By class
Open Intelligence and read the cluster of incidents for one root cause. The pattern shows fast.
About
About the archive
A working reference built from 9 years of DeFi loss events (2017 to 2026), compiled and maintained by s0sta.
Each entry documents a real loss event: the flaw in the vulnerable contract, the attacker's flow with the actual numbers, and the lesson an auditor or bug hunter can take into the next review.
How to use it
By time
The database is ordered by date: access control and reentrancy dominated 2021–22, oracle and flash-loan attacks peaked in 2022–23, and recent years moved to new protocol-logic flaws.
Before an audit
Pick the protocol category in Checklists and use its lessons as your first audit checklist.
Where the data comes from
The archive is open source on GitHub. Incident cards live in database/, deep-dive analyses in analyses/. This site reads them from the repository, so every card links back to its source file.