The Ronin Network bridge hack remains one of the largest single theft events in crypto history. Attackers compromised five of the nine Ronin validator private keys — four belonging to Sky Mavis and one to Axie DAO — enabling unauthorized withdrawals totaling 173,600 ETH and 25.5M USDC. The breach went undetected for six days. On-chain analysis subsequently attributed the attack to Lazarus Group, a North Korean state-sponsored threat actor, leading to OFAC sanctions against associated wallet addresses.
⬟ Vault Mandate & Architecture
Pillar IX · ABCDE Forensic Group · Final PillarThe Vault was designated as the ninth and final pillar of the ABCDE Forensic Group, functioning as the "black box" or archival repository for the project. While the other eight categories focus on active definitions and current infrastructure, The Vault is designed to house the investigative record that gives this project its true forensic weight — moving it beyond a standard dictionary and into a comprehensive investigative tool.
Every significant exploit, collapse, and protocol failure in crypto history carries lessons that the industry has repeatedly failed to internalize. The Vault ensures those lessons are documented with forensic rigor, cross-referenced with the main encyclopedia, and preserved for investigators, lawyers, developers, and researchers who need more than a definition — they need the full case file.
📁 Case File Archive
60+ Files · Continuously Updated · For Investigative & Educational Use⚠ Market Exploits
Hacks · Rug Pulls · Vulnerabilities · Post-MortemsThe Poly Network exploit briefly held the record as the largest DeFi hack in history. The attacker exploited a vulnerability in the cross-chain relay contract's keeper role verification, allowing substitution of their own contract as the authorized keeper and simultaneous drainage of funds across Ethereum, BSC, and Polygon. In an unprecedented outcome, the attacker — self-styled "Mr. White Hat" — returned all funds within two weeks, framing the exploit as a demonstration of the vulnerability.
EthCrossChainManager contract allowing arbitrary calls to EthCrossChainData, enabling the attacker to overwrite the keeper public key. This class of cross-chain bridge vulnerability — improper access control on privileged functions — has since been replicated in numerous subsequent exploits and is now a primary audit focus for bridge security reviews.The Euler Finance attack exploited a flaw in the protocol's donation mechanism combined with a missing health-check in the donateToReserves function. Using flash loans, the attacker created a self-liquidation scenario that drained the protocol's reserves across multiple asset pools. The attacker subsequently returned the majority of funds following on-chain negotiations — a pattern increasingly observed in high-profile DeFi exploits where legal exposure incentivizes partial or full restitution.
⬛ Historical Project Failures
Sunsetted Protocols · Dead Projects · Collapse Post-MortemsThe Terra / LUNA collapse represents the most catastrophic algorithmic stablecoin failure in crypto history. The UST depeg event — triggered by coordinated large-scale withdrawals from Anchor Protocol — initiated a death spiral between UST and LUNA. As UST lost its $1 peg, the mint-and-burn mechanism designed to restore parity instead hyperinflated LUNA's supply from ~350M to ~6.5 trillion tokens within 72 hours, destroying over $40 billion in market value and triggering cascading contagion across the broader crypto market.
The FTX collapse constitutes the largest centralized exchange failure in crypto history and one of the most significant financial frauds of the 21st century. A CoinDesk report revealing Alameda Research's balance sheet — heavily concentrated in FTT, FTX's native token — triggered a bank run. On-chain analysis confirmed that FTX had been systematically misappropriating customer funds to cover Alameda's trading losses and venture investments. FTX filed for Chapter 11 bankruptcy on November 11, 2022, with an estimated $8B+ hole in customer funds.
The Mt. Gox collapse was the first catastrophic centralized exchange failure in Bitcoin's history and remains the foundational case study for custodial exchange risk. At its peak, Mt. Gox handled approximately 70% of all global Bitcoin transactions. The exchange suspended trading and filed for bankruptcy protection in February 2014, revealing that 850,000 BTC belonging to customers and the exchange had been lost — the result of a years-long theft that went undetected due to catastrophically inadequate internal controls, security practices, and accounting procedures.