Continuously maintained research ledger

Hall of Hacks

Search the public record of major crypto exploits, compare losses and attack methods, and trace the phishing campaigns that follow a breach.

Updated · Nightly source refresh

Latest record

Nostra Money Market

$3.5M

Technique
Spot Price Manipulation
Coverage
Merged archive
Total recorded losses
$49.22B
Incident records
2,718
Incidents in 2026
269

Incident archive

Search the record

Full server-rendered archive. Filters enhance the existing HTML.

Showing 12 of 2,718 incidents

Nostra Money Market

Chains: Starknet

Oracle Manipulation

Spot Price Manipulation

$3.5M

Returned funds not reported

Flamincome

Chains: Ethereum

Oracle Manipulation

Spot Price Manipulation

$595K

Returned funds not reported

Startale

Chains: Ethereum

Access Control

Improper Access Control

$2.9K

Returned funds not reported

Chainflip AMM

Chains: Tron

Bridge & Cross-Chain

Bridge Logic Flaw

$736.4K

Returned funds not reported

ether.fi Liquid

Chains: Ethereum

Access Control

Arbitrary External Call

$43.3K

Returned funds not reported

Symbiosis

Chains: BSC, Ethereum

Bridge & Cross-Chain

Unbacked Cross-Chain Mint

$336K

Returned funds not reported

Dominion

Chains: Solana

Key Compromise

Private Key Compromised

Not reported

Returned funds not reported

Nomic

Chains: Nomic

Bridge & Cross-Chain

Unbacked Cross-Chain Mint

$3.15M

Returned funds not reported

Zentra Finance

Chains: Citrea

Token & Share Accounting

Rounding Error

$140K

Returned funds not reported

BeatXswap

Chains: BSC

Oracle Manipulation

Spot Price Manipulation

$77.5K

Returned funds not reported

WealthManagementV2

Chains: BSC

Key Compromise

Private Key Compromised

$26.4K

Returned funds not reported

Cozy V2

Chains: Optimism

Protocol Logic

Unknown

$163.3K

Returned funds not reported

Archive analysis

Where losses concentrate

Rankings are recalculated from the same merged records shown above.

Leading chains and categories

Most reported techniques

Methodology

One durable record, two source layers

Preserved history
The 1,971-record MistTrack archive remains the historical baseline. MistTrack-only incidents are never deleted.
Nightly freshness
The DefiLlama hacks API extends DeFi coverage and refreshes technique and returned-funds fields.
Conservative merge
Records match on normalized project name and incident date within three days. Historical conflicts retain MistTrack values.
Phishing correlation
93,147 post-incident impersonation domains are linked across 248 affected projects. Matches use flagged project brands and incident dates.

Data sources: DefiLlama Hacks API and the preserved MistTrack incident archive. PhishDestroy merges, validates, and enriches the public record; source-only incidents remain intact.

Related Research

Crypto Security Essentials
Essential protection against drainers, fake support, and common wallet traps.
$100K Malvertising Recovery
Wallet access restored and $100K+ returned after a malvertising and stealer attack.
Critical Action Guide
Emergency steps and trusted services for when you have been compromised.