security reports
Incident reports
Root-cause analysis of DeFi exploits, vulnerabilities, and security incidents, written by the team behind the feed.
Latest2026-09-06bitcoin
Liquid Network $320M Range-Proof Cache Exploit
A range-proof verification cache bug in Elements let an attacker mint unbacked L-BTC and peg roughly 3,996 BTC (about $320M) out of Blockstream's Liquid Network, draining 95% of the reserve. The self-described white hat returned 3,400 BTC and kept 598.5 BTC.
Impact
−$320M
August 2026
- 2026-08-232026-08-23Ethereum−$8.47M
Term Finance $8.5M Governance TakeoverTerm Finance's vault DAOs had empty electorates, so $25 of deposits bought 100% of the vote in five vaults. The attacker self-approved proposals, zeroed a 7-day delay and drained 2,841.74 WETH and 1,679,639 USDC.Ethereum−$8.47M - 2026-08-222026-08-22Base−$1.02M
The Sandbox SAND Delegate Hijack and Unbacked MintThe SAND OFT's own approveAndCall let an attacker name themselves LayerZero delegate, forge inbound verification, mint 329 trillion unbacked SAND on Base and empty the Ethereum adapter.Base−$1.02M - 2026-08-192026-08-19Base−$191K
Allbridge $191K Phantom CCTP Deposit ExploitAllbridge's new CCTP router on Base credited a forged Circle message as a real deposit. The attacker booked a phantom $1M, flash-loaned the shortfall and took the router's entire 191,156 USDC.Base−$191K - 2026-08-182026-08-18MAYAChain−$1.36M
Maya Protocol Six-Bug Trade Account ExploitAn attacker chained six MAYAChain bugs so a false theft alert paid an uncapped 49.45M CACAO subsidy into a pool holding 0.11 LINK, then took 99.93% of it and withdrew 48.87M CACAO.MAYAChain−$1.36M - 2026-08-122026-08-12Harmony—
Harmony 4 Billion ONE Unauthorized Mint ExploitAn attacker minted about 4 billion ONE, inflating Harmony's supply by roughly 26%, while a masked totalSupply reading delayed detection and 97% of the tokens reached exchanges before any freeze.Harmony— - 2026-08-072026-08-07Ravencoin—
Ravencoin Consensus Exploit Forces Three-Day Chain RollbackA missing nHeight check in Ravencoin's KAWPOW validation let attackers append forged blocks with no real proof-of-work, forcing RVN freezes and a rollback to block 4,487,775.Ravencoin— - 2026-08-012026-08-01guide—Top 10 DeFi Hacks of 2026 (So Far)The ten biggest crypto hacks of 2026, ranked by amount lost: September's $320M Liquid Network exploit, KelpDAO's $292M bridge hack, Drift's $285M key compromise, and more, with the root cause of each and the operational-failure pattern behind most of the DeFi losses.guide—
July 2026
- 2026-07-302026-07-30Bitcoin−$116M
Coldcard $116M Seed Entropy ExploitA firmware build error gave Coldcard seeds as little as 40 bits of entropy for five years; attackers brute-forced the keyspace offline and swept $116M in BTC from more than 5,200 addresses in four waves.Bitcoin−$116M - 2026-07-242026-07-24Ethereum−$96K
Guru.fund $96K Vault Approval ExploitGuru.fund, a delegated fund-management protocol on Ethereum, lost about $96K across seven transactions when a whitelisted deposit adapter let attackers make each vault approve and drain itself.Ethereum−$96K - 2026-07-232026-07-23Ethereum−$7.54M
Verus Bridge $7.54M Forged Import ExploitThe Verus-Ethereum bridge was drained of $7.54M via a forged cross-chain import on July 23, 2026, two weeks after it refilled reserves recovered from May's $11.58M hack of the same import path.Ethereum−$7.54M - 2026-07-212026-07-21guide—DeFi Security Monitoring Tools Compared (2026)How real-time DeFi security monitoring tools compare in 2026: enterprise platforms (Hypernative, Hexagate), inline firewalls (Forta Firewall, BlockSec), and self-serve machine-readable feeds (Defimon), by approach, coverage, integration, and pricing.guide—
- 2026-07-162026-07-16guide—Automating DeFi Incident Response with a WebSocket Exploit FeedA production integration guide for the Defimon WebSocket feed: raw vs confirmed streams, reconnect handling, filtering alerts against your contracts and exposure, and what to automate versus page a human for.guide—
- 2026-07-152026-07-15Arbitrum−$23.75MOstium $23.75M Oracle Manipulation ExploitOstium, a perpetuals DEX on Arbitrum, lost $23.75M when an attacker with price-submission authority opened BTC longs at $5,000 and closed them near $60,000, draining the vault that backs every trade.Arbitrum−$23.75M
- 2026-07-152026-07-15guide—Bridge Exploits Explained: Why Cross-Chain Is DeFi's Weakest LinkHow cross-chain bridges get drained: validator key compromise, message verification bugs, false deposit events and custody failure, from Ronin and Wormhole to Shibarium and KelpDAO.guide—
- 2026-07-152026-07-15guide—Oracle Manipulation Attacks in DeFi: How Price Oracles Get ExploitedHow DeFi price oracles get manipulated: spot-reserve pricing, missing update authorization, stale feeds and donation attacks, with real incidents and the on-chain patterns that expose them in real time.guide—
- 2026-07-152026-07-15guide—Flash Loan Attacks Explained: How They Work and How to Detect ThemWhat flash loan attacks are, why the loan itself is never the vulnerability, and how exploits that borrow nine figures with zero collateral are detected on-chain within a second.guide—
February 2026
- 2026-02-262026-02-26Ethereum−$1.84MFoom.cash $1.84M Whitehat Rescue: Groth16 Trusted Setup ExploitFoom.cash's ZK lottery shipped a Groth16 verifier with an unfinished trusted setup, making every withdrawal proof forgeable. Defimon detected the exploit and preemptively rescued $1.84M from the Ethereum deployment.Ethereum−$1.84M
November 2025
- 2025-11-302025-11-30Ethereum−$9M
Yearn yETH $9M Numerical Solver ExploitYearn's yETH weighted stableswap pool exploited through numerical instability in fixed-point iteration solver. Attacker collapsed product term to zero, switching pool to constant-sum invariant, then triggered arithmetic underflow to mint 2.35×10⁵⁶ LP tokens.Ethereum−$9M - 2025-11-032025-11-03Multi-chain−$128M
Balancer V2 $128M Rounding ExploitBalancer V2 Composable Stable Pools exploited across multiple chains through rounding direction inconsistency in rate scaling logic. Attacker manipulated pool invariant to deflate BPT prices.Multi-chain−$128M October 2025
- 2025-10-152025-10-15Sui−$3.44M
Typus Finance $3.44M Oracle Manipulation AttackTypus Finance lost $3.44M through oracle manipulation exploiting missing authorization check in custom oracle module. Attacker manipulated prices to drain TLP pool via arbitrage.Sui−$3.44M - 2025-10-042025-10-04Ethereum−$1.8M
Abracadabra Money $1.8M Exploit - Logic Flaw Bypasses SolvencyAbracadabra Money's third exploit in two years. Logic flaw in CauldronV4 contracts allowed $1.8M unbacked MIM borrowing via status flag reset.Ethereum−$1.8M September 2025
- 2025-09-172025-09-17BSC−$2M
NewGold Protocol $2M Flash Loan Attack - Triple Vulnerability ExploitNewGold Protocol lost $2M through flash loan manipulation exploiting broken price oracle, faulty fee logic, and whitelisted dead address bypass.BSC−$2M - 2025-09-122025-09-12Ethereum−$3M
Shibarium $3M Validator Compromise and Flash Loan Bridge ExploitShibarium bridge drained for $3M through validator key compromise and flash loan manipulation. Attacker controlled 10/12 validators to authorize fraudulent checkpoints.Ethereum−$3M
Real-time alerts for attacks like these
Defimon detects exploits on major chains before they execute and streams them to you: human-readable alerts in Telegram, or structured JSON over WebSocket for your own systems.
websocket $200 / mo · signals $50 / mo · channel free