Decentralized finance (DeFi) applications have really become popular in recent years, even reaching more than 250 billion dollars in value committed (TVL). It has also attracted ill-intentioned individuals, who have been responsible for many hacks, hacks or mass attacks. A look back at the 5 biggest hacks in DeFi history.
The 5 most important DeFi hacks
Decentralized finance (DeFi) protocols aim to decentralization and disintermediation of financial services such as currency exchange, lending or borrowing. Real revolution allowed the blockchain, this sector has experienced exceptional enthusiasm since 2021.
In December 2021, the DeFi sector was worth around $250 billion. Nevertheless, such sums of money also attract malicious individuals. In 2022 alone, nearly $2 billion worth of cryptocurrency was stolen, majority from hacks or attacks targeting DeFi.
Let’s find out together the 5 biggest hacks to hit decentralized finance at the time of writing these lines. Here is the full list:
Ronin Network: $625 million; Poly Network: $611 million; BNB Bridge: $586 million; Wormhole Bridge: $325 million; Nomad Bridge: $190 million.
👉 Store your cryptocurrency yourself with the Ledger Nano S Plus
The best way to secure your cryptocurrencies 🔒
🔥 The world leader in crypto security
5 – Nomad Bridge: $190 million.
With losses amounting to $190 million, Nomad Bridge is the 5th biggest hack in DeFi history. As its name suggests, Nomad is a cross-chain bridge allowing tokens to be exchanged between various blockchains (Ethereum (ETH), Avalanche (AVAX), Moonbeam (GLMR), Milkomeda C1 and Evmos).
As you will see throughout this article, bridges are the protocols most often targeted by attacks. Their vulnerability has already been mentioned by Vitalik Buterin, who warned at the beginning of 2022 of the need to progress in securing these tools essential to the proper functioning of the DeFi ecosystem.
In two words, this hack comes from a flaw in Nomad’s smart contracts that allowed a first user to withdraw 100 wBTC, worth $2.3 million. The flaw gradually spread and many users were able to withdraw the same amount multiple times, draining $190 million.
👉 Nomad Bridge hack details
4 – Wormhole Bridge: $325 million
In 4th place in our ranking of the day, we find again a bridge: Wormhole. In total, $325 million worth of wETH was siphoned off of this interoperability protocol between blockchains.
Concretely, the flaw came from a smart contract allowing ETH to be locked in order to recover in return “Wrapped Ether”, compatible with the Solana (SOL) blockchain. In effect, the hacker managed to manipulate this mechanism to print wETH without locking ETH first.
The flaw was open for a few hours, leaving plenty of time for the hacker to realize one of the biggest attacks in decentralized finance. After more than a year of total inactivity, the attacker’s address has recently started to activate.
👉 Know all about the Wormhole Bridge hack
3 – BNB Bridge: $586 million
With $586 million stolen, the official bridge of the BNB Chain ranks third on the podium. More specifically, this attack concerns the BSC Token Hub cross-chain bridgeallowing tokens to be transferred between the BNB Beacon Chain (BEP2) and the BNB Smart Chain (BEP20 or BSC).
In just 2 transactions, the hacker transferred more than 2 million BNB tokens (over $560 million at the time) to various protocols. Nevertheless, the BSC Token Hub blockchain and bridge was quickly shut down by the Binance team.
This emergency intervention, although strongly criticized by the community (the speed of execution calling into question the decentralization of this blockchain), allowed to freeze 80% of the stolen fundsrelatively mitigating the impact of this attack.
👉 Dig Deeper: Binance Avoids What Could Have Been One of the Biggest BNB Chain Hacks in History
2 – Poly Network: $611 million
In second position, we find the only hack in this ranking that did not take place in 2022: Poly Network. Over $611 million was drained of this interoperability protocol between blockchains.
Poly Network teams quickly identified the offending addresses in the case, asking miners on the affected blockchains (Ethereum, BNB Chain and Polygon) to add them to a blacklist.
Note that this story ended well. The hacker has returned all of the stolen cryptocurrencies on a multi-signature wallet provided by Poly Network. In return, the company offered him a position as an IT security advisor and a $500,000 bounty.
👉 Summary of the Poly Network attack
1 – Ronin Network: $625 million
At the top of this ranking, the sad holder of the title of biggest hack in DeFi history is Ronin Network. Again, it is the Ethereum sidechain bridge that is affected: 625 million dollars were able to be stolen in complete peace of mind.
Indeed, the team only realized the hack 5 days after the fact, when a user reported that he could not withdraw 5,000 ETH. In a few words, the attacker managed to take control of 5 network validator nodesallowing him to withdraw as many tokens as he wanted.
In question, an authorization delegated by Axie Infinity to Axie DAO, later revoked but still accessible through the allowlist. The hacker was able to obtain the signature of Axie DAO and have access to the nodes necessary to operate his misdeeds.
👉 All information about Ronin Network hack
🎁 Cryptoast Research Launch Offer
1st Newsletter Free with the code TOASTNL
Newsletter 🍞
Receive a summary of crypto news every Monday by email 👌
What you need to know about affiliate links. This page presents assets, products or services relating to investments. Some links in this article are affiliated. This means that if you buy a product or register on a site from this article, our partner pays us a commission. This allows us to continue to offer you original and useful content. There is no impact on you and you can even get a bonus by using our links.
Investments in cryptocurrencies are risky. Cryptoast is not responsible for the quality of the products or services presented on this page and could not be held responsible, directly or indirectly, for any damage or loss caused following the use of a good or service highlighted in this article. Investments related to crypto-assets are risky by nature, readers should do their own research before taking any action and only invest within the limits of their financial capabilities. This article does not constitute investment advice.
AMF recommendations. There is no guaranteed high return, a product with high return potential involves high risk. This risk-taking must be in line with your project, your investment horizon and your ability to lose part of this savings. Do not invest if you are not ready to lose all or part of your capital.
To go further, read our Financial Situation, Media Transparency and Legal Notices pages.
Journalist for Cryptoast, I strive to dissect every detail of the exciting world of cryptocurrencies and make it accessible and understandable to as many people as possible.
Lilian Aliaga
387 items
