A static, closed-set companion to the research repository below. Every figure, date, and address is taken from the incident writeups in the repository below, nothing live or projected. Example: press reported only the Ethereum leg of the Sandbox bridge exploit; the reconstruction finds 405.83 WETH gross across Base and Ethereum, about 5.2 times the press figure.
Ranked by loss as listed in the repository index, not by how loud the press coverage was. † marks a sourced figure, not independently recomputed.
Computed live from the same dataset as the table below: no external query, nothing to re-run.
| Protocol | Chain | Date | $ Lost | Technique | Writeup |
|---|
Click "Date" or "$ Lost" to sort, click again to reverse. The ≥ / ≈ / † prefixes are copied as-is from the repository index: ≥ means the writeup itself gives a lower bound, ≈ means an independently recomputed approximation, † means a figure sourced from the protocol, press or DefiLlama rather than recomputed. None is added by this page.
Paste a 0x address. Checks it only against the attacker/exploiter/cash-out addresses named in the incidents above. It is not a general wallet safety check, and "no match" says nothing beyond that.
This is an independent research project, not investment, legal, or security advice. It does not audit, endorse, or warn against any protocol, and it does not screen addresses generally, only against the closed set of incidents documented in the repository above. Corrections and disputes are invited: x.com/RealSpap.