Module 16: Postmortems
Major Hacks, 2022 to 2026: When Security Fails at Scale
Chapter 9 of 12 · about 5 minutes
9.1 Not a bug, a campaign
"When people hear 'crypto hack,' they picture a lone hacker finding a clever bug," said Hash. "Some hacks are like that. But the largest ones in recent years look more like intelligence operations: months of planning, social engineering, fake identities, and attacks on the people and systems around the code."
This chapter looks at several of the largest hacks between 2022 and 2026, and the patterns they share.
9.2 The cases
| Incident | Date | Approximate loss | How it happened (as reported) |
|---|---|---|---|
| Ronin bridge | March 2022 | About $625 million | Attackers gained control of enough validator keys to approve fraudulent withdrawals from a bridge serving a blockchain game; the initial compromise reportedly involved social engineering of an employee (Module 3, Chapter 10) |
| Bybit | February 2025 | About $1.46 to $1.5 billion | Attackers compromised the interface used by the exchange's multisig signers, who approved a malicious transaction that appeared routine; the largest crypto theft on record (Module 2, Chapter 6) |
| KelpDAO | April 2026 | About $290 million | Attackers compromised infrastructure used by a cross-chain messaging service, allowing them to drain tokens tied to ETH; described as the largest hack of 2026 at the time |
| Drift Protocol | April 2026 | About $285 million | Described by the protocol as the outcome of a months-long operation by attackers linked to North Korea |
In numbers, KelpDAO and Drift together lost about $290 million + $285 million = $575 million in a single month, April 2026.
US authorities and blockchain analytics firms attributed the Ronin, Bybit, KelpDAO, and Drift attacks to groups linked to North Korea.
9.3 A state-backed threat
Blockchain analytics firms reported that North Korea-linked groups have become the dominant force in crypto theft:
| Period | Share of crypto hack losses attributed to North Korea-linked actors (as reported by TRM Labs) |
|---|---|
| 2020 to 2021 | Under 10% |
| 2022 | 22% |
| 2023 | 37% |
| 2024 | 39% |
| 2025 | 64% |
| 2026, through April | 76% |
Total crypto theft attributed to North Korea since 2017 was estimated at more than $6 billion by 2026. United Nations reports have linked such theft to funding of weapons programmes.
9.4 What these hacks have in common
| Pattern | Explanation | Module |
|---|---|---|
| People, not just code | Social engineering, fake job offers, and impersonation to compromise employees | Module 2, Chapter 10 |
| Attacks on infrastructure around the contracts | Interfaces, servers, and key management, rather than the core smart contract | Module 3, Chapter 13 |
| Blind signing | Signers approving transactions they couldn't fully verify | Module 2, Chapters 6 and 7 |
| Concentrated keys | Too few keys or signers controlling large funds | Module 2, Chapter 13 |
| Bridges and cross-chain systems | Large pools of value and complex trust assumptions | Module 3, Chapter 10 |
| Rapid laundering | Stolen funds swapped and bridged quickly, often through decentralised routes | Module 6, Chapter 2 |
| Long preparation | Months of reconnaissance, sometimes including in-person meetings | Module 2, Chapter 11 |
"So even professional security teams with multisig and hardware wallets got hit," said Mint.
"Because the attackers went after the process around the keys," said Hash. "The interface they trusted. The colleague they trusted. The job applicant they trusted."
9.5 What happened to users
| Incident | Effect on users (general) |
|---|---|
| Ronin | Funds were eventually reimbursed to users with backing from the company and investors |
| Bybit | The exchange said it remained solvent and covered customer assets using its own reserves and loans from partners |
| KelpDAO and Drift | Effects depended on each protocol's response and resources; check current status |
Outcomes for users vary widely. Some platforms absorb losses; others can't. As Chapter 8 showed, even when users are compensated, it can take time and be on terms set by others.
9.6 Lessons for you
| Lesson | Module |
|---|---|
| Read what you sign, and avoid blind signing | Module 2, Chapter 7 |
| Use multisig with truly independent signers for large amounts | Module 2, Chapter 13 |
| Treat unsolicited job offers, files, and meeting links with suspicion | Module 2, Chapter 10 |
| Be cautious with bridges and wrapped assets | Module 3, Chapter 10 |
| Size positions in any protocol to survive total loss | Module 9, Chapter 13 |
| Diversify across platforms | Module 12, Chapter 5 |
| Self-custody shifts this risk to you, so your own security matters | Module 2 |
9.7 Try it yourself
Review your own security setup against the patterns in section 9.4. Do you ever approve transactions you can't fully read? Do any large holdings depend on a single key or device? Have you received unsolicited job offers or file requests related to crypto? List one change you'll make.
Key takeaways from this chapter
- The largest recent hacks, including Ronin (2022), Bybit (2025), and KelpDAO and Drift (2026), involved compromised people, interfaces, and infrastructure, not just code bugs.
- Bybit's roughly $1.5 billion loss in February 2025 is the largest crypto theft on record.
- North Korea-linked groups accounted for a growing share of hack losses, reported at 64% in 2025 and 76% in early 2026.
- Common patterns include social engineering, infrastructure attacks, blind signing, concentrated keys, bridge risks, rapid laundering, and long preparation.
- User outcomes vary; some platforms reimburse users, others can't.
- Read what you sign, use independent multisig for large amounts, beware unsolicited approaches, and size positions to survive total loss.