Crypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainTable · StrataPlanned
Biggest Crypto Hacks of All Time, Ranked
What are the largest crypto hacks of all time, ranked by value stolen?
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
- Multi-chain
ShareEmail it
Blueprint
What the table will hold.
The table as it will open in Strata. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
One row One row per incident, across every chain and year recordedSorted by Value taken, highest first
| Rank | Incident | Date | Victim type | Chain | Attack type | Value takenUSD | Value todayUSD | RecoveredUSD | Attribution | Receipt |
|---|---|---|---|---|---|---|---|---|---|---|
- Rank rank Number
- Position by value taken at the time, largest first.
- Incident incident Text
- The victim's name and a short description of what was attacked.
- Date date Date
- The day of the first attack transaction.
- Victim type victim_type Text
- Exchange, bridge, DeFi protocol, wallet or other kind of victim.
- Chain chain Chain
- The chain where most of the value was taken; an incident across several chains lists each in its details.
- Attack type attack_type Text
- How the attacker got in: key compromise, contract flaw, oracle manipulation, signing interface compromise or phishing.
- Value taken value_taken Exact amount
- Tokens and coins that left victim addresses, valued at the attack block.
- Value today value_today Exact amount
- The same tokens and coins valued at the latest day-end price.
- Recovered recovered Exact amount
- Value frozen, returned or seized afterwards, from the recovery transactions.
- Attribution attribution Text
- The actor a public source attributes the attack to, with that source, or unattributed.
- Receipt receipt Link
- The attack transactions, the price reads and the incident's sources.
Filter by Victim type, Chain, Attack type.
About
What it answers, and for whom.
This table ranks the largest crypto hacks and exploits on record by the value taken, measured at the moment of each attack. Exchanges, bridges, DeFi protocols and wallets appear in one list, each with its date, chain, attack type, what was recovered and the transactions that moved the funds.
Value at the time and value today tell different stories: an old attack priced at today's rates can look far larger or smaller than it was. The table ranks by value at the attack block and shows today's value of the same tokens beside it, so the list can be read either way. Open any row to see the attack transactions and the sources that confirmed the incident.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Incidents come from a reviewed registry; each needs identified attack transactions and a public source, and both are linked from its row.
- Value taken is the sum of tokens and native coins that left victim addresses in the attack transactions, valued at oracle or DEX pool prices at the attack block.
- Incidents older than reliable on-chain price feeds are valued at an off-chain reference price for the day, which is named in the row.
- Recovered value counts issuer freezes, attacker returns and seizures, each from its own transactions, and is never subtracted from the ranking value.
- Breaches whose wallets were never disclosed are listed with the victim's own statement as their only source and marked as not verified on-chain.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- Outflow Transfer logs and native traces from victim addresses in each attack's block range
- Oracle rounds or DEX pool prices at each attack block, and a named daily reference price for older incidents
- Freeze events, attacker return transfers and disclosed seizures, for recovered value
- Public disclosures and post-mortems, recorded with each incident's date and link
Questions
Questions people ask.
What is the biggest crypto hack of all time?
The first row of the table answers it, ranked by value at the time of each attack. Lists disagree because some value losses at today's prices and some count insider frauds or exchange collapses as hacks; this table counts only thefts from wallets and contracts.
What are the biggest DeFi hacks?
Filter the table by victim type to see DeFi protocols and bridges only. Large DeFi losses have come from flawed contract logic, oracle manipulation and compromised validator or multisig keys on bridges, and each row names its cause.
Why are bridge hacks so large?
A bridge holds the assets backing every token it has issued on other chains in one place, often controlled by a small set of validator or multisig keys. Compromising those keys or the verification logic can release the whole escrow at once.
Are hack values adjusted for today's prices?
No. The ranking uses value at the attack block, because that is what was taken. Today's value of the same tokens has its own column, since price moves can make an old hack look much larger or smaller today.
How much stolen crypto is ever recovered?
It varies widely from one incident to the next. The recovered column counts freezes by stablecoin issuers, returns by attackers and seizures by authorities, each from its transactions, so the share recovered can be compared row by row.
- Value at the time
- The value of stolen tokens at prices read at the block of the attack, rather than at today's prices.
- Bridge escrow
- The contract that holds locked assets on one chain while tokens representing them circulate on another.
- Seizure
- Funds taken back from an attacker or launderer by authorities, usually through an exchange or a court order.
Related
More apps like this.
Crypto Exchange Hacks: Full List and Losses
Every known centralized exchange breach, when it happened, which wallets were hit and how much left them, tied to the on-chain outflows.
Multi-chainCrypto Hacks and Exploits: Monthly Report
Every major hack, exploit and rug pull of the month: what was hit, how, how much was taken and where the funds went.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinStolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainBitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Biggest Crypto Hacks of All Time, Ranked on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.