On 21 February 2025, signers at the exchange Bybit approved what looked to them, by the company’s account, like a routine wallet transaction, and over 400,000 ETH and stETH left. The FBI put the theft at about $1.5 billion and attributed it to North Korea. Forensic reviews found no flaw in Safe’s smart contracts. The screen lied.
Nine years earlier, on 17 June 2016, the opposite happened: a contract called The DAO obeyed its code to the letter, and the code paid one withdrawal over and over. Most DeFi hacks since then fit one of those two stories. Either the code did what it was written to do in an order nobody had planned for, or the code was fine and the people, keys or servers around it gave way.
This lesson takes the three classic technical families (reentrancy, flash loans, manipulated oracles), walks through how each attack ran, then covers bridges, signers and the large incidents of 2025 and 2026. It follows our lesson on reading an audit report and goes deeper than the general view in can a blockchain be hacked: here the chain keeps working, and the application on top of it breaks. For where these incidents sit among the other dangers, see our map of DeFi risks.
How to read any DeFi exploit with two questions
An exploit uses a flaw in a protocol to take money the rules were never meant to release. A rug pull is different: the team itself walks away with the funds. An exchange hack is different again, because the victim is a company holding customers’ coins, although Bybit belongs in this lesson since its weak point was a signing flow used across DeFi.
Post-mortems are long, and the first reports are often wrong. Two questions sort almost all of them. Which assumption failed? And who had the power to move the money? A price assumed to be fair, a balance assumed to be updated, a signature assumed to be checked, a screen assumed to be honest: each case below is one of those. The answer to the second question tells you whether the fix belongs in the code or in the organisation.
Reentrancy: the contract is called back before it has finished
When a smart contract sends ether, it hands control to the receiver. If the receiver is itself a contract, it can run code at that moment, including a call back into the sender. The Solidity documentation treats this as a standing pitfall: any external call opens that door, a transfer of ether being just one case.
Here is the shape of the bug, in a simplified example written for this lesson:
function withdraw() external {
uint256 amount = balances[msg.sender];
(bool ok, ) = msg.sender.call{value: amount}(""); // money leaves first
require(ok);
balances[msg.sender] = 0; // balance cleared too late
}The attack runs in four steps.
- The attacker deposits a small amount from a contract and calls withdraw.
- The victim sends the ether, which triggers the attacker’s contract.
- That contract calls withdraw again. The balance has not been reset, so the check still passes and the payment repeats.
- The loop stops when the victim runs dry or the transaction runs out of gas. Only then does the balance reach zero.
The standard defence is called checks-effects-interactions: validate, update your own state, and only then call the outside world. Swap the last lines of the example and the second call finds a zero balance. Many teams also add a reentrancy lock, a flag that refuses any call arriving while the function is still running.
From The DAO to GMX V1: the same bug, nine years apart
The DAO had about 11.5 million ETH committed when an attacker recursively called its splitDAO function before balances were updated, as the DefiLlama hacks database describes it. About 3.6 million ETH left, worth roughly $50 to $60 million at the time depending on the source, into an account subject to a 28-day holding period. That delay gave the community time to argue. Ethereum was hard forked on 20 July 2016 to move the funds to a recovery address, and the unforked chain lives on as Ethereum Classic.
Modern reentrancy is subtler. On 9 July 2025, GMX V1 lost about $42 million on Arbitrum. Sherlock’s analysis traces it to the ETH profit payout on a small trade: the receiver re-entered the system and opened a large BTC short directly through the vault, raising the total short size without updating the average price that a separate tracker kept. GLP, the pool’s share token, is priced from those figures. The attacker bought GLP, repeated the move at larger size so the pool looked far richer than it was, and sold the GLP back at the inflated price. The balance was never the problem: a second piece of state fell out of step with the first. DefiLlama records $40 million returned, with the attacker keeping a bounty of about $5 million.
Curve showed that even a correct guard can vanish. On 30 July 2023 several Curve pools lost about $61.7 million by DefiLlama’s count. The LlamaRisk post-mortem sets out why: Vyper versions 0.2.15, 0.2.16 and 0.3.0 produced a broken reentrancy lock, so the source code had the protection and the deployed bytecode did not. The attacker re-entered between removing and adding liquidity, and new LP tokens were priced on balances from before the burn. A review of the Vyper source alone would not have caught it, which is why an audit’s scope matters.
Flash loan attacks: borrowed size for one transaction
A flash loan lends any amount with no collateral, provided it comes back in the same transaction. Our guide to flash loans covers the mechanics. The point for this lesson: a flash loan is not a bug. It removes one barrier, the capital needed to push a thin market or inflate a position, so a flaw that once required a fortune now requires only gas and a fee. In the bZx case, Quantstamp noted that the flash loans were never the vulnerability.
bZx and Cream: the loan that moved a price
bZx took the two attacks that made flash loans famous, on 15 and 18 February 2020. Quantstamp measured the underwater positions they left at about $640,000 and $800,000. Both ran atomically inside one transaction. In the first, borrowed ETH produced heavy slippage in a thin market, and Quantstamp argues that was not an oracle attack. The second was: the attacker pushed up sUSD on decentralised exchanges, bZx read those prices as the collateral’s value, and the loan was underwater from the moment it was made.
Cream Finance, on 27 October 2021, shows the scale two years later. Per Immunefi’s reconstruction, the attacker flash-minted about $500 million in DAI from MakerDAO and flash-borrowed about 524,000 ETH from Aave. The loop then ran like this: buy yUSD, a Yearn vault token, and post it on Cream; use a second account to borrow more yUSD and re-deposit it, counting the same asset several times; and finally send about $10 million of the vault’s underlying tokens straight into the vault. That transfer raised the vault’s assets per share without minting anything, which took Cream’s yUSD price from about $1 towards $2. The inflated collateral then borrowed everything available, about $130 million of liquidity. Two flaws combined: a price that could be moved, and no cap on supplying the same asset.
Euler 2023: one missing check and a self-liquidation
Euler lost about $197 million on 13 March 2023, and the flash loan only supplied the size. BlockSec’s analysis of the DAI transaction shows the real flaw: donateToReserves let a user give away collateral tokens without any health check.
- Borrow 30 million DAI by flash loan, deposit 20 million of it and use Euler’s own minting to build a position of 410 million eDAI against 390 million dDAI of debt.
- Donate 100 million eDAI to the reserves, leaving 310 million eDAI of collateral against 390 million dDAI of debt. The account is insolvent, and nothing stops it.
- From a second address, liquidate the first at a steep discount, collecting 310 million eDAI and taking on only 259 million dDAI.
- Withdraw about 38.9 million DAI, repay the flash loan and keep the rest.
An attacker liquidating their own account at a discount turns insolvency into profit, which is why the liquidation design counts as much as the missing check. The ending was unusual. Euler offered a 10 percent bounty, and on 3 April 2023 the attacker sent back the last $31 million, bringing the total returned to over $177 million, The Block reported.
Manipulated oracles: a price that someone can move
An oracle tells a protocol what an asset is worth, and a lending market trusts that number with everything it holds. Our lesson on oracle design compares spot prices, time-weighted averages and aggregated feeds. The short version: a spot price read from one pool can be moved in a single trade, an average takes longer and costs more to push, and an aggregated feed draws on several venues. None of them helps if the market behind the token is too thin.
Mango Markets 2022: convictions undone, and an appeal
On 11 October 2022 the price of MNGO, Mango Markets’ own token, was driven up on the three exchanges that fed the platform’s valuation of its perpetual contracts. DefiLlama describes about $5 million of starting capital turning into about $423 million of paper collateral, which then borrowed about $110 to $116 million in real assets. The court record puts the withdrawals inside about thirty minutes. Nothing in the code malfunctioned: the price feed reported a real, thin market.
Avraham Eisenberg was indicted over it on 9 January 2023. The CFTC and the SEC filed civil complaints that month alleging a manipulative scheme. On 18 April 2024 a jury convicted him of commodities fraud, commodities manipulation and wire fraud, in what the Justice Department called its first crypto open-market manipulation case.
The convictions did not hold at trial level. In an opinion of 23 May 2025, Judge Arun Subramanian of the Southern District of New York granted Eisenberg’s Rule 29 motion and treated the counts differently. He vacated the two commodities counts on venue: Eisenberg was in Puerto Rico, and the evidence did not place essential conduct in that district. On wire fraud he entered an acquittal, finding venue lacking there too and insufficient evidence of falsity, because the platform had no terms and no stated duty to repay. “There was just the word ‘borrow,'” he wrote.
A venue ruling is not a finding of innocence. The opinion cites the Supreme Court on that point: such a reversal “does not resolve the bottom-line question of criminal culpability.” The judge also held the evidence sufficient that Eisenberg intended to manipulate, and noted he had waived any challenge to the jury’s finding of a manipulative device.
The case is not closed. DL News reported on 7 January 2026 that prosecutors had appealed in a brief dated 22 December 2025, arguing that “borrow” implies an intent to repay and that the ruling “would unsettle traditional understandings of fraud.” Eisenberg returned $67 million to the Mango DAO in what TRM Labs calls a DAO-mediated settlement. For readers in the US the point is narrow: a ruling on where a case was brought and what was misrepresented is no licence to manipulate DeFi markets.
Donation attacks: Cream’s trick came back in 2026
Sending tokens straight to a contract, outside the normal deposit path, raises assets without raising shares. That is the move behind Cream’s yUSD, and DefiLlama describes it again at Tectonic, a lending market on Cronos, on 30 August 2026: 98 recursive operations built a leveraged TONIC position, two direct transfers into the tTONIC contract lifted its exchange rate, and the TONIC price feed had no smoothing or circuit breaker. Exchange rates of share tokens are oracles too, even when nobody calls them that.
The sequel is the unusual part. The Cronos post-mortem, as reported by The Block, says the attacker borrowed about $120.4 million across nine markets; DefiLlama lists $124.5 million. Validators halted the chain and rolled it back 10,961 blocks, or 1 hour 54 minutes, which reversed about $111.2 million. About $9.19 million had already left. Every other transaction in that window was erased as well, and Cronos described the choice as weighing “the finality users expect from a chain against the funds at risk.”
Bridges and keys: the largest DeFi losses on record
DefiLlama’s two largest entries tagged as DeFi protocols are not lending bugs at all: Ronin at $624 million and Poly Network at $611 million, both cross-chain systems. A bridge holds a pool of assets on one chain and pays out on the strength of a message from another, so a false message empties the pool. Our guide to bridges and intents explains the designs.
Poly Network, Wormhole, Nomad: three different ways to fake a message
Poly Network, 10 August 2021. CertiK’s analysis blames mismanaged access rights between two contracts: EthCrossChainManager governed EthCrossChainData, which held the keeper, the key allowed to approve withdrawals. An attacker abused that link and replaced the keeper’s key with their own. About $342 million came back within hours, the rest sat in an account requiring passwords from both sides, and Poly Network said about 13 days after the attack that it had recovered the remainder.
Wormhole, 2 February 2022. An attacker minted 120,000 wETH on Solana, worth about $320 million, with nothing locked on Ethereum. BlockSec’s walkthrough shows why: signature verification relied on load_instruction_at, an unsafe function that does not check which account it reads, so the attacker supplied a fake account in place of the real system one and the check passed. Jump Crypto, whose group had bought Wormhole’s developer the year before, replaced the 120,000 ETH so that wETH holders were made whole. Wormhole also offered the attacker $10 million for the return of the funds.
Nomad, 1 August 2022. An earlier upgrade had pre-approved 0x00 as a trusted root, and 0x00 is also what the contract returns for any message that was never proven (Immunefi walks through the code). So every message counted as valid. Mandiant lists 532 addresses taking at least $1,000 each, from a total of over $190 million: anyone could copy a working transaction, replace the recipient and submit it. About $36 million of it came back after a bounty let takers keep 10 percent.
Ronin: five keys out of nine
Ronin needed five of nine validators to approve a withdrawal, and on 23 March 2022 an attacker obtained five. The post-mortem, as reported by Cointelegraph, starts with spear-phishing of a former Sky Mavis employee, which gave access to four validators. The fifth belonged to the Axie DAO, which had allowlisted Sky Mavis to sign on its behalf in November 2021 to help distribute free transactions. That arrangement ended in December 2021, but the access was never revoked, and a backdoor through a gas-free RPC node did the rest.
About 173,600 ETH and 25.5 million USDC left. Nobody noticed for six days, until a user could not withdraw 5,000 ETH on 29 March. The US Treasury attributed the heist to North Korea’s Lazarus Group, valuing it at almost $620 million. No contract logic failed. Nine validators looked independent, yet one company’s reach extended to five of them because an old permission was never cleaned up.
Bybit 2025: when the screen lies to the signers
A multisig is meant to remove the single point of failure, and it does, as long as each signer knows what they are signing. Bybit’s wallet ran on Safe, and the exchange did not lose its keys. The attackers went after the tool every signer shared.
Safe said in a statement that the attack began with a compromised Safe{Wallet} developer machine. Elastic Security Labs dates that compromise to 4 February 2025 and the first intrusion into Safe’s AWS environment to the next day, using temporary session tokens, with social engineering likely but the exact lure unknown. Sygnia found malicious JavaScript in Safe’s AWS S3 bucket, modified two days before the theft and limited to Bybit’s cold wallet, so ordinary users saw nothing odd. About two minutes after the malicious transaction, the files were swapped for clean ones.
Sygnia found no evidence of a compromise of Bybit’s own infrastructure, and Safe says outside reviewers found no flaw in its contracts or front-end source code. Bybit’s chief executive Ben Zhou said all the signers saw a masked interface showing the correct address and a Safe URL. What reached the browser was not what ran on the chain.
Several signers used the same website and, on that account, each saw the same false picture, so the threshold added no real independence at the last step. The lesson for anyone running a multisig is to check the payload outside that one interface: confirm on the hardware device what the raw transaction does, simulate it elsewhere and compare hashes between signers. Those habits belong to the security routine later in this module.
DeFi hacks of 2025 and 2026: arithmetic and single points of failure
Cetus, Balancer, Truebit: rounding and overflow
Cetus, the Sui exchange, lost about $223 million on 22 May 2025. Cetus attributed it to an overflow check in an open-source maths library, whose checked_shlw method tested against a 256-bit limit rather than 192. The attacker used a flash swap to move the price, then added enormous liquidity for almost no tokens and withdrew real reserves. Sui validators stopped about $162 million by refusing the attacker’s transactions, and a vote that reached about 90 percent support on 29 May approved moving those funds to a multisig trust held by Cetus, OtterSec and the Sui Foundation. About $60 million had already been bridged to Ethereum. The feature that saved the money also shows how much power a validator set holds over a single address.
Balancer V2 was hit on 3 November 2025. The scaling step in Composable Stable Pools always rounded down, and OpenZeppelin explains how that became lethal: with batchSwap, the attacker pushed pool balances very low, where a rounding error is large relative to the amounts, then ran repeating swap cycles that each inflated the credit. Totals vary with scope: Cointelegraph reported about $116 million, DefiLlama lists $128 million and OpenZeppelin says over $120 million including forks. Balancer’s post-mortem, as reported by AMBCrypto on 18 November, gave $121.1 million stolen and $45.7 million recovered or protected: about $19 million in osETH and $1.9 million in osGNO retrieved by StakeWise, about $4.6 million by whitehats, and about $19.3 million kept safe by emergency pauses.
This is the audit lesson in one case. Trail of Bits says it flagged a rounding concern in Linear Pools in 2021 as of undetermined severity, and that its 2022 review of Composable Stable Pools had the Stable Math library out of scope. A clean-looking report tells you little if the broken part sat outside it.
Truebit is the small version of the same family. On 8 January 2026, per DefiLlama, an integer overflow in old Solidity 0.6.10 token-purchase code let an attacker mint TRU for almost nothing and sell it to the bonding curve for about $26 million. Solidity has reverted on overflow by default since version 0.8, so legacy contracts that still hold value remain a target.
Drift and Kelp: admin control and a one-verifier bridge
Drift, the Solana perpetuals venue, lost about $285 million to $295 million on 1 April 2026, depending on the count, and the contract code held. BlockSec’s timeline shows a Security Council multisig with a threshold of 2 of 5 and no timelock. Two signers were induced to pre-sign transactions using durable nonces, a Solana feature that keeps a signed transaction valid indefinitely instead of letting it expire within minutes. A council migration on 27 March voided the first signatures, and by 30 March the attacker had again reached two.
At about 16:05 UTC on 1 April, two transactions arrived four slots apart and handed the admin role to the attacker. The attacker then listed CVT, a token created weeks earlier and given a price history near $1 through wash trading, as collateral, pointed its oracle at a source they controlled, relaxed withdrawal limits and borrowed real assets against it. The signers’ keys were not stolen, BlockSec notes: only the approval process was manipulated.
QuillAudits reports that Drift’s own post-mortem of 5 April described a six-month operation, with contributors approached in person at conferences, by DPRK-linked actors. Decrypt reported on 5 May that forensic firm Mandiant attributed the attack to a North Korea state-affiliated actor. That attribution comes from Drift and security firms, not from a court. The same report sets out the repayment plan: transferable recovery tokens worth $1 of verified loss each, with Tether committing up to $127.5 million. This is a different event from Drift’s 2022 incident.
Kelp DAO’s rsETH lost about 116,500 tokens, worth about $292 million, on 18 April 2026. The token’s bridge route on LayerZero used a single verifier, a 1-of-1 DVN setting, and that one verifier was fooled. LayerZero’s account: attackers poisoned two RPC nodes used by its DVN, then ran a DDoS against the clean ones so that the forged message was the one seen. It called North Korea’s Lazarus Group the likely culprit, on what it described as preliminary indicators, and said it would stop signing for 1-of-1 applications.
Kelp disputes the blame. It says the setup was LayerZero’s documented default and was confirmed as appropriate during its expansion to layer 2 networks. Neither account has been settled. The damage spread: the attacker posted stolen rsETH as collateral on Aave and borrowed WETH, leaving about $190 million of bad debt, The Block reported on 12 May 2026. A restitution effort led by Aave raised over $300 million in ETH, and Kelp was moving to Chainlink‘s CCIP while requiring four attestors in its LayerZero settings.
The major DeFi hacks in one dated table
Amounts are as of the event, in dollars, from the sources cited above and DefiLlama (retrieved 1 November 2026). Sources often disagree by some percent because they count forks, chains or prices differently.
| Date | Case | Loss then | Family | Money back |
|---|---|---|---|---|
| 17 Jun 2016 | The DAO | 3.6M ETH, about $50-60M | Reentrancy | Hard fork, 20 Jul 2016 |
| 15 and 18 Feb 2020 | bZx | Underwater positions of about $640K and $800K | Flash loan, thin market prices | No figure |
| 10 Aug 2021 | Poly Network | About $610M | Cross-chain access rights | Remainder recovered 13 days later, Poly said |
| 27 Oct 2021 | Cream Finance | About $130M | Flash loans, share price as oracle | No figure |
| 2 Feb 2022 | Wormhole | 120,000 wETH, about $320M | Forged signature check | Replaced by Jump Crypto |
| 23 Mar 2022 | Ronin | About $620M | 5 of 9 validators taken | User funds being restored by April 2022, Ronin said |
| 1 Aug 2022 | Nomad | Over $190M | Trusted root set to 0x00 | About $36M |
| 11 Oct 2022 | Mango Markets | About $110-116M | Oracle manipulation | $67M, DAO-mediated settlement |
| 13 Mar 2023 | Euler | About $197M | Missing health check, flash loan | Over $177M |
| 30 Jul 2023 | Curve (Vyper) | About $61.7M | Compiler broke reentrancy lock | About 68%, per DefiLlama |
| 21 Feb 2025 | Bybit (exchange) | About $1.5B | Signing interface compromised | None returned by the attacker |
| 22 May 2025 | Cetus | About $223M | Overflow check in maths library | About $162M frozen |
| 9 Jul 2025 | GMX V1 | About $42M | Reentrancy | About $40M |
| 3 Nov 2025 | Balancer V2 | About $116M to $128M by count | Rounding | $45.7M recovered or protected, per its post-mortem |
| 8 Jan 2026 | Truebit | About $26.4M | Integer overflow | No figure |
| 1 Apr 2026 | Drift | About $285-295M | Pre-signed admin takeover | Stolen funds not returned; recovery tokens, Tether up to $127.5M |
| 18 Apr 2026 | Kelp DAO rsETH | About $292M | 1-of-1 verifier, forged message | Restitution drive over $300M in ETH |
| 30 Aug 2026 | Tectonic | About $120M to $124.5M | Donation, thin price feed | About $111.2M reversed by chain rollback |
For scale, entries DefiLlama tags as DeFi protocols add up to about $2.85 billion in 2022, $818 million in 2023, $796 million in 2024, $757 million in 2025 and $1.19 billion in 2026 through 1 November. Across all incident types, exchanges and wallets included, its full-year totals are about $3.63 billion for 2022, $1.63 billion for 2023, $1.67 billion for 2024 and $2.72 billion for 2025. Chainalysis counts over $3.4 billion stolen in 2025 with a wider scope, $1.5 billion of it Bybit.
What the pattern says: keys and signers, and arithmetic too
The tempting summary is that clever code attacks have given way to stolen keys. The data for 2025 and 2026 is less tidy. Taking only incidents DefiLlama tags as DeFi protocols from January 2025 through 1 November 2026, 337 events with a stated amount add up to about $1.95 billion, before any recovery. Its labels split them this way:
| DefiLlama class | Lost, 2025 to 1 Nov 2026 | Example |
|---|---|---|
| Token and share accounting | About $573M | Cetus, Balancer, Tectonic |
| Access control | About $459M | Drift |
| Bridge and cross-chain | About $375M | Kelp |
| Key compromise | About $229M | Infini, Step Finance |
| Oracle manipulation | About $104M | Rhea Lend |
| Front end and infrastructure | About $55M | Resolv USR |
| Reentrancy | About $45M | GMX V1 |
| All other classes | About $106M | Abracadabra (protocol logic) |
Two things stand out. Reentrancy, the oldest family, has become small, which fits a decade of tooling and of checks-effects-interactions as a habit. Accounting bugs lead the table, mostly on three incidents, though Cetus’s freeze and Tectonic’s rollback undid much of that total. Maths still matters and audits still miss it. Yet the two largest single DeFi events of the period, Drift and Kelp, needed no maths at all. Smaller cases repeat the theme: Resolv USR lost $24.5 million on 21 March 2026 when a key held in AWS was compromised and 80 million unbacked tokens were minted, and Step Finance lost $40 million in January 2026 through compromised executive devices, per DefiLlama.
So the two questions from the start help more than any label. For a protocol you use, or are thinking about, here is what they suggest looking at. None of this is investment advice, and a clean result guarantees nothing.
- Who can change the contracts, what is the multisig threshold, and is there a timelock? Drift’s 2 of 5 with no delay meant a stolen approval took effect at once.
- How many independent verifiers does a bridged token rely on? Kelp’s route had one.
- Where does the price come from, and how thin is the market behind it? Mango, Cream and Tectonic all turned on that.
- Does the protocol hold another project’s token, directly or as collateral? Aave’s bad debt came from rsETH, not from Aave’s own code.
- What did the audits actually cover, and is the old code still holding funds?
If your funds are caught in an incident, stop signing and read our guide on what can be recovered, and treat any stranger who offers to get your money back as a scammer. Insurance against these failures is the subject of the next lesson of the course, on DeFi cover: what it pays, and what it excludes.
