Research / DeFi hacks ledger · H1 2026

DeFi hacks H1 2026: audit coverage and incident data

An evidence-graded incident ledger showing which victims were audited, whether the exploited path was in scope, and how recent the relevant audit was.

WINDOW 2026-01-01 → 2026-06-29 · EVIDENCE-GRADED · ATTRIBUTION PRIMARY-SOURCE-CHECKED · DATASET V1.0

Every verified incident.

incident-explorer.tsv ack3 · dataset v1.0
Protocol / attack Chain Audit coverage Auditor / audit date
2026-01-01 PRXVT Sybil Attack via CREATE2 addresses on staking contract $97K Base audit status n/d —
2026-01-05 TMX Tribe (TMXTribe) Protocol logic / accounting flaw — mint-stake-swap-redeem loop (inflated AUM / GLP pri… $1.40M Arbitrum unaudited —
2026-01-06 Fusion by IPOR EIP-7702 delegation exploit combined with missing fuse validation $336K Arbitrum in scope · report read Protofire 2024/09/06 in scope BlockSec 2025/02/28 outside
2026-01-07 Polycule (PCULE) custodial exit scam / rug pull (claimed as 'hack' by team) $230K Polygon unaudited —
2026-01-08 Truebit Protocol Integer overflow (unchecked addition) in bonding-curve mint pricing $26.44M Ethereum unaudited —
2026-01-20 Makina (Makina Finance) Flash-loan price/oracle manipulation $4.13M Ethereum in scope · hash verified ChainSecurity 2026/05/06 in scope · hash OtterSec 2025/10/29 in scope Sigma Prime 2025/08 in scope Enigma Dark 2025/07 in scope Cantina 2025/10/15 outside
2026-01-20 SynapLogic Input validation bypass with flash loan in token purchase contract $88K Base audit status n/d —
2026-01-21 SagaEVM (Saga / @Sagaxyz__) precompile bridge exploit infinite mint via EVM precompile bridge (fake IBC messages / ICS20 precompile state-ha… $7.00M SagaEVM / Ethereum outside audit scope Code4rena (Zenith / C4 Zenith) 2024/12 outside
2026-01-25 Aperture Finance (Aperture LM) Arbitrary external call abusing pre-existing ERC20/ERC721 token approvals $3.67M Ethereum / Arbitrum / Base outside audit scope Veridise 2023/10/04 outside Narya.ai 2023/07/03 outside Oak Security 2022/06/27 outside Solidified 2022/09/24 outside
2026-01-25 SwapNet (DEX aggregator integrated into Matcha Meta / 0x) arbitrary external call / approvals abuse (unvalidated call target -> transferFrom of … $16.80M Base / BSC / Arbitrum unaudited —
2026-01-27 PGNLZ Burn mechanism exploit / price manipulation — attacker triggered a flawed burn functio… $100K BSC unaudited —
2026-01-28 XPlayer_Media Burn mechanism exploit — attacker called the privileged DynamicBurnPool() function to … $717K BSC unaudited —
2026-01-29 Revert Lend Staked collateral exploit — attacker flash-loaned funds, minted an Aerodrome Slipstrea… $50K Base outside audit scope PeckShield 2024/08/16 outside Hydn Security 2024/02/28 outside Code4rena 2024/05/22 outside Cantina 2026/06/04 outside
2026-01-30 Gyroscope Arbitrary input / cross-chain bridge exploit — attacker called BridgeToken() bridging … $807K Ethereum in scope · report read Nethermind 2024/06/25 in scope Trail of Bits 2022/09/15 outside Runtime Verification 2022/04/27 outside
2026-01-31 Step Finance Private key / treasury wallet compromise (off-chain signing infrastructure) $40.00M Solana audit status n/d —
2026-02-01 CrossCurve (formerly EYWA) spoofed cross-chain message / missing source validation (access control) $3.00M Ethereum / Arbitrum outside audit scope MixBytes 2024/10/10 outside Hexens 2026/03/19 outside SmartState 2025/08/29 outside
2026-02-14 SOF Token Burn-before-sync flaw with flash loan price manipulation $248K BNB Chain audit status n/d —
2026-02-15 Moonwell Lending Oracle misconfiguration / mispricing (price manipulation via faulty cbETH/USD feed) ex… $1.78M Base / Optimism outside audit scope Halborn 2022/02/01 outside
2026-02-20 Veil Cash Misconfigured Groth16 verifier — forged zkSNARK proofs enabling unauthorized withdrawals $6K Base outside audit scope Pashov Audit Group 2025/02/15 outside
2026-02-21 IoTeX ioTube Bridge compromised private key (validator-owner key); malicious Validator contract upgrade by… $8.00M Ethereum / IoTeX audit status n/d —
2026-02-22 YieldBlox (Blend V2 lending pool, Stellar) Price oracle manipulation of a near-zero-liquidity collateral asset (USTRY) to overval… $10.97M Stellar outside audit scope Code4rena 2025/03/17 outside Certora (engaged with Script3) 2025/04 outside Certora 2025/06 outside
2026-02-22 LAXO Token Burn-before-sync flaw with flash loan price manipulation $190K BNB Chain audit status n/d —
2026-02-23 DGLD Infinite mint via phantom L1 deposit exploiting non-standard transferFrom return value… $250K Base / Ethereum outside audit scope Hacken 2026/03/12 outside Halborn 2026/03/16 outside
2026-02-25 Holdstation Supply chain attack — attacker stole developer session token, bypassed 2FA, injected m… $462K World Chain / BSC / Berachain outside audit scope Verichains 2022/10/21 outside
2026-02-26 FOOM Cash (Foom.Cash) Forged zkSNARK (Groth16) withdrawal proofs via misconfigured verifier (delta2 == gamma2) $2.26M Ethereum / Base unaudited —
2026-02-26 Ploutos Money price oracle misconfiguration (BTC/USD Chainlink feed used to price USDC); admin/deplo… $388K Ethereum / Hemi / Arbitrum outside audit scope CredShields 2026/02/12 outside
2026-02-26 Stake Nova Flash-loan exploit via unchecked validation in RedeemNovaSol() function $137K Solana unaudited —
2026-02-28 Wise Lending V2 Flashloan exploit — Protocol Logic $66K Arbitrum / Ethereum scope evidence n/d Code4rena 2024/03/11 scope n/d Hats Finance 2024/02/19 scope n/d
2026-03-02 Curve LlamaLend (sDOLA-long2) Oracle manipulation via donation attack (flash loan + DolaSavings.stake() to inflate s… $241K Ethereum outside audit scope Statemind 2024/02/02 outside MixBytes 2024/09/02 outside ChainSecurity 2025/02/21 outside
2026-03-05 Solv Protocol (SolvBTC BRO Vault) Self-reentrancy double-mint via ERC-3525/ERC-721 onERC721Received callback (missing no… $2.70M Ethereum unaudited —
2026-03-08 Molt EVM (mEVM) Access control bypass: onlySpawnerToken modifier trivially bypassed by deploying a stu… $101K Base unaudited —
2026-03-09 Gondi V3 (PurchaseBundler) Access control bypass in PurchaseBundler.executeSell(): missing borrower identity chec… $230K Ethereum in scope · report read Zenith 2025/02/04 in scope Code4rena 2024/04/16 outside Code4rena (Mitigation Review) 2024/05/24 outside Halborn 2024/05/03 outside
2026-03-10 Aave V3 CAPO Oracle Misconfiguration (configuration error by Chaos Labs risk oracle operator; … $862K Ethereum in scope · report read Certora 2024/03 in scope Trail of Bits 2021/11/29 outside OpenZeppelin 2020/01/15 outside Oxorio 2025/01/29 outside Sherlock 2025/01/22 outside Pashov Audit Group 2025/11/29 outside
2026-03-12 Stake DAO (Votemarket peripheral oracle) Oracle Message Spoofing — peripheral oracle update contract exploited to drain rewards $176K Arbitrum / Base outside audit scope ChainSecurity 2023/01/17 outside Trust Security 2024/09/10 outside Pashov Audit Group 2024/10/24 outside Zach Obront (independent) 2023/05/26 outside
2026-03-14 Goose Finance Share Accounting Flaw $8K BSC outside audit scope Hacken 2021/02/21 outside CertiK 2021/10/12 outside
2026-03-15 Venus Protocol (Core Pool) — THE/Thena market donation attack Donation attack / vToken exchange-rate inflation (supply-cap bypass via direct token t… $3.70M BSC outside audit scope PeckShield 2023/07/18 outside CertiK 2023/08/03 outside OpenZeppelin 2023/08/17 outside Quantstamp 2023/09/18 outside Fairyproof 2023/06/25 outside Code4rena 2023/08/09 outside
2026-03-17 dTRINITY dLEND liquidity-index inflation via flash-loan premium accrual on an empty reserve (Aave V3 … $257K Ethereum outside audit scope Verichains 2024/06/17 outside Halborn 2024/10/04 outside Cyberscope 2024/10/21 outside Hats Finance 2025/08/22 outside Hashlock 2025/10 outside
2026-03-18 Neutrl DNS / frontend hijack (Permit2 wallet-approval phishing via redirected domain) $0 Ethereum outside audit scope Spearbit 2025/08/04 outside Cantina 2025/07/17 outside Sherlock 2025/09/12 outside
2026-03-18 ShiMamaProtocol Missing Access Control $30K BSC unaudited —
2026-03-22 Resolv Labs (USR stablecoin) Compromised privileged signing key (SERVICE_ROLE held in AWS KMS, controlled by a sing… $24.50M Ethereum outside audit scope Pashov Audit Group 2024/12/09 outside Sherlock 2024/12/02 outside MixBytes 2024/12/20 outside Pessimistic 2024/06 outside
2026-03-22 Cyrus Finance (CyrusTreasury) Oracle/price manipulation via flash loan (PancakeSwap V3 spot-price, no TWAP) $5.00M BSC scope evidence n/d CertiK 2025/11/17 scope n/d
2026-03-28 GoonFi Mispricing Arbitrage (Protocol Logic Bug) $254K Solana unaudited —
2026-04-01 Drift Protocol Admin/multisig private key compromise via months-long DPRK social engineering (durable… $285.00M Solana outside audit scope Trail of Bits 2023/02/15 outside Neodyme 2024/05/10 outside Zellic 2022/02/16 outside OtterSec 2023/08/04 outside
2026-04-01 LML/USDT Staking Protocol price manipulation via flash loan $950K BSC unaudited —
2026-04-03 Silo V2 Oracle misconfiguration (immutable wstUSR oracle at stale price ~1.133 vs market ~0.12… $392K Arbitrum in scope · hash verified Certora 2025/04 in scope · hash
2026-04-04 TMM/USDT (BSC) reserve manipulation exploit reserve/price manipulation via flash loans (constant-product AMM reserve donation/burn) $1.67M BSC audit status n/d —
2026-04-09 Aethir (AethirOFTAdapter bridge exploit) Access control exploit (unprotected transferOwnership ownership takeover on cross-chai… $423K BNB Chain / TRON / Ethereum audit status n/d —
2026-04-12 SubQuery Network access control $131K Base in scope · report read Hacken 2022/04/06 in scope SlowMist 2024/02/29 outside
2026-04-13 Hyperbridge (Polytope Labs) Token Gateway / MMR Verifier exploit cross-chain message forgery via forged Merkle Mountain Range (MMR) state proof -> admi… $2.50M Ethereum / Base / BNB Chain outside audit scope Security Research Labs (SRLabs) 2026/05/12 outside
2026-04-13 Dango Perps Protocol logic flaw — insurance fund donation function did not validate amount > 0 (ne… $410K Dango Mainnet / Ethereum outside audit scope Sherlock 2025/09/29 outside Zellic 2025/04/07 outside Informal Systems 2025/03/05 outside
2026-04-14 Zerion Social engineering / employee device & credential compromise (hot wallet drain). AI-en… $100K Unknown outside audit scope Trail of Bits 2020/12/18 outside PeckShield 2020/08/31 outside Cube53 outside Secfault Security outside
2026-04-14 CoW Swap (CoW Protocol) cow.fi domain hijack DNS / domain hijack (registrar-level) leading to frontend phishing / wallet-drainer; N… $1.20M Ethereum outside audit scope Gnosis / G0 Group 2021/05 outside
2026-04-14 MONA (BurnAddress deferred-LP-burn token, BSC) accounting bug / deferred burn LP reserve manipulation $61K BSC unaudited —
2026-04-16 Grinex Hot wallet breach / exchange infrastructure compromise (private key or operational com… $15.00M Tron / Ethereum audit status n/d —
2026-04-16 Rhea Finance (Burrowland / Rhea Lend) protocol logic bug — margin-trading slippage/open-position validation flaw exploited v… $18.40M Near outside audit scope BlockSec 2024/05/22 outside Trail of Bits 2025/02/19 outside Resonance 2025/10/09 outside
2026-04-18 Kelp DAO (rsETH) LayerZero bridge exploit Cross-chain bridge exploit via forged LayerZero v2 message (compromised 1-of-1 DVN / o… $292.00M Ethereum / Unichain / Arbitrum outside audit scope Sigma Prime 2024/11 outside Code4rena 2023/11/15 outside BailSec 2026/05 outside
2026-04-20 Thetanuts Finance First Depositor Attack on vault initialization — attacker mints 1 share, donates large… $50K Ethereum outside audit scope Consensys Diligence 2023/11 outside PeckShield 2022/05/28 outside X41 D-Sec 2021/12/14 outside Halborn 2023/11 scope n/d Zokyo 2022/03 scope n/d Akira Tech 2022/03 scope n/d
2026-04-20 Juicebox V3 borrowFrom spoof / unregistered accounting source (REVLoans extension on Juicebox V3) $52K Ethereum outside audit scope CertiK 2022/03/29 outside PeckShield 2022/04/08 outside Code4rena (Juicebox V3 NFT Delegate, Oct 2022) 2022/10/23 outside Bernd Artmueller (independent — V3 Migration: JBV3Token, JBV3TokenDeployer only) 2023/01 outside Code4rena 2022/10/23 outside
2026-04-21 Volo (Volo Protocol / Volo Vault) — Sui vault exploit private key compromise (privileged admin/operator key) $3.50M Sui / Ethereum outside audit scope Hacken 2023/09/22 outside MoveBit 2023/09/07 outside OtterSec 2023/10/20 outside Veridise 2025/05/02 outside
2026-04-22 Kipseli Output token validation failure / decimals mismatch (USDC 6-decimal quote used as raw … $72K Base unaudited —
2026-04-23 Giddy (GiddyVaultV3) smart contract exploit — authorization bypass / signature replay $1.30M Ethereum audit status n/d —
2026-04-25 Purrlend access control / privileged-role abuse (admin multisig takeover -> BRIDGE_ROLE granted… $1.52M Hyperliquid L1 / MegaETH outside audit scope CD Security 2026/02 outside
2026-04-26 Scallop (Scallop Lend) smart contract exploit (flash-loan-assisted reward drain + oracle/price-feed manipulat… $142K Sui outside audit scope OtterSec 2023/07/15 outside MoveBit 2023/06/30 outside Zellic 2024/04/19 outside Asymptotic 2025/12/02 outside
2026-04-26 ZetaChain GatewayEVM/GatewayZEVM cross-chain exploit smart contract logic flaw (chained access-control + arbitrary-call + unrevoked ERC20 a… $334K Ethereum / BSC / Base in scope · report read Cantina 2025/04/15 in scope Sherlock 2025/07/11 outside
2026-04-26 Litecoin zero-day vulnerability exploitation and DoS/DDoS $0 Litecoin audit status n/d —
2026-04-27 Singularity Finance Oracle Misconfiguration Exploit $413K Base audit status n/d Paladin Blockchain Security 2025/05/30 outside Hacken 2024/05/08 outside
2026-04-28 Judao Flash loan + reserve manipulation (sell-burn reserve manipulation via double sync() in… $228K BNB Chain audit status n/d —
2026-04-28 Quant (DeFi protocol, Ethereum) Access control exploit enabling unauthorized privileged actions $138K Ethereum audit status n/d —
2026-04-28 YieldCore-3rd-deal (RWAVault) Missing ERC4626 caller authorization check — withdraw()/redeem() overrides stripped th… $399K Ethereum unaudited —
2026-04-29 Aftermath Finance (Aftermath Perps) Fee-accounting logic flaw (signed-integer underflow in integrator/builder-code fee acc… $1.14M Sui in scope · report read OtterSec 2025/11 in scope
2026-04-29 Sweat Economy (Sweat Foundation / $SWEAT) Access-control / refund-logic exploit: ungated NEP-141 ft_resolve_transfer callback we… $3.50M Near outside audit scope Hacken 2024/01/19 outside Guvenkaya 2024/01/29 outside
2026-04-29 Syndicate (Commons cross-chain bridge) Bridge contract compromise via leaked upgrade private key (malicious contract upgrade) $380K Base / Ethereum in scope · report read Softstack (softstack GmbH; formerly Chainsulting) 2025/07/09 in scope Softstack 2025/07/09 outside
2026-04-29 QNT Reserve Pool (EIP-7702 exploit) EIP-7702 arbitrary call vulnerability — admin EOA delegated code to BatchExecutor whic… $55K Ethereum audit status n/d —
2026-04-29 Alchemix yvWETH user position drained via malicious unverified-contract approval (~$1M) malicious-contract approval / arbitrary call execution (wallet drainer) $1.00M Ethereum unaudited —
2026-04-30 Wasabi Protocol (Wasabi Perps) admin key compromise (compromised deployer EOA with sole ADMIN_ROLE -> grantRole delay… $5.50M Ethereum / Base / Berachain in scope · report read Zellic 2024/01/09 in scope Sherlock 2024/11/28 in scope Foobar (0xfoobar) 2023/12/17 in scope Narya.ai 2023/04/21 outside
2026-05-01 Bisq Protocol Logic — negative miner-fee validation bypass via modified client $858K Bitcoin unaudited —
2026-05-01 Sharwa.Finance Oracle Price Manipulation via flash loan $33K Arbitrum outside audit scope Pashov Audit Group 2024/06/23 outside
2026-05-04 SmartCredit Flash Loan Exploit $72K Ethereum in scope · report read ImmuneBytes 2024 in scope Pessimistic.io 2022/01/21 outside
2026-05-05 Ekubo Protocol improper access control / unauthorized transferFrom via unvalidated payment callback $1.40M Ethereum / Arbitrum in scope · hash verified Code4rena 2025/12/10 in scope · hash ABDK 2025/04/01 in scope · hash Plainshift 2025/03/17 in scope · hash Nethermind Security 2024/03/22 outside
2026-05-07 TrustedVolumes Access control / authorization bypass (permissionless signer registration in custom RF… $6.70M Ethereum unaudited —
2026-05-10 Renegade Unprotected Initializer Exploit — proxy delegatecall drain $209K Arbitrum outside audit scope ZK Security 2026/01/30 outside
2026-05-11 INK Finance Whitelisted Address Impersonation via logic flaw in Workspace Treasury Proxy authentic… $140K Polygon outside audit scope Salus Security 2023/08/15 outside
2026-05-12 TAC Protocol (TON-EVM cross-chain bridge) cross-chain bridge exploit (TON side) $2.80M TON / TAC audit status n/d —
2026-05-12 Aurellion Labs Uninitialized Diamond Proxy (EIP-2535) exploit — attacker called initialize() on an un… $456K Arbitrum audit status n/d —
2026-05-13 Transit Finance (Transit Swap) deprecated/legacy smart contract exploit (dormant historical vulnerability in a 2022 c… $1.88M Tron / Ethereum unaudited PeckShield outside
2026-05-15 THORChain rogue/malicious node exploiting GG20 threshold signature scheme (TSS) to reconstruct a… $10.70M Bitcoin / Ethereum / BSC in scope · report read Kudelski Security 2020/06/19 in scope Halborn 2021/09/30 in scope Trail of Bits 2021/08/23 in scope Certik 2020/04/20 outside Gauntlet 2020/06 outside IOActive 2020/11/16 outside Zellic 2025/01/27 outside
2026-05-15 ShapeShift FOX Colony Meta-transaction DSAuth self-call authorization flaw — attacker exploited a semantic c… $133K Arbitrum audit status n/d —
2026-05-16 Adshares (WrappedADS / ADS cross-chain bridge) bridge exploit $628K Ethereum audit status n/d —
2026-05-17 MetaSea (SEA Token) Flash Loan + Reward Inflation (Logic Error) $110K Arbitrum audit status n/d —
2026-05-18 Verus-Ethereum Bridge bridge hack $11.50M Ethereum / Verus unaudited —
2026-05-18 Echo Protocol (eBTC) Monad exploit private key / admin-role compromise enabling unauthorized (infinite) token mint $821K Monad outside audit scope Hacken 2025/08/28 outside MoveBit 2024/07/24 outside OtterSec outside Zellic outside
2026-05-19 Bankr (May 19 wallet breach) AI Agent Prompt Injection / Session Permission Abuse $170K Base unaudited —
2026-05-20 RetoSwap (Haveno-fork Monero P2P DEX) — ACK message arbitrator-hijack exploit protocol-logic / authentication flaw (forged out-of-order ACK message frontrunning mul… $2.70M Monero unaudited —
2026-05-20 MAP Protocol / Butter Bridge V3.1 Infinite Mint via abi.encodePacked Hash Collision $110K Ethereum / BSC outside audit scope CertiK 2023/01/05 outside DeHacker 2024/11/15 outside
2026-05-22 Polymarket (UMA CTF Adapter internal top-up wallet) private key compromise (internal operations/top-up wallet drain) $700K Polygon outside audit scope OpenZeppelin 2023/08/16 outside
2026-05-23 StablR (EURR / USDR) minting multisig compromise private key compromise / multisig misconfiguration (threshold 1) leading to unauthoriz… $2.80M Ethereum audit status n/d —
2026-05-25 SquidRouterModule (third-party Gnosis Safe module impersonating Squid) Access-control / authorization bypass in a malicious third-party Gnosis Safe module (e… $3.20M Ethereum / Base unaudited —
2026-05-25 WUSD.fi / GLOVE Sybil Reward Abuse + Flashloan $207K Ethereum audit status n/d —
2026-05-26 Bitmor Access Control Exploit (compromised executor wallet draining DCA contract approvals) $6K Base outside audit scope FailSafe 2026/03/08 outside
2026-05-27 Stake DAO (vsdCRV LayerZero OFT exploit) deployer private key compromise / cross-chain OFT peer reconfiguration leading to unba… $91K Arbitrum outside audit scope ChainSecurity 2023/01/17 outside Trust Security 2026/04/10 outside Omniscia 2025/09/03 outside Pashov Audit Group 2025/08/08 outside Zach Obront 2023/11/22 outside
2026-05-27 Fluid (Instadapp) — off-chain merkle rewards infrastructure compromise off-chain operational/private key compromise of merkle rewards distribution infrastruc… $215K Ethereum outside audit scope PeckShield 2023/11/10 outside StateMind 2023/12/29 outside MixBytes 2024/06/21 outside Cantina 2025/01/07 outside
2026-05-27 Joe Agent Single-function reentrancy $290K BNB Chain audit status n/d —
2026-05-28 DxSale Access control / owner-privilege abuse of an unaudited legacy liquidity-locker contrac… $7.30M BNB Chain outside audit scope CertiK 2022/08/18 outside
2026-05-28 ONTR Token Uninitialized / zero-address owner backdoor (access control exploit) $98K Ethereum audit status n/d —
2026-05-29 Gravity Bridge denom mapping poisoning (permissionless deployERC20 + missing denom-to-ERC20 collision… $5.40M Ethereum / Cosmos in scope · hash verified Code4rena 2021/11/05 in scope · hash Least Authority 2022/04/11 in scope · hash Informal Systems 2021 in scope Certik scope n/d
2026-05-30 Alephium Bridge (Token Bridge) Off-chain backend exploit / forged guardian messages (forged Wormhole VAAs) $815K Ethereum / BNB Chain / Alephium audit status n/d —
2026-05-30 AFI Protocol Protocol Logic / Vault Exploit $480K Ethereum in scope · report read Cantina 2025/07/30 in scope Quantstamp 2025/11/18 outside
2026-05-30 AROS Flash Loan / Price Manipulation $295K BSC audit status n/d —
2026-06-01 Gnosis Pay smart contract exploit — ERC-1271 / EIP-1271 signature verification bypass in Zodiac D… $265K Gnosis Chain outside audit scope G0 Group 2021/09 outside
2026-06-01 TesseraDAO (TSR) Admin-key / ownership takeover -> unauthorized infinite mint and dump $2.50M BSC unaudited —
2026-06-03 ATM Protocol Logic / Tax-on-Transfer Exploit $244K BSC unaudited —
2026-06-05 DTXT Spoofable Liquidity-Addition Detection Logic $35K BNB Chain audit status n/d —
2026-06-07 Syscoin Bridge malformed SPV proof / proof-validation parsing flaw (unauthorized mint) $8.00M Syscoin unaudited —
2026-06-07 Ambient Finance Flashloan Accounting Logic Exploit $110K Ethereum in scope · report read Zellic 2022/08/24 in scope Quantstamp 2023/04/25 in scope
2026-06-08 Humanity Protocol private key / multisig compromise (bridge ProxyAdmin takeover + unauthorized mint) $32.00M Ethereum / BNB Chain audit status n/d —
2026-06-08 Flooring Protocol DN404/BT404 Ghost Ownership / fpToken Infinite Mint $0 Ethereum outside audit scope Halborn 2023/09/08 outside OtterSec 2023/10/04 outside
2026-06-09 Token of Power (TOP) Governance takeover via malicious Aragon DAO proposal (no-timelock single-tx mint), dr… $1.58M Ethereum unaudited —
2026-06-09 Asterix DN404 Forge Loop (ghost ownership — token ID approval reuse in BT404-style accounting) $40K Ethereum unaudited —
2026-06-09 NovaBox Dividend Snapshot Exploit / Flash Loan $107K Ethereum audit status n/d —
2026-06-10 Raydium (legacy AMM V3 / order-book AMM liquidity pools) Fake LP token mint / remove-liquidity validation bypass (logic flaw in deprecated AMM … $1.34M Solana outside audit scope Kudelski Security 2021/05/11 outside OtterSec 2022/11/11 outside MadShield (now OShield) 2023/06/10 outside Halborn 2024/11/11 outside Sec3 2026/04/21 outside
2026-06-10 Secret Network (Axelar IBC bridge / modified CW20-ICS20 contract) Unbacked/infinite mint via forged IBC packets $4.67M Secret / Axelar / Cosmos unaudited —
2026-06-15 Thetanuts Finance Low-supply share-price / index-token mint manipulation via flash loan (integer-divisio… $105K Ethereum outside audit scope PeckShield 2022/05/28 outside Zokyo 2022/03/16 outside Akira Tech 2022/03 outside X41 D-Sec 2021/12/14 outside Consensys Diligence 2023/11 outside Halborn 2024/02/12 outside
2026-06-17 Aztec Connect Private Rollup Bridge (RollupProcessor escapeHatch) exploit escapeHatch function exploit (missing access control + unverified rollup proof / publi… $2.19M Ethereum in scope · report read Solidified 2022/04/10 in scope Sentnl 2022/03/26 outside Sentnl (Sentnlio Ltd) 2022/03/26 outside
2026-06-17 DIP Transfer/Sell Logic Exploit — missing return statement causes double-execution of tran… $111K BSC unaudited —
2026-06-17 Little Boy Plus Unauthorized minting via zero-value transferFrom bypass (logic exploit in LBPHashrate.… $367K BSC unaudited —
2026-06-19 Namada Shielded Pools IBC Transfer Logic Exploit — shielded cross-chain asset sweep from Multi-Asset Shielde… $600K Namada in scope · report read Informal Systems 2024/08/16 in scope Least Authority 2023/07/03 outside Oak Security 2023/03/28 outside
2026-06-19 mySwap CL CL Pool Accounting Manipulation via Fake Token $305K Starknet audit status n/d —
2026-06-20 jaredfromsubway.eth MEV bot reverse/counter-MEV honeypot — fake-token approval drain $7.50M Ethereum unaudited —
2026-06-20 PancakeSwap OLPC/LABUBU pool exploit (BSC) Malicious token logic / deflationary burn reserve manipulation (rug time-bomb) $1.10M BSC unaudited —
2026-06-21 SecondFi (formerly Yoroi Wallet) predictable-private-key / deterministic-nonce signing flaw (Ed25519 secret nonce unset… $2.40M Cardano unaudited —
2026-06-22 Taiko Bridge Forged cross-chain withdrawal proofs via leaked SGX prover signing key $1.70M Taiko / Ethereum outside audit scope OpenZeppelin 2024/06/26 outside QuillAudits 2024/02 outside
2026-06-23 Royalties (Royal.io) ERC1155 zero-amount batch transfer inflates custom tier balance, enabling 100x royalty… $261K Polygon audit status n/d —
2026-06-23 Royal.io Reward Record Stacking via Zero-Value Transfers (Hook/Settlement Logic Manipulation) $261K Polygon audit status n/d —
2026-06-25 Polymarket (front-end supply-chain / phishing drain) Front-end supply-chain attack (compromised third-party JS dependency) leading to walle… $3.10M Polygon / Ethereum outside audit scope ChainSecurity 2024/04/11 outside OpenZeppelin 2023/08/16 outside Cantina 2026/06/03 outside Certora 2026/04/17 outside Quantstamp 2026/05/26 outside Pashov Audit Group 2026/05/03 outside Zellic 2026/03/13 outside
2026-06-25 Lixir Finance Broken EIP-2612 permit signature verification — attacker reused dummy/invalid signatur… $12K Ethereum in scope · report read Haechi 2021/10/27 in scope CertiK 2021/09/12 outside
left stripe marks incidents where the exploited code was in an audit's scope. amounts are best-consensus figures; the 11 unconfirmed reports are excluded from every row and total.

Cite & data

Built to be checked.

The dataset is published with the report. Every number above derives from it at build time, and every attribution carries its primary source. Cite freely with attribution.

cite as

ack3 (2026). DeFi hacks H1 2026: verified incident ledger with evidence-graded auditor attribution, dataset v1.0. https://ack3.ai/research/defi-hacks-h1-2026/ 

@techreport{ack3_defi_hacks_h1_2026,
  author      = {{ack3}},
  title       = {DeFi hacks H1 2026 — why audited projects were still hacked},
  institution = {ACK3 LTD},
  year        = {2026},
  version     = {1.0},
  url         = {https://ack3.ai/research/defi-hacks-h1-2026/},
  note        = {Window 2026-01-01 to 2026-06-29; dataset v1.0, generated 2026-07-01}
}

DATASET V1.0 · GENERATED 2026-07-01 · PUBLISHED 2026-07-24 · WINDOW 2026-01-01 → 2026-06-29 · CC BY 4.0

Data downloads

Corrections

Every row carries its sources; if one is wrong, we want to know. Corrections land with the research team through the contact form and ship as a versioned dataset update.

submit a correction →