Hacks / Statistics / Q1 2026
Q1 2026 Exploit Report
January–March 2026: 29 reproduced exploits, $11.5M in stated losses.
29 exploits from January–March 2026 are reproduced in the library, 20 more than in Q4 2025. 22 of them state a dollar loss, $11.5M in total, against $135M the quarter before. Logic was the most common root-cause category, on 23 of the 29 incidents (79%). BNB Chain had the most incidents (12), while Ethereum carried the largest stated losses ($6.7M). The largest stated loss was Makina Finance Exploit at $5.1M, 44% of the quarter's stated total.
Incidents
29
9 in Q4 2025.
Stated losses
$11.5M
22 of 29 incidents state a dollar figure. $135M in Q4 2025.
Largest stated loss
$5.1M
Makina Finance Exploit
Most common root cause
Logic
On 23 of 29 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 23 | $3.5M |
| Oracle Manipulation | 10 | $8.5M |
| Access Control | 6 | $155K |
| Arithmetic | 4 | $443K |
| DeFi | 4 | $800K |
| Untagged | 3 | $257K |
| Authentication | 1 | $1.3M |
| Governance | 1 | $5.1M |
| Input Validation | 1 | $3.5K |
| Reentrancy | 1 | $37.7K |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 12 | $1.6M |
| Ethereum | 8 | $6.7M |
| Base | 5 | $1.9M |
| Arbitrum | 2 | $395K |
| Polygon | 2 | $910K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Makina Finance Exploit | Ethereum | $5.1M |
| Moonwell cbETH Oracle Incident | Base | $1.8M |
| FoomCash / FOOM Lottery | Ethereum | $1.3M |
| Whalebit Oracle Manipulation Exploit | Polygon | $824K |
| BCE scheduledDestruction drain | BNB Chain | $800K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Makina Finance ExploitSelf-Referential AUM Oracle Manipulation via Permissionless Re-Accounting | Jan 2026 | Ethereum | Oracle Manipulation | $5.1M |
| Moonwell cbETH Oracle IncidentMispriced Collateral Enables Near-Free Liquidation | Feb 2026 | Base | Oracle Manipulation | $1.8M |
| FoomCash / FOOM LotteryGroth16 verifier with gamma == delta lets anyone forge proofs | Feb 2026 | Ethereum | Authentication | $1.3M |
| Whalebit Oracle Manipulation ExploitSpot-Priced Level Staking Round-Trips a Manipulable Algebra Pool | Mar 2026 | Polygon | Oracle Manipulation | $824K |
| BCE scheduledDestruction draintoken transfer hook burns LP reserve tokens then sync()s the pair | Mar 2026 | BNB Chain | Logic | $800K |
| FutureSwap Perpetual DrainFee Unit-Mismatch (addFee token-units interpreted as bps/share) | Jan 2026 | Arbitrum | Arithmetic | $395K |
| InfinitySixStale 1-min TWAP + Instant Referral Bonus Over-Mint | Mar 2026 | BNB Chain | Oracle Manipulation | $274K |
| Movie Token (MT) double-count burnBSC Mar 2026 ~$242K | Mar 2026 | BNB Chain | Untagged | $242K |
| Curve LlamaLend (Inverse Finance sDOLA market) ExploitOracle / Band Manipulation Mass-Liquidation | Mar 2026 | Ethereum | Oracle Manipulation | $240K |
| LAXO Token ExploitUncompensated Pool-Side Burn on Every Sell Breaks x·y = k | Feb 2026 | BNB Chain | Logic | $137K |
| ATM BlindBox predictable fallback RNGattacker evaluates settlement seed before calling settle | Mar 2026 | BNB Chain | Logic | $99K |
| Old CheckoutPool Bridge Operator (_ALLOW_ALL_)permissionless bridge() routed an ERC-4337 paymaster into draining CheckoutPool's USDC excess | Mar 2026 | Polygon | Access Control | $85.7K |
| Univ3CollateralTokenUni V3 position counted as collateral for every vault owned by the same minter | Mar 2026 | Base | Logic | $57K |
| AlkemiEarn ExploitSelf-Liquidation Storage-Aliasing Collateral Duplication | Mar 2026 | Ethereum | Logic | $43.5K |
| WUKONG Stakingclassical reentrancy in unstake() drains pooled LP | Mar 2026 | BNB Chain | Reentrancy | $37.7K |
| MT Token ExploitFee-on-Transfer Overcharge Drains the AMM Pair via skim()+sync() | Jan 2026 | BNB Chain | Arithmetic | $37K |
| 2026-01 Sparkle! (SPRK) Tobin-tax self-transfer inflation | Jan 2026 | Ethereum | Untagged | $14.6K |
| Xocolatl AccountLiquidatorarbitrary caller-supplied HouseOfReserve zeroes the liquidation cost | Mar 2026 | Base | Access Control | $11.2K |
| DayContract / PolarxSpot Manip + Rigid Principal Guarantee | Mar 2026 | BNB Chain | Oracle Manipulation | $10.6K |
| SynapLogic ExploitUncapped Cumulative Refunds in the Token Sale buy / swap Path | Jan 2026 | Base | Input Validation | $3.5K |
| XDK ExploitSell-Path "Recycle" Removes XDK from the Live Pair and sync()s | Feb 2026 | BNB Chain | Logic | $3K |
| Venus (vTHE) ExploitDonation-Inflated Exchange Rate + borrowBehalf Drains a Victim's Pre-Approved Delegate | Mar 2026 | BNB Chain | Logic | $661 |
| dTRINITY dLENDflash-premium divided by a 1-wei aToken supply inflates the cbBTC liquidity index | Mar 2026 | Ethereum | Untagged | not in dollars |
| EST / BNBDeposit Exploitskim()-Fed Proportional Reward Drain + AMM Reserve Manipulation | Mar 2026 | BNB Chain | Logic | not in dollars |
| PRXVT Staking ExploitTransferable Reward-Receipt Token Resets userRewardPerTokenPaid | Jan 2026 | Base | Logic | not in dollars |
| Revamp referral-reward draina self-referral that pays contributors out of existing pool BNB | Mar 2026 | BNB Chain | Logic | not in dollars |
| StakeOnMe JAKE owner-wrapper reserve asymmetrypublic owner-privileged mint vs. burn pays out against an inflated ETH reserve | Mar 2026 | Ethereum | Logic | not in dollars |
| Truebit ExploitInverted getPurchasePrice Lets Anyone Buy TRU For Free, Then Sell For ETH | Jan 2026 | Ethereum | Logic | not in dollars |
| VTSwapHook reserve/fee accounting divergenceUniswap V4 custom-curve hook books full specified amount into reserves while pricing output on the fee-reduced input | Mar 2026 | Arbitrum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.