The crypto theft dataset

This release 2026-11-01 13:39 UTC

Released daily at 21:20 UTC, and within the hour when a theft of $10M or more is new or newly confirmed. Ids are stable: an id is never reused, and one merged into another incident stays resolvable through /data/id-aliases.json.

Coverage, year by source

Agreed $: share of the year's counted dollars that two or more sources report with the same date and loss. Target known: share of incidents whose target a source states or DefiLlama's protocol list matches (not estimated). DeFiHackLabs, a source with a reproduced exploit for each incident, is counted but not linked. ack3 covers January to June 2026 only.

What changed 12 releases with changes

The full log: /data/changelog.json. Each entry lists every incident added (id, date, name, kind, loss, grade), every id merged away with the id it points to now (into), and for each changed incident the old and new value of date, name, kind, loss, grade, source count, target class and whether it is counted.

Keeping a copy in sync

# Python: apply the releases you have not seen yet to a local copy keyed by id
import requests
base = "https://swan-hack-tracker.pages.dev"
log = requests.get(base + "/data/changelog.json").json()
new = [x for x in log if x["released"] > last_seen]          # last_seen: the release you synced last
full = {r["id"]: r for r in requests.get(base + "/hacks.json").json()["rows"]}
for x in new:
    for m in x["removed"]:
        mine.pop(m["id"], None)                               # merged away: m["into"] holds it now
    for r in x["added"] + x["changed"]:
        mine[r["id"]] = full[r["id"]]                         # take the current row
aliases = requests.get(base + "/data/id-aliases.json").json() # resolve ids you stored before a merge
last_seen = log[-1]["released"]

The log covers releases from 2026-10-31 15:57 UTC, when ids took their current form; for anything older take the full file. One incident by id, with merged ids resolved: /api/incidents?id=<id>.

Licences and citation

Kept out of the public files: attack transactions, attacker and contract addresses, and exploit code. The merged figures, grades, classes and checks are this site's work; cite them as below.