Incidents by year
Crypto hacks and exploits in 2026
165 incidents in 2026.
October 2026 (40)
- Crypto hacks and exploits in October 2026
- zkLink Nova exploit (Oct 2026): $783K — 2026-10-29 · loss $783K · OAK-T10.002 Message-Verification Bypass
- Polymarket hack (Oct 2026): $2.5–2.7M — 2026-10-29 · loss $2.5–2.7M · OAK-T15.002 Supply-Chain / Vendor-Pipeline Compromise
- Binance hack (Oct 2026): $6.3B — 2026-10-29 · loss $6.3B · OAK-T13.004 EIP-7702 Delegation Abuse
- TranchePool exploit (Oct 2026) — 2026-10-28 · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Hifi Finance exploit (Oct 2026): $1M — 2026-10-28 · loss $1M · OAK-T16.002 Hostile-Vote Treasury Drain
- Predict.fun hack (Oct 2026) — 2026-10-27 · OAK-T15.002 Supply-Chain / Vendor-Pipeline Compromise
- Bloom Trading hack (Oct 2026): $947K — 2026-10-26 · loss $947K · OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- Unnamed trading Safe exploit (Oct 2026): $7.45M — 2026-10-26 · loss $7.45M · OAK-T9.004 Access-Control Misconfiguration
- Yapeswap exploit (Oct 2026): $21.9K — 2026-10-25 · loss $21.9K · OAK-T9.003 Governance Attack
- X100 exploit (Oct 2026): $4.85M — 2026-10-24 · loss $4.85M · OAK-T16.001 Vote Takeover via Flash-Loan
- Kimchi hack (Oct 2026): $385K — 2026-10-23 · loss $385K · OAK-T3.004 Influencer-Amplified Promotion-and-Dump
- Initia exploit (Oct 2026): $2.7M — 2026-10-23 · loss $2.7M · OAK-T7.001 Mixer-Routed Hop
- WAX Multi-Chain Bridge exploit (Oct 2026): $90.5K — 2026-10-22 · loss $90.5K · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- NEM exploit (Oct 2026): $821,920 — 2026-10-21 · loss $821,920 · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Fearless Wallet hack (Oct 2026) — 2026-10-21 · OAK-T11.002 Wallet-Software Distribution Compromise
- Slice exploit (Oct 2026): $41K — 2026-10-20 · loss $41K · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Argent-style smart wallets exploit (Oct 2026): $59.8K — 2026-10-19 · loss $59.8K · OAK-T7.001 Mixer-Routed Hop
- AlpsCon AI Trade Hub exploit (Oct 2026): $355K — 2026-10-18 · loss $355K · OAK-T13.004 EIP-7702 Delegation Abuse
- Qubic hack (Oct 2026): $1.3–1.4M — 2026-10-17 · loss $1.3–1.4M · OAK-T11.004 Insufficient-Entropy Key Generation
- BiFi Lending exploit (Oct 2026): $165.4K — 2026-10-17 · loss $165.4K · OAK-T9.002 Flash-Loan-Enabled Exploit
- Kolan exploit (Oct 2026): $3K — 2026-10-15 · loss $3K · OAK-T9.001 Oracle Price Manipulation
- UNCX Network exploit (Oct 2026): $1.49M — 2026-10-14 · loss $1.49M · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Pirate Chain exploit (Oct 2026) — 2026-10-14 · OAK-T9.014 Protocol-Client Consensus Bug
- Gamdom hack (Oct 2026): $3M — 2026-10-13 · loss $3M · OAK-T11.011 Multi-chain Key-store Co-location
- Autheo THEO exploit (Oct 2026): $1.76M — 2026-10-12 · loss $1.76M · OAK-T10.002 Message-Verification Bypass
- Coinkite / Coldcard hack (Oct 2026) — 2026-10-11 · OAK-T11.007.003 Brand-Trust-Leveraged Active Phishing for Seed-Phrase Exfiltration
- Papertrade exploit (Oct 2026): $1.28M — 2026-10-10 · loss $1.28M · OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
- Ledger / CryptoBilis hack (Oct 2026): $72M — 2026-10-09 · loss $72M · OAK-T11.007 Hardware-wallet Supply-chain / Physical-access Compromise
- EtherVista exploit (Oct 2026): $18.6K — 2026-10-09 · loss $18.6K · OAK-T9.004 Access-Control Misconfiguration
- BitBay StableVault exploit (Oct 2026): $14K — 2026-10-09 · loss $14K · OAK-T9.004 Access-Control Misconfiguration
- X7 Finance exploit (Oct 2026): $16.5K — 2026-10-08 · loss $16.5K · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Set Protocol exploit (Oct 2026): $13.7K — 2026-10-06 · loss $13.7K · OAK-T7.001 Mixer-Routed Hop
- MakerDAO legacy auction keeper exploit (Oct 2026): $543K — 2026-10-06 · loss $543K · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Based Visa Card hack (Oct 2026) — 2026-10-05 · OAK-T15.004 Operator-Side Credential Compromise (SSO / Cloud / Registrar / DNS / Package Registry)
- Anonymous Base vault hack (Oct 2026): $6M — 2026-10-04 · loss $6M · OAK-T11.003 In-Use Multisig Smart-Contract Manipulation
- MALT exploit (Oct 2026): $72K — 2026-10-03 · loss $72K · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- GoldPesa exploit (Oct 2026): $114.9K — 2026-10-02 · loss $114.9K · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- NEAR Intents exploit (Oct 2026): $3.8M — 2026-10-01 · loss $3.8M · OAK-T10.002 Message-Verification Bypass
- Microsoft's X account hack (Oct 2026): $200,000 — 2026-10-01 · loss $200,000 · OAK-T15.006 Impersonation via Verified Social-Account Compromise
- FlashLoopAdapter exploit (Oct 2026): $305K — 2026-10-01 · loss $305K · OAK-T9.002 Flash-Loan-Enabled Exploit
September 2026 (30)
- Crypto hacks and exploits in September 2026
- MetaMask Staking hack (Sep 2026) — 2026-09-30 · OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- Fake GIWA chain hack (Sep 2026): $2.08M — 2026-09-26 · loss $2.08M · OAK-T4.008 Fake-DEX Clone-Frontend Phishing
- Limit Break Payment Processor V2 hack (Sep 2026) — 2026-09-25 · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Demex exploit (Sep 2026): $191,929 — 2026-09-25 · loss $191,929 · OAK-T10.002 Message-Verification Bypass
- Payy exploit (Sep 2026): $1.92M — 2026-09-24 · loss $1.92M · OAK-T10.002 Message-Verification Bypass
- Meter Passport exploit (Sep 2026): $2.3M — 2026-09-24 · loss $2.3M · OAK-T10.002 Message-Verification Bypass
- Duelbits hack (Sep 2026): $7M — 2026-09-24 · loss $7M · OAK-T11.011 Multi-chain Key-store Co-location
- Bitget hack (Sep 2026): $351.6M — 2026-09-24 · loss $351.6M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Neutron proposal 9 exploit (Sep 2026): $9.4M — 2026-09-22 · loss $9.4M · OAK-T16.002 Hostile-Vote Treasury Drain
- DoinGud exploit (Sep 2026): $35,486 — 2026-09-21 · loss $35,486 · OAK-T9.002 Flash-Loan-Enabled Exploit
- SingularityNET bridge exploit (Sep 2026): $1.53–1.55M — 2026-09-19 · loss $1.53–1.55M · OAK-T10.001 Validator / Signer Key Compromise
- MultiversX exploit (Sep 2026) — 2026-09-19 · OAK-T9.014 Protocol-Client Consensus Bug
- WaterPlum / Contagious Interview hack (Sep 2026): $10.71M — 2026-09-18 · loss $10.71M · OAK-T15.001 Social Engineering of Operator Personnel
- Likwid (Sep 2026): $55,721 — 2026-09-18 · loss $55,721 · OAK-T7.001 Mixer-Routed Hop
- Nostra exploit (Sep 2026): $3.5M — 2026-09-17 · loss $3.5M · OAK-T9.001 Oracle Price Manipulation
- Flamincome exploit (Sep 2026): $345,900 — 2026-09-16 · loss $345,900 · OAK-T9.001 Oracle Price Manipulation
- D'CENT (Sep 2026) — 2026-09-16
- BonfireSwap exploit (Sep 2026): $50,000 — 2026-09-16 · loss $50,000 · OAK-T9.004 Access-Control Misconfiguration
- Safe strategy executor exploit (Sep 2026): $7.73–7.8M — 2026-09-15 · loss $7.73–7.8M · OAK-T9.004 Access-Control Misconfiguration
- SpiralCom exploit (Sep 2026): $26,800 — 2026-09-14 · loss $26,800 · OAK-T9.001 Oracle Price Manipulation
- Long exploit (Sep 2026): $118,000 — 2026-09-14 · loss $118,000 · OAK-T10.002.001 Off-chain Observer Source-Event Forgery
- Chainflip exploit (Sep 2026) — 2026-09-12 · OAK-T10.002 Message-Verification Bypass
- Symbiosis exploit (Sep 2026): $336,000 — 2026-09-11 · loss $336,000 · OAK-T10.002 Message-Verification Bypass
- ether.fi hack (Sep 2026): $38,000 — 2026-09-11 · loss $38,000 · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Hemi Network (Sep 2026) — 2026-09-07 · OAK-T7.003 Cross-Chain Bridge Laundering
- Liquid Network exploit (Sep 2026): $320M — 2026-09-06 · loss $320M · OAK-T10.001 Validator / Signer Key Compromise
- RedSonic Vault exploit (Sep 2026): $23,000 — 2026-09-05 · loss $23,000 · OAK-T9.001 Oracle Price Manipulation
- Dream Health Chain exploit (Sep 2026): $71,800 — 2026-09-05 · loss $71,800 · OAK-T9.016 Contract Accounting / State-Invariant Flaw
- Notional Finance hack (Sep 2026): $1.73M — 2026-09-04 · loss $1.73M · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- XRPH Wallet hack (Sep 2026): $452,000 — 2026-09-03 · loss $452,000 · OAK-T11.002 Wallet-Software Distribution Compromise
August 2026 (15)
- Crypto hacks and exploits in August 2026
- Tectonic (Aug 2026): $120.4M — 2026-08-30 · loss $120.4M · OAK-T7.003 Cross-Chain Bridge Laundering
- OAK field-collects a live fake-recruiter lure to check its own T15.001 page against a real specimen — and finds the page wrong on two points: the trigger is npm prepare, and the repository carries no payload at all — OnChainAttack, first-party collection — 2026-08-27 — 2026-08-27 · OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- Moonwell exploit (Aug 2026): $8.7M — 2026-08-27 · loss $8.7M · OAK-T9.001 Oracle Price Manipulation
- Term Finance exploit (Aug 2026): $8.5M — 2026-08-23 · loss $8.5M · OAK-T16.001 Vote Takeover via Flash-Loan
- TAC (Aug 2026) — 2026-08-22 · OAK-T7.003 Cross-Chain Bridge Laundering
- The Sandbox exploit (Aug 2026): $675K — 2026-08-22 · loss $675K · OAK-T10.006 Cross-Chain Governance Relay Attack
- BounceBit exploit (Aug 2026): $3.3M — 2026-08-19 · loss $3.3M · OAK-T9.004 Access-Control Misconfiguration
- Allbridge exploit (Aug 2026): $190K — 2026-08-19 · loss $190K · OAK-T10.002 Message-Verification Bypass
- Maya Protocol exploit (Aug 2026): $1.7M — 2026-08-18 · loss $1.7M · OAK-T10.002 Message-Verification Bypass
- Repeat-victim whale hack (Aug 2026): $25.6M — 2026-08-12 · loss $25.6M · OAK-T4.001 Permit2 Signature-Based Authority Misuse
- Harmony exploit (Aug 2026) — 2026-08-12 · OAK-T10.001 Validator / Signer Key Compromise
- USM exploit (Aug 2026): $136K — 2026-08-10 · loss $136K · OAK-T9.001 Oracle Price Manipulation
- Oraichain exploit (Aug 2026) — 2026-08-09 · OAK-T10.002 Message-Verification Bypass
- Coreum–XRPL bridge exploit (Aug 2026): $200K — 2026-08-09 · loss $200K · OAK-T10.001 Validator / Signer Key Compromise
- Coinsbuy hack (Aug 2026): $7.9M — 2026-08-09 · loss $7.9M · OAK-T11.011 Multi-chain Key-store Co-location
July 2026 (20)
- Crypto hacks and exploits in July 2026
- Coldcard hack (Jul 2026) — 2026-07-30 · OAK-T11.002 Wallet-Software Distribution Compromise
- WEMIX hack (Jul 2026): $6.25M — 2026-07-26 · loss $6.25M · OAK-T11.014 Operator Privileged-Key Compromise
- DPRK state banks breached from the inside — former military operators are reported arrested for diverting state funds into overseas crypto wallets and structuring them out through Chinese border brokers — Central Bank of the DPRK / Foreign Trade Bank — 2026-07-12 (reported 2026-07-25) — 2026-07-25 · OAK-T7.010 Travel Rule Evasion
- Triple-A hack (Jul 2026): $11.8M — 2026-07-24 · loss $11.8M · OAK-T15.004 Operator-Side Credential Compromise (SSO / Cloud / Registrar / DNS / Package Registry)
- Lien Finance exploit (Jul 2026): $542,144 — 2026-07-24 · loss $542,144 · OAK-T9.001 Oracle Price Manipulation
- Verus ⇄ Ethereum Bridge, second time (Jul 2026): $7.54M — 2026-07-23 · loss $7.54M · OAK-T10
- Solido Cash (Jul 2026): $900,000 — 2026-07-23 · loss $900,000 · OAK-T7.002 CEX Deposit-Address Layering
- B² Network hack (Jul 2026): $3.86M — 2026-07-23 · loss $3.86M · OAK-T11.014 Operator Privileged-Key Compromise
- AFX Trade exploit (Jul 2026): $24.15M — 2026-07-22 · loss $24.15M · OAK-T10.001 Validator / Signer Key Compromise
- Wanchain Cardano bridge (Jul 2026) — 2026-07-20 · OAK-T10
- Allbridge Core (Jul 2026): $1.65M — 2026-07-19 · loss $1.65M · OAK-T7.001 Mixer-Routed Hop
- Across Protocol (Jul 2026): $4.5M — 2026-07-17 · loss $4.5M · OAK-T10
- DeFiTuna exploit (Jul 2026): $580K — 2026-07-16 · loss $580K · OAK-T9.002 Flash-Loan-Enabled Exploit
- Cascade (Jul 2026): $1.34M — 2026-07-16 · loss $1.34M · OAK-T7.003 Cross-Chain Bridge Laundering
- Ostium exploit (Jul 2026): $11.86M — 2026-07-15 · loss $11.86M · OAK-T9.001 Oracle Price Manipulation
- LayerZero Executor hack (Jul 2026): $2.4M — 2026-07-15 · loss $2.4M · OAK-T11.011 Multi-chain Key-store Co-location
- Bonzo Lend (Jul 2026): $9.05M — 2026-07-12 · loss $9.05M · OAK-T7.001 Mixer-Routed Hop
- Injective Labs SDK hack (Jul 2026) — 2026-07-08 · OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- Summer.fi (Jul 2026): $6.04M — 2026-07-06 · loss $6.04M · OAK-T7.001 Mixer-Routed Hop
- BonkDAO exploit (Jul 2026): $20M — 2026-07-06 · loss $20M · OAK-T16.002 Hostile-Vote Treasury Drain
June 2026 (19)
- Crypto hacks and exploits in June 2026
- Polymarket hack (Jun 2026): $3.0–3.1M — 2026-06-25 · loss $3.0–3.1M · OAK-T15.002 Supply-Chain / Vendor-Pipeline Compromise
- SecondFi hack (Jun 2026): $2.4M — 2026-06-23 · loss $2.4M · OAK-T11.004 Insufficient-Entropy Key Generation
- Taiko bridge exploit (Jun 2026): $1.7M — 2026-06-21 · loss $1.7M · OAK-T10.002 Message-Verification Bypass
- jaredfromsubway.eth hack (Jun 2026): $7.5M — 2026-06-20 · loss $7.5M · OAK-T4.004 Allowance / Approve-Pattern Drainer
- Namada exploit (Jun 2026): $600,000 — 2026-06-19 · loss $600,000 · OAK-T10.002 Message-Verification Bypass
- mySwap CL (Jun 2026): $300K — 2026-06-19 · loss $300K · OAK-T7.001 Mixer-Routed Hop
- Rust crypto-clipper hack (Jun 2026) — 2026-06-17 · OAK-T4.012 Clipboard-Hijacker (Clipper) Address Substitution
- CryptoBandits hack (Jun 2026) — 2026-06-17 · OAK-T4.012 Clipboard-Hijacker (Clipper) Address Substitution
- Steam Workshop / Wallpaper Engine malicious wallpapers — Lumma + Vidar infostealers harvesting Steam sessions and crypto wallets — Windows / cross-chain — disclosed 2026-06-16 — 2026-06-16 · OAK-T4.010 Fake Security-Tool / Browser-Extension Phishing
- Secret Network exploit (Jun 2026): $4.67M — 2026-06-10 · loss $4.67M · OAK-T10.002 Message-Verification Bypass
- Token of Power exploit (Jun 2026): $1.58M — 2026-06-09 · loss $1.58M · OAK-T16.002 Hostile-Vote Treasury Drain
- OpenMonero hack (Jun 2026): $25K — 2026-06-08 · loss $25K · OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- Humanity Protocol hack (Jun 2026): $32M — 2026-06-08 · loss $32M · OAK-T11.011 Multi-chain Key-store Co-location
- Flooring Protocol (Jun 2026): $900K — 2026-06-08 · loss $900K · OAK-T12.008 Hybrid Fungible / Non-Fungible Standard Accounting Divergence
- Syscoin bridge exploit (Jun 2026): $8.56M — 2026-06-07 · loss $8.56M · OAK-T10.002 Message-Verification Bypass
- Zcash Orchard counterfeiting vulnerability — under-constrained halo2 scalar-mul gadget (AI-discovered responsible disclosure) — 2026-05-29 / 2026-06-02 — 2026-06-02 · OAK-T9
- TesseraDAO hack (Jun 2026): $2.4M — 2026-06-01 · loss $2.4M · OAK-T11.014 Operator Privileged-Key Compromise
- Gnosis Pay (Jun 2026) — 2026-06-01 · OAK-T11
- Joe Agent (Jun 2026): $45K — loss $45K · OAK-T9
May 2026 (17)
- Crypto hacks and exploits in May 2026
- Ill Bloom hack (Aug 2026): $5,690,922 — 2026-08-05 · loss $5,690,922 · OAK-T11.004 Insufficient-Entropy Key Generation
- DxSale hack (May 2026): $7.3M — 2026-05-29 · loss $7.3M · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Superfortune hack (May 2026): $15.18M — 2026-05-27 · loss $15.18M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Stake DAO exploit (May 2026): $91K — 2026-05-27 · loss $91K · OAK-T10.002 Message-Verification Bypass
- SquidRouterModule hack (May 2026): $3.2M — 2026-05-25 · loss $3.2M · OAK-T11.003 In-Use Multisig Smart-Contract Manipulation
- RetoSwap / Haveno hack (May 2026): $2.7M — 2026-05-21 · loss $2.7M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- MAP Protocol (May 2026): $110K — 2026-05-20 · loss $110K · OAK-T10
- EchoProtocol eBTC Bridge Signature-Verification Bypass and Unbounded Mint — Monad — 2026-05-19 — 2026-05-19 · loss $76.64M · OAK-T10.002 Message-Verification Bypass
- Verus ⇄ Ethereum Bridge (May 2026): $11.58M — 2026-05-18 · loss $11.58M · OAK-T10
- Nx Console VS Code extension hack (May 2026) — 2026-05-18 · OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- THORChain exploit (May 2026): $10M — 2026-05-15 · loss $10M · OAK-T10.001 Validator / Signer Key Compromise
- LABtrade hack (May 2026) — 2026-05-14 · OAK-T3.004 Influencer-Amplified Promotion-and-Dump
- Roaring Kitty hack (May 2026): $2.86M — 2026-05-11 · loss $2.86M · OAK-T15.006 Impersonation via Verified Social-Account Compromise
- TrustedVolumes RFQ Authorization-Boundary Failure — Ethereum — 2026-05-07 — 2026-05-07 · loss $5.87M · OAK-T9.004 Access-Control Misconfiguration
- Kraken / Coinbase users hack (May 2026): $6.7M — loss $6.7M · OAK-T5.009 Physical-Coercion Extraction (Wrench Attack)
- DSJ Exchange hack (May 2026): $150M — loss $150M · OAK-T11.005.002 Fake-Custodian / Fake-Asset-Manager Fraud
- Dritan Kapllani Jr hack (May 2026): $19M — loss $19M · OAK-T4.007 Native-app Social Phishing on Engagement-Weighted Platforms
April 2026 (9)
- Crypto hacks and exploits in April 2026
- Volo Admin-Key Social-Engineering Compromise — Sui — 2026-04-21 — 2026-04-21 · loss $3.5M · OAK-T11.014 Operator Privileged-Key Compromise
- KelpDAO rsETH exploit (Apr 2026): $292M — 2026-04-18 · loss $292M · OAK-T10.002.001 Off-chain Observer Source-Event Forgery
- Hyperbridge Merkle-proof forgery and counterfeit-DOT mint — Polkadot ⇄ Ethereum / Base / BNB / Arbitrum — 2026-04-13 — 2026-04-13 · loss $2.5M · OAK-T10
- Drift Protocol durable-nonce admin-takeover and fictitious-collateral drain — Solana — 2026-04-01 — 2026-04-01 · loss $285M · OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- Zondacrypto Exchange CEO-Transition Custody Failure and Alleged Russian Mafia Takeover — Apr 2026 — ~$96M — loss $96M
- Wasabi Protocol UUPS Proxy-Upgrade Admin-Key Exploit — Apr 2026 — ~$4.5–5.5M — loss $4.55M · OAK-T6.005 Proxy-Upgrade Malicious Switching
- Rhea Finance Margin-Parser Exploit (Apr 2026): $18.4M — loss $18.4M · OAK-T7.005 Privacy-Chain Hops
- RaveDAO ($RAVE) insider OTC distribution and coordinated dump — Multi-CEX (Binance / Bitget / Gate) — 2026-04 — loss $5.7B · OAK-T1.004 Blacklist / Pausable Transfer Weaponization
- RAVE Token (Apr 2026): $26 — loss $26
March 2026 (8)
- Crypto hacks and exploits in March 2026
- Venus Protocol Supply-Cap Donation-Attack Exploit — BNB Chain — 2026-03-15 — 2026-03-15 · loss $3.7M · OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
- Lido exploit (Mar 2026): $100 — 2026-03-13 · loss $100 · OAK-T14.001 Slashing-Condition Exploit
- Gondi exploit (Mar 2026): $230,000 — 2026-03-09 · loss $230,000 · OAK-T9.004 Access-Control Misconfiguration
- Solana permissioned tokens exploit (Mar 2026) — 2026-03-06 · OAK-T1.004 Blacklist / Pausable Transfer Weaponization
- Resolv Labs Private-Key Compromise and Unlimited USR Mint — Mar 2026 — $25M — loss $25M · OAK-T11
- Polymarket Iran-strike market exploit (Mar 2026): $900,000 — loss $900,000 · OAK-T9.006 Subjective-Oracle Resolution Manipulation
- Panic-Account Farm (Mar 2026)
- Aave wstETH Oracle Misconfiguration Liquidation Cascade — Mar 2026 — $27.78M — loss $27.78M · OAK-T14.003 Restaking Cascading Risk
February 2026 (2)
- Crypto hacks and exploits in February 2026
- Veil Cash exploit (Feb 2026): $5,000 — 2026-02-20 · loss $5,000 · OAK-T9.004 Access-Control Misconfiguration
- Polymarket Iran-strike timing market exploit (Feb 2026): $162,663 — loss $162,663 · OAK-T9.006 Subjective-Oracle Resolution Manipulation
January 2026 (5)
- Crypto hacks and exploits in January 2026
- Hardware Wallet Social Engineering (Jan 2026): $282M — 2026-01-10 · loss $282M · OAK-T7.003 Cross-Chain Bridge Laundering
- IPOR Fusion hack (Jan 2026): $267,000 — 2026-01-06 · loss $267,000 · OAK-T11.013 Legacy-Version Maintenance Attack Surface
- Polymarket Venezuela / Maduro-capture market — operational-insider trading by US Special Forces NCO — 2026-01 — loss $33,000 · OAK-T9.006 Subjective-Oracle Resolution Manipulation
- Polymarket trader-tooling supply-chain compromise — npm + GitHub — 2026-01 — loss $44 · OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- Polycule trading bot hack (Jan 2026): $230,000 — loss $230,000 · OAK-T5.007 Third-party Brand-impersonation Custodial Soft-rug