Biggest DeFi Hacks in History and What Went Wrong

Bridge hacks alone have cost DeFi roughly $2.5 billion since 2016, and three incidents account for well over $1.5 billion of that total combined. Understanding what actually went wrong in each of the three largest reveals a pattern worth knowing before trusting any bridge with meaningful funds. The biggest DeFi hacks share patterns worth understanding before you use any protocol.

Ronin Bridge: $625 Million (March 2022)

Attackers, later attributed to North Korea’s Lazarus Group, compromised five of the nine validator keys controlling Ronin Bridge, the connection between the Axie Infinity game and Ethereum. Sky Mavis, the developer, directly controlled four validators and had retained access to a fifth through an old, temporary arrangement with the game’s DAO that was never revoked. Compromising Sky Mavis’s own systems alone was enough to reach the five-of-nine threshold needed to approve fraudulent withdrawals. This detail is worth sitting with specifically: the attacker didn’t need to defeat some sophisticated cryptographic scheme, they needed to compromise one company’s systems and exploit one forgotten permission that should have been revoked long before. North Korea’s Lazarus Group has since been linked to billions more in crypto theft across multiple separate incidents, reflecting a well-resourced, patient state actor rather than an opportunistic lone hacker. The breach went undetected for six days, discovered only after a user couldn’t complete a routine withdrawal.

Poly Network: $611 Million (August 2021)

An attacker exploited an access control flaw, redirecting Poly Network’s “keeper” role, the permission controlling fund transfers, to their own address, then draining value across multiple chains. In a genuinely unusual resolution, the attacker returned essentially all the funds within about two weeks, claiming the hack was meant to expose the vulnerability rather than to profit from it. The Poly Network case remains one of DeFi’s most genuinely unusual security stories precisely because of that voluntary return, a scale of theft matched by an equally unusual resolution, though relying on an attacker’s goodwill is obviously not a security strategy any protocol should count on repeating.

Wormhole: $325 Million (February 2022)

A signature verification flaw in the Solana-Ethereum bridge let an attacker mint 120,000 wrapped ETH on Solana without ever depositing the real ETH that was supposed to back it. Jump Crypto, one of Wormhole’s backers, covered the full loss directly to prevent the failure from cascading further through Solana’s ecosystem. This decision, a private company absorbing a nine-figure loss rather than letting users bear it, was itself a notable departure from how most exploits play out, where affected users are typically left to absorb the loss directly or wait for a partial, uncertain recovery process.

What the Biggest DeFi Hacks Have in Common: Bridges Are the Weakest Point

All three of DeFi’s largest hacks targeted bridges specifically, the infrastructure connecting one blockchain to another. Bridges concentrate enormous value behind a relatively small number of keys or validators, a structural design that makes them a uniquely attractive target compared to a typical single-chain protocol. This concentration risk is structurally different from a typical DeFi protocol’s smart contract risk: a well-audited single-chain lending protocol still depends on one contract behaving correctly, while a bridge depends on an entire separate verification system, often involving off-chain components, correctly confirming what happened on one chain before releasing funds on another.

Beyond Bridges: Other Categories Worth Knowing

Not every major DeFi exploit targets a bridge. Curve’s 2023 Vyper compiler exploit cost roughly $70 million through a reentrancy flaw. The Cork Protocol hack exploited a missing access control check in a Uniswap v4 hook. And the Beanstalk Farms attack, covered in What Is a Smart Contract Exploit?, used a $1 billion flash loan to seize governance control directly. Each of these followed a genuinely different mechanism, reentrancy, a missing access check, borrowed capital weaponized against governance, underscoring that no single defensive measure protects against every category of risk DeFi protocols actually face.

The Pattern Across All of Them

None of these three hacks were exotic or unprecedented in hindsight, a compromised key, a missing permission check, a verification bug. How to Check If a DeFi Protocol Has Been Audited covers why even careful review can’t guarantee protection against every possible failure, particularly for bridges, whose off-chain verification components add complexity a typical single-chain audit doesn’t fully capture. This is worth internalizing as a genuinely humbling lesson rather than a reason for cynicism: some of the most well-resourced, professionally built protocols in the space have still fallen to relatively simple, describable failures, which is exactly why ongoing vigilance matters more than a one-time audit or a strong reputation alone.

Foire aux questions

The three largest hacks in DeFi’s history share a common thread: real, identifiable, ultimately explainable flaws, not some unknowable mystery. Understanding exactly what went wrong in each one, rather than treating “DeFi hacks” as an undifferentiated category of bad luck, is what turns history into something genuinely useful for evaluating risk today. The biggest DeFi hacks keep teaching the same lesson: the more complex the system, the more places it can break.

Vous préférez apprendre à votre rythme, à partir d'un livre ? La série de livres sur les cryptomonnaies aborde ce sujet plus en détail. Si vous débutez dans le monde des cryptomonnaies, commencez par le premier tome, puis poursuivez votre lecture avec les autres volumes.

La ruée vers l'or numérique : la richesse en chaîne et la réaction en chaîne du millionnaire symbolique