Prior exploit count

Methodology how we score #

**What this measures** This factor counts the total number of distinct in-sample hack incidents affecting this protocol, as recorded in the hacks database with post-mortems completed. Each incident counts once regardless of loss size. The count is updated whenever a new incident is confirmed and post-mortemed. It is the primary input to the chronic-flag calculation (RD-F-078) and feeds directly into the protocol-level badge assignment.

**Why it matters** A protocol that has been successfully exploited once has demonstrated at minimum one exploitable vulnerability in its codebase or operational posture. Six protocols in the dataset were exploited more than once, and in four of those cases the second exploit arrived within twelve months of the first -- either by bypassing an incomplete fix or by targeting a different but equally serious weakness. The prior-exploit count is a leading indicator of security-culture deficiency: it signals that either the code-quality bar is insufficient, the upgrade discipline is weak, or operational security is persistently below peer standards.

**Green / Yellow / Red** Green: zero prior exploits in the database. Yellow: one prior exploit with a documented remediation, a re-audit, and no same-root-cause recurrence for at least twelve months. Red: two or more prior exploits, or one prior exploit without documented remediation or re-audit.

**Common gray cases** Near-miss events (governance proposals voted down before execution, white-hat interventions with full fund recovery) are not counted as incidents unless the underlying vulnerability was successfully triggered even briefly. Curator judgment is required on partial-drain incidents where root cause is unconfirmed.

**Notable historical examples** - **Compound Finance** ($147M, 2021): Second incident in twelve months; governance upgrade introduced the drip() vulnerability on an already-exploited Comptroller. - **Radiant Capital** ($53M, 2024): Second incident targeting an entirely different vector (multisig key compromise) than the first (flash loan attack). - **AlexLab** ($16.18M, 2025): Second exploit via vault permission hijack; first was a private key compromise, indicating independent systemic gaps. - **Abracadabra Money** ($13M, 2025): Second incident via phantom collateral in a gmCauldron upgrade; different vector from first. - **Platypus Finance** ($8.5M, 2023): Part of a pattern of three incidents in eight months.

Measurement what to look for #

Count the number of distinct incidents in the hack database affecting this protocol.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 19 historical incidents #