# Crypto Hack Tracker: Exploits and Losses This Year

> Crypto hack tracker: every DeFi exploit and hack this year with the losses, attack type and chain, and where the stolen funds sit now, each with a receipt.

Markdown copy of https://voltfincrypto.com/apps/crypto-hack-tracker

**Question:** Which crypto hacks happened this year, how much was taken and where are the stolen funds now?

- Kind: Dashboard in Voltfin Vantage
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

This dashboard lists the year's hacks and exploits as they happen: which protocol, bridge, exchange or wallet was hit, on which chain, how the attacker got in and how much was taken. Each loss is read from the attack transactions themselves, so the amount is what left the victim's contracts, not a figure repeated from a headline.

Totals by month and by attack type show where losses come from. A second page follows what attacker addresses still hold, what was frozen or returned and what moved on through bridges, mixers or exchanges. Open any incident to see its transactions, the prices used to value them and the public sources that confirmed it.

## Blueprint

### This year

The year's incidents, the totals and how attackers got in.

- **Value taken** (USD): Total value taken in all incidents of the selected period, valued at each attack block.
- **Incidents** (count): Incidents in the selected period that have identified attack transactions and a public confirmation.
- **Largest incident** (USD): The amount taken in the largest single incident of the period, with its victim and date beside it.
- **Frozen or returned** (USD): Value frozen by issuers or exchanges or returned by attackers for incidents of the period, from the recovery transactions.
- **Value taken by month** (USD): Value taken per month, split by attack type, so a single large incident stands apart from the steady run of smaller ones.
- **How attackers got in** (USD): Losses in the period grouped by attack type: key compromise, contract flaw, oracle manipulation, phishing and insider rug pulls.
- **Every incident**: Each incident with its date, victim, chain, attack type, amount taken, amount recovered and links to the attack transactions.

### Stolen funds

What attackers still hold, what was frozen or returned and what moved on.

- **Still held by attackers** (USD): Value still held by attacker addresses at the latest block, across every incident in the period.
- **Bridged out** (USD): Value attackers moved through cross-chain bridges after the attacks, read from bridge deposit events.
- **Where stolen funds sit now** (USD): For each large incident, where the stolen value sits now: attacker wallets, bridges, mixers, exchanges, frozen or returned.

Filters: Period (This year, last 12 months or all time); Chain (Every chain with a recorded incident).

## How it will be measured

- An incident is added when its attack transactions are identified on-chain and a public disclosure by the affected team or an investigator confirms it; both are linked from the incident.
- The amount taken is the sum of token and native transfers out of the victim addresses in the attack transactions, valued at oracle or DEX pool prices at the attack block.
- Attacker addresses are those the disclosures name, plus addresses that received funds directly from them; their balances are read at the latest block for the still-held figure.
- Recoveries, bounties and issuer freezes are recorded as their own transactions and are never netted silently from the amount taken.
- Every figure carries a receipt: the blocks and transaction hashes it was summed from and the price reads used to value it.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- Source: Attack transactions, with ERC-20 Transfer logs and native-value traces out of victim addresses in the exploit block range
- Source: Native and token balances of attacker addresses at the latest block
- Source: Chainlink AnswerUpdated rounds or DEX pool reserves at the attack block, for USD values
- Source: Public disclosures and post-mortems by the affected teams, recorded with their date and link

## Questions

### What was the biggest crypto hack this year?

The incidents table sorts the year's hacks by the amount taken, valued at the block of each attack, so the largest one is its first row. Each row links to the attack transactions and to the disclosures behind it.

### How do crypto hacks happen?

Most incidents fall into a few types: compromised private keys or signing setups, smart contract flaws such as reentrancy or faulty access control, price oracle manipulation, phishing of users or staff and insiders removing liquidity. The dashboard groups losses by these types.

### Can stolen crypto be recovered?

Sometimes. Stablecoin issuers can freeze tokens held by attacker addresses, exchanges can block deposits and some attackers return funds in exchange for a bounty. Each recovery appears beside its incident as its own transaction, so the net loss stays visible.

### How are hack losses valued?

Each stolen amount is valued at an on-chain price at the attack block, from oracle feeds or DEX pool prices, so the figure reflects what was taken at that moment. Later price moves change what the attacker holds, which the still-held figure shows separately.

### Where does hack data come from?

The attack transactions, the transfers out of victim contracts and the attacker balances are read from the chains. Which addresses belong to an attacker, and what an incident was, comes from public disclosures, which are recorded with each incident as its sources.

## Glossary

- **Exploit**: An attack that abuses a flaw in a contract's code or configuration to take funds, as opposed to stealing the keys that control them.
- **Attack transaction**: A transaction in which funds leave the victim's contracts or wallets during an incident; its hash is the incident's primary evidence.
- **White-hat bounty**: A share of stolen funds an attacker may keep in exchange for returning the rest, offered by the affected team on-chain or in a public post.

## Related apps

- [Crypto Hacks and Exploits: Monthly Report](https://voltfincrypto.com/apps/crypto-hacks-monthly-report)
- [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Crypto Exchange Hacks: Full List and Losses](https://voltfincrypto.com/apps/crypto-exchange-hacks-list)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F