Latest · Oct 23, 2026
September: the worst month for crypto hacks in 2026
DefiLlama tracked $742.5M lost across 35 incidents in September, the worst month of 2026.
Research
Our analysis of crypto hacks and losses, the critical bugs found through Immunefi's bug bounty programs, and the researchers who find them.
Research
Bugfix reviews
Critical bugs that researchers found through Immunefi bug bounties, and how each team fixed them.
- Sky Remote Code Execution Bugfix ReviewFeb 2025
- Top 3 Bugs from the ThunderNFT Invite Only ProgramDec 2024
- Top 3 Bugs from the Shardeum Ancillaries Audit CompetitionNov 2024
See all bugfix reviews
- Top 3 Bugs from the Shardeum Core Audit CompetitionOct 2024
- Top 5 Bugs from the Fuel AttackathonSep 2024
- Raydium Tick Manipulation Bugfix ReviewSep 2024
- Threshold Transaction Malleability Bugfix ReviewAug 2024
- Alchemix Access Control Issue Bugfix ReviewJun 2024
- The Graph Rounding Error Bugfix ReviewMay 2024
- Weekly Bugfix Snapshot —March 29Mar 2024
- Setting Up A Bridge With FoundryFeb 2024
- Stacks DoS Bugfix ReviewFeb 2024
- Introducing Boost: Immunefi's Newest Security OfferingFeb 2024
- zkSync Insufficient Proof Verification Bugfix ReviewFeb 2024
- Beanstalk Insufficient Input Validation Bugfix ReviewJan 2024
- Astar Network Integer Truncation Error Bugfix ReviewJan 2024
- Alchemix Missing Solvency Check Bugfix ReviewNov 2023
- Aztec Multiple-Spend Error Bugfix ReviewNov 2023
- Sui Temporary Total Network Shutdown Bugfix ReviewOct 2023
- Balancer Rounding Error Bugfix ReviewOct 2023
- Common Cross-Chain Bridge VulnerabilitiesAug 2023
- The Potential Impact Of ERC-777 Tokens On DeFi ProtocolsAug 2023
- Yield Protocol Logic Error Bugfix ReviewJul 2023
- How To Reproduce A Simple MEV AttackJul 2023
- How to Write a Bugfix ReviewJun 2023
- Silo Finance Logic Error Bugfix ReviewJun 2023
- DFX Finance Rounding Error Bugfix ReviewJun 2023
- Enzyme Finance Missing Privilege Check Bugfix ReviewMay 2023
- Hack Analysis: BonqDAO, February 2023Mar 2023
- Hack Analysis: Binance Bridge, October 2022Mar 2023
- Beanstalk Logic Error Bugfix ReviewFeb 2023
- Balancer Logic Error Bugfix ReviewFeb 2023
- Hack Analysis: 0xbaDc0dE MEV Bot, September 2022Jan 2023
- Hack Analysis: Nomad Bridge, August 2022Jan 2023
- Hack Analysis: Beanstalk Governance Attack, April 2022Jan 2023
- Moonbeam, Astar, And Acala Library Truncation Bugfix Review — $1m PayoutJan 2023
- Hack Analysis: Omni Protocol, July 2022Dec 2022
- 88MPH Theft Of Unclaimed MPH Rewards Bugfix ReviewDec 2022
- Mt Pelerin Double Transaction Bugfix ReviewNov 2022
- Hack Analysis: Saddle Finance, April 2022Nov 2022
- Hack Analysis: Cream Finance Oct 2021Nov 2022
- Aurora Improper Input Sanitization Bugfix ReviewSep 2022
- Hack Analysis: the Hundred Finance Heist, March 2022Sep 2022
- Aurora Withdrawal Logic Error Bugfix ReviewSep 2022
- Hack Analysis: Uranium Finance, April 2021Sep 2022
- Moonbeam Missing Call Check Bugfix ReviewJul 2022
- Balancer DoS Bugfix ReviewJul 2022
- Two Novel Crypto Wallet Exploits, ExplainedJul 2022
- Synthetix Logic Error Bugfix ReviewJul 2022
- Port Finance Logic Error Bugfix ReviewJun 2022
- Sense Finance Access Control Issue Bugfix ReviewJun 2022
- Aurora Inflation Spend Bugfix Review: $6m PayoutJun 2022
- Redacted Cartel Custom Approval Logic Bugfix ReviewMay 2022
- Wormhole Uninitialized Proxy Bugfix ReviewMay 2022
- Optimism Infinite Money Duplication Bugfix ReviewMar 2022
- Polygon Consensus Bypass Bugfix ReviewFeb 2022
- Subdomain Takeover Bugs — When They’re Applicable And When They’re NotFeb 2022
- APWine Incorrect Check of Delegations Bugfix ReviewFeb 2022
- Notional Double Counting Free Collateral Bugfix ReviewFeb 2022
- Cronos Theft of Transactions Fees Bugfix ReviewJan 2022
- Why Bugfix Reviews Are Good For Web3Jan 2022
- Polygon Lack Of Balance Check Bugfix Review — $2.2m BountyDec 2021
- Enzyme Finance Price Oracle Manipulation Bugfix ReviewNov 2021
- Harvest Finance Uninitialized Proxies Bugfix Review— $200k BountyNov 2021
- Polygon Double-Spend Bugfix Review — $2m BountyOct 2021
- RocketPool and Lido Frontrunning Bugfix ReviewOct 2021
- Belt Finance Logic Error Bugfix Review — Largest Ever Bounty PayoutSep 2021
- OpenZeppelin Reentrancy Bugfix ReviewSep 2021
- Tidal Finance Logic Error Bugfix ReviewAug 2021
- xDai Stake Arbitrary Call Method Bugfix ReviewAug 2021
- Teller Bugfix Review and Bug Bounty LaunchAug 2021
- Alchemix Access Control Bugfix ReviewJul 2021
- MCDEX Insufficient Validation Bugfix ReviewJul 2021
- Cream Finance Insufficient Validation Bugfix ReviewJul 2021
- PancakeSwap Logic Error Bugfix ReviewJul 2021
- Pods Finance Logic Error Bugfix ReviewJun 2021
- Mushrooms Finance Logic Error Bugfix ReviewJun 2021
- SharedStake Insider Exploit PostmortemJun 2021
- Zapper Arbitrary Call Data Bugfix ReviewJun 2021
- 88mph Function Initialization Bugfix ReviewJun 2021
- PancakeSwap Content Injection Bugfix ReviewJun 2021
- Bitswift Race Condition Bugfix ReviewMay 2021
- Charged Particles Griefing Bugfix ReviewMay 2021
- Mushrooms Finance Theft Of Yield Bugfix ReviewMay 2021
- Fei Protocol Flashloan Vulnerability Bugfix ReviewMay 2021
- Sovryn Loan Vulnerability Bugfix ReviewMay 2021
- Vesper Rebase Vulnerability Bugfix Review And Bug BountyMay 2021
- Fei Protocol Vulnerability Bugfix ReviewApr 2021
- PancakeSwap Lottery Vulnerability Bugfix Review And Bug BountyMar 2021
- Armor Bugfix ReviewFeb 2021
- Bitswift Unlimited Mint Bugfix ReviewJan 2021