DeFi hacks in 2026: what broke and why

This page lists major DeFi hacks of 2026. For each one: when it happened, how much was lost, what broke, and what kind of bug it was.

Last updated: October 2026 (2026-10-15). We add new entries every week.

Sources are public only: rekt.news, official post-mortems and security-firm reviews. Losses are what the linked source reported. Where sources disagree, we say so.

01Summary

Summary table

DeFi hacks of 2026 with date, chain, reported loss, root cause, bug class, and source
DateProtocolChainLoss (reported)Root causeBug classCode bug?Source
Jan 8 Truebit Ethereum $26.2M (Defimon: $26.4M) Integer overflow in a five-year-old contract Arithmetic Yes rekt.news
Jan 19–20 Makina Finance Ethereum $4.13M (other outlets: ~$5.1M) Flash-loan manipulation of pool prices used for share price Oracle manipulation, flash loan Yes rekt.news
Feb 15 Moonwell Base $1.78M Oracle priced cbETH with the cbETH/ETH ratio, not a USD price Oracle misconfiguration Yes rekt.news
Mar 5 Solv Protocol Not stated by source $2.73M Callback fired before balances were updated, tokens minted twice Reentrancy Yes rekt.news
Mar 2026 Resolv Labs Not stated by source $24.5–25M Compromised GitHub credential led to stolen signing credentials and unlimited minting Off-chain: key / supply chain No rekt.news
Apr 13 Dango Dango chain $1.9M (most recovered) Contract did not check donation amounts were positive Input validation Yes Halborn
Apr 23 GiddyDeFi Ethereum $1.3M Signed transaction replayed with parameters the signature did not cover Signature / authorization Yes Halborn
Sep 17 Nostra Starknet ~$3.5M Thin-pool price blended into an oracle price Oracle manipulation Yes rekt.news
Apr 1 Drift Solana $285M Social engineering of signers, privileged keys compromised Off-chain No rekt.news
Apr 18 KelpDAO Ethereum and Arbitrum (LayerZero bridge) ~$290–292M Single verifier fed false data via compromised RPC nodes Off-chain No rekt.news
02The pattern

The pattern in 2026: most money was lost off-chain

By value, most 2026 losses did not come from contract bugs. Halborn's H1 2026 report says off-chain causes (compromised keys, signing infrastructure, social engineering) drove 96% of H1 2026 losses (Halborn).

Rekt makes the same point about Drift and KelpDAO: roughly $577M lost in under three weeks, with the code never the target (rekt.news: Wrong Attack Surface).

We'll be plain about what that means. A code audit does not cover keys, signers or infrastructure. That includes ours. Contract bugs still lose real money, and they are what the sections below cover.

03Code bugs

Code-level hacks by bug class

Oracle manipulation

An oracle gives a contract a price. If an attacker can move that price, or the contract reads the wrong number, the contract mis-values collateral. Oracle manipulation is OWASP Smart Contract Top 10 (2025) SC02. Checklist: oracles and price inputs

Makina Finance - January 19–20, 2026

Loss:
$4.13M per rekt.news; other outlets report ~$5.1M
Chain:
Ethereum
Root cause:
A share-price value was derived from Curve pool states. An attacker moved those states with a flash loan inside one transaction. Per rekt, this attack type was listed as out of scope in one of the audits.
Bug class:
Oracle manipulation, flash loan (OWASP SC02, SC07)
Code bug?
Yes
How a pre-audit check relates:
Oracle manipulation and flash-loan price movement are classes Guardix checks for in a pre-audit.
Sources:
rekt.news

Moonwell - February 15, 2026

Loss:
$1.78M in bad debt (as reported by rekt.news)
Chain:
Base
Root cause:
A governance upgrade enabled a new oracle. It treated the cbETH/ETH ratio (about 1.12) as a dollar price and skipped the ETH/USD multiplication. Liquidators then seized cbETH collateral at a fraction of its value.
Bug class:
Oracle misconfiguration (OWASP SC02)
Code bug?
Yes (a configuration and pricing error)
How a pre-audit check relates:
Oracle and price-input errors are a class Guardix checks for in a pre-audit.
Sources:
rekt.news

Nostra - September 17, 2026

Loss:
About $3.5M borrowed against inflated collateral (as reported by rekt.news, confirmed by Nostra)
Chain:
Starknet
Root cause:
An attacker-seeded, thin-liquidity pool produced a distorted price for the NSTR token. Per rekt, the oracle blended that quote with a clean one instead of rejecting the gap. One account borrowed against the inflated collateral.
Bug class:
Oracle manipulation (OWASP SC02)
Code bug?
Yes (oracle design). The rekt piece says there was no flash loan and no reentrancy bug.
How a pre-audit check relates:
Oracle manipulation is one of the classes Guardix checks for in a pre-audit.
Sources:
rekt.news

Arithmetic

Arithmetic bugs happen when a number goes past its limit or a calculation is wrong. This is OWASP SC08 and SWC-101. Checklist: arithmetic

Truebit - January 8, 2026

Loss:
$26.2M, 8,535 ETH (as reported by rekt.news). Defimon reports $26.4M.
Chain:
Ethereum
Root cause:
An unchecked integer overflow in a contract deployed about five years earlier. The attacker minted over 240 million TRU, burned them for ETH, and repeated it.
Bug class:
Arithmetic (OWASP SC08, SWC-101)
Code bug?
Yes
How a pre-audit check relates:
Arithmetic errors are a class Guardix checks for in a pre-audit.
Sources:
rekt.news · Defimon review

Reentrancy

Reentrancy means a contract calls out, and the callee calls back in before the first call finishes. OWASP SC05, SWC-107. Checklist: reentrancy

Solv Protocol - March 5, 2026

Loss:
$2.73M, 38 SolvBTC (as reported by rekt.news, from Solv's statement)
Chain:
Not stated by source
Root cause:
A token callback fired during a mint before the books were balanced. 135 BRO went in and 567 million came out, looped 22 times. Rekt describes it as a self-reentrancy attack and says a checks-effects pattern or a reentrancy guard on the mint would have closed the window.
Bug class:
Reentrancy (OWASP SC05, SWC-107)
Code bug?
Yes
How a pre-audit check relates:
Reentrancy is one of the classes Guardix checks for in a pre-audit.
Sources:
rekt.news

Input validation

A contract trusts a value it never checked: zero, negative, too large, wrong length. OWASP SC04. Checklist: input validation

Dango - April 13, 2026

Loss:
$1.9M. About $410,000 was cashed out (later returned) and $1.49M was stuck on the platform and recovered (as reported by Halborn).
Chain:
Dango chain
Root cause:
The contracts did not verify that donation amounts were positive.
Bug class:
Input validation (OWASP SC04)
Code bug?
Yes
How a pre-audit check relates:
Input validation is one of the classes Guardix checks for in a pre-audit.
Sources:
Halborn April 2026 review · PANews

Signatures and authorization

A signature must cover everything that matters, and must not work twice. OWASP SC01 (access control), SWC-121, SWC-122. Checklist: signatures

GiddyDeFi - April 23, 2026

Loss:
$1.3M (as reported by Halborn)
Chain:
Ethereum
Root cause:
The attacker replayed a legitimate transaction and changed parameters that the signature did not cover.
Bug class:
Signature / authorization (SWC-121, SWC-122)
Code bug?
Yes
How a pre-audit check relates:
Signature and authorization flaws are a class Guardix checks for in a pre-audit.
Sources:
Halborn April 2026 review · Verichains
04Off-chain

Off-chain hacks: keys, signers, infrastructure

These are not code bugs. An audit of the contracts does not cover them.

Drift Protocol - April 1, 2026

Loss:
$285M (as reported by rekt.news and Halborn)
Chain:
Solana
Root cause:
Attackers got pre-signed authority from Drift's Security Council by social engineering, then used it to add a worthless token as collateral and withdraw funds. Halborn attributes it to the Lazarus Group.
Bug class:
Off-chain: key / signer
Code bug?
No
How a pre-audit check relates:
Not a code bug. A code audit, ours included, does not cover key or signer security.
Sources:
rekt.news: Wrong Attack Surface · Halborn April review

KelpDAO rsETH bridge - April 18, 2026

Loss:
About $290M per rekt.news; $292M per Halborn. 116,500 rsETH.
Chain:
Ethereum and Arbitrum (a LayerZero cross-chain bridge). Per rekt, about $178M was drained on Ethereum and $72M on Arbitrum.
Root cause:
A single verifier was fed false data through compromised RPC nodes, and the bridge released funds on what looked like a valid message. LayerZero blamed KelpDAO's single-verifier setup. KelpDAO said it was LayerZero's documented default. Both are per rekt.
Bug class:
Off-chain: infrastructure
Code bug?
No
How a pre-audit check relates:
Not a code bug. A code audit, ours included, does not cover key, signer or infrastructure security.
Sources:
rekt.news · rekt.news: Wrong Attack Surface · Halborn April review

Resolv Labs - March 2026 (per Defimon; rekt published Apr 8)

Loss:
$24.5–25M in ETH (rekt.news says about $25M; rekt's "Wrong Attack Surface" piece says $24.5M)
Chain:
Not stated by source
Root cause:
A supply-chain attack. A compromised GitHub credential led to a malicious CI/CD workflow that exfiltrated signing credentials. A key in Resolv's cloud infrastructure then gave the attacker unlimited minting.
Bug class:
Off-chain: key / supply chain
Code bug?
No
How a pre-audit check relates:
Not a code bug. A code audit, ours included, does not cover key, signer or infrastructure security.
Sources:
rekt.news · rekt.news: Wrong Attack Surface
05Check your code

Check your own code for these classes

Most entries above are bug classes you can check before you ship. Guardix checks Solidity repos for classes like these in a pre-audit: one repo, one commit, $200 flat, results in 2 to 10 hours, depending on code size.

How our checks score on known bugs: 104 of 117 on EVMBench.

Guardix did not run on any codebase listed here.

06Methodology

Methodology, sources and update log

Method. We include a hack when a public source gives its date, loss and cause. We take the loss from the source and link it. If sources differ, we give the range. We don't add a hack on a single social post.

Sources used on this page:

Update log

  • 2026-10-15: first version.
07FAQ

FAQ

What was the biggest DeFi hack of 2026?
By the sources we use, KelpDAO, at about $290–292M in April. Halborn calls it the biggest hack of 2026 to date at the time of its April review. It was not a contract bug: it came from a single verifier fed false data through compromised RPC nodes.
How do most DeFi hacks happen in 2026?
By value, mostly through keys, signers and infrastructure. Halborn says off-chain causes drove 96% of H1 2026 losses. Contract bugs still cause losses, as the code-level entries above show.
What is an oracle manipulation attack?
A contract reads a price from an oracle. The attacker moves that price, often with a thin pool or a flash loan, then borrows or withdraws against the false value. Makina and Nostra above are examples. See oracles and price inputs in the checklist.
Can an audit prevent DeFi hacks?
An audit can reduce code risk. It does not cover keys, signers or infrastructure, and no audit guarantees a contract is safe. See Drift and KelpDAO above.
How often is this page updated?
Weekly. New hacks are added as entries, and the update log shows what changed.