets attacker take $307,000NewAccess ControlEthereumWallet$307k
  6. MUSystem pays deposit bonuses twice, losing about $36,900NewLogic FlawEthereumDeFi$37k
  7. MCN Labs reward flaw causes a reported $92,600 lossNewLogic FlawBNB ChainDeFi$93k
  8. Fake Upbit GIWA bridge drains $2.07m from early usersNewPhishingEthereumBridge$2.1M
  9. Payy's Ethereum bridge contract drained of $1.83m in USDCBridge ExploitEthereumPayments$1.8M
  10. Stolen hot-wallet keys let an attacker empty crypto casino Duelbits on five blockchainsPrivate Key CompromiseMultichainGaming$6.1M
  11. Bitget hack: $387.5 million taken through compromised security appliancesThird-party security appliance compromiseMultichainCentralised Exchange$388M, high severity
  12. Old Magic Eden approvals let attacker take $1.77m in WETHAccess ControlMultichainNFT$1.8M
  13. Inflated NSTR oracle price lets one account borrow $3.5m from NostraOracle ManipulationStarknetLending$3.5M
  14. MEV bot captures 2,900 rsETH drained through a Safe module flawAccess ControlEthereumWallet$7.7M
  15. Signing flaw in D'CENT's app wallet lets attackers move user fundsSoftware BugMultichainWallet$6.6M
  16. Chainflip pays out twice on replayed Tron memosSoftware BugTronCross-chain$736k
  17. Unbacked nBTC minted on Nomic reaches Osmosis poolsSoftware BugCosmos / OsmosisBridge$3.1M
  18. Elements bug sends 4,000 BTC out of Liquid's reserve, 3,400 returnedSoftware BugLiquid / BitcoinBridge$320M, high severity
  19. Injective Binary-Options Exploit and Emergency UpgradeSmart Contract BugInjectiveDerivatives–
  20. Ontology Mainnet Halt After Malicious Attack ActivityOtherOntologyLayer 1–
  21. More Markets Lending Reserve Drain on Flow EVMSmart Contract BugFlowLending$410k
  22. Aquifer AMM Exploit on SolanaAccess ControlSolanaAMM$2.5M
  23. Balancer V1 Legacy Pool Rounding ErrorSmart Contract BugEthereumAMM$234k
  24. Tectonic Oracle Manipulation and Cronos HaltOracle ManipulationCronosLending$120M, high severity
  25. Avici Card Contract DrainAccess ControlSolanaPayments$501k
  26. Moonwell MAMO Market ExploitOracle ManipulationBaseBorrowing$8.7M
  27. CometDEX Backstop Pool DrainSmart Contract BugStellarAMM$718k
  28. Term Finance Vault Governance TakeoverGovernance AttackEthereumLending$8.5M
  29. TAC Cosmos EVM Balance Underflow DrainOtherTACLayer 1$7.5M
  30. The Sandbox OFT Bridge MintAccess ControlMultichainGaming$1.5M
  31. BounceBit Authorisation Exploit and L1 ShutdownAccess ControlBounceBitRestaking$3M
  32. Coldcard Mk3 Seed Entropy SweepPrivate Key CompromiseBitcoinWallet$116M, high severity
  33. Crypto DAO Vault DrainAccess ControlBNB ChainDeFi$52k
  34. WEMIX$ Stablecoin Contract TakeoverAccess ControlWEMIX3.0Stablecoin$731k
  35. Triple-A Hot Wallet DrainOtherMultichainPayments$9.7M
  36. AFX Trade Bridge ExploitAccess ControlArbitrumDerivatives$24M, medium severity
  37. Verus Ethereum Bridge Exploit (second)BridgeEthereumBridge$7.5M
  38. B² Network Staking ExploitAccess ControlBitcoin L2Staking$3.9M
  39. CascadeSmart Contract BugArbitrumPerps$1.3M
  40. OstiumOracle ManipulationArbitrumPerps$24M, medium severity
  41. Bonzo LendOracle ManipulationHederaLending$9M
  42. Summer.fiFlash LoanEthereumYield$6M
  43. BonkDAOGovernance AttackSolanaDeFi$20M, medium severity
  44. PolymarketSupply ChainPolygonDeFi$3M
  45. SecondFiPrivate Key CompromiseCardanoWallet$2.4M
  46. Taiko BridgeBridge ExploitEthereumBridge$1.7M
  47. JaredFromSubway MEV BotPhishingEthereumInfrastructure$7.5M
  48. Aztec Private Rollup BridgeSmart Contract BugEthereumBridge$2.2M
  49. Aztec ConnectSmart Contract BugEthereumInfrastructure$2.1M
  50. RaydiumSmart Contract BugSolanaDEX$1.3M
  51. Secret NetworkBridge ExploitSecret NetworkBridge$4.7M
  52. Humanity ProtocolPrivate Key CompromiseEthereumInfrastructure$31M, medium severity
  53. Syscoin BridgeBridge ExploitSyscoinBridge$10M, medium severity
  54. Gravity BridgePrivate Key CompromiseEthereumBridge$5.4M
  55. DxSaleAccess ControlBNB ChainDeFi$7.3M
  56. Ill Bloom Wallet VulnerabilityPrivate Key CompromiseMultichainWallet$5.2M
  57. New Market TradingAccess ControlEthereumDeFi$4M
  58. StablRPrivate Key CompromiseEthereumStablecoin$2.8M
  59. RetoSwapSmart Contract BugMoneroDEX$2.7M
  60. Echo ProtocolPrivate Key CompromiseMonadYield$77M, high severity
  61. Verus–Ethereum BridgeBridge ExploitEthereumBridge$12M, medium severity
  62. THORChainPrivate Key CompromiseMultichainDEX$11M, medium severity
  63. Transit FinanceSmart Contract BugTronDEX$1.9M
  64. TrustedVolumesAccess ControlEthereumDeFi$5.9M
  65. EkuboSmart Contract BugEthereumDEX$1.4M
  66. Wasabi ProtocolPrivate Key CompromiseEthereumPerps$5M
  67. Aftermath PerpsSmart Contract BugSuiPerps$1.1M
  68. Sweat EconomySmart Contract BugNEARDeFi$3.5M
  69. PurrlendSmart Contract BugHyperliquidLending$1.5M
  70. GiddySmart Contract BugEthereumWallet$1.3M
  71. VoloPrivate Key CompromiseSuiYield$3.5M
  72. Kelp DAOBridge ExploitMultichainYield$292M, high severity
  73. Rhea FinanceSmart Contract BugNEARLending$18M, medium severity
  74. GrinexPrivate Key CompromiseTronCEX$15M, medium severity
  75. CoW SwapPhishingEthereumDEX$1.2M
  76. HyperbridgeBridge ExploitEthereumBridge$2.5M
  77. Drift ProtocolAccess ControlSolanaPerps$286M, high severity
  78. Resolv LabsAccess ControlEthereumStablecoin$25M, medium severity
  79. VenusOtherBNB ChainBorrowing$2.2M
  80. USDC Permit Signature PhishPhishingEthereumWallet$1.8M
  81. Solv ProtocolOtherEthereumVault$2.7M
  82. Blend ProtocolOracle ManipulationStellarBorrowing$11M, medium severity
  83. IoTeX ioTube BridgeAccess ControlEthereumBridge$4.4M
  84. Moonwell cbETH Oracle IncidentOracle ManipulationBaseBorrowing$1.8M
  85. CrossCurveOtherMultichainBridge$2.9M
  86. Step Finance Treasury BreachAccess ControlSolanaTreasury$30M, medium severity
  87. SwapNetOtherMultichainExchange$17M, medium severity
  88. Aperture FinanceOtherMultichainRouting$3.7M
  89. SagaEVMOtherSagaEVMChainlet$7M
  90. Makina FinanceFlash LoanEthereumYield Aggregator$5M
  91. NYC MemecoinRugpullSolanaToken$3.4M
  92. Yo YieldOtherEthereumYield Aggregator$3.7M
  93. Social Engineering TheftPhishingMultichainWallet$282M, high severity
  94. TruebitOtherEthereumToken$27M, medium severity
  95. TMXOtherArbitrumExchange$1.4M
  96. Unleash ProtocolAccess ControlStoryGovernance$3.9M
  97. Flow NetworkOtherFlowExecution Layer$3.9M
  98. Trust Wallet Browser ExtensionAccess ControlMultichainWallet$7M
  99. Address Poisoning AttackPhishingEthereumWallet$50M, high severity
  100. Yearn Finance Legacy yETH ExploitFlash LoanEthereumYield Aggregator$8.9M
  101. Upbit Solana Hot-Wallet BreachAccess ControlSolanaExchange$36M, medium severity
  102. GANA Payment Liquidity DrainOtherBNB ChainToken$3.1M
  103. Moonwell wrsETH Oracle MeltdownOracle ManipulationBaseBorrowing$3.7M
  104. Stream Finance External Manager Blow-UpOtherMultichainSynthetic / Credit$93M, high severity
  105. Beets Fi Balancer V2 Sonic IncidentOtherSonicAMM$3M
  106. Balancer V2 Stable Pool ExploitOtherMultichainAMM$116M, high severity
  107. Garden Finance Multi-Chain Liquidity DrainOtherMultichainCross-chain$11M, medium severity
  108. Typus Finance Oracle ManipulationOracle ManipulationSuiBorrowing$3.4M
  109. Hyperliquid Private Key CompromiseAccess ControlHyperliquidWallet$21M, medium severity
  110. Hypervault Suspected RugpullRugpullHyperliquidYield$3.6M
  111. GriffinAI GAIN Cross-Chain Peer ExploitAccess ControlBNB ChainToken$3M
  112. SBI Crypto Hot-Wallet HeistAccess ControlMultichainExchange$24M, medium severity
  113. UXLINK Multi-Sig & Mint AbuseAccess ControlArbitrumToken$48M, medium severity
  114. Aqua Solana Presale RugRugpullSolanaToken$4.7M
  115. SwissBorg SOL Earn BreachAccess ControlSolanaStaking$42M, medium severity
  116. Bunni v4 Hooks Liquidity DrainOtherEthereumAMM$8.4M
  117. Venus Protocol Delegate PhishPhishingBNB ChainBorrowing$13M, medium severity
  118. Better Bank Bonus-Mint ExploitOtherPulseChainBorrowing$5M
  119. Phishing: 783 BTC DrainedPhishingBitcoinWallet$91M, high severity
  120. BtcTurk HackAccess ControlMultichainExchange$48M, medium severity
  121. Odin.fun ExploitOtherBitcoinAMM$7M
  122. Phishing USDT TheftPhishingEthereumWallet$3M
  123. CrediX ExploitAccess ControlSonicBorrowing$4.5M
  124. WOO X Phishing BreachPhishingMultichainExchange$14M, medium severity
  125. CoinDCX BreachAccess ControlMultichainExchange$44M, medium severity
  126. BigONE Exchange HackAccess ControlMultichainExchange$28M, medium severity
  127. Arcadia Finance ExploitOtherBaseRebalancing$2.5M
  128. GMX ExploitOtherArbitrumPerps$42M, medium severity
  129. Resupply ExploitOracle ManipulationEthereumBorrowing$9.5M
  130. Nobitex HackAccess ControlMultichainExchange$82M, high severity
  131. AlexLab ExploitAccess ControlStacksDeFi$16M, medium severity
  132. Nervos ForceBridge ExploitAccess ControlMultichainBridge$3.7M
  133. Cork Protocol wstETH ExploitOtherEthereumYield$12M, medium severity
  134. Cetus Protocol ExploitOtherSuiAMM$260M, high severity
  135. Bitcoin TheftPhishingBitcoinWallet$331M, high severity
  136. Loopscale HackOracle ManipulationSolanaBorrowing$5.8M
  137. ZKsync Airdrop Contract ExploitAccess ControlZKsyncAirdrop$5M
  138. KiloEx Oracle ManipulationOracle ManipulationEthereumPerps$7M
  139. UPCX ProxyAdmin Take-OverAccess ControlEthereumToken$70M, high severity
  140. Abracadabra GMX-Cauldron BugOtherArbitrumBorrowing$13M, medium severity
  141. Zoth Logic-Contract SwapAccess ControlEthereumRWA$8.3M
  142. 1inch Fusion v1 Re-entrancyOtherEthereumDEX Aggregation$2.6M
  143. Suji Yan Wallet HackPhishingEthereumWallet$4M
  144. Infini Insider DrainAccess ControlEthereumTreasury$50M, high severity
  145. Bybit Multisig Cold-Wallet HackAccess ControlEthereumExchange$1.40bn, high severity
  146. LIBRA Rug PullRugpullSolanaToken$286M, high severity
  147. zkLend ExploitOtherStarknetBorrowing$9.5M
  148. DogWifTools ExploitOtherMultichainTooling$10M, medium severity
  149. Phemex ExploitAccess ControlMultichainExchange$37M, medium severity

Each row opens the incident's own record page, with the on-chain references and sources. Download the data: CSV ·JSON ·RSS · CC BY 4.0 with attribution to YFarmX.

All losses in USD, best public estimate at the time of logging, verified against on-chain analysis and named sources. Losses are coloured by severity band: green under $10M, gold $10M to $50M, red $50M and above. Attribution claims are reported as claims, not findings.Last update · 05 Oct 2026