Hack history / Defend

What would have stopped them

Each way attackers got in, the controls that answer it, and how to check a control is really in place. Built from 3,121 counted thefts ($35.26B) and public security guidance.

Where the money went Self-check Where to look now What came back What the lists miss Keys, accounts and infrastructure Smart contract bug Phishing and scams Insiders Bridge and cross-chain Price, oracle and governance Review methods Sources

Most thefts are code bugs; most dollars go through keys and accounts.

IN PLAIN WORDSBugs in code happen most often (37% of thefts) but each one is usually small. Stolen keys and hacked machines are rarer, yet they took 47% of all the money. So the biggest wins come from guarding keys, not only from checking code.

Where the money went

Share of dollars stolen

Share of thefts

Keys, accounts and infrastructure 47% of $ · 20% of thefts Smart contract bug 16% of $ · 37% of thefts Phishing and scams 11% of $ · 5% of thefts Insiders: rug pulls, frauds, collapses 11% of $ · 11% of thefts Other 6% of $ · 12% of thefts Bridge and cross-chain 5% of $ · 3% of thefts Price, oracle and governance 4% of $ · 11% of thefts

Bars by year: dollars stolen that year through that way in, scaled per box. Check against an outside count: Chainalysis puts 43.8% of 2024's stolen funds through private key compromise; here keys and accounts hold 33% of 2024, and 65% with signer phishing, where sources file some key thefts (DMM Bitcoin, $305M) as phishing.

Where to look now

IN PLAIN WORDSSome kinds of attack are growing and some are fading. Each line is one control: the hollow dot is how often its kind of attack happened from 2021 to 2024, the filled dot since 2025. Red lines are growing: check those controls first.

Review first: Fuzz or prove the invariants (10.8% → 15.3% of thefts), Access checks on every privileged function (9.9% → 12.8% of thefts), Verify every message and proof (1.6% → 3.9% of thefts), Cross-check oracles, stop on stale (1.3% → 2.5% of thefts), Snapshot votes, timelock proposals (0.7% → 1.8% of thefts)

ControlShare of thefts it answersTheftsDollars*

Fuzz or prove the invariants10.8% → 15.3%7% → 4%Access checks on every privileged function9.9% → 12.8%9% → 2%Verify every message and proof1.6% → 3.9%7% → 6%Cross-check oracles, stop on stale1.3% → 2.5%0% → 0%Snapshot votes, timelock proposals0.7% → 1.8%2% → 1%Reconcile minted vs locked0.0% → 0.9%0% → 5%End access when people leave0.5% → 1.4%2% → 1%Initialise proxies, timelock upgrades0.4% → 1.1%1% → 6%Lock down build, CDN, DNS, scripts4.4% → 4.7%6% → 4%Generate keys offline, in a ceremony0.4% → 0.6%1% → 2%Audit scope matches deployed code5.9% → 6.0%1% → 1%Verify signing on a second device0.2% → 0.2%2% → 24%Cap thin collateral0.3% → 0.2%0% → 2%Keep signing machines clean0.6% → 0.2%2% → 2%Sandbox unsolicited files0.8% → 0.4%2% → 2%Independent bridge signers0.6% → 0.0%1% → 0%Cap the hot wallet2.0% → 1.4%12% → 10%No blind signing1.6% → 0.9%11% → 24%Never share a seed phrase1.4% → 0.5%1% → 0%No spot-pool prices10.7% → 8.7%8% → 2%Check inputs, arithmetic, signatures9.4% → 7.3%11% → 7%Split key control across people and machines14.8% → 12.6%18% → 15%

Base: 1,607 counted thefts from 2021 to 2024, 812 since 2025, insiders left out (the sources stopped listing most rug pulls after 2024, so their fall is coverage, not safety). *Dollars leave out each window's single largest theft (Ronin Bridge, Binance CEX), which would otherwise decide the whole line. Individual phishing is undercounted here: CertiK counted 248 phishing incidents in 2025 against a handful in these lists, so the phishing lines are a floor.

Self-check

IN PLAIN WORDSTick the controls you already have. The first bar shows how much of the money stolen so far went through holes those controls close; the second, how ready you are to catch an attack and get money back. Pick who you are to see only your controls. Your ticks stay in this browser only.

Prevent: past losses answered0%

Detect and respond: ready0%

Prevent boxes carry the dollars of the methods they answer; detect and respond boxes split their way in's share.

What came back

IN PLAIN WORDSAfter a theft, money comes back in four ways: the attacker returns it (often for a bounty), an issuer or exchange freezes it, police seize it, or the platform pays users back. Attackers give money back most often after bridge and cross-chain thefts (5% of them), so a bounty offer is worth having ready. Money taken by insiders comes back in <1% of dollars.

Way inDollars back, as sources stateBackThefts by outcome

Keys, accounts and infrastructure

18%Returned by the attacker 10Frozen 21Recovered or seized 23Users reimbursed 31

Smart contract bug

27%Returned by the attacker 51Frozen 14Recovered or seized 38Users reimbursed 32

Phishing and scams

9%Returned by the attacker 1Frozen 4Recovered or seized 3Users reimbursed 3

Insiders: rug pulls, frauds, collapses

<1%Returned by the attacker 1Frozen 4Recovered or seized 6

Other

7%Returned by the attacker 4Frozen 1Recovered or seized 3Users reimbursed 2

Bridge and cross-chain

44%Returned by the attacker 5Frozen 5Recovered or seized 4Users reimbursed 7

Price, oracle and governance

10%Returned by the attacker 11Frozen 9Recovered or seized 10Users reimbursed 5

$5.99B of $35.26B came back in all, as sources state it (17%). Outcomes are read from source descriptions and are a floor: many returns are never reported back to the lists. Thefts by outcome: incidents whose description names that outcome.

Keys, accounts and infrastructure

The contracts work as written: the attacker holds a key, or a machine or service that can use one. 618 thefts, $16.72B (47% of counted dollars).

Methods, by dollars

Key Leaked via Infrastructure · 39$6.64B

Weak Key Generation · 10$3.64B

Hot Wallet Key Compromised · 60$3.12B

Private Key Compromised · 71$1.25B

Validator Key Compromised · 11$891.6M

Supply Chain Attack · 21$238.7M

Largest cases

Binance CEX 2026 · $6.30BLuBian 2020 · $3.50BRonin Bridge 2022 · $624MCoincheck 2018 · $534M

Controls: prevent, detect, respond

No one machine, person or organisation can move hot funds alone: keys in HSMs or MPC, threshold signers on separate infrastructure.

List every key that can move funds. For each: where it lives, who and what can reach it. Two keys behind one login count as one.

Prevent28.3% of all $393 thefts, $11.92B by the methods it answersExchange or custodianRonin SEAL Security Frameworks CryptoCurrency Security Standard (CCSS)

Keys are generated offline from an audited random source, in a recorded ceremony.

A ceremony record exists for every live key: device, software version, witnesses.

Prevent10.6% of all $12 thefts, $3.71B by the methods it answersExchange or custodianCryptoCurrency Security Standard (CCSS)

The hot wallet holds only what a day of withdrawals needs; the rest is cold.

A written cap for the hot share of reserves, and a daily check against it.

Prevent4.4% of all $60 thefts, $3.12B by the methods it answersExchange or custodianCryptoCurrency Security Standard (CCSS)

Access ends the day a partner, validator or employee leaves.

A signer and access list reviewed every quarter, with the date each entry was last confirmed.

Prevent1.4% of all $23 thefts, $953.3M by the methods it answersProtocol teamRonin

What users load is locked down: build pipeline, dependencies, CDN, DNS and third-party scripts.

Who can change the code served to users, listed; dependencies pinned; DNS registrar locked; third-party scripts reviewed.

Prevent2.7% of all $126 thefts, $941.7M by the methods it answersProtocol teamBlockSec

Outflows from hot wallets above a set amount alert a person at once; withdrawals past a daily limit wait for a second approval.

An alert test in the last quarter reached someone who answered within minutes.

Detect23.7% of all $for all 618 thefts this way inExchange or custodianHypernative

Freeze contacts are arranged before they are needed: stablecoin issuers, the large exchanges, SEAL 911.

A contact sheet with named people, confirmed this quarter; one drill sending a freeze request.

Respond23.7% of all $for all 618 thefts this way inExchange or custodianSecurity Alliance BlockSec

Smart contract bug

The contract does what its code says, and the code allows the theft. 1,170 thefts, $5.56B (16% of counted dollars).

Methods, by dollars

Improper Access Control · 143$1.28B

Arithmetic Error · 34$504.2M

Signature Verification Flaw · 14$422.9M

Proxy Upgrade Hijack · 6$420.5M

Reentrancy · 64$387M

Donation Attack · 16$368.7M

Largest cases

Poly Network 2021 · $611MPortal 2022 · $326MDrift Trade 2026 · $285MCetus CLMM 2025 · $223M

Audits

Of 158 code-bug thefts whose audit status a source states, 67 had no audit, 46 were hit in code the audit did not cover, 43 were audited with the scope not stated, and 2 in audited code. Audit scope matters as much as the audit.

Controls: prevent, detect, respond

Every function that moves funds or changes roles checks who calls it.

A list of privileged functions with a test per function that a stranger's call reverts.

Prevent4.4% of all $276 thefts, $1.43B by the methods it answersProtocol teamOWASP Smart Contract Top 10 (2025)

Invariants (solvency, supply, share price) are written down and fuzzed or proven on every function that changes a balance.

An invariant suite runs in CI; each balance-changing function is covered.

Prevent3.1% of all $314 thefts, $1.02B by the methods it answersProtocol teamEuler

The audit covers the code that ships, including upgrades and new modules; changed code is reviewed again.

The deployed bytecode matches the audited commit; a diff since the last audit is empty or reviewed.

Prevent0.7% of all $166 thefts, $237.1M by the methods it answersProtocol teamfrom the data

Proxies are initialised in the deploy transaction; upgrades go through a timelock and a multisig.

No proxy is left uninitialised; the upgrade admin is a timelocked multisig.

Prevent1.9% of all $17 thefts, $619.2M by the methods it answersProtocol teamOWASP Smart Contract Top 10 (2025)

Inputs, signatures and arithmetic are checked at the edges: rounding, decimals, replay, reentrancy.

Tests for zero, maximum and one-wei values; reentrancy guards on external calls; signatures bound to chain and nonce.

Prevent5.7% of all $223 thefts, $1.87B by the methods it answersProtocol teamOWASP Smart Contract Top 10 (2025)

On-chain monitoring is wired to a pause: a narrow guardian role can pause, only governance can unpause.

A simulated attack on a fork trips the pause; the guardian wallet holds gas.

Detect7.9% of all $for all 1,170 thefts this way inProtocol teamForta Hypernative

A whitehat Safe Harbor or bounty offer is published before any attack, so a rescuer or an attacker has a set way to return funds.

The terms and the return address are public and fixed in advance.

Respond7.9% of all $for all 1,170 thefts this way inProtocol teamSEAL Whitehat Safe Harbor (adopted e.g. by Inverse Finance

Phishing and scams

A person is led to approve, run or reveal something: a signer, an employee, a holder. 160 thefts, $4.05B (11% of counted dollars).

Methods, by dollars

Signer Phishing · 5$1.70B

Phishing · 30$1.06B

not stated · 66$555M

Malware · 12$332.3M

Scam · 12$221.4M

Phishing attack · 15$70M

Largest cases

Bybit 2025 · $1.46BFTX 2022 · $477MDMM Bitcoin 2024 · $305MCrypto holder loses $283 million to scammer impersonating wa 2026 · $282M

Controls: prevent, detect, respond

Signers check what they sign on a second, independent device and compare the transaction hash across two interfaces.

A signing runbook that names the two interfaces; a drill where one shows a tampered transaction and signers must refuse.

Prevent2.8% of all $5 thefts, $1.70B by the methods it answersExchange or custodianSEAL Security Frameworks BlockSec

No blind signing: a transaction the hardware wallet cannot decode is simulated first or refused.

Signing devices show decoded calls for every contract you use; the simulation step is logged.

Prevent6.4% of all $35 thefts, $2.76B by the methods it answersExchange or custodianHacken

Machines that sign or deploy do nothing else: no email, no browsing, no code from a job interview.

Signing and deploy machines are listed and separate from daily work machines.

Prevent0.6% of all $12 thefts, $332.3M by the methods it answersProtocol teamInfosecurity SEAL Security Frameworks

Unsolicited files, test tasks and npm packages from recruiters or contacts run only in a sandbox.

A written rule and a sandbox staff actually use; a phishing exercise once a year.

Prevent0.6% of all $16 thefts, $335.1M by the methods it answersProtocol teamInfosecurity

Support never asks for a seed phrase or a transfer: check every request on the official channel you already know.

Holders of large sums keep them in a wallet that needs a second device or person to move.

Prevent1.2% of all $41 thefts, $347.5M by the methods it answersHolder or investorfrom the data

Signing requests from a new device, at an odd hour or to a new destination need a second approver.

Policy rules in the signing platform, and a log of the requests they stopped.

Detect5.7% of all $for all 160 thefts this way inExchange or custodianSEAL Security Frameworks

A theft is reported within hours to the exchange the funds reached, the stablecoin issuer and the police: freezes need speed.

Victims know where to report; the first report goes out the same day.

Respond5.7% of all $for all 160 thefts this way inHolder or investorBlockSec

Insiders: rug pulls, frauds, collapses

The people who run it take the money: a rug pull, an admin drain, an exchange that stops paying out. 349 thefts, $3.92B (11% of counted dollars).

Methods, by dollars

Scam · 4$2.53B

Rug Pull · 244$688.4M

not stated · 48$339.8M

Admin Drain · 21$180.8M

Liquidity Rug · 9$69.8M

Unknown · 1$56.5M

Largest cases

Thodex 2021 · $2.50BLIBRA 2025 · $250MFreeway halts withdrawals, accused of $160 million rug pull 2022 · $160MArgentinian president Javier Milei promotes memecoin that th 2025 · $107M

Controls: prevent, detect, respond

Before buying, read what the owner can do: mint, pause, blacklist, change fees, withdraw pool funds.

The contract is verified on the explorer and its owner functions are read; a clean scanner result is not proof.

Prevent1.4% of all $274 thefts, $907.6M by the methods it answersHolder or investorTrust Wallet

Pool liquidity is locked with a known locker, for most of the pool and well past your horizon.

Lock share, lock contract and expiry are checked, not only that a lock exists.

Prevent1.3% of all $253 thefts, $758.3M by the methods it answersHolder or investorTrust Wallet

Admin powers sit behind a timelock and a multisig whose signers are public.

Any admin action is visible on chain days before it takes effect.

Prevent0.4% of all $34 thefts, $227.1M by the methods it answersProtocol teamSEAL Security Frameworks

Do not keep more on any exchange than you need there; halted or delayed withdrawals are a signal to act.

Exchange balances above a set amount are moved to a wallet you control.

Prevent8.0% of all $4 thefts, $2.53B by the methods it answersHolder or investorfrom the data

Records are kept (deposits, messages, addresses) and reported early; money taken by insiders rarely comes back.

Deposit records and the platform's terms are saved where you can find them.

Respond11.1% of all $for all 349 thefts this way inHolder or investorfrom the data

Bridge and cross-chain

Funds locked on one chain are released on another on a message the bridge should not have trusted. 94 thefts, $1.69B (5% of counted dollars).

Methods, by dollars

Proof Verifier Bug · 4$572.8M

Unbacked Cross-Chain Mint · 7$334.4M

Cross-Chain Message Spoofing · 7$308.4M

Forged Proof · 19$270.5M

Unknown · 3$113.3M

Bridge Logic Flaw · 17$34.7M

Largest cases

Binance Bridge 2022 · $570MLiquid Network 2026 · $320MKelp 2026 · $292.5MNomad 2022 · $190M

Controls: prevent, detect, respond

Validators or signers are independent operators; no organisation holds enough keys to sign alone.

The signer set with each operator named; the threshold is above what any one operator controls.

Prevent0.3% of all $9 thefts, $113.3M by the methods it answersProtocol teamRonin

Every message and proof is checked against the source chain; a message that never happened there is rejected.

Tests with forged, replayed and empty proofs; the trusted root can never be zero.

Prevent3.5% of all $63 thefts, $1.19B by the methods it answersProtocol teamfrom the data

Wrapped supply is reconciled against locked collateral, and large withdrawals are capped or delayed.

An alert when minted value exceeds locked value; a per-hour withdrawal limit.

Prevent1.0% of all $7 thefts, $334.4M by the methods it answersProtocol teamfrom the data

Releases on the destination chain are matched to deposits on the source chain as they happen; a mismatch pauses the bridge.

A reconciliation job with an alert, and a test release with no deposit behind it that it catches.

Detect2.4% of all $for all 94 thefts this way inProtocol teamfrom the data

Freeze contacts on both chains are arranged in advance: issuers, exchanges, SEAL 911.

A contact sheet per chain, confirmed this quarter.

Respond2.4% of all $for all 94 thefts this way inProtocol teamSecurity Alliance BlockSec

Price, oracle and governance

The code is correct; the price, vote or market it trusts is moved within a block or two. 346 thefts, $1.34B (4% of counted dollars).

Methods, by dollars

Spot Price Manipulation · 134$839.9M

Flashloan Governance Attack · 5$187.9M

Market Maker Bot Exploited · 1$100M

Malicious Proposal · 18$59.3M

Stale Oracle Price · 8$31.6M

Governance Attack · 2$30M

Largest cases

Beanstalk 2022 · $182MCREAM Lending 2021 · $130MMango Markets V3 2022 · $115MBitget 2025 · $100M

Controls: prevent, detect, respond

Prices never come from one pool's spot reserves: use a time-weighted average or an aggregated feed.

Every price read is listed with its source; none reads current reserves.

Prevent2.7% of all $251 thefts, $1.04B by the methods it answersProtocol teamOWASP Smart Contract Top 10 (2025) Uniswap docs CertiK

Two price sources are cross-checked; stale, zero or sharply jumping prices stop the action.

Staleness and deviation limits are set per feed and covered by tests.

Prevent0.2% of all $46 thefts, $66.3M by the methods it answersProtocol teamCertiK

Votes are counted from a snapshot before the proposal, and passed proposals wait in a timelock.

A fork test: borrow voting power in one transaction and try to pass and execute a proposal. It must fail.

Prevent0.5% of all $27 thefts, $278.9M by the methods it answersProtocol teamOWASP Smart Contract Top 10 (2025)

Borrowing against thinly traded collateral is capped.

A per-asset cap tied to the liquidity actually available on markets; reviewed when liquidity falls.

Prevent0.4% of all $9 thefts, $126.6M by the methods it answersProtocol teamfrom the data

Sharp price moves or votes cast with borrowed power trip a circuit breaker on borrowing and execution.

Thresholds per market, and a fork test that trips them.

Detect1.9% of all $for all 346 thefts this way inProtocol teamForta

A bounty and negotiation channel is ready, with an on-chain message to the attacker in the first hour.

A prepared message, a bounty figure agreed in advance, a person who can send it.

Respond1.9% of all $for all 346 thefts this way inProtocol teamSEAL Whitehat Safe Harbor (adopted e.g. by Inverse Finance

What these lists miss: phishing of individuals

IN PLAIN WORDSMost phishing steals from one person at a time, so it rarely makes the hack lists this data comes from. A firm that watches wallet-drainer sites counts far more. The top bar is their count, the bottom bar is ours: the gap is what this page cannot see.

Scam Sniffer: wallet drainers on EVM chains

This dataset: phishing of individuals

2023

$295.5M · 324,000 victims

$61M · 23 incidents · 10 of $1M+

report

2024

$494M · 332,000 victims · 30 cases of $1M+

$96.5M · 12 incidents · 6 of $1M+

report

2025

$83.8M · 106,106 victims · 11 cases of $1M+

$96.5M · 8 incidents · 4 of $1M+

report

The two do not count the same thing: Scam Sniffer counts drainer signatures on EVM chains (no address poisoning, no fake support), this dataset counts the cases the hack lists carry, on any chain. Some of ours are theirs (the $55.5M setOwner theft of August 2024 is in both). Scam Sniffer publishes yearly totals and a few cases dated by month, with no reuse licence, so they are shown here as a reference and not added as incidents. Their 2025 drop (−83%) is their finding, not ours.

Review methods and what they cover

IN PLAIN WORDSDifferent checks catch different holes. A code audit cannot see a stolen key, and a key review cannot see a bug. Pick checks so every coloured column has a dot.

Method	Keys	Smart	Phishing	Insiders:	Other	Bridge	Price	Past $ in reach
Code audit, scope matched to the deployed code	·		·	·	·			24%
Invariant fuzzing or formal verification	·		·	·	·			24%
Fork test of flash loan and oracle attacks	·	·	·	·	·	·		4%
Key inventory and key ceremony review		·	·	·	·		·	52%
Signing drill with an independent second check		·		·	·	·	·	59%
Access review: staff, partners, CI and hosting		·	·		·		·	63%
Phishing and red-team exercise		·		·	·	·	·	59%
On-chain monitoring with a pause runbook			·	·	·			72%
Owner powers and liquidity lock read	·	·	·		·	·	·	11%

Past $ in reach: the counted dollars of the ways in the method looks at. It is an upper bound: a method in reach of a hole still has to be done well to find it.

Sources and limits

Losses and methods are this dataset's counted thefts, with each method as the first source names it; a control's dollars are the losses of the methods it answers, split between controls that answer the same method. Detect and respond controls split their way in's share evenly and count toward the second score. A control marked "from the data" is this site's reading of repeated cases, without an outside standard behind it. Guidance is general: it is not an audit of any system and does not promise a control would have stopped a given theft.

Cite this page

SwanBluechip, "What would have stopped them", Crypto hack history, https://swan-hack-tracker.pages.dev/history/defend/ (data as of 2026-10-31).

All incidents Dataset How sure