DeFi Security
DeFi exploit intelligence
Every figure on this page is computed from the records stored in this site. Nothing is fetched live, and unknown values are shown as unknown.
Totals
Data last updated 2026-10-19Published records
15
Incidents with a stored, reviewed record. Drafts are not counted.
Indexed by search engines
13
Records with a verified root cause and at least one source. The rest are published but marked noindex.
With PoC metadata
5
A public test or reproduction entry is recorded as text. We have not run any of them, and an entry is not proof anything is exploitable.
With transaction proof
4
At least one transaction we checked against a public chain node.
Reported USD loss
$354M
Sum of USD figures stated by the cited sources, for 15 of 15 records. Each figure keeps its source's own pricing, unknown losses are left out, and it is not a market total.
Reported USD recovered
$282M
Source-stated USD recoveries for 5 of 15 records. Recoveries are never netted against losses.
Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
By chain
All chains
Ethereum8
BNB Chain3
Starknet2
Base1- Robinhood Chain1
NEAR1- Meter1
- Neutron1
- Cosmos Hub1
- Rootstock1
Hemi1- Liquid1
An incident touching two chains counts once for each.
By vulnerability class
Taxonomy- Bridge and cross-chain verification4
- Oracle and spot-price manipulation3
- Flash-loan amplification3
- Access control and caller trust3
- Accounting and share-price errors2
- Governance takeover2
- Liquidation and collateral logic2
- Business logic flaws1
- Reentrancy1
- Arithmetic, overflow and rounding1
Classes come from each record's root cause, never from its title. An incident can carry more than one.
Most recent incidents
Search and filter all records2026-10-15 · reported loss $3K (2.31 ETH)
KolanHook: an unbounded buyback settled at a manipulated spot priceIndependent analysisPoC metadata recorded1 transaction proof(s)
2026-10-14 · reported loss $808K
UNCX Vesting V2: share records and token balance made to disagreeOfficial statementPoC metadata recorded1 transaction proof(s)
2026-10-01 · reported loss $305K (114.09 ETH)
FlashLoopAdapter: a spoofable caller check in a Safe moduleIndependent analysisPoC metadata recorded1 transaction proof(s)
2026-09-29 · reported loss $3.8M
NEAR Intents: ghost funds from a deposit notification bugOfficial statement
2026-09-24 · reported loss $2.8M
Limit Break Payment Processor V2: forged sender through a trusted forwarderIndependent analysis
2026-09-24 · reported loss $1.92M
Payy: a forged zero-knowledge proof accepted by the bridge verifierOfficial statement
Recently updated
- KolanHook: an unbounded buyback settled at a manipulated spot price2026-10-19
- UNCX Vesting V2: share records and token balance made to disagree2026-10-19
- FlashLoopAdapter: a spoofable caller check in a Safe module2026-10-19
- NEAR Intents: ghost funds from a deposit notification bug2026-10-19
- Limit Break Payment Processor V2: forged sender through a trusted forwarder2026-10-19
Open items
All alerts- Liquid peg-outs suspended; gap of about 600 BTC
- UNCX: under review with counsel; loss tallies disagree
- Term Finance: distributions planned for 2 October and 15 December 2026
Written analysis
All analysis- DeFi hacks, September 2026: the worst month of the year, read through the post-mortems
- Symbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC
- The $20,000 problem: when a protocol's input is cheaper than what it controls
- Unbacked mints: five 2026 incidents, one question the code forgot to ask
Method
Records are written by ThreatWire from primary sources where they exist, then checked against public chain data for the transactions and addresses we show. Evidence is labelled per record: confirmed on-chain, official statement, independent analysis, repository claim or unverified. Public test and reproduction metadata comes from the open DeFiHackLabs dataset (Apache-2.0) and is kept as plain text. We never run it. Details are on each record and in the repository NOTICE file.