Incident database
This is the site-wide incident database: every major security exploit, depeg, and governance attack referenced anywhere on this site, in one table. Rows 1-52 come directly from /security/incident-timeline/‘s sourced 2016-2026 table. Rows 53-73 add incidents and stress events mentioned in other topic pages’ §6 sections that weren’t already in that table — some are exploits with realized losses, some are depegs or design failures with no code exploited, and two (Panoptic, marginfi) are responsibly-disclosed vulnerabilities where no funds were actually lost. Where sources disagree on a loss figure, both figures are kept (“sources differ”).
Incident table
Section titled “Incident table”| Date | Chain | Protocol | Loss (as reported, $) | Root-cause class | Lesson | Page(s) | Source |
|---|---|---|---|---|---|---|---|
| 2016-06-17 | Ethereum L1 | The DAO | $60M (3.6M ETH) | Reentrancy | Update internal balances before sending funds, not after. | /security/bug-classes/ | CoinDesk, 2023-05-09 |
| 2017-07-19 | Ethereum L1 | Parity multisig wallet (1st hack) | $30M (153,037 ETH) | Access control / admin key | A shared init library anyone can call directly turns “initialize once” into “anyone can become owner.” | /security/bug-classes/ | CoinDesk, 2017-07-19 |
| 2017-11-06 | Ethereum L1 | Parity multisig wallet (2nd, frozen) | $280M frozen (not stolen) | Access control / admin key | An uninitialized library can be “owned” and self-destructed, permanently bricking every wallet depending on it. | /security/bug-classes/ | Parity Technologies postmortem, 2017-11-15 |
| 2020-02-15 | Ethereum L1 | bZx (attack 1) | $350K–$620K (sources differ) | Flash-loan-funded exploit | A flash loan removes the capital constraint on manipulating a thin market. | /lending/flash-loans/ | CoinDesk, 2020-02-19 |
| 2020-02-18 | Ethereum L1 | bZx (attack 2) | $600K–$645K (sources differ) | Oracle/price manipulation | Two “independent” price sources moved together under one flash-loan-funded attack. | /lending/flash-loans/, /oracles/oracle-manipulation/ | The Daily Swig, 2020-02 |
| 2020-10-26 | Ethereum L1 | Harvest Finance | $24M | Oracle/price manipulation | Round-tripping a flash loan through a pool to move its share price is a pattern repeated across dozens of later exploits. | /exchange/amm-oracles/, /oracles/oracle-manipulation/ | CoinDesk, 2020-10-26 |
| 2020-11-21 | Ethereum L1 | Pickle Finance | $20M | Smart contract logic bug | Accepting a caller-supplied contract address as a peer without whitelisting lets an attacker swap real deposits into a fake contract. | /security/incident-timeline/ | Decrypt, 2020-11-22 |
| 2020-12-28 | Ethereum L1 | Cover Protocol | $4.4M realized | Smart contract logic bug | Caching pool data in memory but updating only the storage copy let stale reads authorize near-infinite minting. | /security/incident-timeline/ | Mudit Gupta, 2020-12-28 |
| 2021-02-04 | Ethereum L1 | Yearn Finance (yDAI v1 vault) | $11M (net ~$2.8M) | Oracle/price manipulation | A vault reading a stablecoin’s price directly off one AMM pool inherits that pool’s manipulability. | /security/incident-timeline/ | CoinDesk, 2021-02-04 |
| 2021-02-13 | Ethereum L1 | Alpha Homora / Cream Finance (Iron Bank) | $37.5M | Smart contract logic bug | Undercollateralized borrowing extended to a “trusted” whitelisted protocol is only as safe as that protocol’s own input validation. | /lending/money-markets/ | The Defiant, 2021-02-13 |
| 2021-08-10 | Multi-chain (mostly Ethereum L1) | Poly Network | $611M total (~$273M on Ethereum; returned within 15 days) | Smart contract logic bug | Cross-chain relayer contracts that don’t tightly scope who can trigger which keeper function let an attacker call privileged functions directly. | /security/incident-timeline/ | Chainalysis, 2021-08 |
| 2021-08-19 | Solana | Solend | $16,000 | Smart contract / account-validation logic bug | Even a tiny early exploit previews the missing-validation bug class that recurs at every scale later on Solana. | /security/incident-timeline/ | Helius, “Solana Hacks, Bugs, and Exploits” |
| 2021-08-30 | Ethereum L1 | Cream Finance (reentrancy) | $18.8M–$29M (sources differ) | Reentrancy | Integrating an ERC-777 token that calls back into the recipient on transfer reintroduces reentrancy even in an otherwise-guarded codebase. | /security/bug-classes/, /foundations/token-standards/ | Halborn, 2021 |
| 2021-10 | Ethereum L1 | Compound (Proposal 62) | $70M–$90M at risk (sources differ) | Governance attack | A governance-approved code upgrade can itself be the bug, and governance is then both the cause and the only available fix. | /governance/governance-and-tokenomics/ | The Block, 2021-10 |
| 2021-12-02 | Ethereum L1 | Badger DAO | $120M | Front-end/infrastructure compromise | A compromised Cloudflare API key injected malicious approval prompts into a legitimate front-end for three weeks before detection. | /security/bug-classes/, /security/trusted-hardware-and-threat-models/ | CoinDesk, 2021-12-10 |
| 2021-12-13 | Polygon (Ethereum-ecosystem sidechain) | Vulcan Forged | $140M (refunded next day) | Private key compromise | Semi-custodial wallets managed on users’ behalf concentrate key-compromise risk exactly like a centralized exchange. | /security/incident-timeline/ | CoinDesk, 2021-12-14 |
| 2022-02-02 | Solana | Wormhole (token bridge) | $326M | Bridge validator/signature forgery | A deprecated signature-verification function let an attacker spoof a sysvar account and mint wrapped ETH with no real collateral locked. | /cross-chain/bridge-designs/, /cross-chain/bridge-hacks/, /security/bug-classes/ | Halborn, accessed 2026-08-30 |
| 2022-03-22 | Solana | Cashio | $28M–$52.8M (sources differ) | Smart contract / account-validation logic bug | Never checking that a supplied collateral account was actually issued by the real program it claimed to be lets an attacker forge collateral out of nothing. | /stablecoins/pegs-and-psm/, /security/bug-classes/, /foundations/token-standards/ | Halborn, accessed 2026-08-30 |
| 2022-03-23 | Ronin (Ethereum-linked sidechain) | Ronin Network (Axie Infinity) | $624M–$625M (sources differ) | Access control / admin key | Whitelist access granted for a temporary purpose and never revoked stays a live attack surface indefinitely. | /cross-chain/bridge-hacks/, /security/trusted-hardware-and-threat-models/ | rekt.news, accessed 2026-08-30 |
| 2022-04-17 | Ethereum L1 | Beanstalk Farms | $77M | Governance attack | A flash loan can acquire and spend governance voting power within a single transaction if no time delay separates gaining power from using it. | /governance/governance-and-tokenomics/, /security/trusted-hardware-and-threat-models/ | Beanstalk official blog, 2022-04-17 |
| 2022-04-30 | Ethereum L1 | Fei Protocol / Rari Capital Fuse pools | $79.75M | Reentrancy | A borrow function that pays out before recording debt is exploitable even when the underlying code had already fixed the same bug once. | /security/incident-timeline/ | rekt.news, accessed 2026-08-30 |
| 2022-06-24 | Harmony (Ethereum-linked sidechain bridge) | Harmony Horizon Bridge | $100M | Private key compromise | A 2-of-5 multisig secured by hot-wallet keys is only as strong as its weakest stored key. | /cross-chain/bridge-hacks/ | rekt.news, accessed 2026-08-30 |
| 2022-07-03 | Solana | Crema Finance | $8.78M (mostly returned) | Smart contract / account-validation logic bug | A flash-loan-funded attacker fabricated a fake “tick account” the program never verified as genuinely belonging to the pool. | /security/bug-classes/ | Halborn, accessed 2026-08-30 |
| 2022-07-28 | Solana | Nirvana Finance | $3.5M | Flash-loan-funded exploit | A flash loan can pump a protocol’s own bonding-curve token price and redeem the inflated result against real treasury assets. | /security/incident-timeline/ | The Block, 2022-07-28 |
| 2022-08-02 | Ethereum L1 | Nomad Bridge | $190M | Smart contract logic bug | A single misconfigured trusted root (0x00 accepted as automatically valid) turned “prove your message” into “copy-paste anyone else’s valid message.” | /cross-chain/bridge-designs/, /cross-chain/bridge-hacks/ | rekt.news, accessed 2026-08-30 |
| 2022-08-03 | Solana | Slope (mobile wallet) | $4M–$8M (sources differ; ~9,000 wallets) | Front-end/infrastructure compromise | A wallet app that logs seed phrases in plaintext to a third-party error-monitoring service turns a routine crash report into a mass key leak. | /security/incident-timeline/ | Slope Finance postmortem, 2022-08 |
| 2022-10-11 | Solana | Mango Markets | $100M–$117.8M (sources differ) | Oracle/price manipulation | A perp position’s unrealized profit, priced off a market the same attacker just manipulated, is not real collateral. | /lending/collateral-ltv-health/, /oracles/oracle-manipulation/, /derivatives/perpetual-futures/ | Elliptic, 2022-10 |
| 2022-11-02 | Solana | Solend (isolated USDH pool) | $1.26M | Oracle/price manipulation | A known, unpatched single-source price feed is a scheduled exploit waiting for whoever notices first. | /security/incident-timeline/ | CoinDesk, 2022-11-02 |
| 2022-12-16 | Solana | Raydium | $2M–$4.4M (sources differ) | Access control / admin key | A single compromised authority key controlling pool parameters is a direct path to draining “fees” across every pool that key administers. | /exchange/cfmm-math/, /exchange/concentrated-liquidity/ | Raydium postmortem, 2022-12 |
| 2023-03-14 | Ethereum L1 | Euler Finance | $197M (mostly returned) | Smart contract logic bug | A “donation” function letting a user worsen their own health factor without a corresponding liquidation check creates unbacked debt. | /lending/modular-lending/ | rekt.news, accessed 2026-08-30 |
| 2023-07-31 | Ethereum L1 (multi-protocol) | Curve Finance / Vyper compiler bug | $61.7M–$69M (sources differ) across JPEG’d, Alchemix, Metronome, Curve, others | Reentrancy | A compiler-level storage-slot misalignment silently disabled reentrancy locks in every pool built with the affected Vyper versions. | /exchange/stable-pools/ | rekt.news (citing BlockSec), accessed 2026-08-30 |
| 2023-08-07 | Solana | Cypher Protocol | ~$1.04M | Smart contract / account-validation logic bug | An undisclosed margin-logic bug, later complicated by an insider’s own admission, shows “exploit” and “insider misappropriation” aren’t always cleanly separable. | /security/incident-timeline/ | CoinDesk, 2023-08-07 |
| 2023-10-19 | Solana | Synthetify DAO | $230,000 | Governance attack | Burying a malicious payout inside one of many near-identical “spam” proposals on an inactive DAO let it pass unopposed for months. | /security/incident-timeline/ | Blockworks, 2023-10 |
| 2023-11-23 | Ethereum + 5 L2s | KyberSwap Elastic | $48M+ across 6 chains | Smart contract logic bug | A rounding/precision error smaller than 0.00000000001% in tick-liquidity accounting was still exploitable at scale with flash-loaned capital. | /exchange/cfmm-math/, /exchange/concentrated-liquidity/ | rekt.news (citing BlockSec), accessed 2026-08-30 |
| 2023-12-27 | Solana | Thunder Terminal | $240,000 | Front-end/infrastructure compromise | A compromised backend database connection string let an attacker push malicious approvals to users. | /security/incident-timeline/ | Helius, “Solana Hacks, Bugs, and Exploits” |
| 2024-03-26 | Ethereum (Blast L2) | Munchables | $62.5M ($60.5M returned) | Access control / admin key | A single insider with legitimate upgrade authority is as dangerous as a stolen key. | /security/bug-classes/, /security/trusted-hardware-and-threat-models/ | CoinDesk, 2024-03-27 |
| 2024-03-28 | Ethereum L1 | Prisma Finance | $11.6M | Smart contract logic bug | A flash-loan callback trusting caller-supplied calldata without verifying it matches the intended migration flow can be redirected. | /security/incident-timeline/ | ImmuneBytes, 2024 |
| 2024-05-14 | Ethereum (Optimism L2) | Sonne Finance | $20M | Smart contract logic bug | Splitting a market’s creation from its risk-parameter configuration leaves an exploitable window for a known “donation” attack pattern. | /security/incident-timeline/ | Halborn, 2024 |
| 2024-05-16 | Solana | Pump.fun | $1.9M | Access control / admin key | A former employee who retains a privileged authority after leaving is an off-boarding failure, not a code bug. | /exchange/bonding-curves-and-launches/ | The Block, 2024-05 |
| 2024-06-10 | Ethereum L1 | UwU Lend | $19.3M | Oracle/price manipulation | Deriving a “median” price from multiple pools isn’t manipulation-resistant if several inputs are still raw spot prices movable within one flash-loaned transaction. | /security/incident-timeline/ | SlowMist, 2024-06 |
| 2024-07-18 | Ethereum (multisig custody) | WazirX | $234.9M | Front-end/infrastructure compromise | A multisig is only as strong as the interface its signers trust to show them the truth. | /security/trusted-hardware-and-threat-models/ | Elliptic, 2024 |
| 2024-09-03 | Ethereum L1 | Penpie | $27M | Reentrancy | A reward-harvesting function without a reentrancy guard can be re-entered via a spoofed market registration to repeatedly claim rewards. | /derivatives/yield-tokenization/ | Penpie/Magpie postmortem, 2024-09 |
| 2024-09-16 | Ethereum (Arbitrum L2) | DeltaPrime | ~$5.98M | Private key compromise | A single unprotected private key securing an L2 deployment is enough to drain a contract outright. | /security/incident-timeline/ | Hackread, 2024-09 |
| 2024-10-16 | Ethereum (multisig custody) | Radiant Capital | $50M–$58M (sources differ) | Social engineering / supply-chain compromise | Malware delivered via a spoofed trusted contact can compromise multiple signer devices at once, defeating a multisig threshold entirely. | /security/trusted-hardware-and-threat-models/ | Halborn, 2024 |
| 2024-11-16 | Solana | DEXX | $30M | Private key compromise | A “Solana app” that custodies private keys off-chain reintroduces the exact custodial risk DeFi is meant to remove. | /security/incident-timeline/ | Cointelegraph, 2024-11 |
| 2025-01-24 | Solana | NoOnes | $7.9M–$8M (sources differ) | Smart contract / account-validation logic bug | Splitting a large drain into hundreds of transactions each below a size-alerting threshold can evade detection across multiple chains. | /security/incident-timeline/ | crypto.news, 2025-01-24 |
| 2025-02-21 | Ethereum (Safe multisig) | Bybit | $1.46B–$1.5B (sources differ) | Front-end/infrastructure compromise | Hardware wallets only protect what they can display; malicious JavaScript injected into signing infrastructure can make every signer approve a transaction different from the one shown. | /security/bug-classes/, /security/trusted-hardware-and-threat-models/ | Infosecurity Magazine, 2025-02 |
| 2025-04-26 | Solana | Loopscale | $5.8M | Smart contract / account-validation logic bug | Failing to verify the identity of a program supplying a price, not just sanity-checking the number it returns, leaves a cross-program invocation spoofable. | /lending/risk-engines/ | Loopscale postmortem, 2025-04 |
| 2025-07-09 | Ethereum (Arbitrum L2) | GMX V1 | $42M (later returned for a bounty) | Reentrancy | Code that implicitly assumes a caller account is a wallet, not a contract, reopens classic reentrancy even in mature, previously-audited protocols. | /derivatives/perpetual-futures/ | Halborn, 2025 |
| 2026-04-01 | Solana | Drift Protocol | $285M | Social engineering / supply-chain compromise | Weeks of patient social engineering against the humans who hold legitimate governance authority can bypass a timelock entirely. | /derivatives/perpetual-futures/, /security/trusted-hardware-and-threat-models/ | Chainalysis, 2026-04 |
| 2026-04-18 | Ethereum (LRT, cross-chain messaging to Unichain L2) | KelpDAO | $290M (116,500 rsETH) | Bridge validator/signature forgery | A single-verifier cross-chain messaging configuration means compromising just one verifier’s infrastructure is enough to forge a fully “valid” message. | /security/incident-timeline/ | rekt.news, accessed 2026-08-30 |
| 2026-06-10 | Solana | Raydium (legacy AMM V3) | $1.34M | Smart contract / account-validation logic bug | Code retired from a UI but still live on-chain with real funds remains a fully active attack surface until the funds are actually withdrawn. | /security/incident-timeline/ | KuCoin, 2026-06 |
| 2020-03-12 | Ethereum L1 | MakerDAO (Black Thursday) | $4.5M–$5.67M bad debt (sources differ); ~$8.32M ETH won for $0 bids | Mechanism-design flaw (MEV/auction) | Liquidation auctions assumed competitive bidding under normal gas conditions, which failed entirely under simultaneous network congestion. | /stablecoins/cdp-stablecoins/, /lending/liquidations/ | Widely reported post-mortems, 2020-03 |
| 2020-04-23 | Ethereum L1 | Hegic | $28,000 permanently locked (not stolen) | Smart contract logic bug | A single-letter naming collision between a check and the actual storage variable silently broke the unlock path — full collateralization is not automatically a simple, low-risk design. | /derivatives/options/ | Decrypt, secondary, 2020-04 |
| 2020-06 | Ethereum L1 | Balancer | ~$500,000 | Smart contract logic bug | Non-standard, fee-on-transfer (“deflationary”) ERC-20 tokens desynchronize a pool’s internal balance accounting from its real reserves. | /foundations/token-standards/ | rekt.news, secondary |
| 2021-06-16/17 | Ethereum-compatible chains | Iron Finance (TITAN) | TVL collapsed from over $2B; TITAN to near zero | Algorithmic design failure / bank run | A partially-collateralized token’s own defense mechanism (selling the floating token into the stable one) accelerates collapse once large holders start redeeming instead of buying. | /stablecoins/algorithmic-failures/ | CoinDesk; Federal Reserve, “Runs on Algorithmic Stablecoins,” 2021-06/2022-06 |
| 2021-10-27 | Ethereum L1 | Cream Finance (Iron Bank / AMP token) | ~$130M | Reentrancy | Listing a token whose ERC-777 transfer hooks interact unexpectedly with a lending market’s reentrancy guards lets an attacker re-borrow against collateral that should already be consumed. | /lending/money-markets/ | Cream Finance incident acknowledgment, 2021-10-27 |
| 2022-05-07 to 2022-05-12 | Terra (bridged exposure to Ethereum via Wormhole) | TerraUSD (UST) / LUNA | “Tens of billions” of dollars in combined value destroyed | Algorithmic design failure / bank run | An uncollateralized mint-burn peg whose defense mechanism (minting LUNA to redeem UST) itself accelerated LUNA’s price collapse once confidence broke. | /stablecoins/algorithmic-failures/ | Liu, Makarov, Schoar, NBER Working Paper 31160, 2023-05 |
| 2022-06-13 | Ethereum L1 | stETH (Lido) | n/a — depeg, not theft; traded to ~$0.93–0.95 per ETH | Market depeg / liquidity stress (non-exploit) | A liquid staking token that cannot yet redeem 1:1 on-chain depends entirely on secondary-market liquidity, which can vanish under stress. | /staking/liquid-staking-tokens/ | CoinDesk, 2022-06-29 (reporting Nansen research) |
| 2022-10 | Ethereum L1 (Secret Network, separate chain) | Secret Network | n/a — key-extraction vulnerability, no confirmed theft | Trusted-hardware / cryptographic vulnerability | An SGX side-channel (xAPIC/ÆPIC Leak) can extract a TEE-based chain’s master decryption key, threatening retroactive decryption of every “private” transaction. | /mev/encrypted-mempools/ | The Block; Cointelegraph, secondary, 2022-10 |
| 2023-02-07 | Ethereum L1 | CoW Swap (solver exploit) | ~$166,000 | Smart contract logic bug | Trust placed in a newly allow-listed solver’s own external contract code is trust in that solver’s security practices, not the protocol’s. | /exchange/batch-auctions/ | CoW post-mortem, 2023-02 |
| 2023-03-10 to 2023-03-13 | Ethereum L1 | USDC (Circle, Silicon Valley Bank exposure) | n/a — depeg, not theft; traded to ~$0.87 | Market depeg / liquidity stress (non-exploit) | A fiat-backed stablecoin’s peg is only as strong as the liquidity of the bank holding its reserves, and that risk propagates through anything pegged to it via a PSM. | /stablecoins/pegs-and-psm/, /stablecoins/fiat-backed-and-cctp/ | CoinDesk, 2023-03-11/13 |
| 2023-04 | Ethereum L1 | Lido (RockLogic node operator) | 13.77 ETH in slashing penalties and missed rewards | Client software bug / correlated slashing | A validator-client bug that re-imports supposedly-deleted keys shows correlated slashing risk from running the same client, not malicious operator behavior. | /staking/liquid-staking-tokens/ | Lido, “Post Mortem: RockLogic GmbH Slashing Incident,” 2023 |
| 2024-04-23/24 | Ethereum L1 | Renzo (ezETH) | $56M+ in DeFi liquidations across 250+ users | Market depeg / liquidity stress (non-exploit) | A liquid restaking token with no direct redemption path can depeg roughly 79% in under an hour purely from an unpopular announcement, no exploit required. | /staking/lrt-risks/ | DLNews; Protos, secondary, 2024-04 |
| 2024-11 | Ethereum (Taiko L2) | Taiko (priority-gas-auction losses) | 83.9 ETH (~$261,096) | Mechanism-design flaw (MEV/auction) | A totally permissionless “based” sequencing auction can force even the rollup’s own fallback proposer to lose money competing against sophisticated searchers. | /mev/based-rollups-and-preconfs/ | Rezzoli, as of 2024-12 |
| 2025-02-14 | Solana | $LIBRA (Meteora dynamic bonding curve) | ~$90M–$107M traced to insiders; investor losses estimated $87M–$260M+ (sources differ widely) | Insider rug pull / market manipulation | A politically-promoted token launch with insider access to the bonding curve can extract tens of millions from public buyers within hours, with no code bug involved. | /exchange/bonding-curves-and-launches/ | TRM Labs; DL News, secondary, 2026-08-29 |
| 2025-03-06 | Ethereum L1 (1inch Fusion resolvers) | 1inch Fusion (deprecated v1 resolvers) | ~$5M (2.4M USDC and 1,276 WETH) | Smart contract logic bug | A Yul-level memory-pointer underflow in a settlement function can pass nine audits and still be exploitable; end-user funds were not directly at risk. | /exchange/rfq-and-intents/ | rekt.news, 2025-03 |
| 2025-03-24/25 | Ethereum (Polygon) / UMA | Polymarket (UMA dispute-resolution vote) | $7M market resolved on a contested vote | Governance attack | A single actor controlling roughly 25% of an optimistic oracle’s dispute vote can force a contested, factually incorrect resolution to stand. | /derivatives/prediction-markets/, /exchange/prediction-market-amms/ | OddsShopper/niftynoon, secondary, 2025-03 |
| 2025-03-26 | Ethereum (Hyperliquid’s own L1) | Hyperliquid (JELLY incident) | Up to $12M unrealized loss against HLP’s ~$230M balance | Oracle/price manipulation | Pumping a thinly-traded token’s price across exchanges can force a protocol’s own liquidity pool to inherit an attacker’s short position when the order book can’t absorb the liquidation. | /derivatives/perpetual-futures/ | Halborn, secondary, 2025-03 |
| 2025-05-28 | Ethereum (Uniswap v4 hook) | Cork Protocol | ~$12M wstETH | Smart contract logic bug | A hook that can be called without authorization or unvalidated data lets an attacker deposit into a fake market and redeem genuine collateral. | /exchange/v4-hooks-and-am-amm/ | rekt.news, 2025-05 |
| 2025-08-25 | Ethereum (Panoptic, on Uniswap v3) | Panoptic | Up to $5M at risk; $0 lost (responsibly disclosed) | Trusted-hardware / cryptographic vulnerability | A custom position-ownership hashing scheme can be a variant of an academically-broken scheme, letting an attacker forge ownership of another user’s position. | /derivatives/options/ | Metaverse Post / Code4rena, secondary, 2025-08 |
| 2025-09-01 | Ethereum + Unichain (Bunni v2, am-AMM) | Bunni v2 | ~$8.4M | Smart contract logic bug | Rounding errors in a custom liquidity-distribution function can let carefully sized withdrawals break rebalancing math. | /exchange/v4-hooks-and-am-amm/ | rekt.news, 2025-09 |
| 2025-09-17 | Solana | marginfi | $0 lost; ~$160M in deposits at risk (responsibly disclosed) | Smart contract / account-validation logic bug | A newly added instruction that fails to check whether an account is mid-flash-loan can strand debt with no offsetting collateral if exploited. | /lending/flash-loans/ | Asymmetric Research, fetched 2026-08-29 |
Root-cause class definitions
Section titled “Root-cause class definitions”- Reentrancy — a callback re-enters a function before its own state updates finish, letting the same funds be claimed more than once.
- Oracle/price manipulation — a manipulated, stale, or misread price feed drives an incorrect lending, liquidation, or settlement decision.
- Flash-loan-funded exploit — an uncollateralized, same-transaction loan is the capital source that makes an otherwise-separate exploit (usually oracle manipulation) affordable.
- Access control / admin key — a privileged key, role, or permission does something it shouldn’t, is used by the wrong party, or was never revoked after its legitimate purpose ended.
- Governance attack — voting power is acquired, borrowed, or concentrated to pass a malicious or contested proposal, including attacks on a market’s own resolution-oracle vote.
- Bridge validator/signature forgery — a bridge’s cross-chain message-verification step is bypassed, spoofed, or forged rather than genuinely signed by its validator set.
- Smart contract logic bug — a logic, arithmetic, or validation error in contract code that doesn’t fit a more specific class in this list.
- Smart contract / account-validation logic bug (Solana) — a missing or incomplete check of an account’s signer, owner, type, or issuing program, Solana’s dominant bug family.
- Private key compromise — an attacker obtains a private key directly, through a leak, malware, or a semi-custodial arrangement.
- Front-end/infrastructure compromise — the website, API, or signing pipeline a user or signer trusts is compromised, independent of the underlying contract code’s correctness.
- Social engineering / supply-chain compromise — a human is deceived (fake job offer, spoofed contact, malware) or a trusted insider/contractor relationship is abused to gain access.
- Algorithmic design failure / bank run — a stablecoin’s or protocol’s own peg-defense or incentive mechanism accelerates collapse once confidence breaks, rather than restoring stability.
- Market depeg / liquidity stress (non-exploit) — a real asset trades away from its expected value due to a liquidity or confidence shock, with no code exploited and no theft.
- Trusted-hardware / cryptographic vulnerability — a flaw in secure hardware (TEE side-channels) or a custom cryptographic scheme, whether actually exploited or caught via responsible disclosure.
- Client software bug / correlated slashing — a bug in validator or node client software causes unintended, correlated protocol-level penalties across every operator running that client.
- Mechanism-design flaw (MEV/auction) — an auction, liquidation, or sequencing mechanism behaves badly under real-world conditions (congestion, permissionless competition) the design didn’t anticipate.
- Insider rug pull / market manipulation — project insiders or promoters extract value from public participants through coordinated selling or privileged access, with no code exploited.
Count by root-cause class
Section titled “Count by root-cause class”| Root-cause class | Rows | Notable incidents |
|---|---|---|
| Smart contract logic bug | 15 | Nomad ($190M), Euler ($197M), KyberSwap ($48M+), Poly Network ($611M total) |
| Oracle/price manipulation | 7 | Mango Markets ($100M–$117.8M), Harvest ($24M), Hyperliquid JELLY (up to $12M) |
| Reentrancy | 7 | The DAO ($60M), Curve/Vyper ($61.7M–$69M), Cream Finance/AMP (~$130M) |
| Smart contract / account-validation logic bug (Solana) | 8 | Cashio ($28M–$52.8M), Wormhole’s Solana-side program ($326M), Loopscale ($5.8M) |
| Access control / admin key | 6 | Ronin ($624M–$625M), Munchables ($62.5M), Raydium ($2M–$4.4M) |
| Front-end/infrastructure compromise | 5 | Bybit ($1.46B–$1.5B), WazirX ($234.9M), Badger DAO ($120M) |
| Governance attack | 4 | Beanstalk ($77M), Compound Prop 62 ($70M–$90M at risk), Polymarket/UMA ($7M) |
| Private key compromise | 4 | Vulcan Forged ($140M), Harmony ($100M), DEXX ($30M) |
| Market depeg / liquidity stress (non-exploit) | 3 | USDC/SVB, stETH, Renzo ezETH — no code exploited in any of the three |
| Algorithmic design failure / bank run | 2 | Terra/LUNA (“tens of billions”), Iron Finance/TITAN (>$2B TVL wiped) |
| Bridge validator/signature forgery | 2 | Wormhole ($326M), KelpDAO ($290M) |
| Social engineering / supply-chain compromise | 2 | Drift Protocol ($285M), Radiant Capital ($50M–$58M) |
| Trusted-hardware / cryptographic vulnerability | 2 | Secret Network (key-extraction, no confirmed theft), Panoptic ($0 lost, disclosed) |
| Mechanism-design flaw (MEV/auction) | 2 | MakerDAO Black Thursday ( |
| Flash-loan-funded exploit | 2 | bZx attack 1 ($350K–$620K), Nirvana Finance ($3.5M) |
| Insider rug pull / market manipulation | 1 | $LIBRA (~$90M–$107M traced to insiders) |
| Client software bug / correlated slashing | 1 | Lido/RockLogic Prysm slashing (13.77 ETH) |
Excluding the two responsibly-disclosed, zero-loss rows (Panoptic, marginfi) and the frozen-not-stolen Parity 2017 row, this table’s realized losses are dominated by front-end/infrastructure compromise (almost entirely Bybit’s $1.46B–$1.5B) and smart contract logic bugs spread across dozens of smaller incidents — echoing /security/incident-timeline/‘s own finding that the categories of root cause have stayed remarkably stable across a decade even as the dollar figures involved grew by orders of magnitude.