Hacks / Statistics / Q3 2026
Q3 2026 Exploit Report
July–September 2026: 81 reproduced exploits, $144M in stated losses.
81 exploits from July–September 2026 are reproduced in the library, 2 more than in Q2 2026. 67 of them state a dollar loss, $144M in total, against $55M the quarter before. Logic was the most common root-cause category, on 55 of the 81 incidents (68%). Ethereum had the most incidents (35), while Cronos carried the largest stated losses ($75M). The largest stated loss was Tectonic TONIC Thin-Oracle Collateral Manipulation at $75M, 52% of the quarter's stated total.
Incidents
81
79 in Q2 2026.
Stated losses
$144M
67 of 81 incidents state a dollar figure. $55M in Q2 2026.
Largest stated loss
$75M
Tectonic TONIC Thin-Oracle Collateral Manipulation
Most common root cause
Logic
On 55 of 81 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic55Access Control34Oracle Manipulation26DeFi16Input Validation13Authentication9Governance9Arithmetic7Dependency7Untagged6
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 55 | $26.7M |
| Access Control | 34 | $20.1M |
| Oracle Manipulation | 26 | $111M |
| DeFi | 16 | $6.6M |
| Input Validation | 13 | $13.1M |
| Authentication | 9 | $18.3M |
| Governance | 9 | $10.6M |
| Arithmetic | 7 | $2.4M |
| Dependency | 7 | $788K |
| Untagged | 6 | $9.4M |
| Bridge | 5 | $1.9M |
| Reentrancy | 4 | $302K |
| Proxy | 1 | — |
Chains
Where the exploited contracts were deployed.
Ethereum35BNB Chain23Base11Polygon4Arbitrum3Other2Citrea1Cronos1HyperEVM1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 35 | $28M |
| BNB Chain | 23 | $11.8M |
| Base | 11 | $10.7M |
| Polygon | 4 | $110K |
| Arbitrum | 3 | $315K |
| Other | 2 | $18.4M |
| Citrea | 1 | $140K |
| Cronos | 1 | $75M |
| HyperEVM | 1 | $33.4K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Tectonic TONIC Thin-Oracle Collateral Manipulation$75MMore Markets (Flow EVM)$9.3MBonzo Lend / Supra Oracle$9.1MMoonwell MAMO Thin-Market Oracle Manipulation$8.7MTerm Finance Governance Takeover$8.5M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Tectonic TONIC Thin-Oracle Collateral Manipulation | Cronos | $75M |
| More Markets (Flow EVM) | Other | $9.3M |
| Bonzo Lend / Supra Oracle | Other | $9.1M |
| Moonwell MAMO Thin-Market Oracle Manipulation | Base | $8.7M |
| Term Finance Governance Takeover | Ethereum | $8.5M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Tectonic TONIC Thin-Oracle Collateral ManipulationOver-Borrow Against Inflated Spot Mark | Aug 2026 | Cronos | Oracle Manipulation | $75M |
| More Markets (Flow EVM)Ankr bonded LST + 97% E-mode drains the WFLOW reserve | Aug 2026 | Other | Oracle Manipulation | $9.3M |
| Bonzo Lend / Supra OracleBLS Zero-Signature Price Forgery | Jul 2026 | Other | Authentication | $9.1M |
| Moonwell MAMO Thin-Market Oracle ManipulationBorrow Real Assets Against Inflated Collateral | Aug 2026 | Base | Oracle Manipulation | $8.7M |
| Term Finance Governance TakeoverThin gtmvETH Majority → Zero Delay Cooldown → Yearn Vault Drain | Aug 2026 | Ethereum | Governance | $8.5M |
| Pro Token: transfer-hook reward-swap self-dealing drains the pair | Jul 2026 | BNB Chain | Untagged | $8.2M |
| rsETH Safe drainRouter multicall treats a self-call as authorized and the enabled module delegatecalls a recipe | Sep 2026 | Ethereum | Access Control | $7.7M |
| Summer.fi FleetCommanderNAV Inflation via Empty-Ark Donation of Undervalued vgUSDC | Jul 2026 | Ethereum | DeFi | $5.6M |
| Notional V1 escrowunbacked fCash mint overflows uint128 ladders and settles as cash | Sep 2026 | Ethereum | Arithmetic | $1.7M |
| MOKE LP Dividend DrainStale userLPRecord Double-Claim via Unsynced LP Transfers | Aug 2026 | BNB Chain | Logic | $908K |
| Hinkal Shielded PoolLegacy Note Multi-Nullifier Double-Spend | Jul 2026 | Ethereum | Logic | $800K |
| BarnBridge SMART YieldGovernance Capture of an Abandoned DAO → Controller Swap → Approval Drain | Jul 2026 | Ethereum | Governance | $777K |
| Ajna Financeself-controlled liquidation via bucketTake / take accounting | Aug 2026 | Ethereum | Logic | $775K |
| LpdFiSpot-Oracle Price Manipulation Drains Protocol LP via claimInterest | Aug 2026 | BNB Chain | Oracle Manipulation | $690K |
| The Sandbox SAND OFTapproveAndCall hijacks LayerZero delegate and mints unbacked SAND | Aug 2026 | Base | Access Control | $670K |
| The Sandbox SAND OFT (Base)LayerZero Delegate Hijack via approveAndCall | Aug 2026 | Base | Access Control | $670K |
| LULA: pre-accumulated reward redeemed against a manipulable pool | Jul 2026 | BNB Chain | Untagged | $578K |
| Lien Finance: crafted bond payoff over-valued by the pricer | Jul 2026 | Ethereum | Untagged | $542K |
| Flamincomespot-priced, permissionlessly-inflatable strategy NAV drains the proportional-share YUSDT vault | Sep 2026 | Ethereum | Oracle Manipulation | $345K |
| Symbiosis BridgeV2signed receive mints unbounded syBTC (BSC) | Sep 2026 | BNB Chain | Bridge | $336K |
| Internet Token swapV3 mints arbitrary INT to a fake poolvalidateSupply is burned around | Sep 2026 | Base | Reentrancy | $265K |
| Lumi Finance (Sodium ERC-4337 account)Signature-Bypass Drain | Jul 2026 | Arbitrum | Authentication | $264K |
| Balancer V1 BPool joinswapPoolAmountOut roundingmint BPT for 1 satoshi WBTC after dust compression | Aug 2026 | Ethereum | Arithmetic | $234K |
| Edel xStockERC4626 convertToAssets Donation Inflates Collateral and Drains Reserves | Jul 2026 | Ethereum | DeFi | $204K |
| CrowdRingCircle ExploitPremature sync() Turns a Sell-Tax Burn into a Free Reserve Drain | Jul 2026 | BNB Chain | Logic | $201K |
| Allbridge CCTPPhantom Deposit on Base (~$191K) | Aug 2026 | Base | Bridge | $191K |
| SKYDAO sell pathcontrolburn + sync() before the net credit desyncs the pair reserve | Sep 2026 | BNB Chain | Logic | $183K |
| Cozy Finance v2UMA Optimistic Oracle fake YES drains the protection Set | Sep 2026 | Base | Oracle Manipulation | $160K |
| USM / FUM (Minimalist USD)Flash-loan fund/defund extracts ETH buffer via inflated mid-price | Aug 2026 | Ethereum | Logic | $160K |
| Enjin "Crypto Items"unprotected registry initialize() → manager takeover → delegatecall-body injection drains the ERC-1155 item reserve | Aug 2026 | Ethereum | Access Control | $142K |
| Zentra FinanceCustom AToken _burnScaled silently caps oversize burns | Sep 2026 | Citrea | Logic | $140K |
| Fox MarketLP-bond mint priced from a manipulable FOX/USDT spot | Aug 2026 | BNB Chain | Oracle Manipulation | $119K |
| RWT Token ExploitOwner-Gated burn() Lets a Role-Holder Delete an AMM Pair's Own Reserve | Jul 2026 | BNB Chain | Oracle Manipulation | $118K |
| CashCowCoin (CCC)sell() burns LP inventory then sync(), draining the CCC/WBNB pair | Aug 2026 | BNB Chain | Logic | $117K |
| Balancer V1 BPooljoinswapPoolAmountOut rounding drain (empirical reconstruction) | Aug 2026 | Ethereum | Arithmetic | $111K |
| Secured.Fisame-block self-trade pins getMarketUnitPrice at par and drains WBTC | Sep 2026 | Ethereum | Oracle Manipulation | $104K |
| LPBonus (MSN LP-reward pool)reserve-inconsistency between reward accrual and withdrawal lets a flash-manipulated reserve inflate an LP's FIST claim | Sep 2026 | BNB Chain | Logic | $92.6K |
| StrongBlock Governance TakeoverAbandoned Governor → Malicious Upgrade → Pool Drain | Aug 2026 | Ethereum | Access Control | $72K |
| DHC Award vaultclaimed reward can be reset and paid again from the shared pool | Sep 2026 | BNB Chain | Logic | $71.9K |
| BeatXswap LiquidityVestingConvertUniV3 slot0 spot oracle | Sep 2026 | BNB Chain | Oracle Manipulation | $63.7K |
| Nimiq HTLC handlersOpenGSN execute() ignores the signature and opens an HTLC as the liquidity wallet | Sep 2026 | Polygon | Access Control | $50.5K |
| BonfireSwap transfer spends any holder's standing allowancemissing caller check on the router's force-sell | Sep 2026 | BNB Chain | Access Control | $47K |
| ether.fi Liquid / Veda AtomicQueueUnauthenticated solver Drain | Sep 2026 | Ethereum | Access Control | $38.2K |
| DoinGud acceptOffer pays the escrow twiceamount == 0 skips offer deletion | Sep 2026 | Polygon | Logic | $35.4K |
| PrimeFi verifyReportpermissionless stale Chainlink Data Streams report inflates PRFI and empties the WHYPE reserve | Sep 2026 | HyperEVM | Oracle Manipulation | $33.4K |
| UnprotectedArbBot: ungated forwarder drains a pre-granted allowance | Jul 2026 | Base | Untagged | $31.7K |
| Base Unverified Arbitrary CALLAllowance Drain via 0x42be3129 | Aug 2026 | Base | Access Control | $31K |
| Atomic (AtomicLending)Signature Replay + Flash-Loan Spot Manipulation on Arbitrum (~$29,984) | Aug 2026 | Arbitrum | Authentication | $30K |
| Float Protocol HypervisorUniswap V3 spot-priced deposit/withdraw sandwich | Aug 2026 | Ethereum | DeFi | $28K |
| GDCTokensell-tax credits 30% to the pair then burns 100% from it and sync()s | Sep 2026 | BNB Chain | Logic | $27K |
| SpiralHookV2Uniswap V4 spot getSlot0 prices borrow collateral, and noSameBlockSwap keys the guard on tx.origin | Sep 2026 | Ethereum | Oracle Manipulation | $26.8K |
| Drips Network DaiDripsHub give()uint128 → int128 cast flips fund flow | Jul 2026 | Ethereum | Arithmetic | $24.9K |
| GaslessReservoirEnablerwhitelisted WETH plus arbitrary module.call spends every standing approval | Sep 2026 | Polygon | Access Control | $23.8K |
| Reddio RedSonic Vaultpermissionless registerErc20(stETH) double-counts one balance | Sep 2026 | Ethereum | Logic | $23K |
| Sodium Smart Wallet ExploitERC-4337 Session-Key Validation Bypass / EntryPoint Gas-Deposit Griefing | Jul 2026 | Arbitrum | Access Control | $21.2K |
| Falcon Heavy (FH)Sell Path Burns FH From the Pancake Pair | Aug 2026 | BNB Chain | DeFi | $20K |
| NEX/AIC FoT SkimRouter Double-Transfer + Sell Fee Lets skim() Empty the Pair | Aug 2026 | BNB Chain | Logic | $19.1K |
| ZKPanther (Base)Reality.eth governance module → proxy upgrades → ZKP drain | Aug 2026 | Base | Governance | $15.6K |
| Reflexer GEBunauthenticated GebProxyActions.quitSystem drains library-owned SAFEs | Aug 2026 | Ethereum | Access Control | $14K |
| Index Coop ExchangeIssuance TOCTOUUnlocked SetToken Units + Malicious Manager Hook Drain Residual Inventory | Jul 2026 | Ethereum | Logic | $9.6K |
| Arrakis Finance G-UNIUniswap V3 mint/burn sandwich with no same-tx snapshot | Aug 2026 | Ethereum | DeFi | $7.2K |
| Arrakis V1 G-UNIUniswap V3 spot-priced mint/burn sandwich (typed reconstruction) | Aug 2026 | Ethereum | DeFi | $7.2K |
| NFT Auction Marketplace ExploitSettle-Then-Cancel Double Payout Drains the Escrow Pool | Jul 2026 | BNB Chain | Logic | $4.2K |
| Perpetual Protocol (Curie) ExploitMissing Access Control on OrderBook.updateFundingGrowthAndLiquidityCoefficientInFundingPayment() | Jul 2026 | Base | Access Control | $3.1K |
| Pancake V3 Swap HelperSigned Swap Delta Misread as the WBNB Payout | Sep 2026 | BNB Chain | Logic | $1.3K |
| Flashstake V2Unit-based instant rewards dump into a mispriced FLASH/WETH pool | Aug 2026 | Ethereum | Logic | $886 |
| Startale ERC-7579 accountstransient INIT_SLOT stays set after the proxy constructor, so initializeAccount can be called again in the same transaction | Sep 2026 | Ethereum | Logic | $33 |
| DAOstack Genesis Alphapermissionless newOrganization mints reputation and drains the avatar | Sep 2026 | Ethereum | Access Control | not in dollars |
| DEX router drainunverified V3 callback trusts a fake pool and transferFroms any approver | Sep 2026 | BNB Chain | Access Control | not in dollars |
| Enso Finance strategy vaultshort Uni V3 TWAP overvalues FARM deposits | Sep 2026 | Ethereum | Oracle Manipulation | not in dollars |
| Likwid leverage == 0 borrowfrozen pair reserves re-quote the same BNB on every collateral add | Sep 2026 | BNB Chain | Logic | not in dollars |
| Mutual Uniting System (MUS)a first-deposit bonus is paid twice and never capped, so a fresh deposit-withdraw returns more ETH than it put in | Sep 2026 | Ethereum | Logic | not in dollars |
| OMNI404 (O404)ERC-404 transfer(id≤50) + whitelist rounding drain | Sep 2026 | Ethereum | Input Validation | not in dollars |
| ORB addPoolAndSellBNB refund before the sell, then burnLP grinds the pair and a last swap takes the WBNB | Sep 2026 | BNB Chain | Reentrancy | not in dollars |
| Order factorypermissionless createOrderForBuyer sets attacker as seller and aborts the buyer's ETH | Sep 2026 | Ethereum | Access Control | not in dollars |
| Panther Protocol (Base): unopposed self-answered governance proposal captures the Safe | Aug 2026 | Base | Untagged | not in dollars |
| Projekt Reward Vault: fake-purchase allocation from an unverified balance delta | Jul 2026 | Ethereum | Untagged | not in dollars |
| The Red Villagea public request forwarder is a confused deputy that upgrades a UUPS proxy to attacker code | Sep 2026 | Polygon | Access Control | not in dollars |
| Unifi Protocolfake LP drains UP rewards for ~5.86 BNB (BSC) | Sep 2026 | BNB Chain | Logic | not in dollars |
| Unistreets LaunchpadFactoryAutoArbitrary Calldata Injection → V4 LP Burn (2-tx, 2-victim confused deputy) | Aug 2026 | Ethereum | Access Control | not in dollars |
| Yam Financehardcoded GovernorAlpha quorum on a dormant DAO, then masterFallback drains the expired UMA farms | Sep 2026 | Ethereum | Governance | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.