Hacks / Statistics / Q2 2024
Q2 2024 Exploit Report
April–June 2024: 58 reproduced exploits, $88.2M in stated losses.
58 exploits from April–June 2024 are reproduced in the library, the same number as in Q1 2024. 53 of them state a dollar loss, $88.2M in total, against $143M the quarter before. Access Control was the most common root-cause category, on 28 of the 58 incidents (48%). BNB Chain had the most incidents (35), while Ethereum carried the largest stated losses ($75M). The largest stated loss was Hedgey Finance Exploit at $48M, 54% of the quarter's stated total.
Incidents
58
58 in Q1 2024.
Stated losses
$88.2M
53 of 58 incidents state a dollar figure. $143M in Q1 2024.
Largest stated loss
$48M
Hedgey Finance Exploit
Most common root cause
Access Control
On 28 of 58 incidents.
Root causes
How many of the quarter's incidents carry each category.
Access Control28Logic26Oracle Manipulation19Arithmetic8DeFi8Dependency8Governance3Authentication2Reentrancy1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 28 | $61.9M |
| Logic | 26 | $6.7M |
| Oracle Manipulation | 19 | $23.8M |
| Arithmetic | 8 | $8.4M |
| DeFi | 8 | $98.5K |
| Dependency | 8 | $50.2M |
| Governance | 3 | $19.4M |
| Authentication | 2 | $349K |
| Reentrancy | 1 | $350K |
Chains
Where the exploited contracts were deployed.
BNB Chain35Ethereum13Arbitrum4Base4Blast1Linea1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 35 | $2.6M |
| Ethereum | 13 | $75M |
| Arbitrum | 4 | $605K |
| Base | 4 | $1.7M |
| Blast | 1 | $1.4M |
| Linea | 1 | $6.9M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Hedgey Finance Exploit$48MUwuLend Exploit (#1)$19.3MVelocore V2 Exploit$6.9MUwuLend (2nd hack)$3.7MXBridge Exploit$1.6M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Hedgey Finance Exploit | Ethereum | $48M |
| UwuLend Exploit (#1) | Ethereum | $19.3M |
| Velocore V2 Exploit | Linea | $6.9M |
| UwuLend (2nd hack) | Ethereum | $3.7M |
| XBridge Exploit | Ethereum | $1.6M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Hedgey Finance ExploitDangling Approval to Attacker-Controlled tokenLocker | Apr 2024 | Ethereum | Access Control | $48M |
| UwuLend Exploit (#1)sUSDe Oracle Manipulation via Curve Spot Prices in the Median | Jun 2024 | Ethereum | Oracle Manipulation | $19.3M |
| Velocore V2 ExploitfeeMultiplier Overflow Turns a Withdrawal Into a Pool Drain | Jun 2024 | Linea | Arithmetic | $6.9M |
| UwuLend (2nd hack)Hardcoded $1.04 sUSDE Oracle + Live 80% Liquidation Threshold | Jun 2024 | Ethereum | Oracle Manipulation | $3.7M |
| XBridge ExploitPermissionless listToken() Hijacks Token Ownership Then Drains Bridge Reserves | Apr 2024 | Ethereum | Access Control | $1.6M |
| Pike Finance ExploitUnguarded initialize() → UUPS Upgrade Hijack → ETH Drain | Apr 2024 | Ethereum | Access Control | $1.6M |
| Bazaar (Ryolo LBP) ExploitMissing exitPool Authorization Burns a Victim's Pool Shares to the Attacker | Jun 2024 | Blast | Access Control | $1.4M |
| Sonne Finance ExploitEmpty-Market Exchange-Rate Inflation (CompoundV2 Donation Attack) | May 2024 | Base | Arithmetic | $724K |
| Trade On Orion (Orion Protocol BSC) ExploitredeemAtomic Missing Position Check + Liability-Free requestReleaseStake | May 2024 | BNB Chain | Logic | $645K |
| NORMIE ExploitPhantom Self-Mint via the premarket_user Flag + skim() Recycling | May 2024 | Base | Logic | $490K |
| Predy Finance ExploitPermissionless Pair Registration + Lock-Settlement Bypass Drains the Shared Pool | May 2024 | Arbitrum | Logic | $464K |
| Sumer Money ExploitReentrancy via repayBorrowBehalf Refund Inflates the ETH cToken Exchange Rate | Apr 2024 | Base | Reentrancy | $350K |
| Galaxy Fox (GFOX) ExploitPermissionless setMerkleRoot() Lets Anyone Forge an Airdrop Claim | May 2024 | Ethereum | Access Control | $330K |
| SCROLL Token ExploitUniswap UniversalRouter Drained via a balanceOf == type(uint256).max Trap Token | May 2024 | Ethereum | Access Control | $290K |
| OpenLeverage (OPBorrowing) ExploitSelf-Liquidation Bad-Debt Drain via 1inch-Callback Price Manipulation | Apr 2024 | BNB Chain | Oracle Manipulation | $234K |
| Chainge Finance ExploitArbitrary External Call in MinterProxyV2.swap() Drains Approvals | Apr 2024 | BNB Chain | Dependency | $200K |
| Liquidity Tokens (TLN / VOW / VUSD) ExploitLP-Stake Reward Inflation & 1:1 TLN→vUSD Redemption | May 2024 | BNB Chain | Logic | $200K |
| MetaDragon (P404) ExploitPermissionless NFT Burn Mints Free ERC20 | May 2024 | BNB Chain | Access Control | $180K |
| TSURU Wrapper ExploitUnprotected onERC1155Received Free-Mint Drains the LP | May 2024 | Base | Access Control | $140K |
| Z123 (SesameCloudToken) ExploitCustom-Router update() Pool-Burn Arbitrage | Apr 2024 | BNB Chain | Access Control | $135K |
| OSN ExploitLP-Dividend Farming via Instant setBalance→processAccount Reward Payout | May 2024 | BNB Chain | Logic | $109K |
| MARS ExploitFlash-Loan Reflection/Reserve Desync on a Fee-on-Transfer Pair | Apr 2024 | BNB Chain | Oracle Manipulation | $100K |
| NGFS (FENGSHOU) ExploitPermissionless Privilege-Escalation Chain → Unlimited Mint | Apr 2024 | BNB Chain | Access Control | $95.9K |
| Yield Protocol Strategy ExploitLive-Balance burn() Donation Inflation | Apr 2024 | Arbitrum | Logic | $95.2K |
| SteamSwap (MineSTM) Exploitsell() Redeems the Protocol's Own LP To Any Caller | Jun 2024 | BNB Chain | Oracle Manipulation | $91.5K |
| SQUID Token ExploitPermissionless 1:1 V1→V2 Migration + Public sellSwappedTokens Drain | Apr 2024 | BNB Chain | Access Control | $87K |
| YIEDL SpotVault ExploitZero-Share redeem() Token-Drain via Attacker-Controlled Swap Routing | Apr 2024 | BNB Chain | Logic | $77K |
| GROKD ExploitPermissionless updatePool() + depositFromIDO() Reward Pool Drain | Apr 2024 | BNB Chain | Access Control | $72.7K |
| INcufi (AkitaDefender) ExploitSelf-Referral Commission Farming + Un-collateralized 1:1 swapCommision | Jun 2024 | BNB Chain | Logic | $59.6K |
| Unverified Contract 0x00C409 ExploitManipulable AMM Callback Drains WETH Reserves | Apr 2024 | Ethereum | Oracle Manipulation | $56K |
| WILL "Trading" ExploitOver-Sized, Slippage-Free settleExpiredPositions() Buy-Back Sandwich | Jun 2024 | BNB Chain | DeFi | $52.8K |
| Rico / Ricobank ExploitArbitrary-Target flash() Drains the Bank's Reserves | Apr 2024 | Arbitrum | Access Control | $36K |
| APEMAGA ExploitPublic family() Backdoor Burns 99.9% of the Pool's Token Reserve | Jun 2024 | Ethereum | Access Control | $34K |
| JokInTheBox Staking ExploitMissing unstaked Guard ⇒ Infinite Re-Unstake Drain | Jun 2024 | Ethereum | Logic | $33K |
| GPU Token ExploitSelf-Transfer Balance Doubling | May 2024 | BNB Chain | Logic | $32K |
| TGC ExploitBroken Pledge-Reward Math Mints 113,000× the Stake | May 2024 | BNB Chain | Logic | $29.6K |
| YYS / YYSCoin Exploitsell() Returns the Tokens It "Sold" (Double-Payout Drain) | Jun 2024 | BNB Chain | Logic | $28.9K |
| UPS (UtopiaSphere) ExploitSell-Side _swapBurn Drains the LP Pair via skim | Apr 2024 | BNB Chain | Access Control | $28.1K |
| SATX ExploitPermissionless destroyPoolToken() Reserve Manipulation + skim() Drain | Apr 2024 | BNB Chain | Access Control | $28K |
| Hackathon Token Exploitsender == recipient == pair Double-Credit Balance Inflation via skim() | Apr 2024 | BNB Chain | Logic | $20.9K |
| TCH ExploitSignature-Replay Loophole + Pool-Reserve _burn/sync() Price Manipulation | May 2024 | BNB Chain | Authentication | $18.6K |
| EXcommunity (EXboy / EXgirl) ExploitpurchasedAmount Inflation via Zero-Value transferFrom + Pool Donation | May 2024 | BNB Chain | Logic | $18K |
| WSM Presale ExploitSpot-Oracle Price Manipulation in buyWithBNB() via Flash-Loan Pool Crash | Apr 2024 | BNB Chain | Oracle Manipulation | $18K |
| CRB2 Token ExploitFee-on-Transfer Reflection Drain via Self-sellToken Loop | Jun 2024 | BNB Chain | Logic | $15.1K |
| GFA (Generation Finance Academy) ExploitPermissionless setReward / generateReward Self-Mint | Apr 2024 | BNB Chain | Access Control | $14.7K |
| MineSTM Exploitsell() Redeems the Protocol's Own LP at an Attacker-Manipulated Price | Jun 2024 | BNB Chain | Oracle Manipulation | $13.8K |
| RedKeys Game ExploitPredictable On-Chain "Randomness" Lets the Player Always Win | May 2024 | BNB Chain | Logic | $12K |
| MixedSwapRouter ExploitArbitrary transferFrom via Fake "Pool" + Same-Token Path | May 2024 | Arbitrum | Access Control | $10K |
| NCD ExploitUncapped Self-Mint Staking Reward Farmed Across Disposable Contracts | Jun 2024 | BNB Chain | Logic | $6.5K |
| BigBangSwap ExploitsellRewardToken Pays Out Against a Richer Pool Than the Seller Bought From | Apr 2024 | BNB Chain | Oracle Manipulation | $5.1K |
| pNetwork Burner ExploitPermissionless convertAndBurn() + Slippage-Free Kyber Trade → Sandwich | May 2024 | Ethereum | Access Control | $5K |
| BNBX ExploitUnprotected Public transferFrom Drains Every Approver | Apr 2024 | BNB Chain | Access Control | $2.8K |
| Dyson.money ExploitPermissionless harvest() Sandwich Steals Pending Yield from a Near-Empty Vault | Jun 2024 | BNB Chain | DeFi | $1.8K |
| ATM Token ExploitForced Zero-Slippage Auto-Swaps Drained via transfer + skim | Apr 2024 | BNB Chain | DeFi | not in dollars |
| FIL314 ExploitPermissionless hourBurn() Crushes the Self-Contained AMM Reserve | Apr 2024 | BNB Chain | Access Control | not in dollars |
| Hoppy The Frog ExploitTax-Token Auto-Swap Reserve Manipulation | Apr 2024 | Ethereum | Oracle Manipulation | not in dollars |
| SATURN Token ExploitAutoNukeLP Burns the Pool's Reserve on Every Sell | May 2024 | BNB Chain | Oracle Manipulation | not in dollars |
| WIFCOIN (WIFStaking) ExploitTime-Ungated claimEarned() Reward Loop Drains the Staking Pool | Jun 2024 | Ethereum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.