Skip to content

Hall of Hacks — the 20 biggest smart-contract failures on record

$5.67B across 20 incidents, 2016 to 2026. Each one gets the same treatment: a step-by-step account of how the attack actually ran, the real vulnerable code, the one-line difference that would have stopped it, and links to the post-mortems so every word is checkable.

Read them in order and the pattern shows up fast. Almost none of these were exotic cryptography. A missing check, a wrong comparison operator, a default value nobody thought about, a permission nobody revoked.

$5.67B
Lost across these 20
2016→2026
10 years, the same mistakes
7
Distinct failure classes
11
Chains / chain pairs
Vulnerability
Year
Chain

20 of 20 shown

#01 · $1.43B Bybit21 Feb 2025 · Ethereum · Access control 2025 #02 · $624M Ronin Network23 Mar 2022 · Ronin / Ethereum · Access control 2022 #03 · $611M Poly Network10 Aug 2021 · Ethereum + BNB Chain + Polygon · Access control 2021 #04 · $586M BNB Chain Token Hub6 Oct 2022 · BNB Chain · Input validation 2022 #05 · $326M Wormhole2 Feb 2022 · Solana ↔ Ethereum · Input validation 2022 #06 · $291M KelpDAO rsETH18 Apr 2026 · Ethereum ↔ Unichain · Access control 2026 #07 · $223M Cetus Protocol22 May 2025 · Sui · Arithmetic 2025 #08 · $197M Euler Finance13 Mar 2023 · Ethereum · Input validation 2023 #09 · $190M Nomad Bridge1 Aug 2022 · Ethereum ↔ Moonbeam · Input validation 2022 #10 · $181M Beanstalk Farms17 Apr 2022 · Ethereum · Governance 2022 #11 · ~$150M Parity Multisig WalletJul & Nov 2017 · Ethereum · Access control 2017 #12 · $147M Compound Finance29 Sep 2021 · Ethereum · Arithmetic 2021 #13 · $130M Cream Finance27 Oct 2021 · Ethereum · Oracle manipulation 2021 #14 · $128M Balancer v23 Nov 2025 · 8 chains at once · Arithmetic 2025 #15 · $115M Mango Markets11 Oct 2022 · Solana · Oracle manipulation 2022 #16 · $80M Fei Protocol / Rari Capital Fuse30 Apr 2022 · Ethereum · Reentrancy 2022 #17 · $80M Qubit Finance28 Jan 2022 · BNB Chain ↔ Ethereum · Input validation 2022 #18 · $69.3M Curve Finance · Vyper compiler30 Jul 2023 · Ethereum · Compiler / toolchain + Reentrancy 2023 #19 · ~$60M The DAO17 Jun 2016 · Ethereum · Reentrancy 2016 #20 · ~$50M Uranium Finance28 Apr 2021 · BNB Chain · Arithmetic 2021
Check your own contract for this

Every incident here reduces to a pattern the scanner already knows. 201 detectors, run in your browser against your source.

Run the scanner See how it is attacked Read the docs