Hack & exploit tracker
Where the money from major Ethereum hacks went, followed live from the attacker wallets Etherscan has publicly tagged.
How much each hack took
Amounts as recorded by DefiLlama’s hacks database, in US dollars at the time of each hack.
Every hack we follow
Click a hack to see where its funds went. “Still held” is what the tagged attacker wallets hold today; most stolen funds move on through other wallets.
| Hack | Date | Stolen | Funds now |
|---|---|---|---|
| Bybit Signer phishing (social engineering) |
2025-02-21 | $1.40B | Moved out of the tagged wallets |
| Ronin Bridge Validator key compromise |
2022-03-23 | $624.0M | Moved out of the tagged wallets |
| FTX Phishing (social engineering) |
2022-11-12 | $450.0M | Sitting in the attacker wallets |
| Bitget Hot wallet key compromise |
2026-09-24 | $387.0M | Moved out of the tagged wallets |
| Kelp DAO Cross-chain message spoofing |
2026-04-18 | $293.0M | Moved out of the tagged wallets |
| WazirX Signer phishing (social engineering) |
2024-07-18 | $234.9M | Moved out of the tagged wallets |
| Euler Finance Donation attack (accounting flaw) |
2023-03-13 | $197.0M | Moved out of the tagged wallets |
| Nomad Bridge Forged proof |
2022-08-01 | $190.0M | Moved out of the tagged wallets |
| Beanstalk Flash-loan governance attack |
2022-04-17 | $181.0M | Moved out of the tagged wallets |
| Wintermute Phishing / compromised key |
2022-09-20 | $160.0M | Sitting in the attacker wallets |
| Balancer Rounding error (accounting flaw) |
2025-11-03 | $128.0M | Moved out of the tagged wallets |
| Poloniex Malware (social engineering) |
2023-11-10 | $126.0M | Moved out of the tagged wallets |
| Harmony Bridge Validator key compromise |
2022-06-23 | $100.0M | Moved out of the tagged wallets |
| Heco Bridge Hot wallet key compromise |
2023-11-22 | $86.6M | Moved out of the tagged wallets |
| Phemex Hot wallet key compromise |
2025-01-23 | $85.0M | Moved out of the tagged wallets |
| Orbit Bridge Signature verification flaw |
2023-12-31 | $81.7M | Sitting in the attacker wallets |
| AlphaPo Hot wallet key compromise |
2023-07-23 | $60.0M | Moved out of the tagged wallets |
| Infini Private key compromise |
2025-02-24 | $49.5M | Moved out of the tagged wallets |
| KyberSwap Elastic Rounding error (accounting flaw) |
2023-11-22 | $48.0M | Moved out of the tagged wallets |
| Hedgey Finance Missing input validation |
2024-04-19 | $44.7M | Moved out of the tagged wallets |
| Truebit Arithmetic error |
2026-01-08 | $26.4M | Moved out of the tagged wallets |
| Indodax Leaked key via infrastructure |
2024-09-10 | $25.2M | Moved out of the tagged wallets |
| Resolv Leaked key via infrastructure |
2026-03-21 | $24.5M | Sitting in the attacker wallets |
| Rari Capital Arbitrary external call |
2021-05-08 | $10.0M | Moved out of the tagged wallets |
Attacker wallets are only those Etherscan publicly tags for each incident. Hacks are added once Etherscan tags the attacker’s wallets. We describe public transfers for information only; we don’t recover funds or identify people. Updated 2026-10-27 14:15 UTC.
Questions
Where do stolen crypto funds usually go?
In the hacks on this page, most funds first move to fresh wallets the attacker controls, then on to mixers such as Tornado Cash, cross-chain bridges and swap services, and sometimes to exchange deposit addresses. Each hack page shows the first two steps for the wallets Etherscan has tagged.
How do you know which wallets belong to the attacker?
We use only addresses that Etherscan has publicly tagged for that incident (for example “Bybit Exploiter 12”). We don't guess, and we don't identify people.
How current is this?
Hacks with recent activity are re-read from the blockchain every 15 minutes; quieter ones once a day. Last update: 2026-10-27 14:15 UTC.
Can Deep Blue Alpha help recover stolen funds?
No. This page describes public on-chain transfers for information only. Victims should contact the affected platform and law enforcement.
