{
 "dataset": "hacks",
 "title": "Hack & exploit tracker",
 "note": "Every incident with its amount traced to a published source. A blank `amount_usd` is deliberate and is not zero: it means no figure has been stated by a source we would cite, and filling it with an estimate is the one thing this tracker will not do.",
 "integrity": {
  "dataset": "hacks",
  "window_days": 14,
  "scope": "Hand-curated from published sources. No gap ledger covers it, which means this report cannot tell you about an incident nobody wrote up — the one blind spot a tracker like this really has.",
  "rows_window": {},
  "rows_window_says": "",
  "coverage": {
   "ledgers": [],
   "gap_rows": 0,
   "not_looking_minutes": 0,
   "complete": null,
   "windows": []
  },
  "density": {
   "per_day": null,
   "expected_per_day": null,
   "expected_from": "not a continuous record — a day with no rows in it is a quiet day in the world, not a gap in ours",
   "mean_per_day": null,
   "thin_days": [],
   "empty_days": []
  },
  "provenance": [],
  "provider_fallbacks": [],
  "corrections": [],
  "our_downtime": [
   {
    "id": "2026-10-07-unexplained-0239",
    "date": "2026-10-07",
    "minutes": 38,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 38 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-06-unexplained-0757",
    "date": "2026-10-06",
    "minutes": 44,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 44 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-06-unexplained-1006",
    "date": "2026-10-06",
    "minutes": 107,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 107 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-06-unexplained-1856",
    "date": "2026-10-06",
    "minutes": 47,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 47 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-03-unexplained-1956",
    "date": "2026-10-03",
    "minutes": 39,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 39 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-03-unexplained-2103",
    "date": "2026-10-03",
    "minutes": 46,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 46 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-10-02-unexplained-0213",
    "date": "2026-10-02",
    "minutes": 65,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 65 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-29-unexplained-1011",
    "date": "2026-09-29",
    "minutes": 57,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 57 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-28-unexplained-0915",
    "date": "2026-09-28",
    "minutes": 44,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 44 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-28-unexplained-1229",
    "date": "2026-09-28",
    "minutes": 39,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 39 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-28-unexplained-1322",
    "date": "2026-09-28",
    "minutes": 37,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 37 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-28-unexplained-1906",
    "date": "2026-09-28",
    "minutes": 31,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 31 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-25-unexplained-1850",
    "date": "2026-09-25",
    "minutes": 31,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 31 minutes (stage 'budget')",
    "explained": false
   },
   {
    "id": "2026-09-24-unexplained-1211",
    "date": "2026-09-24",
    "minutes": 31,
    "severity": "degraded",
    "title": "The wire wrote no ledger row for 31 minutes (stage 'budget')",
    "explained": false
   }
  ],
  "not_checked": {
   "at": "2026-08-31",
   "checks": 2710,
   "failed": 5,
   "failures": [
    "…and the tape carries PLAIN-TEXT rows as well as linked ones — a row with nothing behind it has no `href` at all, so the two states are distinguishable in the markup and not only in the styling (batch L §9), and a page where every row linked would not be exercising that rule",
    "every recorded incident carries a written post-mortem",
    "…and the timeline shows we were first",
    "…which keeps the permalink, grows the timeline, and records the event that ended it",
    "…and the measured row is 46px on a phone and 42px above 620 — the heights §1 asked for, read off the rendered page"
   ],
   "passed": 2705,
   "raises": 0,
   "skipped": 4,
   "skips": [
    [
     "digest-2026-08-09-pm: its links resolve to published posts and to pages on disk (3 checks)",
     "published before the wrap became a linked recap — the stored post is the audit trail and is never rewritten"
    ],
    [
     "the display rung (44) is asserted on the lead card's figure",
     "the figure is the hero number INSIDE the card graphic — SVG user units in an 800x450 viewBox — so its rendered size is `units x (card width / 800)` and no one value makes it 44px on the front page, an article page and a share kit at once. Measured: 126px before this batch and 68.7px after, at 1440x900, because §6 put the lead in a 1/3 column. Reaching 44 means re-composing the card graphic, which is a batch and not a line — see docs/BATCH-K-REPORT.md"
    ]
   ]
  },
  "not_checked_excluded": false
 },
 "columns": [
  "date",
  "protocol",
  "amount_usd",
  "method",
  "chain",
  "slug",
  "sources"
 ],
 "count": 30,
 "rows": [
  {
   "date": "2026-10-06",
   "protocol": "Bybit",
   "amount_usd": 1500000000.0,
   "method": "theft by Lazarus Group",
   "chain": null,
   "slug": "zachxbt-says-he-fronted-349-700-to-infiltrate-chinese-syndicate-laundering-bybit",
   "sources": null
  },
  {
   "date": "2026-10-02",
   "protocol": "Bitget",
   "amount_usd": 387500000.0,
   "method": "compromised private key",
   "chain": null,
   "slug": "bitget-expects-little-recovery-from-387-5-million-hack-ceo-says",
   "sources": null
  },
  {
   "date": "2026-10-01",
   "protocol": "NEAR Intents",
   "amount_usd": 3800000.0,
   "method": "contract flaw",
   "chain": null,
   "slug": "near-intents-halts-services-after-3-8-million-exploit-pledges-full-compensation",
   "sources": null
  },
  {
   "date": "2026-10-01",
   "protocol": "Bitget",
   "amount_usd": 388000000.0,
   "method": null,
   "chain": null,
   "slug": "crypto-hacks-reached-768m-in-september-2026-the-year-s-worst-month",
   "sources": null
  },
  {
   "date": "2026-09-29",
   "protocol": "Bitget",
   "amount_usd": 388000000.0,
   "method": null,
   "chain": null,
   "slug": "bitget-ceo-says-fund-recovery-outlook-bleak-after-388m-breach",
   "sources": null
  },
  {
   "date": "2026-09-28",
   "protocol": "Bitget",
   "amount_usd": 388000000.0,
   "method": "vulnerability exploit, risk control bypass",
   "chain": null,
   "slug": "bitget-resumes-withdrawals-in-phases-after-388-million-exploit-pledges-full-user",
   "sources": null
  },
  {
   "date": "2026-09-25",
   "protocol": "KelpDAO",
   "amount_usd": 292000000.0,
   "method": "rsETH bridge exploit",
   "chain": null,
   "slug": "kelpdao-sues-layerzero-and-ceo-bryan-pellegrino-over-292m-rseth-bridge-exploit",
   "sources": null
  },
  {
   "date": "2026-09-25",
   "protocol": "Bitget",
   "amount_usd": 352000000.0,
   "method": "spoofed transfers",
   "chain": null,
   "slug": "bitget-hack-losses-climb-to-387-5-million-as-exchange-suspends-withdrawals",
   "sources": null
  },
  {
   "date": "2026-09-22",
   "protocol": "Coldcard",
   "amount_usd": null,
   "method": "exploit",
   "chain": null,
   "slug": "whitehats-recover-52-bitcoin-from-coldcard-exploit-move-funds-to-wyoming-trust",
   "sources": null
  },
  {
   "date": "2026-09-14",
   "protocol": "Symbiosis",
   "amount_usd": 336000.0,
   "method": "Bitcoin bridge exploit",
   "chain": null,
   "slug": "symbiosis-recovers-15-btc-from-bridge-exploit-raises-bounty-offer-to-20-after",
   "sources": null
  },
  {
   "date": "2026-09-11",
   "protocol": "Liquid",
   "amount_usd": null,
   "method": "exploit",
   "chain": null,
   "slug": "blockstream-rejects-ransom-demand-as-liquid-exploit-hackers-retain-nearly-600",
   "sources": null
  },
  {
   "date": "2026-09-08",
   "protocol": "Tectonic",
   "amount_usd": 9190000.0,
   "method": "exploit",
   "chain": null,
   "slug": "cronos-chain-rollback-recovers-111-2-million-from-tectonic-exploit-but-9-2",
   "sources": null
  },
  {
   "date": "2026-09-07",
   "protocol": "Liquid Network",
   "amount_usd": 320000000.0,
   "method": "Elements vulnerability exploit",
   "chain": null,
   "slug": "liquid-network-halts-operations-after-hackers-withdraw-320-million-in-bitcoin-cl",
   "sources": null
  },
  {
   "date": "2026-09-07",
   "protocol": "Coldcard",
   "amount_usd": 7700000.0,
   "method": "compromised hardware wallet",
   "chain": null,
   "slug": "coldcard-hacker-moves-7-7-million-in-bitcoin-45-of-funds-stolen-in-third-attack",
   "sources": null
  },
  {
   "date": "2026-08-30",
   "protocol": "Tectonic",
   "amount_usd": 75000000.0,
   "method": "oracle price manipulation, borrowing against inflated…",
   "chain": null,
   "slug": "cronos-network-halts-after-tectonic-exploit-estimated-at-75-million",
   "sources": null
  },
  {
   "date": "2026-08-24",
   "protocol": "Term Finance",
   "amount_usd": 8500000.0,
   "method": "governance exploit, attacker bought voting power",
   "chain": null,
   "slug": "term-finance-loses-8-5-million-after-attacker-buys-voting-power-in-governance-ex",
   "sources": null
  },
  {
   "date": "2026-08-22",
   "protocol": "BounceBit",
   "amount_usd": 3000000.0,
   "method": "token transfer from compromised wallets",
   "chain": null,
   "slug": "bouncebit-to-sunset-blockchain-and-migrate-to-bnb-chain-after-3-million-exploit",
   "sources": null
  },
  {
   "date": "2026-08-21",
   "protocol": "MANTRA",
   "amount_usd": null,
   "method": "exploit",
   "chain": null,
   "slug": "mantra-token-plunges-18-to-record-low-as-blockchain-halts-following-exploit",
   "sources": null
  },
  {
   "date": "2026-08-21",
   "protocol": "Coldcard",
   "amount_usd": null,
   "method": "firmware vulnerability",
   "chain": null,
   "slug": "coldcard-releases-firmware-after-nine-figure-bitcoin-theft-ai-reviewed-code-for",
   "sources": null
  },
  {
   "date": "2026-08-19",
   "protocol": "Maya Protocol",
   "amount_usd": 1700000.0,
   "method": "exploit",
   "chain": null,
   "slug": "maya-protocol-exploit-drains-bitcoin-and-other-assets-pool-value-drops-11-millio",
   "sources": null
  },
  {
   "date": "2026-08-17",
   "protocol": "Harmony",
   "amount_usd": null,
   "method": "forged tokens, bridge exploit",
   "chain": null,
   "slug": "harmony-to-rollback-109-000-transactions-after-exploit-that-forged-3-trillion-on",
   "sources": null
  },
  {
   "date": "2026-08-17",
   "protocol": "Coldcard",
   "amount_usd": 100000000.0,
   "method": "bug in code",
   "chain": null,
   "slug": "coldcard-bug-allowed-100-million-in-funds-to-be-hacked-over-years-coindesk-repor",
   "sources": null
  },
  {
   "date": "2026-08-13",
   "protocol": "Coldcard",
   "amount_usd": 130000000.0,
   "method": "exploit",
   "chain": null,
   "slug": "bitcoin-holders-moved-15-billion-to-safety-following-coldcard-wallet-compromise-",
   "sources": null
  },
  {
   "date": "2026-08-12",
   "protocol": "Harmony",
   "amount_usd": null,
   "method": "unauthorized token minting",
   "chain": null,
   "slug": "harmony-s-one-token-falls-40-after-exploit-mints-billions-of-unauthorized-tokens",
   "sources": null
  },
  {
   "date": "2026-08-11",
   "protocol": "Coldcard",
   "amount_usd": null,
   "method": null,
   "chain": null,
   "slug": "coldcard-hack-losses-remain-unclear-as-investigators-depend-on-victim-reports-an",
   "sources": null
  },
  {
   "date": "2026-08-11",
   "protocol": "Coinsbuy",
   "amount_usd": 7900000.0,
   "method": "unauthorized withdrawals",
   "chain": null,
   "slug": "coinsbuy-offers-100k-bounty-for-information-on-7-9m-security-breach",
   "sources": null
  },
  {
   "date": "2026-08-11",
   "protocol": "Coinsbuy",
   "amount_usd": 8000000.0,
   "method": "coordinated two-blockchain attack",
   "chain": null,
   "slug": "crypto-exchange-coinsbuy-loses-8-million-in-coordinated-attack-across-tron-and-e",
   "sources": null
  },
  {
   "date": "2026-08-11",
   "protocol": "BTCPay Server",
   "amount_usd": 190000.0,
   "method": "critical exploit vulnerability",
   "chain": null,
   "slug": "btcpay-server-supporters-offer-up-to-3-btc-bounty-after-exploit-drains-payment-s",
   "sources": null
  },
  {
   "date": "2026-08-09",
   "protocol": "Coldcard",
   "amount_usd": null,
   "method": "wallet exploit",
   "chain": null,
   "slug": "bitcoin-and-ether-etfs-post-best-inflow-week-since-april-amid-coldcard-exploit-f",
   "sources": null
  },
  {
   "date": "2026-08-09",
   "protocol": "BTCPay",
   "amount_usd": null,
   "method": "drained Lightning nodes",
   "chain": null,
   "slug": "btcpay-restricts-remote-lightning-access-after-attackers-steal-funds",
   "sources": null
  }
 ]
}