Incident Post-Mortems
23 long-form incident post-mortems from the DeFi Intel research desk. Each entry runs 2,000–3,500 words with a 7–9-section structure, executive summary, and bull/bear/watch-points rail.
Bybit Cold Wallet Compromise (Feb 21, 2025)
On February 21, 2025, Bybit's Ethereum cold wallet was drained of approximately 401,346 ETH plus various staked-ETH derivatives in a single execution, totaling $1.46B at the time of the breach and instantly setting th…
FTX Collapse and Bankruptcy (Nov 6-11, 2022)
Between November 6 and November 11, 2022, FTX International, then the world's third-largest cryptocurrency exchange by volume, collapsed from an apparent $32B valuation to Chapter 11 bankruptcy with a customer-asset s…
Terra/Luna Death Spiral and UST Depeg (May 8-12, 2022)
Between May 8 and May 12, 2022, the Terra ecosystem suffered the largest single-protocol value destruction in cryptocurrency history, with the algorithmic stablecoin TerraUSD (UST) depegging from $1 to under $0.10 and…
Ronin Bridge Validator Compromise (March 23, 2022)
On March 23, 2022, the Ronin Bridge - the canonical bridge between Ethereum and the Ronin sidechain that hosted Sky Mavis's Axie Infinity ecosystem - was drained of 173,600 ETH and 25.5M USDC, valued at approximately …
Wormhole Bridge Signature Bypass (Feb 2, 2022)
On February 2, 2022, the Wormhole Bridge - the principal cross-chain bridge between Ethereum and Solana, carrying approximately $1B in locked Ethereum assets at the time - was exploited via a signature-verification by…
Curve Finance Vyper Reentrancy Compiler Bug (July 30, 2023)
On July 30, 2023, multiple Curve Finance stable pools were drained via a previously-unknown bug in the Vyper smart-contract compiler's @nonreentrant decorator. Vyper versions 0.2.15, 0.2.16, and 0.3.0 generated reentr…
Beanstalk Flash-Loan Governance Attack (April 17, 2022)
On April 17, 2022 at 12:24 UTC, the Beanstalk Farms decentralized stablecoin protocol was drained of approximately $182M of locked assets in a single atomic transaction. The attacker did not exploit a smart-contract b…
The DAO Reentrancy Exploit (June 17, 2016)
On June 17, 2016, an unidentified attacker exploited a reentrancy vulnerability in The DAO, a $150M Ethereum-based investment vehicle that at the time held approximately 14% of all ether in circulation, and drained 3,…
Mt. Gox Hot-Wallet Drain and Collapse (2011-2014)
Mt. Gox, the Tokyo-based bitcoin exchange that processed approximately 70% of global BTC trading volume at its peak in early 2014, declared bankruptcy on February 28, 2014 after disclosing that 850,000 BTC belonging t…
Euler Finance donateToReserves Exploit (March 13, 2023)
On March 13, 2023, an attacker exploited Euler Finance, an Ethereum-based money market that supported permissionless listing and leveraged lending, draining approximately $197M across DAI, USDC, WBTC and stETH from th…
Poly Network Cross-Chain Exploit (August 10, 2021)
On August 10, 2021, an attacker exploited Poly Network, a cross-chain interoperability protocol that bridged assets between Ethereum, BNB Chain, Polygon, and several other networks, draining approximately $611M in ass…
BNB Chain Token Hub IAVL Proof Forgery (Oct 7, 2022)
On October 6-7, 2022, an attacker exploited a verification flaw in the IAVL+ Merkle proof library used by the BSC Token Hub - the native cross-chain bridge between Binance Beacon Chain (the BNB governance chain) and B…
Three Arrows Capital Insolvency and BVI Liquidation (June-July 2022)
Three Arrows Capital, a Singapore-based crypto hedge fund founded by Su Zhu and Kyle Davies in 2012, was placed into BVI liquidation on June 27, 2022, after defaulting on margin calls totaling several hundred million …
Celsius Network Withdrawal Halt and Chapter 11 (June-July 2022)
Celsius Network, a centralized crypto lender founded by Alex Mashinsky in 2017 and headquartered in Hoboken, New Jersey, halted all customer withdrawals on June 12, 2022, citing 'extreme market conditions,' and filed …
Coincheck NEM Hot-Wallet Theft (Jan 26, 2018)
On January 26, 2018, Tokyo-based crypto exchange Coincheck reported the unauthorized transfer of 523 million NEM (XEM) tokens from a single hot wallet, with a market value at the time of approximately $530M (approxima…
Multichain Disappearance and Cease-Operations Announcement (Jul 2023)
Multichain, formerly known as Anyswap and at one point the largest cross-chain bridging protocol by total value locked with peaks exceeding $10B, suffered a slow-motion implosion across May to July 2023 that culminate…
Atomic Wallet Mass Seed-Phrase Compromise (Jun 3, 2023)
Beginning approximately June 2, 2023 and continuing in waves through the following weeks, users of Atomic Wallet, a non-custodial multi-asset wallet client offered by Estonia-registered Atomic Protocol OU, began repor…
BlockFi Chapter 11 Bankruptcy (Nov 28, 2022)
BlockFi Inc., a Jersey City-based centralized crypto lender founded in 2017 by Zac Prince and Flori Marquez, filed for Chapter 11 bankruptcy protection in the District of New Jersey on November 28, 2022, with approxim…
Genesis Global Capital Chapter 11 Bankruptcy (Jan 19, 2023)
Genesis Global Capital LLC, the institutional crypto lending arm of Digital Currency Group (DCG), filed for Chapter 11 bankruptcy protection in the Southern District of New York on January 19, 2023, listing approximat…
Bitfinex Multisig Compromise (Aug 2, 2016)
On August 2, 2016, the Hong Kong-based exchange Bitfinex disclosed the theft of 119,756 BTC, valued at approximately $72M at the time of the breach and approximately $4.5B at the November 2021 high. The compromise tar…
Cetus Protocol Exploit on Sui (May 22, 2025)
On May 22, 2025, Cetus Protocol, the dominant concentrated-liquidity DEX on the Sui Network, suffered a $230M exploit driven by an integer-overflow bug in the decimal-handling logic of its tick-math library. The attac…
Cream Finance Third Hack of 2021 (Oct 27, 2021)
On October 27, 2021, Cream Finance, a Compound-fork lending protocol that had been a substantial player in DeFi credit markets through 2020-21, suffered its third major exploit of the year, losing approximately $130M …
WazirX Exchange Hack (Jul 18, 2024)
On July 18, 2024, WazirX, India's largest cryptocurrency exchange by spot trading volume, lost approximately $235M in customer assets to a compromise of its Liminal Custody-managed multisig hot wallet. The attack mech…
Subscribe to DeFi Intel research
One weekly email summarising every new paper review, incident post-mortem, jurisdiction guide and chain deep-dive. Free tier; Pro for the analyst-grade breakdowns.