Continuously maintained research ledger

Hall of Hacks

Search the public record of major crypto exploits, compare losses and attack methods, and trace the phishing campaigns that follow a breach.

Updated · Nightly source refresh

Latest record

Mercado Bitcoin

$40M

Technique
Unknown
Coverage
Merged archive
Total recorded losses
$56.23B
Incident records
2,786
Incidents in 2026
332

Incident archive

Search the record

Search documented incidents by protocol, chain, attack type or year.

Showing 12 of 2,786 incidents

Mercado Bitcoin

Chains: Bitcoin, Ethereum, Solana, TRON, Polygon, Arbitrum, Avalanche, BNB Chain, Stellar, XDC

Protocol Logic

Unknown

$40M

Returned funds not reported

Premia V3

Chains: Arbitrum

Protocol Logic

Withdrawal Logic Flaw

$437K

Returned funds not reported

BTCPay Server

Chains: Bitcoin, Litecoin

Frontend & Infrastructure

Key Leaked via Infrastructure

Not reported

Returned funds not reported

Troves

Chains: Unknown

Access Control

Improper Access Control

$666.9K

Returned funds not reported

b14g

Chains: CORE

Protocol Logic

Unknown

Not reported

Returned funds not reported

Binance CEX

Chains: Ethereum, Bitcoin, TRON, Avalanche, Optimism, Arbitrum, Base

Frontend & Infrastructure

Key Leaked via Infrastructure

$6.36B

Returned funds not reported

Polymarket International

Chains: Polygon

Frontend & Infrastructure

Supply Chain Attack

$2.7M

Returned funds not reported

zkLink Nova

Chains: Ethereum

Bridge & Cross-Chain

Cross-Chain Message Spoofing

$783.1K

Returned funds not reported

Hifi Finance

Chains: Ethereum

Governance

Malicious Proposal

Not reported

Returned funds not reported

Fence Finance

Chains: Avalanche

Token & Share Accounting

Incorrect Share Accounting

$1.01M

Returned funds not reported

Predict Fun

Chains: BNB Chain

Frontend & Infrastructure

Frontend Compromise

$400K

Returned funds not reported

Zilliqa X-Bridge

Chains: Zilliqa

Key Compromise

Private Key Compromised

Not reported

Returned funds not reported

Archive analysis

Where losses concentrate

Rankings are recalculated from the same merged records shown above.

Leading chains and categories

Most reported techniques

Methodology

One durable record, two source layers

Preserved history
The 1,971-record MistTrack archive remains the historical baseline. MistTrack-only incidents are never deleted.
Nightly freshness
The DefiLlama hacks API extends DeFi coverage and refreshes technique and returned-funds fields.
Conservative merge
Records match on normalized project name and incident date within three days. Historical conflicts retain MistTrack values.
Phishing correlation
105,989 post-incident impersonation domains are linked across 260 affected projects. Matches use flagged project brands and incident dates.

Data sources: DefiLlama Hacks API and the preserved MistTrack incident archive. PhishDestroy merges, validates, and enriches the public record; source-only incidents remain intact.

Related Research

Crypto Security Essentials
Essential protection against drainers, fake support, and common wallet traps.
$100K Malvertising Recovery
Wallet access restored and $100K+ returned after a malvertising and stealer attack.
Critical Action Guide
Emergency steps and trusted services for when you have been compromised.