Hacks / Statistics / Q4 2025
Q4 2025 Exploit Report
October–December 2025: 9 reproduced exploits, $135M in stated losses.
9 exploits from October–December 2025 are reproduced in the library, 43 fewer than in Q3 2025. 8 of them state a dollar loss, $135M in total, against $51.1M the quarter before. Access Control and Oracle Manipulation were the most common root-cause categories, on 4 incidents each. Ethereum had both the most incidents (4) and the largest stated losses ($131M). The largest stated loss was Balancer V2 Exploit at $120M, 89% of the quarter's stated total.
Incidents
9
52 in Q3 2025.
Stated losses
$135M
8 of 9 incidents state a dollar figure. $51.1M in Q3 2025.
Largest stated loss
$120M
Balancer V2 Exploit
Most common root cause
Access Control
On 4 of 9 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 4 | $4.6M |
| Oracle Manipulation | 4 | $3.9M |
| Dependency | 3 | $2.9M |
| Arithmetic | 2 | $129M |
| DeFi | 2 | $246K |
| Logic | 2 | $4.4M |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 4 | $131M |
| Base | 2 | $1.2M |
| Arbitrum | 1 | $146K |
| BNB Chain | 1 | — |
| Other | 1 | $2.7M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Balancer V2 Exploit | Ethereum | $120M |
| yETH Weighted-StableSwap Exploit | Ethereum | $9M |
| Ribbon Finance MarginPool | Other | $2.7M |
| MIM Spell ("MIMSpell3") Exploit | Ethereum | $1.7M |
| Moonwell Exploit | Base | $1M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Balancer V2 ExploitComposableStablePool Rounding-Error Drain via Rate-Scaled _upscale/_downscale | Nov 2025 | Ethereum | Arithmetic | $120M |
| yETH Weighted-StableSwap ExploitInvariant Rounding Drift Mints Unbacked LP | Dec 2025 | Ethereum | Arithmetic | $9M |
| Ribbon Finance MarginPoolcorrupted oToken expiry prices via pricer proxy takeover | Dec 2025 | Other | Oracle Manipulation | $2.7M |
| MIM Spell ("MIMSpell3") ExploitCollateral-Free MIM Mint from Privileged Cauldrons | Oct 2025 | Ethereum | Logic | $1.7M |
| Moonwell ExploitCorrupted wrsETH Oracle ⇒ Borrow ~$88K Against ~$0.07 of Collateral | Nov 2025 | Base | Oracle Manipulation | $1M |
| BaseSwapCallback ExploitPublic uniswapV3SwapCallback Approval Drain | Oct 2025 | Base | Access Control | $220K |
| Sharwa Finance ExploitMargin Position Closed Against an Attacker-Manipulated Spot Pool (No Slippage Bound) | Oct 2025 | Arbitrum | Oracle Manipulation | $146K |
| DRLVaultV3 ExploitSelf-Referential Slippage Lets a Manipulated Pool Set Its Own "Minimum Out" | Nov 2025 | Ethereum | DeFi | $100K |
| TokenHolder / BorrowerOperationsV6 ExploitPrivileged-Role Confused-Deputy Drain via sell()'s Arbitrary Call | Oct 2025 | BNB Chain | Dependency | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.