Skip to content
DeFi Reference

Security incident timeline (2016–2026)

1. TL;DR

Section titled “1. TL;DR”

This page catalogues 52 major security incidents across Ethereum (L1 and L2/sidechains) and Solana from 2016 through mid-2026, each with a date, chain, loss figure, root-cause classification, and a cited source. Losses cluster overwhelmingly into a small number of recurring root-cause categories — front-end/infrastructure compromise ($1.84B across this table, driven mostly by the 2025 Bybit hack), access-control/admin-key failures ($722M, driven mostly by Ronin), and bridge validator/signature forgery (~$616M, split between Wormhole and 2026’s KelpDAO incident) — rather than novel cryptographic breaks. The clear trend across a decade of data: the code that attackers exploit has become more varied and more scrutinized over time, but the boundary they actually attack (a human trusting what a screen shows them, or one key/committee holding too much unchecked power) has stayed remarkably constant.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

Aviation didn’t get safer because every crash was unique — it got safer because investigators built a shared, standardized database of what actually went wrong in each one, and the same handful of causes (fuel exhaustion, pilot disorientation, mechanical fatigue) kept reappearing until the industry designed around them specifically. This table is the same idea applied to DeFi: a single, dated, sourced ledger of what actually failed in each major incident, so that “root cause” becomes something you can count and compare across a decade, instead of a fresh mystery every time.

ELI5

Section titled “ELI5”

This page is a big table listing the biggest thefts and hacks in Ethereum and Solana history, one row per event, with the date, how much was taken, what actually went wrong, and where that information comes from. Instead of treating every hack as a totally new kind of disaster, the table sorts them into a small number of repeat causes — like “someone tricked a person into approving the wrong thing” or “a check that should have run never ran” — so you can see which mistakes actually cost the most money over time.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario: the Mango Markets exploit (11–12 October 2022, Solana), reconstructed as one concrete before/after sequence — the fullest single-incident mechanism on this page, with the deeper mechanics covered on /lending/collateral-ltv-health/.

  1. Before. MNGO (Mango’s governance/perp-collateral token) trades at roughly $0.038. Attacker Avraham Eisenberg holds a large short-side counterparty position via a second account and no meaningful existing collateral beyond starting capital.
  2. He opens a large long MNGO-PERP position. Using his main account, he takes an outsized long position in Mango’s MNGO perpetual future — a market thin enough that Mango’s own price feed reflects its own internal, low-liquidity trading.
  3. He pumps the price against himself, using himself. Trading between his own accounts on Mango’s spot market, he pushes MNGO from ~$0.038 to ~$0.91 (as of 2022-10, secondary sources) — a roughly 24x move on paper.
  4. The unrealized “profit” becomes real, spendable collateral. Mango’s risk engine values the long perp position’s unrealized profit at the now-inflated oracle price, and counts that paper profit as legitimate account equity — because, mechanically, nothing in the price feed or the collateral formula distinguishes “profit from real external demand” from “profit from my own wash trade.”
  5. After. Using that inflated equity as collateral, the attacker borrows roughly $100M–$117.8M (sources disagree; as of 2022-10) in real assets — USDC, SOL, and other tokens actually held in Mango’s pools — draining real, other-users’-deposited liquidity against collateral that only existed because he had just manufactured it himself.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: Loss figures in incident trackers are precise, agreed-upon numbers. Reality: Sources frequently disagree — Mango’s loss is reported anywhere from $100M to $117.8M, Radiant Capital’s from $50M to $58M, and this page states the full range wherever sources diverge rather than picking one number.
  • Myth: A hack with a large headline loss figure means that money is gone forever. Reality: Poly Network ($611M), Euler ($197M, mostly), Crema Finance ($8.78M, mostly), and Munchables ($62.5M) all had most or all funds returned — sometimes for a negotiated bounty, sometimes voluntarily — while the incident still counts as a security failure regardless of the final recovery outcome.
  • Myth: The industry’s worst losses come from advanced cryptographic exploits. Reality: The single largest loss in this table (Bybit, $1.46–1.5B) came from compromised front-end infrastructure making signers approve a transaction different from what they saw — not a break of any cryptographic primitive.
  • Myth: Root-cause classification is objective and uncontested. Reality: Several incidents plausibly span two categories (Bybit is “front-end compromise” mechanically but “social engineering” in how attackers first got in; Cypher Protocol’s loss was later complicated by an insider’s own admission) — this table picks the single best-fitting category per row and notes ambiguity in the lesson column where it matters.
  • Myth: Newer protocols get hacked more than mature, audited ones. Reality: Cream Finance, Euler, and Compound-derived forks (Fei/Rari’s Fuse pools, Sonne Finance) were all previously audited, and in Fei/Rari’s case the exact bug being exploited had already been fixed once upstream in Compound’s own code before resurfacing.

If you only remember one thing

Section titled “If you only remember one thing”

Across a full decade and 52 incidents, the categories of root cause barely changed even as the specific code, chains, and dollar amounts did — which means the fix is rarely “audit harder,” and usually “close a specific, already-known boundary.”

3. How it works

Section titled “3. How it works”

Methodology

Section titled “Methodology”

Each row below traces to either a primary post-mortem (the protocol’s own incident report, e.g. Loopscale, Raydium, Beanstalk, Slope, Penpie) or a reputable secondary tracker/investigator (rekt.news, Halborn’s “Explained” series, Elliptic, Chainalysis, CoinDesk, The Block, SlowMist, Helius’s own Solana incident tracker), cited per row. Where sources disagree on a loss figure, the row states the range rather than picking one number (per this site’s sourcing rule: give the range the sources give). Root causes are classified into a fixed taxonomy so the table is usable as a searchable database rather than free text: Reentrancy, Oracle/price manipulation, Flash-loan-funded exploit, Access control / admin key, Governance attack, Bridge validator/signature forgery, Smart contract logic bug, Smart contract / account-validation logic bug (used specifically for Solana’s missing-owner/signer/type-confusion bug family, cross-referenced to /security/bug-classes/), Private key compromise, Front-end/infrastructure compromise, and Social engineering / supply-chain compromise. A small number of rows involve incidents on an Ethereum-adjacent sidechain (Ronin, Harmony’s bridge) or PoS sidechain (Polygon, for Vulcan Forged) rather than a strict L1 or rollup L2; these are labeled explicitly in the Chain column rather than folded silently into “Ethereum.” Incidents already covered in depth elsewhere on this site (Mango Markets, Beanstalk, Loopscale, Wormhole, Ronin) are included here for completeness of the database but kept terse, with a cross-reference to the fuller treatment.

Incident table (2016–2026)

Section titled “Incident table (2016–2026)”
DateChainProtocolLoss (USD, as reported)Root cause classLessonSource
2016-06-17Ethereum L1The DAO$60M (3.6M ETH)ReentrancyUpdate internal balances before sending funds, not after.CoinDesk, “How The DAO Hack Changed Ethereum,” 2023-05-09 — https://www.coindesk.com/consensus-magazine/2023/05/09/coindesk-turns-10-how-the-dao-hack-changed-ethereum-and-crypto
2017-07-19Ethereum L1Parity multisig wallet (1st hack)$30M (153,037 ETH)Access control / admin keyExtracting shared init logic into a library anyone can call directly turns “initialize once” into “anyone can become owner.”CoinDesk, 2017-07-19 — https://www.coindesk.com/markets/2017/07/19/30-million-ether-reported-stolen-due-to-parity-wallet-breach
2017-11-06Ethereum L1Parity multisig wallet (2nd, frozen)$280M frozen (not stolen)Access control / admin keyA library left uninitialized can be “owned” and self-destructed by anyone, permanently bricking every wallet that depends on it.Parity Technologies postmortem, 2017-11-15 — https://medium.com/paritytech/a-postmortem-on-the-parity-multi-sig-library-self-destruct-63daca3a4cf7
2020-02-15Ethereum L1bZx (attack 1)$350K–$620KFlash-loan-funded exploitA flash loan removes the capital constraint on manipulating a thin market; the deeper bug was a liquidation check that never fired.CoinDesk, 2020-02-19 — https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack
2020-02-18Ethereum L1bZx (attack 2)$600K–$645KOracle/price manipulationTwo “independent” price sources moved together under one flash-loan-funded attack, so a cross-source sanity check passed anyway.The Daily Swig, 2020-02 — https://portswigger.net/daily-swig/bzx-crypto-heist-results-in-reported-losses-of-more-than-55-million
2020-10-26Ethereum L1Harvest Finance$24MOracle/price manipulationRound-tripping a flash loan through a pool to move its share price, then trading against a vault that trusts that price, is a pattern repeated across dozens of later exploits.CoinDesk, 2020-10-26 — https://www.coindesk.com/tech/2020/10/26/harvest-finance-24m-attack-triggers-570m-bank-run-in-latest-defi-exploit
2020-11-21Ethereum L1Pickle Finance$20MSmart contract logic bugAccepting a caller-supplied contract address as a peer “jar” without whitelisting let an attacker swap real deposits into a fake contract.Decrypt, 2020-11-22 — https://decrypt.co/49149/pickle-finance-hack
2020-12-28Ethereum L1Cover Protocol$4.4M realizedSmart contract logic bugCaching pool data in memory but updating only the storage copy let stale reads authorize near-infinite token minting.Mudit Gupta, 2020-12-28 — https://mudit.blog/cover-protocol-hack-analysis-tokens-minted-exploit/
2021-02-04Ethereum L1Yearn Finance (yDAI v1 vault)$11M (attacker net ~$2.8M)Oracle/price manipulationA vault strategy that reads a stablecoin’s price directly off one AMM pool inherits that pool’s manipulability.CoinDesk, 2021-02-04 — https://www.coindesk.com/tech/2021/02/04/yearn-finance-dai-vault-has-suffered-an-exploit-11m-drained
2021-02-13Ethereum L1Alpha Homora / Cream Finance (Iron Bank)$37.5MSmart contract logic bugUndercollateralized borrowing extended to a “trusted” whitelisted protocol is only as safe as that protocol’s own input validation.The Defiant, 2021-02-13 — https://thedefiant.io/cream-and-alpha-finance-get-hacked-for-37-5m
2021-08-10Multi-chain (mostly Ethereum L1)Poly Network$611M total (~$273M on Ethereum; returned within 15 days)Smart contract logic bugCross-chain relayer contracts that don’t tightly scope who can trigger which keeper function let an attacker call privileged functions directly.Chainalysis, 2021-08 — https://www.chainalysis.com/blog/poly-network-hack-august-2021/
2021-08-19SolanaSolend$16,000Smart contract / account-validation logic bugEven a tiny, early exploit of an insecure config-update check previews the exact missing-validation bug class that recurs at every scale later on Solana.Helius, “Solana Hacks, Bugs, and Exploits,” accessed 2026-08-30 — https://www.helius.dev/blog/solana-hacks
2021-08-30Ethereum L1Cream Finance (reentrancy)$18.8M–$29MReentrancyIntegrating an ERC-777 token that calls back into the recipient on transfer reintroduces reentrancy even in an otherwise-guarded codebase.Halborn, 2021 — https://halborn.com/explained-the-cream-finance-hack-august-2021/
2021-10Ethereum L1Compound (Proposal 62)$70M–$90M at riskGovernance attackA governance-approved code upgrade can itself be the bug, and governance is then both the cause and the only available fix. See /governance/governance-and-tokenomics/.The Block, 2021-10 — https://www.theblock.co/amp/linked/119086/compound-bug-comp-risk-misreward
2021-12-02Ethereum L1Badger DAO$120MFront-end/infrastructure compromiseA compromised Cloudflare API key injected malicious approval prompts into a legitimate front-end for three weeks before detection.CoinDesk, 2021-12-10 — https://www.coindesk.com/business/2021/12/10/badgerdao-reveals-details-of-how-it-was-hacked-for-120m
2021-12-13Polygon (Ethereum-ecosystem sidechain)Vulcan Forged$140M (refunded next day)Private key compromiseSemi-custodial wallets managed on users’ behalf concentrate key-compromise risk exactly like a centralized exchange.CoinDesk, 2021-12-14 — https://www.coindesk.com/business/2021/12/14/gaming-platform-vulcan-forged-refunds-users-after-140m-hack
2022-02-02SolanaWormhole (token bridge)$326MBridge validator/signature forgeryA deprecated signature-verification function let an attacker spoof a sysvar account and mint wrapped ETH with no real collateral locked. Full trust-model analysis: /cross-chain/bridge-designs/.Halborn, accessed 2026-08-30 — https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022
2022-03-22SolanaCashio$52.8MSmart contract / account-validation logic bugNever checking that a supplied collateral account was actually issued by the real program it claimed to be lets an attacker forge collateral out of nothing.Halborn, accessed 2026-08-30 — https://www.halborn.com/blog/post/explained-the-cashio-hack-march-2022
2022-03-23Ronin (Ethereum-linked sidechain)Ronin Network (Axie Infinity)$624M (173,600 ETH + 25.5M USDC)Access control / admin keyWhitelist access granted for a temporary purpose and never revoked stays a live attack surface indefinitely.rekt.news, accessed 2026-08-30 — https://rekt.news/ronin-rekt/
2022-04-17Ethereum L1Beanstalk Farms$77MGovernance attackA flash loan can acquire and spend governance voting power within a single transaction if no time delay separates gaining power from using it. See /governance/governance-and-tokenomics/.Beanstalk official blog, incident 2022-04-17 — https://bean.money/blog/beanstalk-governance-exploit
2022-04-30Ethereum L1Fei Protocol / Rari Capital Fuse pools$79.75MReentrancyA borrow function that pays out before recording debt is exploitable even when the underlying (Compound-derived) code had already fixed the same bug once.rekt.news, accessed 2026-08-30 — https://rekt.news/rariswap-rekt/
2022-06-24Harmony (Ethereum-linked sidechain bridge)Harmony Horizon Bridge$100MPrivate key compromiseA 2-of-5 multisig secured by hot-wallet keys is only as strong as its weakest stored key, regardless of the threshold number.rekt.news, accessed 2026-08-30 — https://rekt.news/harmony-rekt/
2022-07-03SolanaCrema Finance$8.78M (mostly returned)Smart contract / account-validation logic bugA flash-loan-funded attacker fabricated a fake “tick account” the program never verified as genuinely belonging to the pool.Halborn, accessed 2026-08-30 — https://www.halborn.com/blog/post/explained-the-crema-finance-hack-july-2022
2022-07-28SolanaNirvana Finance$3.5MFlash-loan-funded exploitA flash loan can pump a protocol’s own bonding-curve token price and redeem the inflated result against real treasury assets.The Block, 2022-07-28 — https://www.theblock.co/post/159975/solana-stablecoin-nirvana-sinks-90-amid-3-5-million-flash-loan-exploit
2022-08-02Ethereum L1Nomad Bridge$190MSmart contract logic bugA single misconfigured trusted root (0x00 accepted as automatically valid) turned “prove your message” into “anyone can copy-paste anyone else’s valid message.”rekt.news, accessed 2026-08-30 — https://rekt.news/nomad-rekt/
2022-08-03SolanaSlope (mobile wallet)$4M–$8M (~9,000 wallets)Front-end/infrastructure compromiseA wallet app that logs seed phrases in plaintext to a third-party error-monitoring service turns a routine crash report into a mass key leak.Slope Finance postmortem, 2022-08 — https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39
2022-10-11SolanaMango Markets$100M–$117.8MOracle/price manipulationA perp position’s unrealized profit, priced off a market the same attacker just manipulated, is not real collateral. Full mechanism: /lending/collateral-ltv-health/.Elliptic, 2022-10 — https://www.elliptic.co/insights/mango-market-exploit-defi-loses-nearly-900-million-to-hackers-in-costliest-30-days-on-record
2022-11-02SolanaSolend (isolated USDH pool)$1.26MOracle/price manipulationA known, unpatched single-source price feed is a scheduled exploit waiting for whoever notices first, even after the team has publicly flagged the risk.CoinDesk, 2022-11-02 — https://www.coindesk.com/business/2022/11/02/defi-protocol-solend-struck-by-126m-oracle-exploit
2022-12-16SolanaRaydium$2M–$4.4MAccess control / admin keyA single compromised authority key controlling pool parameters is a direct path to draining “fees” across every pool that key administers.Raydium postmortem, 2022-12 — https://raydium.medium.com/detailed-post-mortem-and-next-steps-d6d6dd461c3e
2023-03-14Ethereum L1Euler Finance$197M (mostly returned)Smart contract logic bugA “donation” function letting a user worsen their own health factor without a corresponding liquidation check creates unbacked debt that can be gamed at scale.rekt.news, accessed 2026-08-30 — https://rekt.news/euler-rekt/
2023-07-31Ethereum L1 (multi-protocol)Curve Finance / Vyper compiler bug$69M across JPEG’d, Alchemix, Metronome, Curve, othersReentrancyA compiler-level storage-slot misalignment silently disabled reentrancy locks in every pool built with the affected Vyper versions, regardless of how careful each protocol’s own code was.rekt.news (citing BlockSec analysis), accessed 2026-08-30 — https://rekt.news/curve-vyper-rekt/
2023-08-07SolanaCypher Protocol~$1.04MSmart contract / account-validation logic bugAn undisclosed margin-logic bug, later complicated by an insider’s own admission of taking related funds, shows “exploit” and “insider misappropriation” aren’t always cleanly separable after the fact.CoinDesk, 2023-08-07 — https://www.coindesk.com/business/2023/08/07/solana-based-cypher-protocol-experiences-exploit-freezes-smart-contract
2023-10-19SolanaSynthetify DAO$230,000Governance attackBurying a malicious payout inside one of many near-identical “spam” proposals on an inactive DAO let it pass unopposed for months.Blockworks, 2023-10 — https://blockworks.co/news/solana-exploit-dao-hacker
2023-11-23Ethereum + 5 L2sKyberSwap Elastic$48M+ across 6 chainsSmart contract logic bugA rounding/precision error smaller than 0.00000000001% in tick-liquidity accounting was still exploitable at scale once an attacker could target it precisely with flash-loaned capital.rekt.news (citing BlockSec analysis), accessed 2026-08-30 — https://rekt.news/kyberswap-rekt/
2023-12-27SolanaThunder Terminal$240,000Front-end/infrastructure compromiseA compromised backend database connection string let an attacker push malicious approvals to users, showing a trading front-end’s ops hygiene matters as much as its contracts.Helius, “Solana Hacks, Bugs, and Exploits,” accessed 2026-08-30 — https://www.helius.dev/blog/solana-hacks
2024-03-26Ethereum (Blast L2)Munchables$62.5M ($60.5M returned)Access control / admin keyA single insider with legitimate upgrade authority is as dangerous as a stolen key, and no code audit catches a trusted developer acting maliciously. See /security/bug-classes/.CoinDesk, 2024-03-27 — https://www.coindesk.com/tech/2024/03/27/munchables-exploited-for-62m-ether-linked-to-rogue-north-korean-team-member
2024-03-28Ethereum L1Prisma Finance$11.6MSmart contract logic bugA flash-loan callback trusting caller-supplied calldata without verifying it matches the intended migration flow can be redirected to hijack unrelated positions.ImmuneBytes, 2024 — https://immunebytes.com/blog/prisma-finance-exploit-march-28-2024-detailed-analysis/
2024-05-14Ethereum (Optimism L2)Sonne Finance$20MSmart contract logic bugSplitting a market’s creation from its risk-parameter configuration into separate, timelock-delayed transactions leaves an exploitable window for a known “donation” attack pattern.Halborn, 2024 — https://www.halborn.com/blog/post/explained-the-sonne-finance-hack-may-2024
2024-05-16SolanaPump.fun$1.9MAccess control / admin keyA former employee who retains a privileged authority after leaving is an off-boarding failure, not a code bug.The Block, 2024-05 — https://www.theblock.co/post/295029/pump-fun-post-mortem
2024-06-10Ethereum L1UwU Lend$19.3MOracle/price manipulationDeriving a “median” price from multiple pools isn’t manipulation-resistant if several of the inputs are still raw spot prices movable within one flash-loaned transaction.SlowMist, 2024-06 — https://slowmist.medium.com/analysis-of-the-uwu-lend-hack-9502b2c06dbe
2024-07-18Ethereum (multisig custody)WazirX$234.9MFront-end/infrastructure compromiseA multisig is only as strong as the interface its signers trust to show them the truth; attackers altered what signers approved without their knowledge.Elliptic, 2024 — https://www.elliptic.co/insights/235-million-lost-by-wazirx-in-north-korea-linked-breach/
2024-09-03Ethereum L1Penpie$27MReentrancyA reward-harvesting function without a reentrancy guard can be re-entered via a spoofed market registration to repeatedly claim rewards before state settles.Penpie/Magpie postmortem, 2024-09 — https://blog.penpiexyz.io/penpie-post-mortem-report-1ac9863b663a
2024-09-16Ethereum (Arbitrum L2)DeltaPrime~$5.98MPrivate key compromiseA single unprotected private key securing an L2 deployment is enough to drain a contract outright, regardless of how well other chains’ deployments are secured.Hackread, 2024-09 — https://hackread.com/deltaprime-hacker-exploits-arbitrum-admin-key/
2024-10-16Ethereum (multisig custody)Radiant Capital$50M–$58MSocial engineering / supply-chain compromiseMalware delivered via a spoofed trusted contact can compromise multiple signer devices at once, defeating a multisig threshold entirely by making the front-end lie to every signer simultaneously. See /security/trusted-hardware-and-threat-models/.Halborn, 2024 — https://www.halborn.com/blog/post/explained-the-radiant-capital-hack-october-2024
2024-11-16SolanaDEXX$30MPrivate key compromiseA “Solana app” that custodies private keys off-chain on users’ behalf reintroduces the exact custodial risk DeFi is meant to remove.Cointelegraph, 2024-11 — https://cointelegraph.com/news/solana-dexx-hack-november-2024-suspicious-wallets
2025-01-24SolanaNoOnes$7.9M–$8MSmart contract / account-validation logic bugSplitting a large drain into hundreds of transactions each below a size-alerting threshold can evade detection even across multiple chains simultaneously.crypto.news, 2025-01-24 — https://crypto.news/ex-paxful-ceos-bitcoin-marketplace-noones-exploited-for-nearly-8m-zachxbt-says/
2025-02-21Ethereum (Safe multisig)Bybit$1.46B–$1.5BFront-end/infrastructure compromiseHardware wallets only protect what they can display; malicious JavaScript injected into signing infrastructure can make every signer approve a transaction different from the one shown. See /security/trusted-hardware-and-threat-models/.Infosecurity Magazine, 2025-02 — https://www.infosecurity-magazine.com/news/fbi-confirms-north-koreas-lazarus/
2025-04-26SolanaLoopscale$5.8MSmart contract / account-validation logic bugFailing to verify the identity of a program supplying a price, not just sanity-checking the number it returns, leaves a cross-program invocation spoofable. Full mechanism: /lending/risk-engines/.Loopscale postmortem, 2025-04
2025-07-09Ethereum (Arbitrum L2)GMX V1$42M (later returned for a bounty)ReentrancyCode that implicitly assumes a caller account is a wallet, not a contract, reopens classic reentrancy even in mature, previously-audited protocols.Halborn, 2025 — https://www.halborn.com/blog/post/explained-the-gmx-hack-july-2025
2026-04-01SolanaDrift Protocol$285MSocial engineering / supply-chain compromiseWeeks of patient social engineering against the humans who hold legitimate governance authority can bypass a timelock entirely, since the timelock only had to be approved by the people meant to guard it. See /security/trusted-hardware-and-threat-models/.Chainalysis, 2026-04 — https://www.chainalysis.com/blog/lessons-from-the-drift-hack/
2026-04-18Ethereum (LRT, cross-chain messaging to Unichain L2)KelpDAO$290M (116,500 rsETH)Bridge validator/signature forgeryA single-verifier (“single-DVN”) cross-chain messaging configuration means compromising just one verifier’s infrastructure is enough to forge a fully “valid” cross-chain message.rekt.news, accessed 2026-08-30 — https://rekt.news/kelpdao-rekt/
2026-06-10SolanaRaydium (legacy AMM V3)$1.34MSmart contract / account-validation logic bugCode retired from a UI but still live on-chain with real funds remains a fully active attack surface until the funds are actually withdrawn.KuCoin, 2026-06 — https://www.kucoin.com/news/flash/raydium-addresses-1-34m-exploit-in-deprecated-amm-v3-code

4. Worked numeric example

Section titled “4. Worked numeric example”

Two complementary worked examples, continuing the table above.

(a) Mango Markets, continued from §2. Before the attack: MNGO ≈ $0.038. After the pump: MNGO ≈ $0.91, a multiple of 0.91/0.038≈24×0.91 / 0.038 \approx 24\times. If the attacker’s long position notional was, illustratively, NN MNGO-PERP contracts, his paper profit at the manipulated price versus the pre-attack price is approximately N×(0.91−0.038)=N×0.872N \times (0.91 - 0.038) = N \times 0.872 — and it was against this number, not against any independently-verified market value, that Mango’s risk engine extended $100M–$117.8M in real borrowed assets (as of 2022-10). The core arithmetic failure: the risk engine’s formula (collateral value = position size × oracle price) was correct; the input to that formula was not independent of the borrower’s own actions in the same market.

(b) Aggregating the table by root cause. Summing this page’s 52 rows (using the midpoint of any reported range, and excluding the Parity 2017 funds that were frozen rather than stolen) by root-cause category surfaces which failure mode has actually cost the most, historically:

Root cause classApprox. total (this table, $M)Dominant incident(s)
Front-end/infrastructure compromise~$1,841MBybit ($1.46–1.5B), WazirX ($234.9M), Badger DAO ($120M)
Access control / admin key~$722MRonin ($624M), Munchables ($62.5M)
Bridge validator/signature forgery~$616MWormhole ($326M), KelpDAO ($290M)
Smart contract logic bug~$802MEuler ($197M), Nomad ($190M), Poly Network ($273M Ethereum-side)
Reentrancy~$302MFei/Rari ($79.75M), Curve/Vyper ($69M), The DAO ($60M)
Social engineering / supply-chain compromise~$339MDrift Protocol ($285M), Radiant Capital ($54M)
Private key compromise~$276MVulcan Forged ($140M), Harmony ($100M)
Oracle/price manipulation~$165MMango ($108.9M midpoint), Harvest ($24M)
Governance attack~$157MCompound Prop 62 ($80M at risk), Beanstalk ($77M)
Smart contract / account-validation logic bug (Solana)~$78MCashio ($52.8M), Crema ($8.78M)
Flash-loan-funded exploit (as the primary label, not merely the funding mechanism)~$4MNirvana Finance ($3.5M)

The single largest category by dollar value in this table is not a cryptographic break at all — it’s front-end/infrastructure compromise, almost entirely because of one incident (Bybit). Excluding Bybit, access-control/admin-key failures and smart-contract logic bugs are roughly tied for the largest categories, reinforcing §1’s claim: the kind of failure that costs the most has stayed remarkably stable even as the absolute dollar figures involved have grown by orders of magnitude.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • rekt.news leaderboard — a continuously updated, community-maintained ranking of the largest crypto hacks and exploits, the primary tracker this page draws from for post-2022 Ethereum-side incidents. rekt.news/leaderboard
  • Chainalysis Crypto Crime reports — annual and incident-specific reports used by exchanges, regulators, and investigators to attribute and quantify hacks (cited directly for Poly Network and Drift Protocol above). chainalysis.com
  • Immunefi and SEAL 911 — bug-bounty infrastructure and a rapid-response security coordination network (referenced in /security/trusted-hardware-and-threat-models/) that this page’s more recent incidents (Bybit) were partly investigated through.
  • Halborn’s “Explained” series — detailed technical post-mortems for individual incidents (Wormhole, Ronin, Cashio, Crema, Radiant, Sonne, GMX), the single most-cited secondary source in this table.

Solana

Section titled “Solana”
  • Helius’s “Solana Hacks, Bugs, and Exploits” tracker — a Solana-specific incident history maintained by a major Solana infrastructure provider, cited directly for Solend (2021) and Thunder Terminal above. helius.dev/blog/solana-hacks
  • SEAL 911 — the same cross-ecosystem rapid-response network referenced above; not Solana-specific, but active in tracing funds and coordinating exchange freezes for Solana incidents as well as Ethereum ones.
  • Project-level post-mortems (Raydium, Loopscale, Slope, Penpie) — several of this table’s Solana rows trace to the affected protocol’s own public incident report rather than a third-party tracker, reflecting an ecosystem norm of publishing detailed technical post-mortems quickly after an incident.

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”

This section covers risks of relying on incident-tracking data itself, distinct from the individual incidents already tabulated in §3.

  • Attribution disputes. North Korea/Lazarus Group attribution for incidents like Munchables, WazirX, Radiant Capital, Bybit, and Drift Protocol rests on investigator and government statements (FBI, Chainalysis, Elliptic, Mandiant, TRM Labs) rather than court-proven fact in every case; this page and /security/trusted-hardware-and-threat-models/ report these as attributed, not as legally established beyond dispute.
  • “Loss” is not always a stable number. Poly Network, Euler, Crema Finance, GMX V1, and Munchables all had most or all funds returned, sometimes for a negotiated bounty — the headline loss figure captures the moment of the exploit, not the eventual financial outcome, and different trackers sometimes report the pre-recovery and post-recovery figures inconsistently.
  • Survivorship and reporting bias. Incidents with a public post-mortem, a named tracker entry, or a large enough dollar figure to attract press coverage are systematically over-represented relative to smaller or quietly-settled incidents (like rug pulls resolved privately, or exploits below a reporting threshold) — this table’s 52 rows are a sample of documented incidents, not a claim of completeness (rekt.news’s own leaderboard states: “this list is not complete and it never will be”).
  • Root-cause classification can flatten genuinely compound incidents. Bybit is filed here under “front-end/infrastructure compromise” because that is the mechanical point of failure, but the initial compromise of Safe{Wallet}‘s infrastructure was itself achieved through social engineering — a single fixed taxonomy inevitably discards some nuance that a full case-by-case narrative would preserve.
  • Double-counting across ecosystems. Wormhole and Ronin are sometimes filed under “Ethereum” and sometimes under the chain whose program actually contained the bug (Solana, in Wormhole’s case) across different trackers; this page classifies Wormhole under Solana (since the exploited signature-verification code lived in its Solana-side program) for consistency with /security/bug-classes/, but readers cross-referencing other trackers should expect this classification choice to vary.

7. Open problems

Section titled “7. Open problems”
  • Will the industry converge on a standardized incident taxonomy? This page’s 11-category root-cause taxonomy is a synthesis built for this site, not an adopted industry standard — rekt.news, DeFiLlama, and Chainalysis each use their own, only partially overlapping classification schemes, making cross-tracker aggregation (as attempted in §4) inherently approximate.
  • How should a fully-recovered hack be counted? Whether Poly Network, Euler, or Munchables should count the same as an unrecovered loss of the same headline size in any aggregate statistic (like §4’s category totals) is a genuine methodological question this page does not claim to resolve — it reports the originally-reported figure and notes recovery status per row instead.
  • Can incident data actually drive prevention, or only retrospective analysis? Several of this table’s bug classes (reentrancy via ERC-777 hooks, donation-style health-check bypasses) recurred after well-documented earlier instances of the same pattern (Cream Finance’s 2021 reentrancy predates Fei/Rari’s 2022 reentrancy; bZx’s 2020 oracle manipulation predates Harvest’s 2020 near-identical pattern within the same year) — whether public incident databases meaningfully reduce repeat occurrences of the same root cause, or mainly serve forensic and insurance purposes after the fact, is unresolved in this page’s sources.
  • How complete is the North Korea attribution picture, really? Several 2024–2026 incidents in this table carry a DPRK attribution from at least one investigator; whether the true share of unattributed incidents in this table that are also DPRK-linked is higher than currently documented is an open question this page cannot answer from public sourcing alone.

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereum (incl. L2/sidechain)Solana
Rows in this table3418
Earliest incident in this tableThe DAO, 2016-06-17Solend, 2021-08-19
Largest single loss in this tableBybit, $1.46B–$1.5B (2025-02)Wormhole, $326M (2022-02, exploited program lived on Solana)
Most common root-cause class (by row count)Smart contract logic bugSmart contract / account-validation logic bug
Distinctive patternBridge and cross-chain-messaging incidents (Wormhole’s Ethereum-facing side, Nomad, Harmony, KelpDAO) recur across the full decadeConcentrated in 2022 (5 of 18 rows) around the ecosystem’s early-DeFi-boom period, then a longer tail of smaller, faster-patched incidents through 2026

Ethereum’s decade-plus head start shows in both directions: it has the earliest and some of the largest incidents in this table, but also the longest track record of the same bug classes (reentrancy, oracle manipulation) recurring in new forms even after well-documented earlier instances. Solana’s incident history is shorter and skews toward the account-validation bug family this site’s /security/bug-classes/ page documents as structurally distinct from Ethereum’s — and, reassuringly for the ecosystem’s maturity, several of Solana’s more recent entries in this table (NoOnes, Loopscale, the 2026 legacy Raydium code) are smaller-dollar and faster-diagnosed than the ecosystem’s 2022 incidents (Cashio, Wormhole, Mango), even as Ethereum’s own largest-ever incident (Bybit) happened in the same period.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

rekt.news Leaderboard — rekt.news, continuously updated; accessed 2026-08-30. rekt.news/leaderboard

Summary of the reference

Section titled “Summary of the reference”

The leaderboard is a ranked, continuously-updated list of the largest cryptocurrency hacks and exploits by USD value, currently tracking 316 entries (as of this fetch, 2026-08-30). Each entry lists the protocol name, exact date, exact or near-exact USD loss figure, and — distinctively — an audit-status tag (an entry is marked “Audited” with the auditing firm named, “Unaudited,” or “Out of scope” for the specific exploited code path), a detail no other tracker used in this page’s research surfaces as prominently. The page carries no separate methodology page or explanatory text beyond a single terse footer statement framing its own scope and, importantly, its own incompleteness. The top of the leaderboard as fetched includes Bybit ($1,436,173,027, 2025-02-21), Ronin ($624,000,000, 2022-03-23), Poly Network ($611,000,000, 2021-08-10), a BNB Bridge incident ($586,000,000, 2022-10-06, out of this page’s Ethereum/Solana scope), an FTX-linked entry, Wormhole ($326,000,000, 2022-02-02), and a cluster of 2025–2026 nine-figure incidents including KelpDAO ($290,000,000) and Drift Protocol ($285,000,000) — both independently confirmed and included in this page’s table in §3. The individual per-incident pages linked from the leaderboard (used directly for Ronin, Nomad, Euler, Fei/Rari, Harmony, Curve/Vyper, KyberSwap, and KelpDAO in this table) go considerably deeper than the leaderboard itself, typically including a step-by-step technical reconstruction of the exploit transaction and, where available, a direct quote from the affected protocol’s own team or a named security researcher.

Key quotes

Section titled “Key quotes”

“here lie the names of some of the defi protocols that have fallen victim to attack, exploit or arbitrage. this list is not complete and it never will be.” (leaderboard footer)

“Nobody hacked KelpDAO. They hacked what KelpDAO trusted.” (rekt.news, KelpDAO incident page, framing the single-DVN cross-chain-messaging root cause)

“The attack ultimately arose from an incorrect donation mechanism and did not account for the donator’s debt health, permitting them to create an unbacked DToken debt that will never be liquidated.” (rekt.news, Euler incident page, quoting Omniscia’s analysis)

“the whitelist access was never revoked, allowing the attacker who had compromised Sky Mavis validators to use the additional (Axie DAO) signature necessary to approve transactions.” (rekt.news, Ronin incident page)

How to read the original

Section titled “How to read the original”

Background needed: none beyond general familiarity with USD figures and blockchain protocol names — the leaderboard itself requires no prior technical knowledge, though the individual incident pages it links to assume the reader can follow a smart-contract-level technical walkthrough. What to skip on a first pass: entries for chains and incidents outside this site’s Ethereum/Solana scope (BNB Chain, Bitcoin-adjacent CEXs, pure CEX collapses like FTX) — the leaderboard mixes DeFi protocol hacks, bridge hacks, and centralized-exchange incidents indiscriminately by dollar size, so filtering by relevance is a manual step the page itself doesn’t help with. The hardest part of using this source well is exactly that lack of filtering and methodology: two incidents of similar dollar size can have wildly different levels of technical detail available depending on whether rekt.news’s own writers covered that specific incident in depth or merely logged the headline figure.

What changed since

Section titled “What changed since”
  • The leaderboard is a living document by design — this page’s snapshot (52 rows drawn from it, other trackers, and primary post-mortems, accessed 2026-08-30) will already be incomplete relative to rekt.news’s own list by the time a reader visits it, since new incidents are added continuously and the site’s own footer explicitly disclaims completeness.
  • Several of this table’s older entries (Poly Network, Euler, Crema Finance) show recovered/returned funds as a later update to their original “loss” figure — a pattern that will likely repeat for some of this table’s most recent, still-unresolved entries (e.g., DeltaPrime, NoOnes) as investigations continue past this page’s 2026-08 cutoff.

Secondary references

Section titled “Secondary references”
  1. Chainalysis, annual Crypto Crime Report series — read for macro-level, cross-year trend analysis (total value stolen per year, geographic/attribution breakdowns) that a single leaderboard snapshot cannot provide.
  2. Halborn, “Explained” incident series — read for the deepest single-incident technical reconstructions among this page’s sources, especially for bridge and cross-chain incidents (Wormhole, Ronin, Radiant Capital, Sonne, GMX).
  3. Helius, “Solana Hacks, Bugs, and Exploits” — read for a Solana-specific incident history maintained by a major ecosystem infrastructure provider, useful as a cross-check against Ethereum-centric trackers’ Solana coverage.
  4. Individual protocol post-mortems (Loopscale, Raydium, Beanstalk, Slope, Penpie) — read directly rather than through any tracker when available, since a primary post-mortem is consistently more precise about root cause than any secondary aggregation.

10. Sources

Section titled “10. Sources”