DeFi Protocol Exploit

It began on Ethereum in June 2016, when an unknown attacker drained about 3.6 million ether (roughly $50-60 million) from The DAO through a re-entrancy bug, leading to Ethereum's hard fork; the attacker has never been prosecuted.

Decentralised finance (DeFi) runs lending, trading and bridging on public smart contracts, so a coding or design flaw can be abused by anyone. The first landmark case was the June 2016 attack on 'The DAO' on Ethereum, where about 3.6 million ether (roughly $50-60 million at the time) was drained through a re-entrancy bug, leading to Ethereum's hard fork. Flash-loan attacks, which borrow huge sums within a single transaction to manipulate prices, appeared with the bZx incidents in February 2020. Cross-chain bridges became the biggest targets from 2021-2022 (Poly Network, Wormhole, Ronin, Nomad), and the FBI has attributed several of the largest bridge thefts to North Korean state hackers. Today the category also covers oracle and price manipulation, governance attacks and private-key compromise of protocol operators.

A DeFi protocol holds users' pooled funds in smart contracts that follow their code literally. Attackers look for a flaw, such as a bug in how withdrawals are counted, a price feed that can be pushed around, or a bridge whose signing keys can be stolen, and use it to withdraw far more than they put in. Many attacks happen in a single transaction or a few minutes, often funded with a flash loan. Stolen tokens are then swapped, bridged between blockchains and sent through mixers to obscure the trail.

Smart contracts hold hundreds of millions in open code that anyone can study, and one bug, flash loan or stolen signing key empties them in a single transaction with no bank to reverse it. It has been reliably lucrative: Chainalysis found 82% of the $3.8 billion stolen in 2022 came from DeFi, and North Korean crews still take billions. Prosecution is rare because attackers claim the code allowed it (Avraham Eisenberg's $110 million Mango Markets fraud conviction was vacated by the judge in 2025) and the largest thefts are state-backed.

Chainalysis counted $3.8 billion stolen in crypto hacks in 2022, mostly from DeFi and bridges, and $2.2 billion in 2024. The largest single exploits are Ronin ($620 million, March 2022, attributed by the FBI to Lazarus) and Poly Network ($611 million, 2021, later returned). Protocols have shut down and users have been left holding worthless tokens, while the proceeds fund North Korea's weapons programmes.