What happened, and when
A dated registry of exploits and protocol events for event-study work. Every entry names its source and links back. Nothing here is unattributed, and no amount is estimated by us.
187 events
| Date | Event | Chains | Loss | Returned | Source |
|---|---|---|---|---|---|
| 2026-05-07 |
TrustedVolumes: $6.7 Million exploit
Access Control · Caller Impersonation
Access Control · Caller Impersonation · Other
|
Ethereum | $6.7 Million | — | DeFiLlama |
| 2026-05-05 |
Ekubo: $1.4 Million exploit
Access Control · Token Approval Abuse
Access Control · Token Approval Abuse · DeFi Protocol
|
Ethereum | $1.4 Million | — | DeFiLlama |
| 2026-05-04 |
SquidRouterModule: $3.2 Million exploit
Access Control · Improper Access Control
Access Control · Improper Access Control · DeFi Protocol
|
Ethereum Base | $3.2 Million | — | DeFiLlama |
| 2026-05-04 |
SmartCredit: $72 Thousand exploit
Protocol Logic · Unknown
Protocol Logic · Unknown · DeFi Protocol
|
Ethereum | $72 Thousand | — | DeFiLlama |
| 2026-05-01 |
Bisq: $550 Thousand exploit
Input Validation · Missing Input Validation
Input Validation · Missing Input Validation · DeFi Protocol
|
Bitcoin | $550 Thousand | — | DeFiLlama |
| 2026-05-01 |
Sharwa.Finance: $32.9 Thousand exploit
Oracle Manipulation · Spot Price Manipulation
Oracle Manipulation · Spot Price Manipulation · DeFi Protocol
|
Arbitrum | $32.9 Thousand | — | DeFiLlama |
| 2026-04-30 |
Wasabi Perps: $5.5 Million exploit
Key Compromise · Deployer Key Compromised
Key Compromise · Deployer Key Compromised · DeFi Protocol
|
Ethereum Base Berachain +1 | $5.5 Million | — | DeFiLlama |
Exploit records come from the public DeFiLlama hacks registry and are re-imported as recovery figures are updated. Depegs are detected daily from the platform's own hourly bars, and governance upgrades are read from Governor Bravo logs on chain; each row names its source. Curated entries add the transactions and addresses behind an event so it can be traced in the explorer and lined up against price windows. We publish what the source publishes, and amounts we cannot attribute are shown as blank, never filled in. The CSV carries the same rows as the filter you are looking at, one event per line, up to 5,000; past that, request the registry as a data export.