Hacks / Statistics
Exploit Statistics
What the reproduced exploits add up to: how many, how much was lost, which root causes and chains they cluster on, and how that compares with what audits report. Select any bar or cell to open the incidents it counts. Data as of November 2026.
Incidents reproduced
979
On-chain exploits, each with a root-cause write-up and a runnable proof of concept.
Stated losses
$5.55B
811 of 979 incidents state a dollar figure.
Audit findings
1,362
High-severity findings from public audit reports, rebuilt as runnable cases.
Root-cause tags in use
410
Distinct vulnerability tags across incidents and findings.
On-chain incidents
Exploits that happened on a live chain and are reproduced here. Losses are the dollar figure each write-up states; incidents that give their loss only in tokens are counted but add nothing to the dollar totals.
Stated losses by year
Dollars lost in the incidents of each year.
View as table
| Year | Incidents | State a loss | Stated losses |
|---|---|---|---|
| 2017 | 2 | 1 | $150M |
| 2018 | 3 | 3 | $210M |
| 2019 | 0 | 0 | — |
| 2020 | 9 | 7 | $72.5M |
| 2021 | 37 | 33 | $1.05B |
| 2022 | 133 | 110 | $1.39B |
| 2023 | 220 | 191 | $504M |
| 2024 | 193 | 174 | $279M |
| 2025 | 166 | 141 | $1.68B |
| 2026 | 210 | 151 | $214M |
Incidents by year
How many of each year's exploits are in the library.
6 incidents with no date are left out.
View as table
| Year | Count |
|---|---|
| 2017 | 2 |
| 2018 | 3 |
| 2019 | 0 |
| 2020 | 9 |
| 2021 | 37 |
| 2022 | 133 |
| 2023 | 220 |
| 2024 | 193 |
| 2025 | 166 |
| 2026 | 210 |
Stated losses by root cause
Dollars lost in incidents tagged with each category.
An incident with two categories counts under both, so the bars add up to more than the total.
View as table
| Category | Incidents | State a loss | Stated losses |
|---|---|---|---|
| Access Control | 399 | 336 | $3.46B |
| Dependency | 106 | 97 | $1.62B |
| Bridge | 21 | 20 | $1.57B |
| Logic | 531 | 426 | $969M |
| Oracle Manipulation | 300 | 268 | $863M |
| Arithmetic | 106 | 94 | $596M |
| Governance | 73 | 61 | $360M |
| Reentrancy | 69 | 61 | $182M |
| Data Integrity | 7 | 6 | $157M |
| DeFi | 183 | 138 | $114M |
| Untagged | 41 | 27 | $94.4M |
| Authentication | 28 | 24 | $28.5M |
| Input Validation | 32 | 23 | $27.4M |
| Accounting | 1 | 1 | $7.3M |
| Denial of Service | 6 | 4 | $141K |
| Business Logic | 1 | 1 | $3K |
Incidents by root cause
How many incidents carry each category.
The 10 most common of 17 categories. The rest are in the table.
View as table
| Category | Count |
|---|---|
| Logic | 531 |
| Access Control | 399 |
| Oracle Manipulation | 300 |
| DeFi | 183 |
| Arithmetic | 106 |
| Dependency | 106 |
| Governance | 73 |
| Reentrancy | 69 |
| Untagged | 41 |
| Input Validation | 32 |
| Authentication | 28 |
| Bridge | 21 |
| Data Integrity | 7 |
| Denial of Service | 6 |
| Accounting | 1 |
| Business Logic | 1 |
| Proxy | 1 |
Incidents by chain
Where the exploited contracts were deployed.
10 more chains with 31 incidents between them are in the table.
View as table
| Chain | Incidents | State a loss | Stated losses |
|---|---|---|---|
| BNB Chain | 406 | 351 | $275M |
| Ethereum | 399 | 316 | $4.91B |
| Base | 57 | 47 | $37M |
| Arbitrum | 43 | 40 | $82.5M |
| Polygon | 28 | 23 | $101M |
| Avalanche | 15 | 12 | $17.6M |
| Other | 12 | 6 | $24M |
| Fantom | 6 | 5 | $12.8M |
| Blast | 3 | 3 | $7.6M |
| Gnosis | 3 | 1 | $1.5M |
| Linea | 2 | 2 | $7M |
| Citrea | 1 | 1 | $140K |
| Cronos | 1 | 1 | $75M |
| HyperEVM | 1 | 1 | $33.4K |
| Moonbeam | 1 | 1 | $1M |
| zkSync | 1 | 1 | $202K |
How large the losses are
Incidents grouped by the size of their stated loss.
The 45 incidents of $10M and up hold 90% of all stated losses.
View as table
| Stated loss | Incidents | Total | Share of losses |
|---|---|---|---|
| Under $10K | 143 | $489K | <0.1% |
| $10K–$100K | 269 | $10.3M | 0.2% |
| $100K–$1M | 222 | $73M | 1.3% |
| $1M–$10M | 132 | $461M | 8.3% |
| $10M and up | 45 | $5B | 90% |
Root causes over time
Incidents per category and year, for the nine most common categories.
Starts in 2020. The 5 earlier incidents are in the yearly charts above.
View as table
| Category | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 |
|---|---|---|---|---|---|---|---|
| Logic | 4 | 16 | 56 | 122 | 82 | 102 | 146 |
| Access Control | 2 | 7 | 56 | 74 | 83 | 88 | 87 |
| Oracle Manipulation | 3 | 14 | 35 | 79 | 53 | 52 | 64 |
| DeFi | 1 | 3 | 17 | 57 | 23 | 45 | 37 |
| Arithmetic | 0 | 5 | 11 | 30 | 27 | 11 | 20 |
| Dependency | 1 | 3 | 14 | 18 | 21 | 31 | 18 |
| Governance | 2 | 10 | 15 | 19 | 6 | 7 | 14 |
| Reentrancy | 1 | 5 | 15 | 20 | 14 | 6 | 7 |
| Input Validation | 0 | 0 | 3 | 4 | 3 | 5 | 17 |
Ten largest stated losses
Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Bybit Cold-Wallet Heist | Feb 2025 | Ethereum | Access Control | $1.46B |
| Ronin Bridge Exploit | Mar 2022 | Ethereum | Access Control | $625M |
| Poly Network Exploit | Aug 2021 | Ethereum | Access Control | $610M |
| Euler Finance $197M Exploit | Mar 2023 | Ethereum | Logic | $197M |
| Beanstalk Farms Exploit | Apr 2022 | Ethereum | Governance | $182M |
| Nomad Bridge Exploit | Aug 2022 | Ethereum | Bridge | $152M |
| Parity WalletLibrary kill | Nov 2017 | Ethereum | Access Control | $150M |
| SmartMesh (SMT) Exploit | Apr 2018 | Ethereum | Arithmetic | $140M |
| Cream Finance (Oct 2021) Exploit | Oct 2021 | Ethereum | Oracle Manipulation | $130M |
| Balancer V2 Exploit | Nov 2025 | Ethereum | Arithmetic | $120M |
Audit findings
High-severity bugs that auditors reported before anyone exploited them, rebuilt as runnable cases. They describe a flaw, not money that left a protocol, so they carry no loss figure.
Findings by root cause
How many audit findings carry each category.
The 10 most common of 56 categories. The rest are in the table.
View as table
| Category | Count |
|---|---|
| Logic | 749 |
| Untagged | 379 |
| Denial of Service | 254 |
| Access Control | 195 |
| Arithmetic | 108 |
| DeFi | 56 |
| Loss Of Funds | 53 |
| Accounting | 43 |
| Dependency | 41 |
| Oracle Manipulation | 40 |
| Reentrancy | 39 |
| Input Validation | 38 |
| Authentication | 29 |
| Governance | 29 |
| Bridge | 26 |
| Liveness | 10 |
| Signature | 9 |
| Data Integrity | 7 |
| Economic | 7 |
| Math | 7 |
| Mev | 4 |
| Nft | 4 |
| Reward Calculation | 3 |
| State | 3 |
| Timing | 3 |
| Token | 3 |
| Approval | 2 |
| Cross Chain | 2 |
| Data Structure | 2 |
| Economic Design | 2 |
| Fee | 2 |
| Liquid Staking | 2 |
| Liquidation | 2 |
| Access | 1 |
| Account | 1 |
| Availability | 1 |
| Dex | 1 |
| Flash Loan | 1 |
| Frozen Funds | 1 |
| Funds | 1 |
| Gas | 1 |
| Injection | 1 |
| Insolvency | 1 |
| Integer Bounds | 1 |
| Lifecycle | 1 |
| Mint | 1 |
| Oracle Manipulation | 1 |
| Redeem | 1 |
| Rounding | 1 |
| Storage | 1 |
| Streaming | 1 |
| Tokenomics | 1 |
| Trust | 1 |
| Upgrade Safety | 1 |
| Upgradeable | 1 |
| Vesting | 1 |
What audits report, and what gets exploited
Each category's share of incidents next to its share of audit findings. A wide gap means a bug class is over- or under-represented in audit reports relative to the exploits that reach a live chain.
Share of incidents and of audit findings, by root cause
Percent of entries that carry each category.
Shares are of entries with at least one category tag: 938 of 979 incidents and 983 of 1,362 findings.
View as table
| Category | Incidents | Share of incidents | Findings | Share of findings |
|---|---|---|---|---|
| Logic | 531 | 57% | 749 | 76% |
| Access Control | 399 | 43% | 195 | 20% |
| Oracle Manipulation | 300 | 32% | 40 | 4.1% |
| DeFi | 183 | 20% | 56 | 5.7% |
| Arithmetic | 106 | 11% | 108 | 11% |
| Dependency | 106 | 11% | 41 | 4.2% |
| Governance | 73 | 7.8% | 29 | 3% |
| Reentrancy | 69 | 7.4% | 39 | 4% |
| Denial of Service | 6 | 0.6% | 254 | 26% |
| Accounting | 1 | 0.1% | 43 | 4.4% |
| Loss Of Funds | 0 | 0% | 53 | 5.4% |
Quarterly reports
One page per quarter: the count, the stated losses, the root causes and chains behind them, and every incident of the quarter.
Incidents per quarter
The last 16 quarters. Select a column to open its report.
The grey column is the quarter in progress.
View as table
| Quarter | Incidents | Stated losses |
|---|---|---|
| Q1 2023 | 37 | $324M |
| Q2 2023 | 60 | $74.1M |
| Q3 2023 | 55 | $77.6M |
| Q4 2023 | 68 | $27.5M |
| Q1 2024 | 58 | $143M |
| Q2 2024 | 58 | $88.2M |
| Q3 2024 | 42 | $33.1M |
| Q4 2024 | 35 | $14.4M |
| Q1 2025 | 50 | $1.47B |
| Q2 2025 | 55 | $26.7M |
| Q3 2025 | 52 | $51.1M |
| Q4 2025 | 9 | $135M |
| Q1 2026 | 29 | $11.5M |
| Q2 2026 | 79 | $55M |
| Q3 2026 | 81 | $144M |
| Q4 2026 (in progress) | 21 | $2.8M |
- Q4 202621 incidents, so far$2.8M stated
- Q3 202681 incidents$144M stated
- Q2 202679 incidents$55M stated
- Q1 202629 incidents$11.5M stated
- Q4 20259 incidents$135M stated
- Q3 202552 incidents$51.1M stated
- Q2 202555 incidents$26.7M stated
- Q1 202550 incidents$1.47B stated
- Q4 202435 incidents$14.4M stated
- Q3 202442 incidents$33.1M stated
- Q2 202458 incidents$88.2M stated
- Q1 202458 incidents$143M stated
- Q4 202368 incidents$27.5M stated
- Q3 202355 incidents$77.6M stated
- Q2 202360 incidents$74.1M stated
- Q1 202337 incidents$324M stated
- Q4 202260 incidents$63M stated
- Q3 202231 incidents$161M stated
- Q2 202222 incidents$397M stated
- Q1 202220 incidents$769M stated
- Q4 20217 incidents$215M stated
- Q3 202113 incidents$678M stated
- Q2 202113 incidents$142M stated
How these numbers are made
- The library is a sample. It counts exploits that are reproduced here, not every incident in the industry. Key thefts and exchange breaches are mostly absent because there is no contract bug to replay, so the totals understate industry-wide losses.
- A loss is the first dollar figure the write-up states. That is often the reproduced transaction and sometimes the whole campaign, so two incidents are not always measured the same way. Amounts given only in ETH, BNB or another token are not converted.
- Coverage. 811 of 979 incidents state a dollar figure. The other 168 appear in every count and in no dollar total.
- Categories overlap. An entry tagged with two root-cause categories is counted under both, which is also how the explorer filters.
- Audit findings carry no loss and are never added to the incident figures.