What Is an Exploit in Crypto?
An exploit is an attack that takes advantage of a vulnerability in software or protocol design to make a system behave in unintended ways. In crypto, it usually means draining funds through a smart contract bug.
On this page 6
An exploit is an attack that takes advantage of a vulnerability in software or protocol design to make a system behave in ways its creators never intended. In crypto, the word most often describes someone using a bug in a smart contract to drain funds from a protocol. Headlines tend to say “hack”, but within the industry “exploit” is the more precise term.
Exploit vs. vulnerability vs. hack
These words get used interchangeably, but they mean different things. A vulnerability is a weakness in code or design. An exploit is the technique that takes advantage of that weakness, or the attack carried out with it. “Hack” is a loose everyday word for any kind of unauthorized access.
Say a contract updates a user’s balance only after sending them funds. That ordering is a vulnerability. An attacker repeatedly withdrawing the same funds by abusing it is the exploit. This particular bug class is called reentrancy.
Common types of crypto exploits
- Smart contract bugs: Broken access controls, arithmetic mistakes or logic flaws such as reentrancy.
- Oracle manipulation: Temporarily distorting the price data a protocol relies on. See our oracle entry for more.
- Flash loan attacks: Borrowing huge sums without collateral, repaid within the same transaction, to manipulate prices or governance votes.
- Key compromise: Stealing the admin or validator keys of a bridge or protocol.
- Front-end attacks: The contracts are fine, but the website is hijacked to trick users into signing malicious transactions.
The last two aren’t smart contract bugs in a strict sense, but the damage looks similar. Knowing which category an incident falls into tells you what the fix will be.
Famous crypto exploits
In 2016, an attacker used a reentrancy bug to drain roughly 3.6 million ETH from The DAO, an investment contract on Ethereum. The fallout led to a hard fork that split the chain and created Ethereum Classic. In August 2021, more than $600 million was taken from Poly Network, and the attacker later returned most of it. In March 2023, Euler Finance lost about $197 million, which was also eventually returned.
These cases show that even audited protocols with long track records can hide bugs. That is why many projects run bug bounty programs that pay “white hat” researchers to find vulnerabilities before attackers do.
What should users do after an exploit?
Start with official channels to learn which network, contracts and assets are affected. Early statements are often incomplete, and a full post-mortem may take days. If you have granted token approvals to the affected protocol, revoking them can limit further losses.
Fake “compensation” and “fund recovery” sites appear quickly after big incidents. No genuine refund process will ever ask for your seed phrase. Even if a reimbursement is announced, verify the address and method through the project’s official channels; our phishing guide covers the warning signs.
Frequently asked questions
Is exploiting a smart contract legal?
Taking funds from a protocol without authorization can be prosecuted as a crime in many countries, even if the code technically allowed it. The person behind the 2022 Mango Markets attack was prosecuted in the United States.
Is an audited protocol safe from exploits?
An audit reduces risk but doesn’t remove it. Check which version of the code was audited and whether changes were made afterwards.