The Vault

The Ronin Network bridge hack remains one of the largest single theft events in crypto history. Attackers compromised five of the nine Ronin validator private keys — four belonging to Sky Mavis and one to Axie DAO — enabling unauthorized withdrawals totaling 173,600 ETH and 25.5M USDC. The breach went undetected for six days. On-chain analysis subsequently attributed the attack to Lazarus Group, a North Korean state-sponsored threat actor, leading to OFAC sanctions against associated wallet addresses.

The Poly Network exploit briefly held the record as the largest DeFi hack in history. The attacker exploited a vulnerability in the cross-chain relay contract's keeper role verification, allowing substitution of their own contract as the authorized keeper and simultaneous drainage of funds across Ethereum, BSC, and Polygon. In an unprecedented outcome, the attacker — self-styled "Mr. White Hat" — returned all funds within two weeks, framing the exploit as a demonstration of the vulnerability.

The Euler Finance attack exploited a flaw in the protocol's donation mechanism combined with a missing health-check in the donateToReserves function. Using flash loans, the attacker created a self-liquidation scenario that drained the protocol's reserves across multiple asset pools. The attacker subsequently returned the majority of funds following on-chain negotiations — a pattern increasingly observed in high-profile DeFi exploits where legal exposure incentivizes partial or full restitution.

The Wormhole bridge exploit targeted a signature verification flaw in the Solana-side bridge contract, allowing the attacker to mint 120,000 wETH on Solana without depositing equivalent ETH collateral on Ethereum. The exploit leveraged a deprecated verify_signatures function that failed to properly validate guardian signatures. Jump Crypto, Wormhole's backer, subsequently replenished the stolen funds — one of the largest single bailouts in DeFi history — preserving protocol solvency and preventing cascading liquidations.

The Beanstalk Farms attack represents the first large-scale governance exploit in DeFi history. The attacker used a flash loan to acquire a supermajority of STALK governance tokens within a single transaction block, immediately passed a malicious governance proposal (BIP-18) that had been pre-staged 24 hours earlier, and drained the protocol's reserves — all within a single atomic transaction. The attack exploited the protocol's lack of a time-lock on governance execution, a design flaw that has since become a standard audit checklist item.

The Terra / LUNA collapse represents the most catastrophic algorithmic stablecoin failure in crypto history. The UST depeg event — triggered by coordinated large-scale withdrawals from Anchor Protocol — initiated a death spiral between UST and LUNA. As UST lost its $1 peg, the mint-and-burn mechanism designed to restore parity instead hyperinflated LUNA's supply from ~350M to ~6.5 trillion tokens within 72 hours, destroying over $40 billion in market value and triggering cascading contagion across the broader crypto market.

The FTX collapse constitutes the largest centralized exchange failure in crypto history and one of the most significant financial frauds of the 21st century. A CoinDesk report revealing Alameda Research's balance sheet — heavily concentrated in FTT, FTX's native token — triggered a bank run. On-chain analysis confirmed that FTX had been systematically misappropriating customer funds to cover Alameda's trading losses and venture investments. FTX filed for Chapter 11 bankruptcy on November 11, 2022, with an estimated $8B+ hole in customer funds.

The Mt. Gox collapse was the first catastrophic centralized exchange failure in Bitcoin's history and remains the foundational case study for custodial exchange risk. At its peak, Mt. Gox handled approximately 70% of all global Bitcoin transactions. The exchange suspended trading and filed for bankruptcy protection in February