Hacks / Statistics / Q1 2025
Q1 2025 Exploit Report
January–March 2025: 50 reproduced exploits, $1.47B in stated losses.
50 exploits from January–March 2025 are reproduced in the library, 15 more than in Q4 2024. 40 of them state a dollar loss, $1.47B in total, against $14.4M the quarter before. Logic was the most common root-cause category, on 27 of the 50 incidents (54%). BNB Chain had the most incidents (24), while Ethereum carried the largest stated losses ($1.47B). The largest stated loss was Bybit Cold-Wallet Heist at $1.46B, 99% of the quarter's stated total.
Incidents
50
35 in Q4 2024.
Stated losses
$1.47B
40 of 50 incidents state a dollar figure. $14.4M in Q4 2024.
Largest stated loss
$1.46B
Bybit Cold-Wallet Heist
Most common root cause
Logic
On 27 of 50 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic27Access Control23Oracle Manipulation15DeFi11Dependency6Arithmetic4Reentrancy4Business Logic1Governance1Input Validation1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 27 | $1.8M |
| Access Control | 23 | $1.46B |
| Oracle Manipulation | 15 | $1.4M |
| DeFi | 11 | $668K |
| Dependency | 6 | $1.46B |
| Arithmetic | 4 | $4.8M |
| Reentrancy | 4 | $496K |
| Business Logic | 1 | $3K |
| Governance | 1 | — |
| Input Validation | 1 | $4.5M |
| Untagged | 1 | — |
Chains
Where the exploited contracts were deployed.
BNB Chain24Ethereum16Base7Arbitrum1Avalanche1zkSync1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 24 | $1.9M |
| Ethereum | 16 | $1.47B |
| Base | 7 | $30.2K |
| Arbitrum | 1 | $86K |
| Avalanche | 1 | — |
| zkSync | 1 | $202K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Bybit Cold-Wallet Heist$1.46B1inch Fusion V1 Settlement Exploit$4.5MAI IPC Token Exploit$590KDCF Token Exploit$442KSIR (Leverage) Exploit$354K
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Bybit Cold-Wallet Heist | Ethereum | $1.46B |
| 1inch Fusion V1 Settlement Exploit | Ethereum | $4.5M |
| AI IPC Token Exploit | BNB Chain | $590K |
| DCF Token Exploit | BNB Chain | $442K |
| SIR (Leverage) Exploit | Ethereum | $354K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Bybit Cold-Wallet HeistDelegateCall masterCopy Overwrite of a Gnosis Safe | Feb 2025 | Ethereum | Access Control | $1.46B |
| 1inch Fusion V1 Settlement ExploitYul Calldata-Length Underflow Hijacks the Resolver Dynamic Suffix | Mar 2025 | Ethereum | Arithmetic | $4.5M |
| AI IPC Token ExploitSell-Triggered Pool Burn (_destroy) Drains the AMM Reserve | Jan 2025 | BNB Chain | Logic | $590K |
| DCF Token ExploitTransfer-to-Pair Reserve Burn Inflates DCF Price | Mar 2025 | BNB Chain | Oracle Manipulation | $442K |
| SIR (Leverage) ExploitDirty Transient-Storage Slot Turns uniswapV3SwapCallback Into an Open Drain | Mar 2025 | Ethereum | Access Control | $354K |
| The Idols NFT ExploitSelf-Transfer Reward Double-Claim via delete claimedSnapshots | Jan 2025 | Ethereum | Logic | $329K |
| Yzi AI (YziAI / YziLabs) ExploitHard-Coded manager Backdoor in transferFrom | Mar 2025 | BNB Chain | Access Control | $222K |
| Venus (zkSync Era) ExploitwUSDM ERC4626 Donation → Oracle Price Inflation → Self-Liquidation Drain | Feb 2025 | zkSync | Oracle Manipulation | $202K |
| UniLend V2 ExploitCollateral Self-Withdrawal via Flawed Health-Factor Accounting | Jan 2025 | Ethereum | Logic | $200K |
| Four.meme Launchpad ExploitLiquidity Migration Front-Run via Pre-Initialized Pancake V3 Pool | Feb 2025 | BNB Chain | DeFi | $186K |
| Hegic V8888 Put Pool ExploitRe-withdrawable Liquidity Tranche (withdrawWithoutHedge) | Feb 2025 | Ethereum | Logic | $104K |
| Alkimiya SilicaPools Exploituint128(shares) Truncation Inflates Redemption Payout | Mar 2025 | Ethereum | Arithmetic | $95.5K |
| StepHeroNFTs ExploitReentrancy in claimReferral() Drains the Marketplace's BNB | Feb 2025 | BNB Chain | Reentrancy | $92K |
| Paribus ExploitAlgebra/Camelot LP-NFT Collateral Priced from Manipulable Spot Price | Jan 2025 | Arbitrum | Oracle Manipulation | $86K |
| AST Token ExploitFaulty transfer Liquidity-Tracking Burns Pool Reserves Twice | Jan 2025 | BNB Chain | Logic | $65K |
| BankX RouterswapXSDForETH Reentrancy (BSC focus) | Feb 2025 | BNB Chain | Reentrancy | $43K |
| LAURA Token ExploitPermissionless removeLiquidityWhenKIncreases() Reserve Burn | Jan 2025 | Ethereum | Access Control | $41.2K |
| Mosca ExploitSelf-Compounding join() Balance Inflation Drains the Treasury | Jan 2025 | BNB Chain | Arithmetic | $37.6K |
| 98Token ("98#") ExploitUnprotected public swapTokensForTokens() Drains the Contract's Token Reserve | Jan 2025 | BNB Chain | Access Control | $28K |
| RoulettePotV2 ExploitPermissionless swapProfitFees() Drained Through a Manipulated WBNB/LINK Spot Price | Jan 2025 | BNB Chain | Access Control | $27.7K |
| LPMine ExploitReward-Time Desync + Pool-Balance Reward Valuation Drains the Reward Pool | Jan 2025 | BNB Chain | Logic | $24K |
| H2O Token Exploitskim()-Triggered Self-Minting Reward Drain | Mar 2025 | BNB Chain | Logic | $22.5K |
| JPulsepot / FortuneWheel ExploitPermissionless swapProfitFees() + Spot-Price Fee Sizing | Jan 2025 | BNB Chain | Access Control | $21.5K |
| Mosca ExploitexitProgram() Pays Out Internal Credit That Was Never Backed by a Deposit | Jan 2025 | BNB Chain | Logic | $19K |
| Odos Limit Order Router ExploitPublic ERC-6492 isValidSigImpl(... allowSideEffects = true) Arbitrary-Call Drain | Jan 2025 | Base | Dependency | $15.6K |
| 0xD4F1…7Cb3 ExploitUninitialized OwnableUpgradeable Lets Anyone Become Owner and withdrawFees() | Feb 2025 | BNB Chain | Access Control | $15.2K |
| SamPrisonman (SBF) ExploitExternally-Controlled Balance Write Lets an Attacker Zero the AMM Pool Reserve | Mar 2025 | Ethereum | Dependency | $14K |
| AIXBT Forced-Swap ExploitPublic "Auth-Key" Selector Swaps Victim's Whole Balance into Attacker LP | Jan 2025 | Base | Access Control | $13.6K |
| BBX Token ExploitStuck Daily-Burn Repeatedly Drains the Pool's BBX Reserve | Mar 2025 | BNB Chain | Logic | $11.9K |
| HORS ExploitUnprotected, Attacker-Callback 0xf78283c7 Drains the Pool's LP Tokens | Jan 2025 | BNB Chain | Access Control | $10.4K |
| GMT7 Helper permissionless drainunverified trading bot helper exposed public buy/sell functions with no access control and infinite router approval | Feb 2025 | BNB Chain | Access Control | $10.1K |
| GoldReserve NFT profit double-claimERC1155 transfer resets the per-address profit accumulator | Feb 2025 | BNB Chain | Logic | $7.3K |
| Unverified "Slot" Staking ContractreleaseSlot() Reentrancy BNB Drain | Feb 2025 | BNB Chain | Reentrancy | $6.7K |
| Pump / TiPTAG Token ExploitPermissionless Pre-Listing Liquidity Seeding Drains the Bonding-Curve Listing | Mar 2025 | BNB Chain | Access Control | $6.4K |
| Peapods Finance ExploitPermissionless depositFromPairedLpToken() Forced Swap at Manipulated Spot Price | Feb 2025 | Ethereum | Access Control | $3.5K |
| 0x MainnetSettler ExploitArbitrary transferFrom via the BASIC Action's sellToken == address(0) Confused-Deputy Fall-Through | Mar 2025 | Ethereum | Access Control | $3K |
| RnsPay arbitrary dexRouter call drains any token a victim approved to the protocolattacker-supplied exchange target lets pay() execute transferFrom against arbitrary victims | Mar 2025 | Ethereum | Access Control | $1.1K |
| Unverified swapit() helperpublic function lets anyone trigger a contract-owned USDC swap through the same AMM pool, harvesting the price impact | Mar 2025 | Base | Access Control | $980 |
| wkeyDAO ExploitFixed-Price Presale buy() vs. Live AMM Price Arbitrage | Mar 2025 | BNB Chain | Oracle Manipulation | $767 |
| PTM (Phoenix To Moon) tokenpublic addLiquidity() lets anyone spend the token contract's own PTM/USDT into the LP | Mar 2025 | BNB Chain | Access Control | $553 |
| DUCKVADER ExploitPermissionless Free-Mint via Broken buyTokens() + Storage Shadowing | Mar 2025 | Base | Access Control | not in dollars |
| HenloKart native-token drainzero-value race commitment funded from the victim balance, then immediately cancelled back to the attacker | Feb 2025 | Base | Logic | not in dollars |
| INVISTECH buy-tax drained the AMM pairfee-on-transfer tax charged from the pair's own reserves on every buy, breaking the constant-product invariant | Feb 2025 | BNB Chain | DeFi | not in dollars |
| MCAI tax-wallet allowance bypassprivileged transferFrom drains the Uniswap V2 pair | Jan 2025 | Ethereum | Access Control | not in dollars |
| OpenOcean Limit Order Protocolunrestricted transferTokens() drains any pre-approved maker | Feb 2025 | Base | Access Control | not in dollars |
| SBR Token Exploitskim() + broken token transfer zeroes a Uniswap-V2 reserve | Mar 2025 | Ethereum | Oracle Manipulation | not in dollars |
| Scorch OTC scorch() drains ETH via manipulated spot getAmountsOut quoteon-chain price manipulation in a burn-for-ETH function | Feb 2025 | Ethereum | Oracle Manipulation | not in dollars |
| Sorra Staking ExploitReward Recomputed In Full On Every Partial withdraw | Jan 2025 | Ethereum | Untagged | not in dollars |
| StackMarket graduated-account flash-loan drainbuy path swaps a Uniswap V3 pool with caller-controlled (zero) slippage, then unwinds at the inflated pool price | Mar 2025 | Base | DeFi | not in dollars |
| SWT token burn-then-sync drainpermissionless burn(address,uint256) desyncs an AMM pair's reserves before sync() | Mar 2025 | Avalanche | Access Control | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.