How sure are these numbers?

How sure, by dollars and by count 3,140 counted thefts, $35.33B

Big thefts are checked more often than small ones, so the dollar squares are greener than the count squares. Counted: hacks, exploits, phishing, scams and rug pulls with a loss in money taken; see not counted for the rest.

The four checks

From reports to incidents all kinds

Attack transactions checked: 823, confirmed 811, contradicted 6 (a block date more than 30 days from the incident date sends it to review). A transaction no public node returns counts as unconfirmed, never as false.

Year by year

Taken: the figure used for each theft (the median when three or more sources give one). Range: the sum of every theft's lowest and highest dollar figure at the time across sources. Percentages are shares of that year's dollars. Bar colours as in the squares above.

What was attacked target known for 88% of incidents

From the sources' own target field where they give one, else SlowMist's category pages, Web3 Is Going Great's tags, the kind of incident (phishing and scams take from people) or the source (DeFiHackLabs and rekt.news cover contract exploits). Each incident's page names which. Bridges filed as DeFi protocols are counted as bridges.

Where sources disagree the most by the dollar gap

Dots on a log scale: each source's own figure (hollow: a coin amount priced at the time here, or the rekt.news leaderboard); the bar is the figure used. With three or more figures the median is used, with two the first source in the order DefiLlama, SlowMist, DeFiHackLabs, Web3 Is Going Great, rekt.news, so no number is invented. Every incident with a gap over 25% is grade B and in the list as such.

Not counted in the stolen total

Review queue 268 incidents

An incident can carry more than one reason. Filter the list by "In review" to see each one. Nothing is typed in by hand to clear a flag.

How a release is made

Run

Every source is read again, merged and checked; nothing is edited by hand except attribution notes, each tied to an official statement.

Gate

No blocking failure, and at least 99% of incidents must come out the same as the last release. This release: 100.00%.

Kept private

Attack transactions, attacker and contract addresses and exploit code stay in the private database; the public file says only whether a transaction was confirmed.

Updated

2026-11-01 08:49 UTC, daily.

Terms, for analysts and traders

Grade A, B, C

Like a rating for each number. A: two or more sources agree within 3 days and 25%. B: two or more sources, but they disagree. C: one source.Not a rating of the project, only of how well its loss is documented.

Source

An independent public list of incidents, like a wire service. Two lists citing the same blog post still count as two.DefiLlama, SlowMist Hacked, Web3 Is Going Great, rekt.news, DeFiHackLabs, ack3 (Jan to Jun 2026).

Loss

US dollars at the time of the theft, as the sources state it; not today's value of the stolen tokens.Coin amounts with no dollar figure are priced at the day's price and marked.

Range

The lowest and highest dollar figure any source gives, like the spread between analysts' estimates.A wide range is usually face value against money actually taken.

Median

With three or more figures, the middle one: one outlier cannot move it.With two figures, one source's own figure, never an average.

On chain

The attack transaction itself, read from the chain's public nodes: the settlement record, not a report about it.Confirmed when the block date is within 30 days of the incident.

Face value

Tokens an attacker created out of nothing, priced at market. They could never all be sold, so they stay out of totals.Listed and flagged, never deleted.

Counted

In the stolen total: hacks, exploits, phishing, scams and rug pulls, with money taken, one incident each, not resting on one source for $500M or more.Collapses, frauds and mistakes are kept and counted apart.