Incident Post-Mortems
48 long-form incident post-mortems from the DeFi Intel research desk. Each entry runs 2,000–3,500 words with a 7–9-section structure, executive summary, and bull/bear/watch-points rail.
Drift Protocol $285M DPRK Exploit: Full Breakdown
Drift Protocol, Solana's largest perp DEX, lost ~
Grinex Exchange Wallet Drain (April 17, 2026)
Grinex, the Kyrgyzstan-incorporated successor to the sanctioned Russian exchange Garantex, was drained of ~$13.74M (on-chain ~$15M in USDT) from dozens of
Humanity Protocol Bridge Admin-Key Theft (June 9, 2026)
A June 5, 2026 phishing email impersonating Bithumb planted root-access malware on a Humanity Protocol employee laptop that, via an accidental mainnet-laun
KelpDAO rsETH Cross-Chain Bridge Exploit (April 18, 2026)
Kelp DAO lost ~116,500 rsETH (~$292M) on April 18, 2026 when an attacker defeated its LayerZero bridge's single one-of-one DVN by compromising RPC nodes an
Resolv USR Minting-Key Compromise and Depeg (March 22, 2026)
Resolv's USR stablecoin was exploited on March 22, 2026 after attackers compromised the AWS KMS-hosted SERVICE_ROLE minting key through a supply chain that
Step Finance Treasury Drain and Shutdown (January 31, 2026)
Step Finance, Solana's longest-running portfolio dashboard, lost 261,854 SOL (~$27M, with ~$40M claimed across all assets) on January 31, 2026 after attack
Matcha Meta / SwapNet Exploit: $13.4M Lost to Arbitrary-Call Bug
On January 25, 2026, users of Matcha Meta, the DeFi exchange meta-aggregator built by 0x, lost approximately $13.43M when an attacker exploited an arbitrary-call vulnerability in SwapNet, one of the third-party DEX aggregators wired into the Matcha Meta routing stack. The loss…
Truebit Legacy-Contract Mint Exploit (January 8, 2026)
Truebit lost 8,535 ETH (~$26.4M) on January 8, 2026 -- 2026's first major crypto exploit -- when an attacker triggered an integer overflow in a dormant, un
$330M Bitcoin Social-Engineering Theft (April 28, 2025)
On April 28, 2025, ZachXBT flagged the theft of 3,520 BTC (~$330.7M) from an elderly US long-term holder, one of the largest individual crypto thefts ever
Bybit Cold Wallet Hack 2025: $1.46B Exploit Explained
On Feb 21, 2025, Bybit lost $1.46B in the largest crypto theft. Malicious JS injection via Safe interface (Lazarus Group) caused the exploit. No customer…
Cetus Protocol $223M Sui Exploit: Integer-Overflow Bug
Coinbase Insider Data Breach and Extortion (May 2025)
In May 2025 Coinbase disclosed (via an SEC 8-K on May 14) that a threat actor had bribed overseas customer-support contractors to exfiltrate the PII of und
CoinDCX Operational-Wallet Compromise (July 19, 2025)
CoinDCX, a major Indian exchange, lost ~$44.2M in USDT/USDC on July 19, 2025 from an internal liquidity-provisioning (market-making) wallet, India's second
GMX V1 Cross-Contract Reentrancy Exploit (July 9, 2025)
GMX V1 on Arbitrum lost ~$42M on July 9, 2025 to cross-contract reentrancy: during an ETH refund in executeDecreaseOrder, the attacker reentered the Vault
Nobitex Exchange Drain and Burn (June 18, 2025)
On June 18, 2025, during the Israel-Iran conflict, the pro-Israel group Gonjeshke Darande (Predatory Sparrow) drained ~$90M from the hot wallets of Nobitex
DMM Bitcoin Hack and Shutdown (May 31, 2024)
On May 31, 2024, DMM Bitcoin lost 4,502.9 BTC (~$305M), the year's largest hack, after TraderTraitor (Lazarus) socially engineered an employee of wallet-so
Munchables Rogue-Developer Exploit: $62.5M Returned
On Mar 26-27, 2024, Munchables (GameFi on Blast) lost ~$62.5M to a rogue developer. ZachXBT linked the insider to DPRK. All funds were voluntarily returned…
PlayDapp Minting Exploit (Feb 9-12, 2024)
Between Feb 9-12, 2024, an attacker exploited an access-control failure on PlayDapp's PLA token, adding a minter role (via suspected key compromise) and mi
Radiant Capital Multisig/Device Compromise (Oct 16, 2024)
On Oct 16, 2024, Radiant Capital was drained of ~$50M across Arbitrum and BNB Chain after DPRK-aligned attackers (UNC4736 / Citrine Sleet, per Mandiant) co
WazirX Hack 2024: $235M Exchange Exploit
On July 18, 2024, WazirX lost $235M in a social engineering attack targeting its Liminal Custody multisig. The Lazarus Group exploited a calldata…
Atomic Wallet Hack 2023: $100M+ Seed-Phrase Compromise
Over $100M stolen from 5,500 Atomic Wallet users on June 2-3, 2023 in a mass seed-phrase compromise attributed to Lazarus Group. No recovery for most victims.
Curve Finance Vyper Bug 2023: $73M Exploit Explained
On July 30, 2023, a Vyper compiler bug in @nonreentrant decorator caused $73M in Curve pool losses from multiple attackers. Partial recovery achieved.
Euler Finance Hack 2023: $197M Exploit Explained
The $197M Euler Finance hack on March 13, 2023 exploited a faulty donateToReserves function combined with self-liquidation via flash loans. All funds were…
Genesis Global Capital Bankruptcy 2023: $3.4B Claims Collapse
Genesis Global Capital filed for Chapter 11 on Jan 19, 2023 after $2.4B 3AC exposure and FTX collapse, affecting 232,000 Gemini Earn customers with $3.4B…
JPEX Unlicensed-Exchange Fraud, Hong Kong (Sep 2023)
In September 2023, JPEX, an unlicensed crypto exchange that marketed via influencers and OTC cash shops, collapsed into Hong Kong's largest crypto fraud, ~
Mixin Network Cloud-Database Hack (Sep 23, 2023)
On Sep 23, 2023, Mixin Network lost ~$200M (the largest 2023 hack) after an attacker compromised its third-party cloud-service provider's database and reac
Multichain Disappearance 2023: $210M Bridge Implosion
The Multichain bridge collapsed in July 2023, with losses of about $210M after CEO Zhao Jun's arrest made MPC keys inaccessible, exposing centralization…
Orbit Bridge Multisig Hack (Dec 31, 2023)
On New Year's Eve, December 31, 2023, the Orbit Bridge (Ozys, South Korea) was drained of ~$81.5M (30M USDT, 10M USDC, 10M DAI, 9,500 ETH, 231 WBTC) after
Poloniex, HTX & Heco Bridge Hacks: ~$240M Lost (Nov 2023)
Over a roughly two-week span in November 2023, three platforms in Justin Sun's crypto ecosystem, the Poloniex exchange, the HTX (formerly Huobi) exchange, and the Heco cross-chain bridge connecting HTX's Heco Chain to Ethereum, were hit by hacks that together drained on the or…
Beanstalk Hack 2022: $182M Governance Exploit
On April 17, 2022, Beanstalk lost $182M in a flash-loan governance exploit. The attacker borrowed $1B to pass a malicious proposal and drain protocol funds.
BlockFi Bankruptcy 2022: $10B Liabilities Explained
The BlockFi Chapter 11 bankruptcy in November 2022, triggered by $680M in FTX exposure, resulted in $10B in liabilities and reshaped crypto lending regulation.
BNB Chain Token Hub Exploit 2022: $568M IAVL Proof Forgery
On Oct 7, 2022, attackers exploited an IAVL Merkle proof flaw in the BNB Chain Token Hub bridge to mint $568M in BNB, with $430M frozen by validator…
Celsius Network Collapse 2022: $4.7B Insolvency Explained
The Celsius Network withdrawal halt and Chapter 11 filing in June-July 2022 resulted in a $4.7B loss due to mismanaged stETH leverage and misrepresentation.
FTX Collapse 2022: $8B+ Fraud and Bankruptcy
In Nov 2022, FTX collapsed after a $8B+ shortfall from commingling customer funds with Alameda Research, leading to bankruptcy and founder Sam…
Nomad Bridge Hack 2022: $190M Copy-Paste Exploit
The $190M Nomad bridge hack of August 1, 2022 began with a Replica contract bug that let anyone copy-paste the exploit, turning one attack into a free-for-all.
Ronin Bridge Hack 2022: $620M Validator Exploit
The $620M Ronin Bridge hack on March 23, 2022, resulted from a spear-phishing campaign that compromised validator keys, enabling the largest crypto theft…
Terra/Luna Collapse 2022: $40B+ UST Depeg Explained
The $40B+ Terra/Luna crash of May 2022 originated from an algorithmic stablecoin design flaw, depegging UST and collapsing Luna, triggering a cascade of…
3AC Collapse 2022: $3B+ Hedge Fund Insolvency
The Three Arrows Capital collapse in June 2022 caused $3B+ in losses from concentrated leverage on Luna/UST and stETH-ETH basis, cascading lender bankruptcies.
Voyager Digital Bankruptcy 2022: $1.3B Chapter 11 Explained
Voyager Digital halted withdrawals on July 1, 2022 and filed Chapter 11 with $1.3B in customer crypto and a $650M+ defaulted loan to Three Arrows Capital.
Wormhole Bridge Exploit 2022: $326M Signature Bypass
In the $326M Wormhole Bridge exploit (Feb 2, 2022), an attacker bypassed signature verification using a deprecated Solana function, minting 120k wETH…
Cream Finance Hack 2021: $130M Oracle Manipulation Exploit
Cream Finance lost $130M on Oct 27, 2021 to a flash-loan amplified price oracle manipulation exploit on its yUSD vault collateral. No recovery was possible.
Poly Network Cross-Chain Exploit 2021: $611M Heist Explained
On August 10, 2021, the Poly Network cross-chain bridge was exploited for $611M due to a flaw in verifyHeaderAndExecuteTx allowing keeper key overwrite.…
KuCoin Hack 2020: $281M Hot Wallet Key Compromise
The $281M KuCoin hack of September 26, 2020 stemmed from leaked hot-wallet private keys. Token swaps, freezes and insurance made users whole; Lazarus blamed.
Upbit Hack 2019: 342,000 ETH Stolen by Lazarus
The Upbit hack of November 27, 2019 saw 342,000 ETH (~$50M) leave the exchange's hot wallet; South Korean police attributed it to Lazarus and Andariel in 2024.
Coincheck Hack 2018: $530M NEM Theft Explained
On Jan 26, 2018, Tokyo exchange Coincheck lost $530M in NEM tokens from a single hot-wallet key compromised via targeted phishing. Root cause: no cold…
Bitfinex Multisig Compromise 2016: $72M Hack Explained
In August 2016, the Bitfinex exchange lost $72M in Bitcoin due to a compromise of its BitGo multisig hot-wallet architecture. The attackers were later…
The DAO Hack 2016: $60M Reentrancy Exploit
On June 17, 2016, The DAO lost $60M in ether to a reentrancy exploit. The attacker recursively withdrew funds before balance updates, leading to a…
Mt. Gox Hack 2014: $450M Loss Explained
The 2014 collapse of Mt. Gox saw $450M in bitcoin stolen. A multi-year hot-wallet key compromise led to the exchange's insolvency.
Subscribe to DeFi Intel research
One weekly email summarising every new paper review, incident post-mortem, jurisdiction guide and chain deep-dive. Free tier; Pro for the analyst-grade breakdowns.