Hacks / Statistics / Q4 2024
Q4 2024 Exploit Report
October–December 2024: 35 reproduced exploits, $14.4M in stated losses.
35 exploits from October–December 2024 are reproduced in the library, 7 fewer than in Q3 2024. 35 of them state a dollar loss, $14.4M in total, against $33.1M the quarter before. Access Control and Logic were the most common root-cause categories, on 14 incidents each. BNB Chain had the most incidents (15), while Fantom carried the largest stated losses ($7M). The largest stated loss was Polter Finance Exploit at $7M, 49% of the quarter's stated total.
Incidents
35
42 in Q3 2024.
Stated losses
$14.4M
35 of 35 incidents state a dollar figure. $33.1M in Q3 2024.
Largest stated loss
$7M
Polter Finance Exploit
Most common root cause
Access Control
On 14 of 35 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 14 | $2.2M |
| Logic | 14 | $1.9M |
| Oracle Manipulation | 12 | $1.4M |
| DeFi | 6 | $111K |
| Arithmetic | 4 | $331K |
| Reentrancy | 4 | $731K |
| Untagged | 3 | $9.9M |
| Bridge | 2 | $1M |
| Dependency | 2 | $385K |
| Governance | 1 | $132K |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 15 | $599K |
| Ethereum | 10 | $1.6M |
| Base | 4 | $1.8M |
| Arbitrum | 2 | $343K |
| Other | 2 | $2.9M |
| Fantom | 1 | $7M |
| Polygon | 1 | $85.7K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Polter Finance Exploit | Fantom | $7M |
| GemPadLock reentrancy (Dec 2024) | Other | $1.9M |
| CompoundFork (Pike Finance "uSUI") Exploit | Base | $1M |
| FEG SmartBridge | Other | $1M |
| SASHA Token Exploit | Ethereum | $600K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Polter Finance ExploitSpot-Reserve Price Oracle Manipulation Drains an Aave-V2 Lending Market | Nov 2024 | Fantom | Untagged | $7M |
| GemPadLock reentrancy (Dec 2024)multi-chain ~$2M | Dec 2024 | Other | Untagged | $1.9M |
| CompoundFork (Pike Finance "uSUI") ExploitSpot-Price Oracle Manipulation of a Compound v2 Fork | Oct 2024 | Base | Untagged | $1M |
| FEG SmartBridgeWormhole relayer allowlist pollution → forged withdraw | Dec 2024 | Other | Bridge | $1M |
| SASHA Token ExploitDraining a Deployer-Seeded, Massively Mispriced Uniswap V3 Pool | Oct 2024 | Ethereum | Oracle Manipulation | $600K |
| Clober DEX ExploitRebalancer._burn Reentrancy via Attacker-Controlled burnHook | Dec 2024 | Base | Reentrancy | $501K |
| vETH (Lambo.win) ExploitUnbacked takeLoan via addVirtualLiquidity Inflates an AMM Pair | Nov 2024 | Ethereum | Logic | $447K |
| MoonHacker Vault ExploitUnauthenticated AAVE Flash-Loan Callback Drains the Vault | Dec 2024 | Base | Access Control | $319K |
| P719 Token ExploitSell Price Inflated by an Un-Compensated Burn Inside transfer() | Oct 2024 | BNB Chain | Oracle Manipulation | $312K |
| MorphoBlue PAXG/USDC Market ExploitMisconfigured Oracle (1e12 Decimal-Scale Error) | Oct 2024 | Ethereum | Arithmetic | $230K |
| DeltaPrime ExploitUnwhitelisted claimReward() Pair + Cross-Function Reentrancy Drains a SmartLoan's Borrowed Funds as "Reward" | Nov 2024 | Arbitrum | Reentrancy | $211K |
| Lava Lending ExploitFlash-Inflated Uniswap-V3-LP Collateral Drains an Aave-V2 Fork | Oct 2024 | Arbitrum | Oracle Manipulation | $132K |
| Ora AI (ORAAI) ExploitPermissionless stuckToken() Allowance Grant Drains the Uniswap Pair | Oct 2024 | Ethereum | Access Control | $131K |
| BTC24H Lock ExploitAccess-Control-Free claim() Drains a Token Vesting Lock | Dec 2024 | Polygon | Access Control | $85.7K |
| Matez Staking Exploituint128 Truncation Lets Anyone Stake "for Free" | Nov 2024 | BNB Chain | Arithmetic | $80K |
| 0x Protocol "Settler" ExploitArbitrary External Call via BASIC Action Drains a Leftover Approval | Nov 2024 | Ethereum | Dependency | $66K |
| CoW Protocol Solver-Router ExploitUnvalidated uniswapV3SwapCallback Drains Settlement's Residual WETH | Nov 2024 | Ethereum | Access Control | $59K |
| MFT Token ExploitBurn-on-Sell sync() Drains the PancakeSwap Pair | Nov 2024 | BNB Chain | Oracle Manipulation | $33.7K |
| AkashaOFT (AK1111) ExploitPermissionless nonblockingLzReceive1() Free-Mint Backdoor | Nov 2024 | BNB Chain | Access Control | $31.5K |
| Vista Finance ExploitFlash-Mint Burns Through the Staking Lock to Sell Free Collateral | Oct 2024 | BNB Chain | Access Control | $29K |
| AIZPT314 ExploitERC-314 "Buy Mints 2× From Reserve" Price-Skew Drain | Oct 2024 | BNB Chain | Oracle Manipulation | $20K |
| FireToken ExploitDeflationary "burn-from-pool + sync()" AMM Reserve Drain | Oct 2024 | Ethereum | Oracle Manipulation | $20K |
| ChiSale ExploitRevenue-Share Computed on Full msg.value (Self-Referral ETH Drain) | Nov 2024 | Ethereum | Logic | $16.3K |
| Bizness Locker ExploitReentrancy in splitLock Refund Drains Locked Tokens | Dec 2024 | Base | Reentrancy | $15.7K |
| Pledge ExploitPermissionless swapTokenU() Drains the Contract's Token Holdings | Dec 2024 | BNB Chain | Access Control | $15K |
| Erc20transfer ExploitPermissionless Arbitrary transferFrom Drainer (amount==0 ⇒ "take it all") | Oct 2024 | Ethereum | Access Control | $14.8K |
| RichPip (RPP) Token ExploitSell-Triggered LP Burn Pumps a Self-Manipulated Pool | Nov 2024 | BNB Chain | Oracle Manipulation | $14.1K |
| Stake319 (X319) ExploitPermissionless claimEther() drains the contract's BNB | Nov 2024 | BNB Chain | Access Control | $12.9K |
| LABUBU ExploitSelf-Transfer Balance Inflation via Stale Cached Balances | Dec 2024 | BNB Chain | Logic | $12K |
| JHY Token ExploitDividend Pool Drained via 100× Over-Credited distributeCAKEDividends | Dec 2024 | BNB Chain | Logic | $11.2K |
| NFTG Presale ExploitMispriced PresaleWithUSDT() Pays ~13× the USDT Deposited | Nov 2024 | BNB Chain | Oracle Manipulation | $10K |
| ERC1967Proxy (0xb7E1…) ExploitUnauthenticated "Order Settlement" Drains Proxy Reserves | Nov 2024 | BNB Chain | Access Control | $8.5K |
| VRUG ("Vitalik's Rug") ExploitUnsynced UniswapV2 Reserve Donation Harvest | Nov 2024 | Ethereum | DeFi | $8.4K |
| HYDT Protocol ExploitSpot-Reserve Oracle Lets initialMint() Print HYDT at a Manipulated BNB/USD Price | Oct 2024 | BNB Chain | Oracle Manipulation | $5.8K |
| SlurpyCoin ExploitAttacker-Timed Token-Owned BuyOrSell Pool Manipulation | Dec 2024 | BNB Chain | Reentrancy | $3K |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.