Smart contract vulnerabilities stories

Oct 6, 2026

Flash loan attacks drained $1.2 billion from DeFi between 2020 and 2024, study finds

Flash loan attacks caused $1.211 billion in losses across 72 incidents between February 2020 and July 2024, representing 18.44% of all DeFi attack losses during the period, according to a study published in the Journal of Financial Crime by University of Winchester researchers. Logic exploits accounted for 55% of losses in the later period, overtaking price manipulation as the primary attack vector.

Oct 6, 20264 sources

Oct 1, 2026

Zano rolls back blockchain 30 days after exploit mints 36.9 million ZANO tokens

Zano executed a one-month blockchain rollback after an attacker exploited a Gateway Address vulnerability to illicitly mint 36.9 million ZANO tokens and 1.8 quadrillion Freedom Dollar (fUSD) tokens. The exploit, which went undetected for approximately 30 days, leveraged missing verification in Gateway Addresses before the network decided to rewind the blockchain to remove the illegitimate supply.

Oct 1, 20264 sources

Sep 18, 2026

Radix blockchain halted for 10 days after $1.3 million exploit from 3-year-old bug

A vault flaw created during a routine code refactor three years ago enabled a $1.3 million theft on the Radix blockchain, forcing validators to halt the network for 10 days. The Radix Foundation disclosed the incident on September 17.

Sep 18, 20261 source

Sep 13, 2026

Chainflip loses $736,000 in USDT after TRON exploit, halts network

Decentralized cross-chain swap protocol Chainflip paused its network after losing 736,442.17 USDT through six unauthorized payouts when an attacker exploited its handling of TRON transaction memos. The protocol has announced users will be made whole.

Sep 13, 20262 sources

Aug 31, 2026

Balancer warns liquidity providers to exit V1 pools after $234,000 drain from rounding bug

Balancer issued a warning on Aug. 31 for liquidity providers to withdraw from its deprecated V1 pools after a fixed-point rounding flaw led to approximately $234,000 being drained. The deprecated pools are non-pausable, leaving withdrawal as the only protection.

Aug 31, 20261 source

Aug 28, 2026

Cosmos EVM vulnerability exploited across six blockchains after four-month delay, draining nearly $6 million

Hackers exploited a critical balance-handling flaw in the Cosmos EVM module to drain funds from six blockchains between August 20-25, 2026. Cosmos Labs had identified the vulnerability affecting approximately 40 blockchains but failed to act for four months before the attacks occurred.

Aug 28, 20262 sources

Aug 19, 2026

Maya Protocol halts network after $1.7 million exploit drains crypto assets

Cross-chain decentralized exchange Maya Protocol suspended its network after an attacker exploited multiple software vulnerabilities to steal approximately $1.7 million in Bitcoin and other cryptocurrencies. The exploit caused the protocol's native CACAO token to plummet 89%.

Aug 19, 20263 sources

Aug 12, 2026

Coreum XRPL bridge loses nearly 200,000 XRP in relayer logic exploit

The Coreum cross-chain bridge connecting to the XRP Ledger was drained of approximately 199,916 XRP on August 9 in under two hours. The attack exploited a flaw in the bridge's relayer logic rather than a vulnerability in the XRP Ledger itself.

Aug 12, 20263 sources

Jul 25, 2026

Across Reveals Sub-$4 Million Net Loss From Solana Relayer Exploit

An attacker exploited a missing eight-byte check in Across Protocol's offchain code to fabricate $41.7 million in Solana deposit events, draining approximately $4 million from a Risk Labs-operated relayer on July 17, 2026. The attack was part of a broader wave of cross-chain bridge exploits that drained over $35 million across multiple protocols within hours.

Jul 25, 20263 sources

Jul 22, 2026

Balance Coin Stablecoin Collapses 99% Following $1 Million Exploit of Bitcoin Reserves

Balance Coin, an algorithmic stablecoin, suffered a catastrophic 99% price collapse after hackers exploited vulnerabilities to drain approximately $1 million from its bitcoin-backed vaults.

Jul 22, 20261 source

May 30, 2026

BY Token Loses $88.4K in BSC Exploit Amid Surge in DeFi Hacks

The BY token project suffered an $88,400 loss through a Binance Smart Chain exploit targeting vulnerable contract logic, occurring during what security firm CertiK identified as the worst month for DeFi exploits in four years with attacks on 27 out of 30 days in April 2026.

May 30, 20262 sources

Top claims

▪Researchers analyzed 20.63 billion transactions across seven blockchain networks, including Ethereum, Base, Optimism, Arbitrum, BNB Chain, Avalanche, and Polygon.
▪A Journal of Financial Crime study found flash loan attacks drained $1.211 billion from decentralized finance platforms across 72 incidents between February 2020 and July 2024, representing 18.44% of $6.568 billion lost across 254 exploits.
▪Flash loan attacks pose an existential threat to decentralized finance

Related timelines