Hacks / Statistics / Q3 2025
Q3 2025 Exploit Report
July–September 2025: 52 reproduced exploits, $51.1M in stated losses.
52 exploits from July–September 2025 are reproduced in the library, 3 fewer than in Q2 2025. 46 of them state a dollar loss, $51.1M in total, against $26.7M the quarter before. Logic was the most common root-cause category, on 39 of the 52 incidents (75%). Ethereum had the most incidents (20), while Arbitrum carried the largest stated losses ($41.1M). The largest stated loss was GMX v1 Exploit at $41M, 80% of the quarter's stated total.
Incidents
52
55 in Q2 2025.
Stated losses
$51.1M
46 of 52 incidents state a dollar figure. $26.7M in Q2 2025.
Largest stated loss
$41M
GMX v1 Exploit
Most common root cause
Logic
On 39 of 52 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic39Access Control27DeFi16Oracle Manipulation16Dependency13Governance4Authentication2Input Validation2Reentrancy2Arithmetic1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 39 | $50.3M |
| Access Control | 27 | $3.8M |
| DeFi | 16 | $5.1M |
| Oracle Manipulation | 16 | $46.7M |
| Dependency | 13 | $2.9M |
| Governance | 4 | $78.8K |
| Authentication | 2 | $20.6K |
| Input Validation | 2 | $2.5M |
| Reentrancy | 2 | $41M |
| Arithmetic | 1 | $563 |
Chains
Where the exploited contracts were deployed.
Ethereum20BNB Chain18Arbitrum6Base5Avalanche1Other1Polygon1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 20 | $1.5M |
| BNB Chain | 18 | $5.9M |
| Arbitrum | 6 | $41.1M |
| Base | 5 | $2.6M |
| Avalanche | 1 | $2.4K |
| Other | 1 | $18.2K |
| Polygon | 1 | $3.1K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
GMX v1 Exploit$41MFPC Token Exploit$4.7MArcadia RebalancerSpot$2.5MSuperRare Staking Exploit$730KNGP Token Exploit$493K
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| GMX v1 Exploit | Arbitrum | $41M |
| FPC Token Exploit | BNB Chain | $4.7M |
| Arcadia RebalancerSpot | Base | $2.5M |
| SuperRare Staking Exploit | Ethereum | $730K |
| NGP Token Exploit | BNB Chain | $493K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| GMX v1 ExploitGLP Share-Price Manipulation via globalShortAveragePrice | Jul 2025 | Arbitrum | Oracle Manipulation | $41M |
| FPC Token ExploitSell-Side burnLpToken() Drains the Pool's Own FPC Reserve | Jul 2025 | BNB Chain | Oracle Manipulation | $4.7M |
| Arcadia RebalancerSpotUnvalidated swapData → Arbitrary router.call | Jul 2025 | Base | Input Validation | $2.5M |
| SuperRare Staking ExploitPermissionless updateMerkleRoot() + Single-Leaf Merkle Forgery | Jul 2025 | Ethereum | Access Control | $730K |
| NGP Token ExploitSell-Fee Burns NGP Out of the Pair and sync()s, Collapsing the AMM Reserve | Sep 2025 | BNB Chain | Logic | $493K |
| Coinbase Fee-Account DrainConfused-Deputy via 0x Settler BASIC Arbitrary Call | Aug 2025 | Ethereum | Dependency | $300K |
| weETH LRT Minter ExploitUnprotected 0x03b79c24(address) Token Sweep | Jul 2025 | Ethereum | Access Control | $286K |
| RANT Token ExploitSelf-Transfer Triggers Un-compensated LP Reserve Burn | Jul 2025 | BNB Chain | DeFi | $190K |
| D3X AI ExploitProxy exchange() Prices D3XAT From A Manipulable PancakeSwap Spot Reserve | Aug 2025 | BNB Chain | Oracle Manipulation | $136K |
| WETC Token ExploitFee-on-Transfer + skim/sync Reserve Drain | Jul 2025 | BNB Chain | DeFi | $101K |
| EverValueCoin (EVA) ExploitStale-Price Orderbook Settlement Arbitraged Against a Live AMM | Aug 2025 | Arbitrum | Oracle Manipulation | $100K |
| YuliAI ExploitBuyback Priced off a Flash-Manipulated V3 Spot Price | Aug 2025 | BNB Chain | Oracle Manipulation | $78.8K |
| Equilibria (VaultEPendle)reward debt not updated on ERC20 share transfer, draining native-ETH rewards via fresh receivers | Aug 2025 | Ethereum | Logic | $62.7K |
| Grizzifi ExploitSybil Milestone-Reward Farming via Self-Referral Chain | Aug 2025 | BNB Chain | Access Control | $61K |
| WhereIsMyDragonTreasurefixed redemption reward larger than the recipe cost to mint a legendary card | Jul 2025 | Ethereum | Logic | $47.5K |
| Stepp2p ExploitDouble-Refund via modifySaleOrder on an Already-Cancelled Order | Jul 2025 | BNB Chain | Logic | $43.8K |
| 0x8d2e ExploitPermissionless uniswapV3SwapCallback Drains the Contract's USDC | Aug 2025 | Base | Access Control | $40K |
| BaseCallback 0x8d2e… ExploitUnauthenticated uniswapV3SwapCallback Self-Transfer | Aug 2025 | Base | Access Control | $40K |
| SWAPP Staking ExploitUnchecked transferFrom Return Value Lets a Free deposit Mint Staking Balance, Then emergencyWithdraw Drains the Vault | Jul 2025 | Ethereum | Dependency | $32.2K |
| Bebop JAM Settlement ExploitSignature-Bypass + Unconstrained Interactions Drain Stale Approvals | Aug 2025 | Arbitrum | Authentication | $20.1K |
| Size Credit LeverageUp ExploitArbitrary External Call via GenericRoute Swap Drains User Approvals | Aug 2025 | Ethereum | Dependency | $19.7K |
| Kame Aggregator ExploitUnvalidated executor.call() in swap() Drains User Approvals | Sep 2025 | Other | Dependency | $18.2K |
| LUXERA (XERA) ExploitDangling Infinite Approval to Multicall3 Drained via aggregate3 | Aug 2025 | BNB Chain | Access Control | $17K |
| VDS Exploitdeposit() Mints 5× VDS for AVD, Redemption Refunds AVD 1:1 | Jul 2025 | BNB Chain | Logic | $11.1K |
| MulticallWithETH ExploitArbitrary-Call aggregate() Drains an Unlimited USDC Approval | Jul 2025 | BNB Chain | Access Control | $10.5K |
| ABCCApp ExploitPermissionless addFixedDay() Vesting Time-Warp Drains the DDDD Reward Reserve | Aug 2025 | BNB Chain | Access Control | $10.1K |
| Unverified proxy 0x6f7a drained via permissionless rebalanceAndAddLiquidity selectoranyone could push a victim's live token balance through its liquidity path | Aug 2025 | Ethereum | Access Control | $7.6K |
| BoJ Leverage Market cbBTC reserve index inflationflash-loan fee compounding against a near-empty aToken supply inflates the liquidity index to steal every listed asset | Jul 2025 | Base | Oracle Manipulation | $7.2K |
| Beefy ZapRouter arbitrary route executionarbitrary call() spent victim allowances via transferFrom | Aug 2025 | Arbitrum | Access Control | $6.6K |
| Liquity V2 scrvUSD branch urgent-redemption arbitragepermissionless cherry-picking of undercollateralized troves with a 2% bonus | Jul 2025 | Ethereum | Logic | $4.2K |
| 0xf340 VRF-Wrapper ExploitPermissionless initVRF() Hijacks the LINK Payment Recipient | Aug 2025 | Ethereum | Access Control | $4K |
| Bebop JamSettlement self-taker arbitrary-interaction draincaller-supplied transferFrom calldata executed by the settlement contract against accounts that approved it | Aug 2025 | Base | Access Control | $3.9K |
| Unverified Polygon swap router drained via fake Uniswap V3 poolattacker-supplied pair/callback trusted without authentication | Aug 2025 | Polygon | Access Control | $3.1K |
| Liquity V2 ActivePool urgentRedemptionpermissionless extraction of collateral from shut-down undercollateralized troves at a +2% bonus | Jul 2025 | Ethereum | Logic | $2.7K |
| BIFKN314 (ERC-314) flash-swap LP inflationreserve snapshot taken after swap-out, before repayment, lets a dust addLiquidity mint pool-dominating LP shares | Jul 2025 | Avalanche | Logic | $2.4K |
| Pendle Reflectorreflect() operated on Reflector-held balances using caller-supplied, unvalidated market and limit-router addresses | Aug 2025 | Arbitrum | Access Control | $2.3K |
| BaseSwapperUniswapV3 public swap drains its own token balancearbitrary public access + full-balance refund to caller-chosen recipient | Aug 2025 | Arbitrum | Access Control | $1.8K |
| Unverified670471Balancer flash-loan callback forwarded to a victim that repays the loan with its own funds | Jul 2025 | Ethereum | Access Control | $1.8K |
| Empty Set Reserve stale fixed-order drainbuying COMP below market from a hard-coded maker/taker price | Jul 2025 | Ethereum | Oracle Manipulation | $1.5K |
| Unverified6883 Fake-Pair Callback HijackUniswapV2 flash-swap callback trusts a freshly-created attacker pair and pays WETH into it | Jul 2025 | Ethereum | Logic | $1K |
| BSC "DD" initcode-token drainunverified victim exposes arbitrary token-path swap using its own WBNB | Aug 2025 | BNB Chain | Logic | $700 |
| MyCoinMaster missing-access-control on buyBYAdmin lets anyone mint MYC for free and drain the pool via swappublic function lacked an onlyAdmin guard present on every other privileged path | Aug 2025 | BNB Chain | Access Control | $653 |
| StrategyLlamaLendConvex share-accounting draina dust deposit minted strategy shares that redeemed for the strategy's entire Curve Lend position | Jul 2025 | Ethereum | Logic | $563 |
| Size Credit FlashLoanLoopingV1_7 Generic-Route Arbitrary Callthird-party token allowance theft via caller-controlled router.call(data) | Aug 2025 | Ethereum | Dependency | $533 |
| Unverified-proxy USDT drain via recipient-only signaturesigned 5-min/recipient message did not bind victim, token, amount, or nonce | Jul 2025 | BNB Chain | Authentication | $502 |
| Hexotic (HEX-OTC) ExploitMispriced OTC Orders Arbitraged Against Uniswap-V3 Spot | Aug 2025 | Ethereum | Oracle Manipulation | $500 |
| AnyswapV4Router permit-fallback draintrusting a non-reverting permit() on a token that does not enforce it | Jul 2025 | Ethereum | Dependency | not in dollars |
| AutoPooledTradingBot double-withdrawalwithdrawInvestment pays out from deposits without burning shares, so emergencyWithdrawAll pays the same position twice | Aug 2025 | Ethereum | Logic | not in dollars |
| PDZ / "TB Build" ExploitSpot-Price getAmountsOut Reward Inflation | Aug 2025 | BNB Chain | Oracle Manipulation | not in dollars |
| PresaleV5 oracle manipulationflash-loan spot-price (slot0) read by the presale pricing function let an attacker buy tokens cheap and sell them at fair price | Aug 2025 | Ethereum | Oracle Manipulation | not in dollars |
| UPENG burn+sync drainpermissionless burn(address,uint256) lets anyone torch a Uniswap-V2 pair's token side, then sync() commits the manipulated balance as reserves | Jul 2025 | BNB Chain | Access Control | not in dollars |
| WXC Token ExploitBurn-From-Pool + sync() "Phantom Reserve" Drain | Aug 2025 | BNB Chain | DeFi | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.