Hacks / Statistics / Q2 2026
Q2 2026 Exploit Report
April–June 2026: 79 reproduced exploits, $55M in stated losses.
79 exploits from April–June 2026 are reproduced in the library, 50 more than in Q1 2026. 53 of them state a dollar loss, $55M in total, against $11.5M the quarter before. Logic was the most common root-cause category, on 52 of the 79 incidents (66%). Ethereum had both the most incidents (35) and the largest stated losses ($40M). The largest stated loss was Verus–Ethereum Bridge Exploit at $11.6M, 21% of the quarter's stated total.
Incidents
79
29 in Q1 2026.
Stated losses
$55M
53 of 79 incidents state a dollar figure. $11.5M in Q1 2026.
Largest stated loss
$11.6M
Verus–Ethereum Bridge Exploit
Most common root cause
Logic
On 52 of 79 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic52Access Control41Oracle Manipulation27DeFi11Dependency8Bridge7Arithmetic6Authentication6Denial of Service3Governance3
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 52 | $35.2M |
| Access Control | 41 | $37.5M |
| Oracle Manipulation | 27 | $3.3M |
| DeFi | 11 | $920K |
| Dependency | 8 | $10.4M |
| Bridge | 7 | $20.8M |
| Arithmetic | 6 | $2.7M |
| Authentication | 6 | $7.3M |
| Denial of Service | 3 | $140K |
| Governance | 3 | $198K |
| Input Validation | 2 | — |
| Reentrancy | 2 | $45K |
| Untagged | 2 | $212K |
| Accounting | 1 | $7.3M |
Chains
Where the exploited contracts were deployed.
Ethereum35BNB Chain26Arbitrum5Base5Polygon5Avalanche1Gnosis1Linea1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 35 | $40M |
| BNB Chain | 26 | $13M |
| Arbitrum | 5 | $823K |
| Base | 5 | $483K |
| Polygon | 5 | $519K |
| Avalanche | 1 | — |
| Gnosis | 1 | — |
| Linea | 1 | $166K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Verus–Ethereum Bridge Exploit$11.6MJaredFromSubway MEV Bot$7.5MDxSale Liquidity-Locker Exploit$7.3MTrustedVolumes Exploit$5.9MNew Market Trading Exploit$4M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Verus–Ethereum Bridge Exploit | Ethereum | $11.6M |
| JaredFromSubway MEV Bot | Ethereum | $7.5M |
| DxSale Liquidity-Locker Exploit | BNB Chain | $7.3M |
| TrustedVolumes Exploit | Ethereum | $5.9M |
| New Market Trading Exploit | Ethereum | $4M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Verus–Ethereum Bridge ExploitForged Cross-Chain Import With No Source-Amount Validation | May 2026 | Ethereum | Bridge | $11.6M |
| JaredFromSubway MEV BotResidual ERC-20 Approvals to Untrusted Bait Wrappers | Jun 2026 | Ethereum | Logic | $7.5M |
| DxSale Liquidity-Locker ExploitStealthy Ownership Takeover + Privileged Drain (~$7.3M BNB) | May 2026 | BNB Chain | Access Control | $7.3M |
| TrustedVolumes ExploitPermissionless Signer Registration + Wrong-Key Authorization Drains an RFQ Settlement Proxy | May 2026 | Ethereum | Access Control | $5.9M |
| New Market Trading ExploitPayload-Forgery Drain via Axelar "Express" Path on a Gnosis Safe Module | May 2026 | Ethereum | Access Control | $4M |
| Aztec V1 Escape-Hatch ExploitUnbacked Withdrawals via Verifier-Trusted Rollup Proofs | Jun 2026 | Ethereum | Access Control | $2.2M |
| Aztec Connect (V3) ExploitnumRealTxs proof-vs-settlement coverage mismatch | Jun 2026 | Ethereum | Bridge | $2.2M |
| Thetanuts Finance ExploitInteger-Division Truncation in mint() After the Vault Is Drained to ~0 totalSupply | Jun 2026 | Ethereum | Arithmetic | $2.1M |
| ATM LP-Burn ExploitMisplaced LP Tokens Are Burn-Redeemable by Anyone via PancakeV2 burn() | Jun 2026 | BNB Chain | Access Control | $1.6M |
| Ekubo Protocol ExploitFlash-Accounting pay() Funded From a Victim's Standing Approval | May 2026 | Ethereum | Dependency | $1.4M |
| Giddy YieldBasis VaultV3EIP-712 signature only binds swap data, not token/amount/aggregator | Apr 2026 | Ethereum | Authentication | $1.3M |
| OLPC ExploitOwner decimalsValue Misconfig Amplifies Pair-Side Burn → amountIn=0 Supporting-Fee Drain | Jun 2026 | BNB Chain | Access Control | $1.1M |
| Squid SquidMulticall ExploitArbitrary-Target Default Call Turns an Approved Multicall into a Universal transferFrom Proxy | Apr 2026 | BNB Chain | Dependency | $800K |
| Adshares Bridge ExploitCompromised Minter Key Fabricates Cross-Chain Mints | May 2026 | Ethereum | Access Control | $628K |
| Aurellion Labs Diamond Re-Init DrainUnprotected initialize → diamondCut pull/sweep | May 2026 | Arbitrum | Access Control | $456K |
| Singularity dynBaseUSDCv3 ExploittotalAssets() Inflation via a Mis-Configured (Fee-Tier-42 / Zero-Liquidity) Oracle Path | Apr 2026 | Base | Oracle Manipulation | $413K |
| RWAVault ExploitOverridden ERC4626.withdraw Drops the Allowance Spend | Apr 2026 | Ethereum | Access Control | $399K |
| SQ Token Staking ExploitHardcoded Owner Backdoor + Self-Minting Staking Rewards | May 2026 | BNB Chain | Access Control | $346K |
| AROS ExploitLeaked claimSigner Key + AMM-Reserve Drain via Signed Claims | May 2026 | BNB Chain | Access Control | $295K |
| RoyalRoyalties ExploitZero-Amount ERC-1155 Batch Transfer Inflates tierBalanceOf 100× | Jun 2026 | Polygon | Logic | $261K |
| ATM Token ExploitPer-Address Anti-Whale Guards Sidestepped by 30 Sybil "Farmer" Clones | Jun 2026 | BNB Chain | Logic | $244K |
| a152 Authorized-Spender Allowance Drainprivileged spender abused to pull any user's approved tokens | Apr 2026 | Ethereum | Access Control | $229K |
| DLMC ExploitReserve-Derived livePrice Self-Inflation Drains the Token's Own USDT Backing | Jun 2026 | BNB Chain | Oracle Manipulation | $223K |
| SKP/USDT Exit-Scam DrainPre-Positioned 96.8%-of-Supply "Whitelist" Treasury + Pool Drain | May 2026 | BNB Chain | Untagged | $212K |
| SKP Token ExploitOwner Backdoor ownerBurnLiquidityPairTokens() Reserve Drain → Collateral Price Inflation | May 2026 | BNB Chain | Access Control | $212K |
| Renegade Darkpool ExploitRe-Initializable Proxy → Attacker-Controlled delegatecall | May 2026 | Arbitrum | Access Control | $210K |
| WUSD ExploitSybil-Farmable _englove() Reward Mint + Thin-Pool GLO Drain | May 2026 | Ethereum | Logic | $200K |
| MAP Protocol ExploitUnverified retryMessageIn Forges a Cross-Chain Message to Mint 1e33 MAPO | May 2026 | Ethereum | Bridge | $180K |
| PerpPair ExploitSelf-Dealt LP/Trader Pair Inflates Curve-Priced PnL out of the Shared Vault | Apr 2026 | Linea | Oracle Manipulation | $166K |
| INK Finance ExploitFlash-Loan-Inflated, Permissionless claimPayroll() Treasury Drain | May 2026 | Polygon | Access Control | $140K |
| AIDCToken sell-burn drains the AMM pair reservedeflation logic burns tokens from the LP without a counterpart | Jun 2026 | BNB Chain | Logic | $132K |
| DIP ExploitFee-on-Sell Transfer + skim/sync Reserve-Collapse on the DIP/AIC Pair | Jun 2026 | BNB Chain | Oracle Manipulation | $111K |
| MetaSea (SEA Token) ExploitredeemPosition() Over-Pays From an Unguarded Reward Distributor | May 2026 | Arbitrum | Logic | $110K |
| Thetanuts ExploitZero-Cost Index-Vault mint() via Rounding-Down Component Deposits | Jun 2026 | Ethereum | Arithmetic | $105K |
| Huma Finance ExploitEvaluation-Agent Approval Bypass via refreshAccount() | May 2026 | Polygon | Access Control | $101K |
| BY Token ExploitPermissionless triggerAutoBurn() Pool-Reserve Drain | Jun 2026 | BNB Chain | Access Control | $87.4K |
| LegendaryMoneyMonNft ExploitcliamRewred() Signature Bypass via ecrecover → address(0) == admin | May 2026 | BNB Chain | Authentication | $85.5K |
| Kipseli PropAMM ExploitUSD-Scale Quote Misread as cbBTC Token Units | Apr 2026 | Base | Arithmetic | $70K |
| Ambient (CrocSwap) ExploitNative-ETH Surplus Settlement Drained via a Self-Dealt Grid-Walk + Range Harvest | Jun 2026 | Ethereum | Logic | $67.8K |
| JUDAO sell-hook reserve draintoken transfer hook burns liquidity directly from its own DEX pair, desyncing the AMM reserves the attacker then arbitrages | Apr 2026 | BNB Chain | DeFi | $62K |
| JB ExploitGateway-Driven sell → PoolBurn(pool) + sync() AMM-Reserve Drain (Venus-leveraged) | Jun 2026 | BNB Chain | Access Control | $50K |
| Joe Agent (JOE) ExploitremoveLiquidityViaContract Reentrancy on Pooled LP Custody | May 2026 | BNB Chain | Reentrancy | $45K |
| DTXT Exploit1-Wei USDT Donation Misclassifies a Sell as a Liquidity Add (Fee Bypass + Stale-Reserve Drain) | Jun 2026 | BNB Chain | Logic | $35K |
| Lixir vault permit signature bypassany holder's vault shares drained with a forged signature | Jun 2026 | Ethereum | Authentication | $33K |
| Sharwa Margin TradingUniswap-V3 spot-price oracle used to value NFT collateral | May 2026 | Arbitrum | Oracle Manipulation | $32.9K |
| AISOTH Presale ExploitSame-Tx Buy+Claim of Below-Market Inventory, Dumped Into the Live AIS/USDT Pair | Jun 2026 | BNB Chain | Oracle Manipulation | $30.3K |
| MONA / LisaVault ExploitSelf-Referral Node Farming + Insider LP Drain | Apr 2026 | BNB Chain | Access Control | $20.4K |
| YSDAO ExploitBalance-vs-Reserve "Add/Remove Liquidity" Tax Bypass + Permissionless Staking.sync() Price Pump | May 2026 | BNB Chain | Logic | $19.5K |
| ElevateFi ExploitFixed-USD Staking Packages Priced from Spot DAI/EFI Reserves | May 2026 | Polygon | Oracle Manipulation | $16K |
| Fractal Protocol ExploitStale-Price / Retroactive-Yield Arbitrage via Permissionless compute() | May 2026 | Arbitrum | Oracle Manipulation | $13.7K |
| BOSS ExploitHelper Mint/Burn Drains the Pair's BOSS Reserve, then a Degenerate-Reserve Swap Loop Empties the USDT Side | Jun 2026 | BNB Chain | Access Control | $10.2K |
| WHALE ExploitFlash-Inflated AMM Reserve → Mining-Hashrate Over-Credit Drain | Jun 2026 | BNB Chain | Oracle Manipulation | $3.5K |
| TesseraSwap ExploitCEI Violation: Treasury Pays the Output Token Before Collecting the Input Token | May 2026 | Base | Logic | $13 |
| ATOHook Solady ReentrancyGuard Storage CollisionInflated getReward() Drain | Jun 2026 | Ethereum | Access Control | not in dollars |
| Aztec Escape-Hatch Exploit (variant 2)Unconstrained Inner proof_id Witness | Jun 2026 | Ethereum | Untagged | not in dollars |
| BlastFOMOVault claimBonus clone-churn drains BNB bonus pool | May 2026 | BNB Chain | Logic | not in dollars |
| Blockchain Bets ERC-1155 stake/transform inflates redeemable BCB → UniV2 dump | Apr 2026 | Ethereum | Logic | not in dollars |
| BoostHook Leveraged Long ExploitSpot open without post-open solvency + MAX_LIQS_PER_BLOCK cascade cap | May 2026 | Ethereum | Oracle Manipulation | not in dollars |
| Cook Finance IssuanceCaller-Chosen Weightings Drain CKToken Components via Thin Pancake Pools | Jun 2026 | BNB Chain | Oracle Manipulation | not in dollars |
| Gnosis Pay / Zodiac DelaymoduleTxSignedBy ignores EIP-1271 staticcall success | Jun 2026 | Gnosis | Authentication | not in dollars |
| HeisenbergHook Fee Path HijackUnrestricted poolKey overwrite + permissionless processFees/processBurn | May 2026 | Ethereum | Logic | not in dollars |
| Juicebox REVLoans ExploitTrust-on-First-Use of a Caller-Supplied Loan Source Inflates Borrowable Surplus | Apr 2026 | Ethereum | Logic | not in dollars |
| LBP (Little Boy Plus) ExploitReserve-Manipulated LP-Credit Inflates Mining Rewards Minted Into the Pool | Jun 2026 | BNB Chain | Oracle Manipulation | not in dollars |
| Mure Distribution ExploitAttacker-Controlled source Forges Both Verifier and Signature | May 2026 | Ethereum | Access Control | not in dollars |
| NovaBox ExploitStale Dividend Checkpoint on Join + Constructor extcodesize Bypass | Jun 2026 | Ethereum | Logic | not in dollars |
| Ocean Protocol BPool / SideStaking gulp drainpool internal records desynced from real token balance, harvestable via single-sided joins + exits | Jun 2026 | Polygon | Logic | not in dollars |
| ONTR Token Zero-Owner onlyOwner Free Mint → Pancake WETH Drain | May 2026 | Ethereum | Access Control | not in dollars |
| QNT Reserve EIP-7702 + Permissionless BatchCall.batch() Drain | Apr 2026 | Ethereum | Access Control | not in dollars |
| Sat1Hook ForensicsGrindable Hook Identity, but No Confirmed Protocol Loss | May 2026 | Ethereum | Input Validation | not in dollars |
| Saturn Protocol (sUSDat)Withdrawal Freeze via strcBalance/vestingAmount Desync + 33% PROCESSOR Extraction | Apr 2026 | Ethereum | Arithmetic | not in dollars |
| sAVAX Rebalancer arbitrary-call drains victim credit delegationpermissionless target/data execution from a delegated Aave borrower | Apr 2026 | Avalanche | Access Control | not in dollars |
| Squid Router Module ExploitCaller-Supplied Delegate on the Permissionless Axelar Express Path | May 2026 | Ethereum | Access Control | not in dollars |
| SubQuery (SQT) ExploitUnprotected Settings.setBatchAddress() Role Hijack | Apr 2026 | Base | Access Control | not in dollars |
| Thetanuts BTC/USD Vault ExploitERC4626-Style First-Depositor Share Rounding at totalSupply() == 0 | Apr 2026 | Ethereum | Arithmetic | not in dollars |
| TOP ExploitAragon Instant-Execution Governance Self-Mint + Balancer BPool Drain | Jun 2026 | Ethereum | Governance | not in dollars |
| TTSwap Market: permissionless initGood + attacker-controlled ERC20 skews AMM accounting via buyGood/payGood | Apr 2026 | Ethereum | Logic | not in dollars |
| Vault4626Donation of Non-Asset WETH Inflates totalAssets() and Is Paid Out on redeem() | Jun 2026 | Base | DeFi | not in dollars |
| Victim automation execute() missing auth drains yvWETH via Yearn withdrawal path | Apr 2026 | Ethereum | Access Control | not in dollars |
| xLOOT Staking ExploitDuplicate NFT IDs in redeem(uint256[]) Claim the Same Epoch Reward Repeatedly | Apr 2026 | Ethereum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.