Smart Contract Hacks: What Are They and How They Happen

‍

Summary

• Smart contract hacks exploit flaws in code, ranging from reentrancy bugs and flash loan manipulation to access control failures, oracle manipulation, and compromised bridge validators, to steal users’ funds.
• Hackers span a wide spectrum, from white hat researchers who disclose bugs responsibly to opportunistic crews and organized state-linked groups, and AI agents that are increasingly capable of finding and exploiting vulnerabilities autonomously.
• Some of the largest smart contract hacks include 2021’s Poly Network exploit, 2022’s Ronin Bridge Hack, and 2025’s Bybit Exchange Hack.
• Prevention rests on layered defenses, including independent code audits, ongoing bug bounty programs, multi-signature implementation, time-delayed withdrawals, and more.

A smart contract is a set of code deployed on a blockchain that carries out an action or a set of actions automatically once its specified conditions are met, without the need for approval from a higher authority or middleman. The absence of a human in the loop is precisely what makes smart contracts efficient, but it is also what makes them such an attractive target for hackers. Once a contract is deployed, its code is generally fixed and public, enabling anyone with the technical expertise to inspect the code line by line to find any unintended loopholes or errors.

‍

‍

Billions of dollars in digital assets now move through smart contracts that manage lending pools, trading platforms, bridges between blockchains, and decentralized applications. Each one is a potential entry point for an attacker, and history has shown that even audited, well-funded protocols can fall victim to a single overlooked flaw. This article breaks down how these hacks happen, who tends to be behind them, what motivates the attacks, as  well as some of the most consequential examples on record, and the defensive steps organizations take to reduce their exposure.

How Do People Hack Smart Contracts?

The majority of smart contract attacks do not involve cracking encryption or brute-forcing a password. Instead, they usually involve parsing through the codebase for said smart contracts, looking for any exploitable bugs in it. These attacks generally fall into several key categories.

Reentrancy 

Reentrancy is one of the oldest smart contract attack vectors. Imagine a bank teller who hands you your withdrawal before updating the ledger that tracks your balance. If you attempt another withdrawal before the ledger catches up, the cashier hands it over a second time, and a third, since the books have not recorded the initial withdrawal yet. This is how a reentrancy attack works in concept, giving a malicious contract the chance to call back into the withdrawal function repeatedly before the first transaction finishes. The infamous 2016 Dark DAO hack, which led to the hard fork of Ethereum and Ethereum Classic, was one such example of a reentrancy attack.

‍

‍

Flash loan attacks 

Flash loan attacks take on a different approach. Flash loans let a borrower take out a very large, uncollateralized loan and repay it within the same transaction, a legitimate tool for arbitrage and refinancing. Attackers have repurposed this feature to temporarily flood a market with borrowed capital, push a token's on-chain price away from its real value, trade against that distorted price on a vulnerable protocol, and repay the loan once the damage is done, all inside a single block.

Access control failures 

These hacks target the access controls of a smart contract. When an attacker is able to bypass the controls which should limit contract calls to approved addresses or admins, an attacker can simply call it directly. This enables accessing functions which they should not have access to, which can include a full withdrawal of funds held in the contract.

Oracle manipulation 

These types of hack target the price feeds that many contracts rely on to know the current market value of an asset. If a protocol pulls its price data from a single, thinly traded source instead of a broad, tamper-resistant feed, an attacker can push that one source off balance and trick the contract into mispricing a trade.

‍

‍

Bridge and validator compromises 

These sit slightly outside pure code bugs. Cross-chain bridges often depend on a small set of validators or signers who approve transfers between blockchains. If an attacker gains enough of those signing keys through phishing or social engineering, the bridge's code can work exactly as designed and still be exploited, as the attacker is impersonating an authorized party rather than exploiting a bug.

Who Hacks Smart Contracts?

The people behind smart contract hacks fall into a few broad categories.

Independent security researchers, sometimes called white hats, look for bugs and disclose them responsibly, sometimes exploiting the discovered flaw themselves to rescue funds before a malicious party finds it. Opportunistic individuals or small crews scan newly deployed contracts for obvious mistakes, often using automated scripts that watch the blockchain around the clock for a protocol that looks rushed to market.

‍

‍

On the flip side, individual black hat hackers and criminal syndicates seek the same bugs and flaws for the purpose of theft. At a higher level, state-linked hacking units are also responsible for a notable number of hacks. Several of the largest hacks of all time have been attributed to the infamous North Korean Lazarus Group, including the 2022 Ronin bridge exploit and 2025’s Bybit hack, resulting in over $2B in losses.

With the proliferation of AI and AI agents, AI agents are also becoming involved in the scene, with the ability to read code, uncover zero-day vulnerabilities (unknown software or hardware flaws that developers have had zero days to fix, leaving systems open to sudden attack) and write an exploit script, all without any human intervention.

Why Do People Hack Smart Contracts?

The motive in the overwhelming majority of smart contract exploits is straightforward theft. A successful exploit can hand an attacker control of a lending pool's reserves, a bridge's locked collateral, or an exchange's hot and cold wallets in a matter of minutes, and the pseudonymous nature of blockchain addresses gives the attackers a head start before anyone even notices the funds are missing. In the Ronin case, the breach that began on 23 March 2022 was not discovered until 29 March, giving the attackers nearly a week of uninterrupted head start to move funds through exchanges and mixing services before the network even paused withdrawals.

As for why a particular contract becomes the target rather than another, the answer usually comes down to a mix of opportunity and reward. Newly launched protocols that skip a thorough audit to rush a product to market are attractive because their code has not been stress-tested by outside reviewers. Contracts holding large sums of locked value are attractive simply because the payoff justifies the effort of finding a flaw. Bridges in particular have proven popular targets because they concentrate enormous value behind a comparatively small number of signing keys, turning what should be a distributed trust model into something closer to a single point of failure.

Famous Smart Contract Hacks

The Ronin Network bridge hack remains one of the clearest demonstrations of how a validator compromise can bypass code entirely. Attackers used hacked private keys to forge withdrawal approvals, moving out 173,600 ETH and 25.5 million USDC, a haul Arkham data valued at roughly $625 million at the time of the theft. At the time, the bridge only required five of nine validators to approve any withdrawals from the bridge. After gaining access to the required number of validators, the final step was a simple withdrawal of all of the funds held by the bridge contract in two transactions.

‍

‍

The Bybit exchange hack of February 2025 was the largest known hack then, as the first crypto hack to cross the billion dollar mark. Attackers compromised the interface of Safe, a widely used multisignature wallet platform, altering what Bybit's own signers saw on screen during a routine transfer so they unknowingly authorized a transaction redirecting more than 401,000 ETH and related tokens to attacker-controlled addresses. Arkham launched a 50,000 ARKM bounty to identify the attacker, which was solved by independent on-chain sleuth, ZachXBT, pinning the blame on North Korea’s Lazarus Group.

Read our full write-up on the infamous Lazarus Group here. 

The Poly Network exploit of August 2021 showed a different outcome. An attacker drained roughly $611 million across multiple blockchains by exploiting a flaw in how the protocol verified cross-chain messages, exploiting a true smart contract bug. Fortunately, in this scenario, the majority of the stolen funds were ultimately returned, with some analysts speculating that the exploiters found it too difficult to launder such a large amount.

How Do Organisations Prevent Hacks?

No defense is absolute, but several practices have become standard among protocols that take security seriously. Independent code audits, carried out by specialized firms before a contract goes live, help to check for critical weaknesses and common code bugs in the code base. Additionally, an appropriately-sized bug bounty program extends that audit indefinitely by paying independent researchers or teams to continuously test the code after launch, effectively crowd-sourcing the search for flaws to a much larger pool of eyes than what any single audit firm can offer.

Formal verification takes this further by mathematically proving that a contract's code behaves exactly as specified under every possible input, rather than simply testing a sample of scenarios and hoping nothing was missed. Multisignature requirements and time-delayed withdrawals also add friction on purpose, so a single compromised key or manipulated interface cannot alone drain a treasury. The delay window also gives defenders a chance to notice and freeze suspicious activity before it settles permanently on-chain.

‍

‍

On-chain monitoring tools, including the kind of wallet and entity tracking Arkham provides, allow security teams and independent investigators to flag unusual transfers and trace stolen funds toward exchanges or mixers quickly enough to alert those platforms before withdrawals are processed.

Finally, many protocols now cap the value any single bridge or contract can hold, or require large withdrawals to pass through additional review, limiting how much an attacker can extract even if a bug is being exploited.

Conclusion

Smart contracts remove the need for a trusted middleman, but that design choice means the code itself has to behave as the middleman would, catching every edge case a human might have caught by instinct. The hacks examined here, from validator key theft to interface spoofing to cross-chain message forgery, show that the weak point is rarely the blockchain itself; it is almost always the human decisions, rushed timelines, or concentrated trust built into the systems layered on top of it.

As more value moves on-chain, the incentive to find one overlooked line of code will only grow, which is why audits, bounty programs, and transparent on-chain investigation have quickly become permanent fixtures of the industry.