DeFi hacks are inevitable. Understanding what went wrong in major attacks helps you avoid similar risks.
The Biggest DeFi Hacks
| Protocol | Year | Amount Lost | Attack Type |
|---|---|---|---|
| Ronin Bridge | 2022 | $625M | Private key compromise |
| Poly Network | 2021 | $611M | Cross-chain vulnerability |
| Wormhole | 2022 | $326M | Signature verification |
| FTX (CEX) | 2022 | $8B | Corporate fraud |
| Nomad Bridge | 2022 | $190M | Smart contract bug |
| Mixin Network | 2023 | $200M | Cloud provider breach |
| Euler Finance | 2023 | $197M | Flash loan attack |
| Multichain | 2023 | $125M | Admin key compromise |
Case Study 1: Ronin Bridge ($625M)
What happened:
- Hackers compromised 5 of 9 validator private keys
- Signed fraudulent transactions to drain 173K ETH and 25.5M USDC
- The breach went undetected for 6 days
Root cause: Insufficient decentralisation of validators. Axie’s team controlled most nodes.
Lesson: Validator sets need to be diverse. No single entity should control a majority of nodes.
Case Study 2: Poly Network ($611M)
What happened:
- Attacker exploited a vulnerability in the cross-chain contract
- Used a single function call to transfer tokens between chains without authorisation
- Most funds were later returned by the hacker
Root cause: The eth_call function could be called without proper authorisation from the network’s keepers.
Lesson: Cross-chain bridges need rigorous audit of authorisation logic. One unchecked function can drain everything.
Case Study 3: Euler Finance ($197M)
What happened:
- Flash loan attack that manipulated the EToken contract
- Used a donation to artificially inflate the exchange rate
- Borrowed against inflated collateral and drained the protocol
Root cause: The donation function didn’t properly account for exchange rate manipulation.
Lesson: Donation and share-calculation logic must be carefully tested for edge cases.
Case Study 4: Nomad Bridge ($190M)
What happened:
- A smart contract upgrade inadvertently made the
processMessagefunction callable without verification - A single legitimate message set the “root” to zero
- Anyone could then copy the call with their own address
Root cause: An initialization bug that left the bridge in an unauthenticated state.
Lesson: Contract upgrades need thorough re-auditing. Small changes can have catastrophic consequences.
Common Attack Vectors
| Attack Type | How It Works | Prevention |
|---|---|---|
| Flash loan | Borrow huge amount, manipulate price, repay | Oracle manipulation resistance |
| Reentrancy | Recursive call to drain before balance updates | Reentrancy guards |
| Oracle manipulation | Manipulate price feed to liquidate | Multiple oracle sources |
| Private key theft | Compromise validator or admin keys | Hardware wallets, multisig |
| Smart contract bug | Exploit logic errors | Multiple audits, bug bounties |
| Governance attack | Buy enough tokens to pass malicious proposal | Vesting, timelocks |
How to Protect Your Funds
| Step | Why |
|---|---|
| Use established protocols | Older protocols have proven security |
| Check for audits | Multiple recent audits from reputable firms |
| Avoid new experimental bridges | Cross-chain bridges are the highest risk |
| Don’t chase high yields | >20% APY often means higher risk |
| Diversify across protocols | Don’t put everything in one place |
| Use cold storage for long-term | Keep DeFi exposure limited |
| Monitor protocol activity | Follow their security communications |
Signs a Protocol Might Be Unsafe
| Red Flag | Concern |
|---|---|
| Anonymous team | No accountability |
| No audit | Unchecked code |
| Very high yields | Unsustainable or scam |
| No time lock | Team can change contracts instantly |
| Single admin key | One person can drain everything |
| Rushed launch | Corners were cut |
| No bug bounty | No incentive for responsible disclosure |
Bottom Line
DeFi hacks are not random — they exploit specific vulnerabilities. The biggest risks are cross-chain bridges (most hacks), flash loan attacks (complex but common), and admin key compromises (inside job or social engineering). Protect yourself by using established protocols, checking audits and time locks, and never putting all your funds into a single DeFi position.