DeFi hacks: the exploits that drained protocols
The essentials in 30 seconds
- DeFi hacks are exploits that drain a protocol’s funds, and they usually follow 4 patterns: code flaws, price manipulation, stolen keys and bridge weaknesses.
- An exploit can finish inside 1 transaction, which is why speed beats any manual response.
- A crypto crash raises the reward for attackers, because collateral and pools hold more stress.
- Recovery after a hack depends on pauses, negotiation and the protocol’s design, and no outcome is guaranteed.
- Checks on audits, keys and limits suit readers in Singapore and Hong Kong as of October 2026.
DeFi hacks are exploits in which an attacker uses a weakness in a protocol to drain its funds. As of October 2026 they remain one of the fastest ways to lose money in decentralized finance, and a crypto crash gives them more room to work. This page sorts the exploits into 4 patterns, explains what users face afterwards, and lists checks that lower exposure. For the basics, read the guide on what DeFi is.
On this page
Compare the EQOS Asia offers and request a 30-minute pre-diagnostic.
What are DeFi hacks, and why do exploits drain whole protocols?
A DeFi hack is rarely a break-in of the usual kind. The attacker sends ordinary transactions that use the contract in a way its authors did not plan. Because the funds sit in the contract itself, a successful exploit can drain the full balance, and no bank officer stands between the attacker and the money.
Most exploits fit 4 patterns: a flaw in the contract logic, a manipulated price, a stolen or misused key, and a weakness in a bridge between blockchains. The sections below take each pattern in turn, describe the mechanism, and show the check that a reader can run to see whether a protocol has addressed it.
How does a reentrancy exploit drain a DeFi protocol?
Reentrancy is a classic logic flaw. A contract sends funds to a caller before it updates its own records, and the caller’s code calls back in before the update lands. The contract sees the old balance and pays again. The loop repeats until the pool is empty, all inside one transaction.
Other logic flaws follow the same spirit: rounding errors that favour the caller, missing limits on a withdrawal, and rules that behave differently at extreme values. Developers prevent them with careful ordering, tests and independent review. Readers can check whether a protocol publishes its audits, its test results and a bug bounty that rewards honest reports.
How do flash loans help exploit a DeFi protocol?
A flash loan lends a very large sum for the length of one transaction, on the condition that it is repaid before the transaction ends. An attacker can borrow it, move the price in a thin pool, use the false price in a lending protocol to borrow more, then repay the flash loan and keep the difference.
The weakness lies in the price source, not in the flash loan. A protocol that reads its price from a single thin pool can be moved by one large trade. A protocol that averages prices over time, or reads several sources, makes the attack costly. Ask which source feeds the price and how long it averages.
How do stolen keys and weak permissions lead to DeFi hacks?
Some DeFi hacks involve no code flaw at all. The attacker obtains an admin key, a signer’s device or a deployment credential, then uses legitimate powers to move funds or replace the contract. Phishing messages and fake support chats are common ways to reach the person who holds the key.
Design choices limit the damage. A multisignature wallet needs several approvals, a timelock delays changes so that users can exit, and a spending cap limits what any one action can move. Readers can look for published signer lists, a delay of several days and clear limits, because these features turn a total loss into a partial one.
Why do cross-chain bridges attract DeFi hacks?
A bridge moves value between blockchains. It usually locks assets on one chain and issues a matching token on another, so the locked pool becomes a large target. A flaw in the verification step can let an attacker claim assets without a matching deposit, and the issued tokens then lose their backing.
Bridge risk spreads through DeFi because wrapped tokens serve as collateral in many protocols. If the backing fails, every protocol that accepted the token inherits the loss. Readers can check how a bridge verifies messages, how many parties approve a transfer, and which protocols accept its tokens as collateral.
What happens to users after DeFi hacks hit a protocol?
The first response is usually a pause, where the team stops deposits and withdrawals to limit further loss. Next comes analysis of the transaction trail, which is public on the blockchain. Some teams negotiate with the attacker, offering a reward for returned funds, and some funds are frozen by issuers of centralized tokens.
Outcomes differ and none is guaranteed. Some users recover part of their funds, some receive claim tokens that settle later, and some recover little. Wise planning assumes that the funds in a protocol can be unavailable for a long period, and it sizes each position so that a pause stays manageable.
How can you reduce exposure to DeFi hacks in a crypto crash?
4 habits cut exposure. Spread funds across several protocols instead of one. Prefer protocols with published audits, bug bounties and timelocks. Keep a size that you could lose without harm. Use a hardware wallet for the keys that you control. Teams that want a structured review of their exposure can contact EQOS Asia for a 30-minute pre-diagnostic.
The crypto crash pillar guide shows where DeFi hacks sit among the other channels of market stress. This page is general information, not investment advice, and it names no protocol or product. Your decisions depend on your situation, so confirm the details with a qualified adviser.
See also in this guide
Frequently asked questions
What are DeFi hacks?
DeFi hacks are exploits where an attacker uses a weakness in a protocol to drain funds. They usually follow 4 patterns: contract logic flaws, price manipulation, stolen or misused keys, and weak bridges. Most happen through ordinary transactions, and a single transaction can be enough to empty a pool.
How does a flash loan attack work?
The attacker borrows a large sum within one transaction, moves the price in a thin pool, uses the false price to borrow more elsewhere, then repays the flash loan and keeps the gain. The fix sits in the price source: averaged prices and several sources make the attack expensive.
Can users get their money back after a hack?
Outcomes vary and none is guaranteed. Teams may pause the protocol, trace the funds on the public blockchain, and negotiate with the attacker. Some users recover part of their funds, some receive claim tokens, and some recover little, so plan each position as if it could be locked for a long period.
Does this page give investment advice?
This page is general information, not investment advice. It explains how exploits work and which checks help, and it names no protocol, token or product. Your decisions depend on your tolerance, your jurisdiction and your goals, so confirm the details with a qualified adviser.
Test your knowledge
1. What does a reentrancy exploit repeat?
- A price update
- A withdrawal before the records update
- A token launch
Show the answer
A withdrawal before the records update.
2. How long does a flash loan last?
- One transaction
- One month
- One year
Show the answer
One transaction.
3. What does a timelock give users?
- A higher yield
- A new wallet
- Time to exit before a change
Show the answer
Time to exit before a change.
4. Where does a flash loan attack find its weakness?
- In the price source
- In the wallet colour
- In the exchange logo
Show the answer
In the price source.
5. How many patterns of DeFi hacks does this page sort?
- 2
- 9
- 4
Show the answer
4.
About the author
Stéphane Jambu
President, EQOS Forecast Asia
Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile
Sources: EQOS Asia crypto pillar guide (eqos-asia.com/crypto-crash/crypto-crash.html) and EQOS Asia contact page (eqos-asia.com/contact.html), consulted on 23 October 2026. Page updated on 23 October 2026.