DeFi hacks are inevitable. Understanding what went wrong in major attacks helps you avoid similar risks.
The Biggest DeFi Hacks
| Protocol | Year | Amount Lost | Attack Type |
|---|---|---|---|
| Ronin Bridge | 2022 | $625M | Private key compromise |
| Poly Network | 2021 | $611M | Cross-chain vulnerability |
| Wormhole | 2022 | $326M | Signature verification |
| FTX (CEX) | 2022 | $8B | Corporate fraud |
| Nomad Bridge | 2022 | $190M | Smart contract bug |
| Mixin Network | 2023 | $200M | Cloud provider breach |
| Euler Finance | 2023 | $197M | Flash loan attack |
| Multichain | 2023 | $125M | Admin key compromise |
Case Study 1: Ronin Bridge ($625M)
What happened:
- Hackers compromised 5 of 9 validator private keys
- Signed fraudulent transactions to drain 173K ETH and 25.5M USDC
- The breach went undetected for 6 days
Root cause: Insufficient decentralisation of validators. Axie’s team controlled most nodes.
Lesson: Validator sets need to be diverse. No single entity should control a majority of nodes.
Case Study 2: Poly Network ($611M)
What happened:
- Attacker exploited a vulnerability in the cross-chain contract
- Used a single function call to transfer tokens between chains without authorisation
- Most funds were later returned by the hacker
Root cause: The eth_call function could be called without proper authorisation from the network’s keepers.
Lesson: Cross-chain bridges need rigorous audit of authorisation logic. One unchecked function can drain everything.
Case Study 3: Euler Finance ($197M)
What happened:
- Flash loan attack that manipulated the EToken contract
- Used a donation to artificially inflate the exchange rate
- Borrowed against inflated collateral and drained the protocol
Root cause: The donation function didn’t properly account for exchange rate manipulation.
Lesson: Donation and share-calculation logic must be carefully tested for edge cases.
Case Study 4: Nomad Bridge ($190M)
What happened:
- A smart contract upgrade inadvertently made the
processMessagefunction callable without verification - A single legitimate message set the “root” to zero
- Anyone could then copy the call with their own address
Root cause: An initialization bug that left the bridge in an unauthenticated state.
Lesson: Contract upgrades need thorough re-auditing. Small changes can have catastrophic consequences.
Common Attack Vectors
| Attack Type | How It Works | Prevention |
|---|---|---|
| Flash loan | Borrow huge amount, manipulate price, repay | Oracle manipulation resistance |
| Reentrancy | Recursive call to drain before balance updates | Reentrancy guards |
| Oracle manipulation | Manipulate price feed to liquidate | Multiple oracle sources |
| Private key theft | Compromise validator or admin keys | Hardware wallets, multisig |
| Smart contract bug | Exploit logic errors | Multiple audits, bug bounties |
| Governance attack | Buy enough tokens to pass malicious proposal | Vesting, timelocks |
How to Protect Your Funds
| Step | Why |
|---|---|
| Use established protocols | Older protocols have proven security |
| Check for audits | Multiple recent audits from reputable firms |
| Avoid new experimental bridges | Cross-chain bridges are the highest risk |
| Don’t chase high yields | >20% APY often means higher risk |
| Diversify across protocols | Don’t put everything in one place |
| Use cold storage for long-term | Keep DeFi exposure limited |
| Monitor protocol activity | Follow their security communications |
Signs a Protocol Might Be Unsafe
| Red Flag | Concern |
|---|---|
| Anonymous team | No accountability |
| No audit | Unchecked code |
| Very high yields | Unsustainable or scam |
| No time lock | Team can change contracts instantly |
| Single admin key | One person can drain everything |
| Rushed launch | Corners were cut |
| No bug bounty | No incentive for responsible disclosure |
Bottom Line
DeFi hacks are not random — they exploit specific vulnerabilities. The biggest risks are cross-chain bridges (most hacks), flash loan attacks (complex but common), and admin key compromises (inside job or social engineering). Protect yourself by using established protocols, checking audits and time locks, and never putting all your funds into a single DeFi position.
Patterns across the hacks
Looked at together, the major attacks reveal how few distinct failure modes actually caused the damage. Almost every headline exploit falls into one of a handful of buckets, and once you recognise them, the defensive moves become obvious.
Centralised key risk. Ronin and Multichain both fell to compromised validator or admin keys. When a small number of keys controls huge pools, a single breach is enough. The defence is validator diversity and multisig requirements that no one entity can satisfy alone.
Bridge authorisation bugs. Poly Network, Wormhole, and Nomad all suffered from broken authorisation or verification logic in cross-chain code. These are the hardest to predict, which is why bridges keep getting drained. The user-level defence is to treat any bridge that is new, unaudited, or holding large sums as the highest-risk transaction you can make.
Flash loan manipulation. Euler Finance was drained through a donation that inflated an exchange rate before a flash loan was borrowed against the inflated collateral. These attacks exploit pricing and accounting edge cases and are countered by oracle manipulation resistance and careful share-calculation logic.
In each case the loss was not a random act but a predictable exploitation of a specific weakness. For you as a user, the practical implication is to spread risk so that no single protocol failure is catastrophic, keep genuinely long-term holdings out of DeFi entirely, and weight your positions toward the oldest, most-tested protocols with strong audit and governance hygiene. That combination will not make exploits impossible, but it ensures that when one happens, you are not the headline.