# Crypto Hacks and Exploits: Monthly Report

> A dated monthly report on crypto hacks, DeFi exploits and rug pulls: what was attacked, how, the amounts lost and where the stolen funds moved on-chain.

Markdown copy of https://voltfincrypto.com/apps/crypto-hacks-monthly-report

**Question:** Which crypto hacks and exploits happened this month, and how much was lost?

- Kind: Report in Voltfin Folio
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Each month brings new exploits: a lending market drained through a price oracle, a bridge key compromised, a token whose deployer pulled the liquidity. This report collects the month's incidents in one dated document, with each loss traced to the transactions that moved the funds.

It is written for people who need the facts quickly and want to check them: security teams, risk desks, journalists and anyone exposed to the protocols involved. Every amount will be cited to its on-chain transactions, so a reader can open the receipt and follow the funds.

## Blueprint

### The month in one paragraph

How many incidents, the total taken and recovered, and the attack that mattered most.

Cites: Incidents this month; Total taken; Total recovered.

### Every incident

Each incident with its date, chain, protocol, attack type, amount taken and the transactions behind it.

Cites: Amount taken per incident.

### How attackers got in

Losses grouped by attack type: code flaws, compromised keys, oracle manipulation, phishing and rug pulls.

Cites: Losses by attack type.

### Where the funds went

The paths stolen funds took through bridges, mixers and exchanges, and what was frozen or returned.

Cites: Funds bridged; Funds frozen or returned.

### What changed

Fixes, audits and policy changes that followed, and the patterns worth watching next month.

## How it will be measured

- An incident enters the report when an attack transaction is identified on-chain and a public source confirms it; both are recorded with the incident.
- Amounts lost are the token amounts that left the victim contracts in the attack transactions, valued at oracle prices at the attack block.
- Fund flows follow the attacker addresses forward through bridges, mixers and exchanges, and stop at labelled addresses.
- The report is dated: every figure is pinned to a block before its publication date, so later movements appear in the next edition.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: Attack transactions and the token transfers out of victim contracts
- Source: Attacker address flows through bridges, mixers and exchanges
- Source: Public incident disclosures by the affected teams, recorded with their source

## Questions

### What counts as a hack or an exploit?

An incident where funds were taken from a protocol, bridge, exchange or wallet without the owners' consent, through a code flaw, a compromised key or a manipulated price. Rug pulls, where insiders remove liquidity, are listed separately.

### How are losses valued?

Each stolen token amount is read from the attack transactions and valued at an on-chain oracle price at the block of the attack, so the value reflects what was taken at that moment rather than today's prices.

### Are recovered funds subtracted?

Recoveries and bounties are shown beside each incident as their own transactions. The headline loss stays the amount taken, and the net figure shows what was not returned.

### Where do stolen funds usually go?

Most attackers swap tokens into a liquid asset, bridge across chains and try to reach mixers or exchanges. The report follows those hops and names the labelled addresses where the trail stops.

## Glossary

- **Oracle manipulation**: Moving the price a protocol reads, often with a flash loan, so it lends too much or liquidates wrongly.
- **Rug pull**: When a token's creators or insiders withdraw its liquidity or dump their holdings, leaving buyers with tokens they cannot sell.

## Related apps

- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)
- [Wallet Drainer Tracker: Phishing Losses by Month](https://voltfincrypto.com/apps/wallet-drainer-tracker)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F