Hacks / Statistics / Q2 2025
Q2 2025 Exploit Report
April–June 2025: 55 reproduced exploits, $26.7M in stated losses.
55 exploits from April–June 2025 are reproduced in the library, 5 more than in Q1 2025. 47 of them state a dollar loss, $26.7M in total, against $1.47B the quarter before. Access Control and Logic were the most common root-cause categories, on 34 incidents each. BNB Chain had the most incidents (30), while Ethereum carried the largest stated losses ($22.5M). The largest stated loss was Cork Protocol Exploit at $12M, 45% of the quarter's stated total.
Incidents
55
50 in Q1 2025.
Stated losses
$26.7M
47 of 55 incidents state a dollar figure. $1.47B in Q1 2025.
Largest stated loss
$12M
Cork Protocol Exploit
Most common root cause
Access Control
On 34 of 55 incidents.
Root causes
How many of the quarter's incidents carry each category.
Access Control34Logic34Oracle Manipulation17DeFi16Dependency9Arithmetic4Authentication2Denial of Service2Governance2Input Validation2
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 34 | $14.4M |
| Logic | 34 | $10.9M |
| Oracle Manipulation | 17 | $23.9M |
| DeFi | 16 | $250K |
| Dependency | 9 | $1.1M |
| Arithmetic | 4 | $12.1M |
| Authentication | 2 | $89.6K |
| Denial of Service | 2 | $1.2K |
| Governance | 2 | $21.9K |
| Input Validation | 2 | $2.4K |
| Data Integrity | 1 | $25K |
Chains
Where the exploited contracts were deployed.
BNB Chain30Ethereum18Base6Arbitrum1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 30 | $3.6M |
| Ethereum | 18 | $22.5M |
| Base | 6 | $565K |
| Arbitrum | 1 | $14.5K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Cork Protocol Exploit$12MResupply Finance Exploit$9.6MMBU Token Exploit$2.2MBSC MEV Vault 0xb5cb…$1.1MR0AR (1R0R) Staking Exploit$777K
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Cork Protocol Exploit | Ethereum | $12M |
| Resupply Finance Exploit | Ethereum | $9.6M |
| MBU Token Exploit | BNB Chain | $2.2M |
| BSC MEV Vault 0xb5cb… | BNB Chain | $1.1M |
| R0AR (1R0R) Staking Exploit | Ethereum | $777K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Cork Protocol ExploitPermissionless Market Creation with Attacker-Controlled exchangeRateProvider | May 2025 | Ethereum | Access Control | $12M |
| Resupply Finance ExploitEmpty-Vault Share-Price Inflation → exchangeRate = 0 → Uncollateralized Borrow | Jun 2025 | Ethereum | Oracle Manipulation | $9.6M |
| MBU Token ExploitDecimal-Scaling Bug in deposit() Mints ~1e18× Too Many Tokens | May 2025 | BNB Chain | Arithmetic | $2.2M |
| BSC MEV Vault 0xb5cb…Authorized Helper Arbitrary Call Drains Venus vTokens | Jun 2025 | BNB Chain | Access Control | $1.1M |
| R0AR (1R0R) Staking ExploitBackdoored user.amount + Self-Capping EmergencyWithdraw() Drain | Apr 2025 | Ethereum | Access Control | $777K |
| Impermax V3 ExploitSelf-Liquidation Debt Wipe via restructureBadDebt | Apr 2025 | Base | Logic | $300K |
| Nalakuvara / LotteryTicketSwap50 ExploitFixed-Payout Redemption Drains the AMM Pool | May 2025 | Base | Oracle Manipulation | $105K |
| RICE / BentoBox-Clone ExploitSignature-less setMasterContractApproval Lets Anyone Drain Any Depositor | May 2025 | Base | Access Control | $88.1K |
| IRYSAI ExploitBackdoored transferFrom Lets the Tax Wallet Drain the LP Pool | May 2025 | BNB Chain | Access Control | $69.6K |
| Unverified 0x607742A2 ExploitPermissionless uniswapV3SwapCallback Approval Drain | Apr 2025 | Base | Access Control | $62.3K |
| MOMO Buyback-Bot ExploitPermissionless, Slippage-Free 5ff02eae() Sandwiched on a Thin USD1/MOMO Pool | Jun 2025 | BNB Chain | Access Control | $48.3K |
| Usual Money ExploitVaultRouter.deposit Routes Through an Attacker-Controlled Swap Venue With No Real Slippage Floor | May 2025 | Ethereum | DeFi | $43K |
| YDT Token ExploitPermissionless proxyTransfer() Drains the Liquidity Pool | May 2025 | BNB Chain | Access Control | $41.3K |
| "b5cb0555" ExploitPermissionless printMoney() Forwarder Drains a Trusted Treasury (Confused Deputy) | Jun 2025 | BNB Chain | Access Control | $35.3K |
| AIRWA ExploitPermissionless setBurnRate() + Zero-Value Transfer Pool-Reserve Annihilation | Apr 2025 | BNB Chain | Access Control | $34.2K |
| Meta Pool (mpETH) ExploitFree mint() on a Native-ETH ERC4626 Vault | Jun 2025 | Ethereum | Logic | $25K |
| BTNFT ExploitPermissionless Reward Theft via a Broken _update Override | Apr 2025 | BNB Chain | Access Control | $19K |
| Life Protocol ExploitAsymmetric Bonding Curve: Pump the Buy Price, Dump at 90% of the Peak | Apr 2025 | BNB Chain | Logic | $18K |
| Gangster Finance "OG Vault" ExploitStale lastPayout Drip-Pool Drain via Self-donate() + harvest() | Jun 2025 | BNB Chain | Logic | $16.5K |
| YB Token ExploitSell-Triggered Uncompensated Pool-Reserve Burn (sync() price manipulation) | Apr 2025 | BNB Chain | Oracle Manipulation | $15.3K |
| AaveBoost ExploitPermissionless proxyDeposit() Subsidy Drain | Jun 2025 | Ethereum | Access Control | $14.8K |
| Stead Farm ExploitPermissionless STEAD Drain via Un-Access-Controlled Function | Jun 2025 | Arbitrum | Access Control | $14.5K |
| Bankroll Network Stack Pluspublic buyFor(address,...) spends any victim's LINK allowance and lets the caller skim the dividend pool it just inflated | Jun 2025 | Ethereum | Access Control | $12.2K |
| Unwarp ExploitPermissionless unwrapWETH(amount, recipient) Self-Balance Drain | May 2025 | Base | Access Control | $9K |
| BitCrown Distributor Drained via Unprotected batchTransferanyone could move the distributor's token balance to any recipient | Jun 2025 | BNB Chain | Access Control | $7.9K |
| KRC Token ExploitFee-on-Transfer Token Burns From Its Own Pool, Desyncing Reserves | May 2025 | BNB Chain | Oracle Manipulation | $7.2K |
| Unverified BSC Victim Drain (mintTokens 0x88417d5c)missing access control lets anyone sweep the contract's ERC20 balances | May 2025 | BNB Chain | Access Control | $5.7K |
| BankrollStack (BankrollNetworkStack) ExploitFlash-Loan Dividend-Drip Capture | Jun 2025 | BNB Chain | Governance | $5.4K |
| Gradient Market Maker Pool ExploitMixed-Unit LP Share Accounting (ETH wei summed 1:1 with ERC-20 token units) | Jun 2025 | Ethereum | Arithmetic | $5K |
| HoldSafe price-manipulation referral drainoracle pricing of stake value and rewards from a manipulable DEX spot route | Jun 2025 | BNB Chain | Oracle Manipulation | $4.8K |
| TokenVault (Gangster Finance)same-tx donate+deposit inflates fresh shares against the drip pool | Jun 2025 | BNB Chain | Logic | $3.2K |
| InitcodeFactory collectFeescaller-authorizes via fake token creator() and drains ETH on a non-WETH token1 | Jun 2025 | Ethereum | Access Control | $2.4K |
| ParaSwap Augustusarbitrary exchangeData lets an unprivileged caller drain any account that approved the router — $2,299 DAI | Jun 2025 | Ethereum | Access Control | $2.3K |
| FixedTokenBSwap RTV drainattacker-supplied path + fake-token transferFrom bypass the on-chain price check, extracting a fixed 10 RTV per call | Jun 2025 | Ethereum | Logic | $2.2K |
| BitallxSC payout-array bypass drains victim USDT balancepublic BitallxPayOut validates only totalSendAmount, never sum(amount[]) | May 2025 | BNB Chain | Access Control | $2K |
| Beta (BETA) Presalepublic set() + per-sender-only deposit cap let a recycled flash loan drain the presale | May 2025 | BNB Chain | Access Control | $1.7K |
| PegaBallbuyGamesFrom self-funds ticket purchases from the contract balance instead of msg.value — free vendor/referrer cut drain | Jun 2025 | Ethereum | Logic | $1.5K |
| Laundromat ExploitFree Ring-Membership Drains a Dormant Mixer | Apr 2025 | Ethereum | Access Control | $1.5K |
| TSAggregatorGeneric arbitrary swap-target calldata drains victim allowanceattacker-chosen swapRouter/data lets swapIn() call any function on any token the aggregator is allowed to spend | Jun 2025 | BNB Chain | Logic | $1.3K |
| DogeAlliance sync() reserve manipulationLP pairs with token balances desynced from reserves drained by permissionless sync + swap | May 2025 | BNB Chain | Oracle Manipulation | $990 |
| BasePricePool withdrawGOUT price-decouplingmanipulable-balance oracle lets flash-bought QCD be redeemed for GOUT at an inflated internal rate | Jun 2025 | BNB Chain | Oracle Manipulation | $803 |
| SinstakeNetworkZombie dividend-donation flash-drainflash-borrowed ZOMBIE donates dividends that the same-tx buyer/seller immediately withdraws, netting excess ZOMBIE convertible to WBNB | Jun 2025 | BNB Chain | Logic | $705 |
| TokenFactory fake-router LP draincaller-supplied swap infrastructure is trusted without verifying the returned pair belongs to the new token | Jun 2025 | BNB Chain | Access Control | $657 |
| Dumbo DUM staking reward inflationpermissionless, repeatable distribute() lets an attacker mint compounding rewards inside one transaction | May 2025 | BNB Chain | Logic | $628 |
| AmpKashi (Kashi AMP/USDC) flash-loan oracle manipulationborrow against a stale spot price | Apr 2025 | Ethereum | Oracle Manipulation | $572 |
| Unverified Base airdrop-claim contract drained via constructor-time claim spamper-claimant eligibility keyed on msg.sender with no nonce/code/allow-list guard | May 2025 | Base | Access Control | $551 |
| WAL-E Coin proxy reinitialization → authorized buyback drainpublic initialize() with no guard rewrites owner/router and unlocks triggerZeusBuyback | Jun 2025 | BNB Chain | Access Control | $430 |
| Aventa / IntelliQuant reward-claim drainclaim size is computed from a spot, attacker-controllable token balance | Apr 2025 | Ethereum | Logic | not in dollars |
| BankrollNetwork Stack ExploitStale lastPayout Instant-Drip Dividend Inflation | Jun 2025 | BNB Chain | Logic | not in dollars |
| BITDOG tokenpublic changeRouterVersion hijacks swap router & drains contract BNB | Apr 2025 | BNB Chain | Access Control | not in dollars |
| Crosswise MasterChef trusted-forwarder hijackpublic setter with no access control enables arbitrary _msgSender() spoofing | May 2025 | BNB Chain | Access Control | not in dollars |
| FlyLong (FLG)public balance-forger lets any caller fake the LP's token balance and drain the WBNB side of the pair — access-control/missing-auth | Apr 2025 | BNB Chain | Access Control | not in dollars |
| MultiTransferSwap ETH refund drainloop-accumulation bug lets attacker reclaim msg.value against the contract's own balance | Apr 2025 | Ethereum | Logic | not in dollars |
| Silo Finance ExploitUntrusted Swap/Silo Targets in openLeveragePosition Let Attacker Re-route a "Swap" into Silo.borrow | Jun 2025 | Ethereum | Input Validation | not in dollars |
| tCDP transferFrom allowance-swap bug drains holders' tokensERC-20 transferFrom debits the wrong allowance slot | Apr 2025 | Ethereum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.