hackscan
/

Analysis

Who steals the most, on which chains, how, and from where. Click any line for the hacks behind it.

├─ stolen_total
$27.5B
├─ recovered
$2.37B (8.6%)
├─ attributed
54 of 1331 hacks
├─ flagged_wallets
8,955
└─ zachxbt_posts
197

Attackers

Confirmed: named by a government, the victim or a major security firm. Suspected: linked by on-chain investigators (ZachXBT, SlowMist…), not officially confirmed.

  1. 01North Korea (Lazarus and affiliates) · confirmed30 hacks$4.02B
  2. 02North Korea (Lazarus and affiliates) · suspected17 hacks$1.22B
  3. 03SIM-swapping gang · confirmed1 hack$450M
  4. 04Individual · confirmed2 hacks$117M
  5. 05Gonjeshke Darande · suspected1 hack$82.0M
  6. 06former Ankr employee · confirmed1 hack$5.0M
  7. 07Kokomo Finance Team · confirmed1 hack$4.0M
  8. 08Dragoma Team · confirmed1 hack$3.5M
  9. 09Not attributed1277 hacks$21.6B

By year

Total stolen per year.

  1. 012026326 hacks$8.74B
  2. 022025148 hacks$2.72B
  3. 032024216 hacks$1.66B
  4. 042023197 hacks$1.63B
  5. 052022185 hacks$3.63B
  6. 062021125 hacks$2.86B
  7. 07202046 hacks$3.98B
  8. 08201926 hacks$277M
  9. 09201831 hacks$1.12B
  10. 1020178 hacks$289M
  11. 1120165 hacks$136M
  12. 1220156 hacks$9.9M
  13. 1320146 hacks$487M
  14. 1420132 hacks$1.3M
  15. 1520123 hacks$568K
  16. 1620111 hack$8.8M

By chain

Hacks touching each chain (a cross-chain hack counts on every chain it hit).

  1. 01Ethereum551 hacks$16.4B
  2. 02Bitcoin66 hacks$11.8B
  3. 03Arbitrum103 hacks$7.54B
  4. 04Base66 hacks$6.80B
  5. 05Avalanche28 hacks$6.78B
  6. 06Optimism32 hacks$6.77B
  7. 07TRON5 hacks$6.41B
  8. 08BSC264 hacks$3.12B
  9. 09Solana58 hacks$1.73B
  10. 10Polygon65 hacks$1.56B
  11. 11Tron21 hacks$962M
  12. 12XRP6 hacks$575M

How they got in

Attack class. Keys and people fail more often than code.

  1. 01Key Compromise163 hacks$8.96B
  2. 02Frontend & Infrastructure101 hacks$7.50B
  3. 03Social Engineering62 hacks$3.12B
  4. 04Access Control228 hacks$1.96B
  5. 05Bridge & Cross-Chain56 hacks$1.53B
  6. 06Token & Share Accounting169 hacks$1.45B
  7. 07Oracle Manipulation162 hacks$894M
  8. 08Input Validation71 hacks$756M
  9. 09Reentrancy62 hacks$450M
  10. 10Rugpull42 hacks$285M
  11. 11Protocol Logic179 hacks$253M
  12. 12Governance23 hacks$250M

By country

Where the victims are headquartered, when public.

  1. 01Singapore49 hacks$8.62B
  2. 02China30 hacks$5.57B
  3. 03Japan9 hacks$1.52B
  4. 04United States145 hacks$1.35B
  5. 05South Korea21 hacks$714M
  6. 06Philippines2 hacks$636M
  7. 07United Kingdom19 hacks$590M
  8. 08Seychelles7 hacks$448M
  9. 09India7 hacks$367M
  10. 10Switzerland19 hacks$354M
  11. 11El Salvador1 hack$320M
  12. 12Cayman Islands5 hacks$245M

By target

What kind of project was hit.

  1. 01CEX119 hacks$13.0B
  2. 02DeFi Protocol968 hacks$9.27B
  3. 03Other25 hacks$4.08B
  4. 04Chain34 hacks$465M
  5. 05Wallet22 hacks$416M
  6. 06Token99 hacks$123M
  7. 07Gaming11 hacks$79.8M
  8. 08NFTfi25 hacks$42.7M
  9. 09Layer 18 hacks$13.2M
  10. 10Gambling Platform2 hacks$11.2M
  11. 11Payments2 hacks$10.9M
  12. 12AI Agent2 hacks$9.3M

Biggest recoveries

Funds returned, frozen or reimbursed after the hack.

  1. 01Bybit$1.40B stolen · Feb 21, 2025$1.40B
  2. 02Portal$326M stolen · Feb 2, 2022$326M
  3. 03DMM Bitcoin$305M stolen · May 31, 2024$305M
  4. 04Euler V1$197M stolen · Mar 13, 2023$240M
  5. 05GMX V1 EVM$42.0M stolen · Jul 9, 2025$40.0M
  6. 06Drift Trade$14.5M stolen · May 11, 2022$14.5M
  7. 07KiloEx$7.5M stolen · Apr 14, 2025$6.8M
  8. 08Defrost$12.0M stolen · Dec 24, 2022$6.0M
  9. 09ParaSpace Lending V1$5.0M stolen · Mar 17, 2023$5.0M
  10. 10Ankr$5.0M stolen · Dec 2, 2022$5.0M

Sources and method

Hacks
DefiLlama hacks, refreshed every hour.
Location
The victim's publicly known headquarters, found by an AI model from public records. Unknown stays unknown.
Attribution
Kept only when a government, the victim or a major security firm named the attacker publicly.
Wallets
Etherscan exploiter labels (eth-labels, Forta datasets), MEW darklist, post-mortems, theft addresses named by ZachXBT.
Sanctions
US Treasury OFAC SDN list (514 addresses).
Updated
Nov 1, 2026. Something wrong? Request a correction.