Hacks / Statistics / Q1 2024
Q1 2024 Exploit Report
January–March 2024: 58 reproduced exploits, $143M in stated losses.
58 exploits from January–March 2024 are reproduced in the library, 10 fewer than in Q4 2023. 48 of them state a dollar loss, $143M in total, against $27.5M the quarter before. Logic was the most common root-cause category, on 23 of the 58 incidents (40%). Ethereum had both the most incidents (35) and the largest stated losses ($117M). The largest stated loss was Orbit Chain Bridge Exploit at $81.5M, 57% of the quarter's stated total.
Incidents
58
68 in Q4 2023.
Stated losses
$143M
48 of 58 incidents state a dollar figure. $27.5M in Q4 2023.
Largest stated loss
$81.5M
Orbit Chain Bridge Exploit
Most common root cause
Logic
On 23 of 58 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic23Access Control21Arithmetic11Oracle Manipulation11Reentrancy7Dependency6DeFi3Input Validation3Governance2Bridge1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 23 | $13.5M |
| Access Control | 21 | $97.2M |
| Arithmetic | 11 | $18.3M |
| Oracle Manipulation | 11 | $17.4M |
| Reentrancy | 7 | $365K |
| Dependency | 6 | $14.1M |
| DeFi | 3 | $140 |
| Input Validation | 3 | $4.3M |
| Governance | 2 | $223K |
| Bridge | 1 | $81.5M |
Chains
Where the exploited contracts were deployed.
Ethereum35BNB Chain15Arbitrum5Base1Blast1Polygon1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 35 | $117M |
| BNB Chain | 15 | $1.2M |
| Arbitrum | 5 | $19.2M |
| Base | 1 | $572K |
| Blast | 1 | $4.8M |
| Polygon | 1 | — |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Orbit Chain Bridge Exploit$81.5MPrisma Finance Exploit$11MWooFi (WooPPV2) Exploit$8MAbracadabra / MIM Spell V2 Exploit$6.5MSeneca Protocol Exploit$6.4M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Orbit Chain Bridge Exploit | Ethereum | $81.5M |
| Prisma Finance Exploit | Ethereum | $11M |
| WooFi (WooPPV2) Exploit | Arbitrum | $8M |
| Abracadabra / MIM Spell V2 Exploit | Ethereum | $6.5M |
| Seneca Protocol Exploit | Ethereum | $6.4M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Orbit Chain Bridge ExploitForged Validator Signatures Drain the ETH Vault | Jan 2024 | Ethereum | Access Control | $81.5M |
| Prisma Finance ExploitUnauthorised MigrateTroveZap Flash-Loan Callback Drains Trove Collateral | Mar 2024 | Ethereum | Access Control | $11M |
| WooFi (WooPPV2) ExploitSlippage-Model Price Collapse Drain | Mar 2024 | Arbitrum | Oracle Manipulation | $8M |
| Abracadabra / MIM Spell V2 ExploitrepayForAll Rebase De-sync + Rounding-Up Debt Inflation | Jan 2024 | Ethereum | Arithmetic | $6.5M |
| Seneca Protocol ExploitArbitrary External Call Abuses User Approvals | Feb 2024 | Ethereum | Dependency | $6.4M |
| Gamma Strategies (UniProxy / Hypervisor) ExploitSpot-Price Vault-Share Inflation | Jan 2024 | Arbitrum | Oracle Manipulation | $6.3M |
| SSS ExploitSelf-Transfer Balance-Doubling Lets Attacker Mint Phantom SSS and Drain the WETH Pool | Mar 2024 | Blast | Logic | $4.8M |
| Radiant Capital ExploitEmpty-Market liquidityIndex Inflation + rayDiv Rounding Drain | Jan 2024 | Arbitrum | Arithmetic | $4.5M |
| Socket Gateway ExploitArbitrary call in WrappedTokenSwapperImpl Drains User Approvals | Jan 2024 | Ethereum | Dependency | $3.3M |
| Unizen "UnizenIO2" ExploitArbitrary-Call TradeAggregator.swap Token Theft | Mar 2024 | Ethereum | Dependency | $2.1M |
| Unizen ExploitArbitrary call in the Unizen Aggregator Drains Any User Who Approved It | Mar 2024 | Ethereum | Dependency | $2.1M |
| Blueberry Protocol ExploitOracle Decimal Mismatch Enables ~$1.4M Under-Collateralized Borrow | Feb 2024 | Ethereum | Arithmetic | $1.4M |
| MO Token ExploitSelf-Recycling Borrow Burns Pool Reserves to Inflate price() and Drain USDT | Mar 2024 | Base | Oracle Manipulation | $572K |
| MIC Token ExploitLP-Fee Distributor Pays the Same LP Tokens Over and Over | Jan 2024 | BNB Chain | Logic | $500K |
| Wise LendingLending-Share Price Inflation via Deposit/Withdraw Rounding Asymmetry | Jan 2024 | Ethereum | Arithmetic | $464K |
| Wise Lending ExploitLending-Share Price Inflation via Rounding Asymmetry + Bad-Debt Donation | Jan 2024 | Ethereum | Arithmetic | $464K |
| Compound v2 cUNI ExploitStale-Oracle Discount Borrow (Open Oracle UniswapAnchoredView) | Feb 2024 | Ethereum | Oracle Manipulation | $440K |
| LavaLending ExploitWrapperOracle Price-Depeg Lets Manipulated LP Drain the Aave Pool | Mar 2024 | Arbitrum | Oracle Manipulation | $340K |
| DAO SoulMate ExploitPermissionless redeem() Drains the DAO's SetToken Basket | Jan 2024 | Ethereum | Access Control | $319K |
| ZongZi / ZZF ExploitManipulated-Price Reward Drain via burnToHolder + receiveRewards | Mar 2024 | BNB Chain | Oracle Manipulation | $223K |
| LQDX / LiquidXv2Zap ExploitArbitrary-account deposit() Spends Anyone's Approval | Jan 2024 | Ethereum | Access Control | $220K |
| NBLGAME (NblNftStake) ExploitERC721 onERC721Received Reentrancy Double-Withdraw | Jan 2024 | Ethereum | Reentrancy | $180K |
| DeezNutz (DN404) ExploitSelf-Transfer Balance Inflation in a Reflection-Fork of DN404 | Feb 2024 | Ethereum | Logic | $170K |
| DN404 ExploitUnguarded init() Lets Anyone Re-init a Vesting Proxy and Drain Its Tokens | Feb 2024 | Ethereum | Access Control | $170K |
| TGBS ExploitRepeated Permissionless Pool Burns via Self-Transfer Draining the TGBS/WBNB Pair | Mar 2024 | BNB Chain | Access Control | $150K |
| ARK ExploitPublic, Rate-Limit-Free autoBurnLiquidityPairTokens() AMM Reserve Drain | Mar 2024 | BNB Chain | Access Control | $130K |
| Barley Finance ExploitFlash-Loaned Collateral Double-Counted as bond() Deposit | Jan 2024 | Ethereum | Reentrancy | $130K |
| Affine DeFi LidoLevV3 ExploitFlashloan-Triggered upgradeTo Drains All Aave Collateral | Feb 2024 | Ethereum | Access Control | $115K |
| Bridge Mutual BMIZapper ExploitArbitrary External Call Drains Pre-Approved User Funds | Jan 2024 | Ethereum | Dependency | $114K |
| Citadel Finance ExploitSpot-Price Oracle Manipulation in CitadelRedeem.redeem() | Jan 2024 | Arbitrum | Oracle Manipulation | $93K |
| BurnsDeFi / BurnsBuild ExploitSpot-AMM Price-Oracle Manipulation in burnToHolder | Feb 2024 | BNB Chain | Oracle Manipulation | $67K |
| GHT ExploitPermissionless transferFrom Drains the Uniswap V2 Pair | Mar 2024 | Ethereum | Access Control | $57K |
| JuiceStaking ExploitUncapped stakeWeek Bonus Multiplier Inflation | Mar 2024 | Ethereum | Logic | $54K |
| XSIJ (GGGTOKEN) ExploitRepeatable, Un-reset autoBurnLiquidityPairTokens() Pool Drain | Jan 2024 | BNB Chain | Logic | $51.7K |
| Particle Trade ExploitForged-Lien accountBalance Mint via onERC721Received | Feb 2024 | Ethereum | Reentrancy | $50K |
| DualPools ExploitDonation-Inflated Exchange Rate Lets 2 wei of dLINK Borrow the Whole Pool | Feb 2024 | BNB Chain | Arithmetic | $41.9K |
| ParaSwap AugustusV6 ExploitCallback Hijack Drains Pre-Approved User Tokens | Mar 2024 | Ethereum | Access Control | $24K |
| BBT ExploitPermissionless setRegistry() + mint() Infinite-Mint Drain | Mar 2024 | Ethereum | Access Control | $17.2K |
| Pandora's Nodes 404 ExploittransferFrom Allowance Underflow Lets Anyone Move Tokens Out of the Pool | Feb 2024 | Ethereum | Arithmetic | $17K |
| IntrospectionToken (IT) ExploitInflationary Repricing Mint Drains the IT/USDT Pancake Pair | Mar 2024 | BNB Chain | Logic | $13.4K |
| ALP (ApolloX) ExploitPublic _swap() Drains the Portfolio Vault's LP Tokens | Mar 2024 | BNB Chain | Access Control | $10.6K |
| Swarm Markets (XToken) ExploitPublic mint() / burnFrom() Mint-and-Unwrap Drain | Feb 2024 | Ethereum | Access Control | $7.7K |
| RuggedArt (RuggedMarket) ExploitReentrant targetedPurchase Buys NFTs With Self-Staked Collateral | Feb 2024 | Ethereum | Reentrancy | $3.5K |
| ETHFIN ExploitPermissionless doBuyback() Buyback-Pot Drain via Holder-Count Manipulation | Mar 2024 | BNB Chain | Access Control | $1.2K |
| Peapods Finance ExploitFree Index-Token Mint via flash() + bond() Self-Collateralization | Jan 2024 | Ethereum | Reentrancy | $1K |
| SHELL MEV-Bot DrainPermissionless Arbitrage Function with Attacker-Chosen Recipient | Jan 2024 | BNB Chain | Access Control | $1K |
| Babyloogn ExploitPermissionless Airdrop Drain via Zero-Value NFT "Stake" | Feb 2024 | BNB Chain | Logic | $700 |
| MINER (ERC-X / ERC404-style) ExploitFractional-Transfer NFT Mint/Burn Asymmetry Drains the Uniswap V3 Pool | Feb 2024 | Ethereum | Logic | $140 |
| ADC ExploitPermissionless calcStepIncome() Drains the MainPool | Feb 2024 | Ethereum | Access Control | not in dollars |
| Binemon (BIN) ExploitPermissionless sweepTokenForMarketing() Price-Manipulation Arbitrage | Mar 2024 | BNB Chain | Access Control | not in dollars |
| Curio Governance Token (CGT) ExploitDAO Governance Takeover via Fake DSChief Vote + Timelocked vat.suck / DSToken.mint | Mar 2024 | Ethereum | Governance | not in dollars |
| EGGX ExploitERC404 Flash-Mintable NFTs Drain a Per-NFT Token Airdrop | Feb 2024 | Ethereum | Logic | not in dollars |
| Freedom (FREE / FREEB) ExploitSlippage-less Treasury Buy at an Attacker-Manipulated Price | Jan 2024 | BNB Chain | Oracle Manipulation | not in dollars |
| GAIN (GainOS) ExploitPath-Dependent balanceOf Rebase Bug Drains the AMM Reserve | Feb 2024 | Ethereum | Logic | not in dollars |
| Game (TheGame / Anciliainc) ExploitReentrancy + Stale bidEther Refund in makeBid() | Feb 2024 | Ethereum | Reentrancy | not in dollars |
| MINER (ERC404) ExploitSelf-Transfer Balance Inflation via skim() | Feb 2024 | BNB Chain | Logic | not in dollars |
| SMOOFS Staking ExploitReentrant Withdraw() Drains the Reward-Token Pool via safeTransferFrom Callback | Feb 2024 | Polygon | Reentrancy | not in dollars |
| ZoomerCoin ExploitSpot-Priced Upfront Staking Reward Drained via AMM Price Manipulation | Feb 2024 | Ethereum | Oracle Manipulation | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.