Incident All ledgers
Furucombo: $14.0m
Furucombo lost $14.0m on 27 February 2021. Ranked 161st of 1,272 crypto failures, with method, returned funds and comparable incidents.
- Date
- 27 February 2021
- Lost
- $14.0m
- Returned or repaid
- None recorded
- Target
- DeFi Protocol
- Category
- Access Control
- Method
- Delegatecall Hijack
- Chains
- Ethereum
On February 27, 2021, an attacker exploited Furucombo for about $14M by deploying a fake contract posing as the Aave v2 implementation. Because Furucombo did not authenticate the delegatecall target, pre-approved tokens were drained from about 22 users.
Against the ledger
- It ranks 161st of the 1,272 incidents with a known loss, and 33rd in 2021.
- It accounts for 21.4% of the $65.4m in known losses in February 2021.
- 225 incidents in the ledger are classified as Access Control, for $1.96bn in total. This one is 0.7% of that.
- The ledger records no returned funds.
Closest in size by the same method
| Date | Target | Lost | Type | Method | Returned |
|---|---|---|---|---|---|
| 25 Mar 2024 | Curio | $16.0m | DeFi Protocol | Delegatecall Hijack | — |
| 27 May 2026 | SUPERFORTUNE AI | $15.2m | Token | Improper Access Control | — |
| 28 May 2025 | Cork V1 | $12.0m | DeFi Protocol | Improper Access Control | — |
| 06 Aug 2024 | Ronin Bridge | $12.0m | DeFi Protocol | Uninitialized Proxy | — |
| 22 Sept 2025 | UXLINK | $11.3m | DeFi Protocol | Delegatecall Hijack | — |
All failures in 2021 · The failures ledger
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
Cite this Bitminer.io, “Furucombo, failures ledger”, data to 2 November 2026, https://bitminer.io/ledger/incident/furucombo-2021-02-27/. How this is built