How entries are collected and checked

I keep this tracker as a dated, sourced record of public reports. It does not investigate, accuse or rate anyone. Every entry says what its sources say, links them, and changes when they change.

What counts as an agent-money incident

Money lost, moved to the wrong place, or exposed through a disclosed drain path, where an autonomous or automated piece of software held, spent, signed or decided on the funds, or where agent infrastructure was the path. That covers:

• AI agent with a wallet
• Trading bot
• MEV or arbitrage bot
• Keeper, oracle or market-maker bot
• Agent wallet or signer
• Agent payment rail
• Agent framework, plugin or router
• AI-written code

Left out: tokens that only have "AI" in their name and were hacked through ordinary contract bugs; attackers using AI to phish people; incidents where a bot was the attacker rather than the thing that lost money; and general protocol hacks with no agent or bot involved. The window starts on 1 November 2024.

Dates are in UTC, the day the money moved. A loss is money that moved. A near-miss is a disclosed vulnerability or study that showed a working path to an agent's money before (or without) a reported loss.

Where entries come from

• DeFiLlama's public hacks dataset (structured rows; used as a lead, never as the only source)
• rekt.news (post-mortems feed)
• Cointelegraph (news feed)
• The Block (news feed)
• CoinDesk (news feed)
• The Defiant (news feed)
• SlowMist (post-mortems feed)
• Hacker News stories matching agent-money searches (the linked page is the source)
• GitHub security advisories for agent wallet and agent payment packages (x402, AgentKit, elizaOS, GOAT, Solana Agent Kit)
• Public block explorers and RPC endpoints, to check cited transactions
• A starting set researched by hand from post-mortems, security-firm write-ups, news and papers, covering November 2024 to November 2026

When an entry is published

Collection runs every day. A new entry is published only when all of these hold:

1. A rule-based classifier finds an agent, bot or agent-infrastructure signal and a loss or drain path. No language model reads the collected text, so a hostile article cannot steer it.
2. There is at least one per-incident link (a post-mortem, an article or an advisory), not just a list page.
3. A second, independent signal agrees: another outlet, a DeFiLlama row, or the link is itself a security firm's post-mortem or an advisory.
4. The record passes the field checks: real dates inside the window, known chains and causes, well-formed transaction hashes, sources with publishers.

Anything short of that is held and retried on every run, so a dataset row with no link is published on the day a news story matches it. Entries collected this way are marked "reported" and say "collected automatically". Starting-set entries went through the same field checks, and a checker opened every cited page and kept an entry only when at least one page named the project.

One incident, one entry

The same loss shows up as a dataset row, a post-mortem and several articles, days apart and with different figures. Items are treated as one incident when they share a transaction hash; or share a link and are within 7 days of each other with the same project or a similar headline; or name the same project within 7 days; or have near-identical headlines within 3 days. A matching item adds its link to the existing entry instead of creating a new one. One article that covers several incidents does not merge them.

On-chain checks

Transaction hashes cited by sources are looked up on public endpoints for Ethereum, Base, Arbitrum, OP Mainnet, Polygon, BNB Chain, Solana and Base Sepolia. Each entry shows whether the transaction was found and its block time. When sources gave only the month, the block time sets the day, and the change is logged on the entry. A transaction that is not found is shown as not found; nothing is hidden. The checks only read: nothing is signed or sent.

Root causes and the free checks

Cases checked and left out

Some widely repeated cases did not meet the scope once the primary sources were read:

• Coinbase (August 2025): MEV bots took the funds; the wallet that lost them was not an agent.
• Kipseli (April 2026): A protocol quoting bug; the only bot involved was the taker.
• Step Finance (January 2026): Secondary posts linked it to AI agents or MCP; no primary source does. Entry method undisclosed (executive devices compromised).
• ElizaOS secrets exposure (December 2025): Agent secrets were exposed, but no source says wallet keys were among them and no drain path was shown.
• Bitget (April 2025): An exchange incident: the sources describe eight trading accounts gaining about $20M from abnormal VOXEL futures trading, which Bitget rolled back; Bitget did not confirm a bot was involved (QA B4-QA-12).

Corrections and replies

Anyone can send a new incident, a correction or a reply. Links sent this way are stored, never fetched by my servers; a reported incident goes through the same publication rule as everything else. Every report is reviewed; a correction backed by a source is applied and dated on the entry, and the reasons for any report I do not act on are recorded. A party named in an entry can send a reply, which I add to the entry, dated, once I have confirmed it comes from them (for example, an email from the project's own domain).

Pipeline status

• Last run: Nov 11, 2026, 8 of 9 sources answered
• Published entries: 49; held leads waiting for a source: 2; items merged into existing entries: 9; near-scope items left out: 7
• Data: live from the tracker service, generated Nov 11, 2026. Machine-readable feed: /api/feed.json on the tracker service.

This is a record of public reports, not a security audit, legal, compliance or investment advice. Names appear only as the sources report them.