Value taken
USDTotal value taken in all incidents of the selected period, valued at each attack block.
Dashboard · VantagePlanned
Crypto Hack Tracker: Exploits and Losses This Year
Which crypto hacks happened this year, how much was taken and where are the stolen funds now?
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
- Multi-chain
ShareEmail it
Blueprint
What the dashboard will show.
The dashboard as it will open in Vantage. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
This year
The year's incidents, the totals and how attackers got in.
Incidents
countIncidents in the selected period that have identified attack transactions and a public confirmation.
Largest incident
USDThe amount taken in the largest single incident of the period, with its victim and date beside it.
Frozen or returned
USDValue frozen by issuers or exchanges or returned by attackers for incidents of the period, from the recovery transactions.
Value taken by month
USDValue taken per month, split by attack type, so a single large incident stands apart from the steady run of smaller ones.
How attackers got in
USDLosses in the period grouped by attack type: key compromise, contract flaw, oracle manipulation, phishing and insider rug pulls.
Every incident
Each incident with its date, victim, chain, attack type, amount taken, amount recovered and links to the attack transactions.
Stolen funds
What attackers still hold, what was frozen or returned and what moved on.
Still held by attackers
USDValue still held by attacker addresses at the latest block, across every incident in the period.
Bridged out
USDValue attackers moved through cross-chain bridges after the attacks, read from bridge deposit events.
Where stolen funds sit now
USDFor each large incident, where the stolen value sits now: attacker wallets, bridges, mixers, exchanges, frozen or returned.
- Period
- This year, last 12 months or all time
- Chain
- Every chain with a recorded incident
About
What it answers, and for whom.
This dashboard lists the year's hacks and exploits as they happen: which protocol, bridge, exchange or wallet was hit, on which chain, how the attacker got in and how much was taken. Each loss is read from the attack transactions themselves, so the amount is what left the victim's contracts, not a figure repeated from a headline.
Totals by month and by attack type show where losses come from. A second page follows what attacker addresses still hold, what was frozen or returned and what moved on through bridges, mixers or exchanges. Open any incident to see its transactions, the prices used to value them and the public sources that confirmed it.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- An incident is added when its attack transactions are identified on-chain and a public disclosure by the affected team or an investigator confirms it; both are linked from the incident.
- The amount taken is the sum of token and native transfers out of the victim addresses in the attack transactions, valued at oracle or DEX pool prices at the attack block.
- Attacker addresses are those the disclosures name, plus addresses that received funds directly from them; their balances are read at the latest block for the still-held figure.
- Recoveries, bounties and issuer freezes are recorded as their own transactions and are never netted silently from the amount taken.
- Every figure carries a receipt: the blocks and transaction hashes it was summed from and the price reads used to value it.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- stablecoin_freezesTo buildStablecoin freezes and blacklistsAddresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- Attack transactions, with ERC-20 Transfer logs and native-value traces out of victim addresses in the exploit block range
- Native and token balances of attacker addresses at the latest block
- Chainlink AnswerUpdated rounds or DEX pool reserves at the attack block, for USD values
- Public disclosures and post-mortems by the affected teams, recorded with their date and link
Questions
Questions people ask.
What was the biggest crypto hack this year?
The incidents table sorts the year's hacks by the amount taken, valued at the block of each attack, so the largest one is its first row. Each row links to the attack transactions and to the disclosures behind it.
How do crypto hacks happen?
Most incidents fall into a few types: compromised private keys or signing setups, smart contract flaws such as reentrancy or faulty access control, price oracle manipulation, phishing of users or staff and insiders removing liquidity. The dashboard groups losses by these types.
Can stolen crypto be recovered?
Sometimes. Stablecoin issuers can freeze tokens held by attacker addresses, exchanges can block deposits and some attackers return funds in exchange for a bounty. Each recovery appears beside its incident as its own transaction, so the net loss stays visible.
How are hack losses valued?
Each stolen amount is valued at an on-chain price at the attack block, from oracle feeds or DEX pool prices, so the figure reflects what was taken at that moment. Later price moves change what the attacker holds, which the still-held figure shows separately.
Where does hack data come from?
The attack transactions, the transfers out of victim contracts and the attacker balances are read from the chains. Which addresses belong to an attacker, and what an incident was, comes from public disclosures, which are recorded with each incident as its sources.
- Exploit
- An attack that abuses a flaw in a contract's code or configuration to take funds, as opposed to stealing the keys that control them.
- Attack transaction
- A transaction in which funds leave the victim's contracts or wallets during an incident; its hash is the incident's primary evidence.
- White-hat bounty
- A share of stolen funds an attacker may keep in exchange for returning the rest, offered by the affected team on-chain or in a public post.
Related
More apps like this.
Crypto Hacks and Exploits: Monthly Report
Every major hack, exploit and rug pull of the month: what was hit, how, how much was taken and where the funds went.
Multi-chainBiggest Crypto Hacks of All Time, Ranked
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainStolen Crypto Tracker: Where Hacked Funds Went
Follow a hack's stolen funds hop by hop into bridges, swap protocols, mixers and exchanges, or see what still sits in attacker wallets.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinCrypto Exchange Hacks: Full List and Losses
Every known centralized exchange breach, when it happened, which wallets were hit and how much left them, tied to the on-chain outflows.
Multi-chainBitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Crypto Hack Tracker: Exploits and Losses This Year on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.