Hacks / Statistics / Q4 2026
Q4 2026 Exploit Report
In progressOctober–November 2026 so far: 21 reproduced exploits, $2.8M in stated losses.
21 exploits from October–November 2026 are in the library so far. The quarter is still open, so every figure on this page will grow. 9 of them state a dollar loss, $2.8M in total. Logic was the most common root-cause category, on 16 of the 21 incidents (76%). Ethereum had both the most incidents (13) and the largest stated losses ($1.6M). The largest stated loss was Fence tranche pool at $1M, 36% of the quarter's stated total.
Incidents so far
21
The quarter is still open.
Stated losses
$2.8M
9 of 21 incidents state a dollar figure.
Largest stated loss
$1M
Fence tranche pool
Most common root cause
Logic
On 16 of 21 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 16 | $1.8M |
| Access Control | 6 | $731K |
| DeFi | 6 | $14.8K |
| Arithmetic | 3 | — |
| Dependency | 3 | $579K |
| Untagged | 3 | $1M |
| Authentication | 1 | — |
| Bridge | 1 | $783K |
| Governance | 1 | $21.9K |
| Input Validation | 1 | — |
| Oracle Manipulation | 1 | — |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 13 | $1.6M |
| Avalanche | 2 | $1M |
| Base | 2 | $41K |
| BNB Chain | 2 | $152K |
| Polygon | 2 | $14.8K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Fence tranche pool | Avalanche | $1M |
| zkLink Nova | Ethereum | $783K |
| MakerDAO flip-keeper | Ethereum | $538K |
| BiFi USDT | Ethereum | $166K |
| AlpsCon AI Trade Hub | BNB Chain | $152K |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Fence tranche poolthe UTC rollover credits a scheduled principal payment that was never paid, and draw pays it again | Oct 2026 | Avalanche | Untagged | $1M |
| zkLink NovaTransient finalizeMessageHash Reused to Forge a Batch Root | Oct 2026 | Ethereum | Bridge | $783K |
| MakerDAO flip-keeperungated 0x8804d1de hopes a caller-supplied worker, then exits 200 WETH | Oct 2026 | Ethereum | Access Control | $538K |
| BiFi USDTone idle gap of 264,060 blocks is reapplied at a live utilization the attacker sets | Oct 2026 | Ethereum | Logic | $166K |
| AlpsCon AI Trade Huba public Hardhat address is whitelisted, and a zero entry index pays the historical USDC index | Oct 2026 | BNB Chain | Logic | $152K |
| UNCX Smart Token VestingShared-Pool Share Double-Debit | Oct 2026 | Ethereum | Logic | $86K |
| Slice FundsModuleUnbacked Release From a Caller-Chosen Source | Oct 2026 | Base | Access Control | $41K |
| YapeswapZero-Quorum Governance Capture, Then a Fake Yearn Vault | Oct 2026 | Ethereum | Governance | $21.9K |
| BitBay StableVaultwithdraw on an empty position pays the caller the whole vault, uncapped by shares | Oct 2026 | Polygon | Logic | $14.8K |
| Argent relay modulesa public owner signature is replayed, and the recovery deadline can be wrapped into the past | Oct 2026 | Ethereum | Authentication | not in dollars |
| EtherVistaswap's constant-product (K) check multiplies two uint112 reserves, so the invariant overflows and the pool drains | Oct 2026 | Ethereum | Arithmetic | not in dollars |
| ETHMACOAPYa base-set donation makes zero-fee actualizeFee ceil unitShares from 12253 to 12264 | Oct 2026 | Ethereum | Arithmetic | not in dollars |
| FlashLoopAdaptercaller self-attests as the Safe, then swapRouter.call runs the victim | Oct 2026 | Ethereum | Access Control | not in dollars |
| GoldPesa GPXHooksTAKE_PAIR settles the shared unlock, so another position's debt cancels the burn credit | Oct 2026 | Base | Logic | not in dollars |
| KolanHookexpired buy windows settle on the pool's own spot, then the escrowed ETH is bought back with no price limit | Oct 2026 | Ethereum | Oracle Manipulation | not in dollars |
| MALT sLPbelow-peg recovery deposits treasury DAI into the pair, and swap counts it as the caller's input | Oct 2026 | Polygon | Logic | not in dollars |
| Safe approval squatunlimited ERC-20 allowances point at an empty CREATE address anyone can occupy | Oct 2026 | Avalanche | Untagged | not in dollars |
| Set Protocolzero-fee actualizeFee ceils unitShares from 4927 to 4928 and over-redeems the base set | Oct 2026 | Ethereum | Arithmetic | not in dollars |
| TIPMinepermissionless mine() burns TIP out of the Pancake pair and sync() leaves the SOL reserve in place | Oct 2026 | BNB Chain | Access Control | not in dollars |
| X100 Senatetwo flash-bought seats pass a same-block vote that dumps treasury X into the attacker's pool | Oct 2026 | Ethereum | Untagged | not in dollars |
| X7 Finance (X7Pioneer)empty-array claimRewards([]) re-accrues the same donated ETH without advancing the watermark, inflating the per-token reward until one NFT drains the whole pool | Oct 2026 | Ethereum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.