In 2022, the crypto industry was hit with centralized exchange bankruptcies, bridge failures, stablecoin depeggings, and much more.

That year is still treated as the disaster benchmark. The data says otherwise. Losses fell in 2023, climbed back through 2024 and 2025, and the first half of 2026 recorded more individual hacks than any six-month period in crypto history.

The Four Eras of Crypto Failure

Two patterns run through every year since 2022. A handful of incidents drive the majority of losses, and the defense that worked against last year's attack rarely works against this year's.

👉 Quick takeaway: Total stolen funds have not trended cleanly in either direction. What has changed is the attack surface. Balance sheet failures defined 2022. Bridge and contract code defined 2022 into 2023. Private keys took over in 2024. By 2026, the weak point is operational security and the humans holding access.

Period	Dominant Failure Mode	Total Stolen	What It Exposed
2022	CeFi insolvency and bridge exploits	🔴 ~$3.8B 🔴 Highest annual total on record	Custody, leverage, opaque balance sheets
2023	Retrenchment and enforcement	🟢 ~$1.7B 🏆 Lowest total of the period	Flash loan attacks peaked, then faded
2024	Private key compromise	⚠️ ~$2.2B	"Decentralized" platforms with centralized key storage
2025	Single-point infrastructure failure	🔴 ~$2.2B to $2.7B	One breach can exceed an entire prior year
H1 2026	Access control and social engineering	⚠️ ~$972M to $1.32B 🔴 Record incident count	Audited code is no longer the weak point

Loss figures are drawn from Chainalysis annual crypto crime reports for 2022 through 2024, and from TRM Labs and CertiK reporting for 2025 and 2026. Trackers use different methodologies, so treat these as ranges rather than precise figures.

The 2022 Contagion Chain: How One Collapse Became Six

Most coverage treats the 2022 failures as a bad year with several unrelated blowups. That framing is wrong. The Federal Reserve Bank of Chicago's 2023 retrospective describes a direct causal chain. Terra/Luna's collapse in May triggered liquidity stress at Three Arrows Capital, which then defaulted on loans to Celsius, Voyager, BlockFi, and Genesis. FTX's November collapse was the last domino, not an independent event.

👉 Quick takeaway: Six months separated the first failure from the last. Every firm on this list had direct financial exposure to at least one other firm on it. The interconnections were deep and largely invisible to outsiders until the defaults started.

Month	Event	Estimated Loss / Exposure
May 2022	Terra/Luna UST de-pegs; LUNA hyperinflates	🔴 ~$40B in market cap erased 🔴 Trigger for everything below
June 2022	Celsius Network freezes withdrawals	$11.7B in assets under management
July 2022	Three Arrows Capital liquidated	~$500M LUNA exposure; multi-billion creditor defaults
July 2022	Voyager Digital files for bankruptcy	Heavy 3AC and Terra exposure
November 2022	FTX collapses after bank run	🔴 ~$8B customer shortfall reported
November 2022	BlockFi files for bankruptcy	$1B to $10B in assets and liabilities

The OECD described this sequence as a textbook example of contagion risk in crypto markets, with each firm's failure amplifying stress at the next.

Centralized Exchange/Brokerage Failures

Centralized platforms dominated crypto for a decade partly by default. Decentralized alternatives were slow, expensive, and hard to use. So users handed over their private keys and trusted the platform.

That trust had a structural problem. Centralized exchanges lacked transparency about their actual holdings, carried heavy leverage, and had deep financial ties to each other. A shock at one firm did not stay contained. It traveled, and it caused an avalanche of liquidations at every firm downstream.

Celsius Network, June 2022

Celsius was a centralized crypto lending platform offering its users a chance to earn a yield on their crypto investments. Two months before its collapse, it claimed to have 1.7 million users and $11.7 billion in assets managed.

The bear market exposed how badly overleveraged Celsius had become. Terra/Luna's collapse in May 2022 was the direct trigger. It vaporized the value of assets Celsius held and sparked a wave of withdrawal requests the platform could not meet. The Chicago Fed's 2023 analysis identifies the Terra/Luna event as the starting point for the entire chain of CeFi distress that followed.

Three Arrows Capital, July 2022

Three Arrows Capital was one of the largest crypto hedge funds in the world before it imploded in July 2022. The fund had placed roughly $500 million into Terra/LUNA. When that position went to near zero in May, 3AC could no longer service the leveraged positions it held across multiple protocols. BTC and ETH price drops accelerated the liquidations.

The real damage spread outward. 3AC had borrowed heavily from BlockFi, Voyager Digital, Genesis, and Blockchain.com. When it defaulted, those firms absorbed losses they could not absorb. Voyager filed for bankruptcy weeks later. The Chicago Fed's retrospective cites 3AC as the second major link in the 2022 contagion chain, sitting directly between Terra/Luna and the broader CeFi failures.

Voyager Digital, July 2022

With a large sum invested in 3AC, the US-based cryptocurrency broker Voyager Digital was the next one in line to go bankrupt, carrying over $1.4 billion in debt.

In addition to 3AC, Voyager had exposure to Terra, Alameda Research, Celsius, and Babel Finance. Every one of those counterparties was under stress at the same time.

FTX, November 2022

The failure of FTX, one of the top-five crypto exchanges by trading volume, marked the next stage of crypto contagion.

On November 2nd, Coindesk published a report that made the community nervous. The document revealed that Alameda Research, FTX's close business partner, stored the majority of its funds in FTT, the native token of the exchange. Scared of the upcoming devaluation, users rushed to withdraw their funds, which led to a liquidity crisis.

Binance initially signaled it would buy FTT to stabilize the exchange, then reversed that decision within 24 hours after reviewing FTX's financials. The bank run accelerated. Within days, FTX suspended withdrawals. A hack then drained an additional several hundred million dollars from wallets, exploiting the chaos of the collapse. FTX filed for Chapter 11 bankruptcy on November 11, 2022. Sam Bankman-Fried was arrested in December.

BlockFi, November 2022

BlockFi's assets and liabilities both fell somewhere between $1 billion and $10 billion at the time of filing. The range reflects how opaque its books were, which is itself part of the story.

It had lent to 3AC, held exposure to Celsius, and relied on an FTX credit facility for liquidity. When FTX collapsed, that credit facility vanished. BlockFi filed for Chapter 11 on November 28, 2022, two weeks after FTX.

Bridge Failures 2022

Bridges play an important role in the blockchain ecosystem. By minting wrapped tokens, they enable seamless transfer from one blockchain to another.

The idea connects blockchains and simplifies crypto usage in general. It also concentrates enormous value behind a small number of keys.

👉 Quick takeaway: Every bridge on this list concentrated control in a handful of keys or a single verification function. Ronin required five signatures out of nine and the attacker obtained five. Harmony required two. The pattern is not bad luck. It is a design choice that traded security for lower operating cost.

Bridge	Month	Loss	Root Cause
Wormhole	February 2022	⚠️ ~$325M	Signature verification flaw on Solana
Ronin	March 2022	🔴 ~$540M 🔴 Largest bridge loss of 2022	Five of nine validator keys compromised
Harmony Horizon	June 2022	⚠️ ~$100M	🔴 Multi-sig threshold of just two signatures
Nomad	August 2022	⚠️ ~$190M	Faulty initialization let anyone drain funds
BNB Chain Bridge	October 2022	🔴 ~$570M	Forged proof of deposit 🔴 Entire chain halted to contain it

Wormhole, February 2022

Wormhole acted as a cross-chain link between Ethereum, Solana, and other blockchains. On February 2nd, an attacker stole around $325 million worth of wrapped ethers by exploiting a signature verification bug that developers missed before releasing the new version.

Ronin, March 2022

An attacker gained control over four of nine validator private keys and used one more from Axie DAO. That gave them the five signatures the bridge required to authorize withdrawals.

The protocol lost about $540 million worth of Ethereum and USDC. A more decentralized validator set would have made the attack significantly harder.

Harmony's Horizon, June 2022

The same failure at smaller scale. Hackers obtained two of the five private keys the bridge required for transaction validation. The platform lost around $100 million, which the attackers laundered through Tornado Cash with no chance of recovery.

Nomad Bridge, August 2022

Nomad's developers released an update containing a bug that let attackers mint 100 wBTC on Ethereum by sending just 0.01 wBTC from Moonbeam. Because the exploit was trivial to copy, hundreds of opportunistic addresses joined in.

The Nomad team had published a blog post earlier that year explaining they had given up light clients to avoid complex implementation. Lower operating costs meant lower security. That decision cost the project $190 million.

Binance Smart Chain, October 2022

An attacker discovered a vulnerability in the BSC bridge contract and minted 2 million BNB out of thin air. No real user funds were impacted, but hackers moved tokens to other chains before BSC suspended its network.

The hack itself is not the worst part. The fact that a single party could suspend an entire working network should make users wary. What happens when that same power gets pointed at end-user funds?

Stablecoin Failures 2022

Fundamentally, these failures came down to two things: not being fully backed, and not having a robust redemption mechanism.

UST, May 2022

Terra's UST collapse remains the largest crypto failure by market value ever recorded. Here is what happened according to the Chainalysis report:

Terraform Labs withdrew 150 million UST from Curve's pool. Two traders used this temporary vulnerability for their own profits and swapped $185 million UST to USDC.
Terraform Labs and its supporters tried to rebalance the UST ratio by purchasing it back.
Their attempt made the problem worse as the large trades broke UST's peg.
Investors panicked and a large sell-off began. UST's sister token LUNA hyperinflated and led to a total crash of both assets.

Two structural flaws made the collapse inevitable once it started.

UST's peg depended on LUNA absorbing volatility. When UST started to slip, the system minted more LUNA to buy it back. More LUNA supply drove LUNA's price down, which made UST harder to defend, which required more LUNA minting. The spiral had no floor.

The system also had no external reserve large enough to break the panic. Once large holders started selling, the mechanism worked against itself. Academic research published in Finance Research Letters confirmed that the Terra/LUNA crash produced measurable spillover effects across other crypto assets, not just within the Terra ecosystem.

aUSD, August 2022

Acala Network, a Polkadot DeFi platform, experienced a major attack in August. Hackers minted over $1.2 billion worth of Acala's stablecoin aUSD without any collateral, immediately triggering a depeg.

In response, Acala's team halted all operations on the platform. That did not help much. The aUSD peg was never restored.

With a single party able to block operations across the whole network, the platform does not look particularly decentralized. This is what happens when a protocol is not immutable and the team holds admin keys.

Circle USDC, August 2022

In August 2022, the US Treasury sanctioned USDC and ETH addresses connected to Tornado Cash under money-laundering provisions. A centralized fiat-backed stablecoin issuer had no option but to comply.

Dune reported roughly 40 cryptocurrency addresses banned within a single day.

How was Circle able to freeze funds sitting in non-custodial wallets? The issuer can add custom parameters to every issued token and blacklist specific addresses at the contract level. Self-custody protects you from the exchange. It does not protect you from the token issuer.

USDT, November 2022

After the FTX collapse, law enforcement had Tether freeze $46 million worth of stolen USDT.

The action itself looks justified. It also demonstrates the scale of power centralized issuers hold over user funds. This was not a first. Tether froze $150 million USDT in January 2022 and $35 million in September 2020.

Flash Loan Attacks on DeFi Protocols

DeFi solutions avoid centralization risk. They are exposed to a different class of attack instead.

Flash loans allow immediate uncollateralized borrowing of large sums, repaid within a single transaction. Applied to governance systems, they became a weapon. The top DeFi exploits of 2022 include the following three cases.

Beanstalk, April 2022

Beanstalk Farms was drained of $182 million via a flash loan attack. The attacker exploited the project's vote governance system, capturing a supermajority of voting power and approving code that transferred funds to their own wallet. The entire sequence executed in a single block.

The Redemption, April 2022

Before launching a decentralized exchange, Redemption applied to Certik for a code audit. On the same day, the platform suffered a coordinated flash loan attack that drained 4 million 2OMB tokens, roughly $1.6 million.

The audit later confirmed the smart contract contained a vulnerability. The project did not have time to fix it.

Cauldron, September 2022

Cauldron, running on Avalanche, lost roughly $370,000 when an attacker manipulated the token price in the contract, according to Certik's report. It is a small figure next to the CeFi collapses, which is exactly the point. Flash loan attacks are a code problem, not a solvency problem, and the loss ceiling reflects that.

2022 saw 48 flash loan exploits totalling $278 million. That was not the peak.

2023: Losses Halved, Enforcement Started

Total stolen funds dropped roughly 54% to about $1.7 billion. That decline tracked the cooldown in DeFi protocol exploits that had driven the 2021 to 2022 spike.

The composition changed too. Flash loan attacks actually peaked in 2023 with $316 million stolen across 72 incidents, more than 2022 in both count and value. Bridge hacks largely disappeared as protocols hardened key management.

Notable incidents that year:

Euler Finance, March. ~$197 million in a flash loan attack. The attacker returned most of the funds weeks later.
Atomic Wallet, June. ~$100 million, attributed to Lazarus Group.
Multichain, July. ~$126 million after the CEO reportedly disappeared with key access.
Curve Finance, July. ~$70 million via a Vyper compiler reentrancy bug affecting multiple pools.
Mixin Network, September. ~$200 million from a cloud database provider compromise.
Poloniex and HTX, November. ~$126 million and ~$110 million respectively, both private key compromises.

Three things happened outside the hacks that mattered more.

Silvergate, Signature Bank, and Silicon Valley Bank all failed in March 2023. Circle held $3.3 billion of USDC reserves at SVB, and USDC briefly depegged to $0.87. It was the clearest demonstration that crypto's fiat rails carry bank risk regardless of what happens on-chain.

Binance settled with the US Department of Justice for $4.3 billion in November 2023. Changpeng Zhao stepped down as CEO and later served four months in prison.

Sam Bankman-Fried was convicted on all seven counts in November 2023.

2024: The Private Key Era

Stolen funds rose roughly 21% to about $2.2 billion across 303 incidents. The vector shifted decisively. Private key exploits accounted for roughly $1.2 billion, ten times what flash loan attacks produced in the same year.

Smart contract exploits set a record for incident count at 100, but barely breached $196 million in total losses. The code was getting better. The key management was not.

👉 Quick takeaway: Four of the five largest 2024 incidents involved compromised keys rather than exploited code. DMM Bitcoin never recovered and wound down operations entirely. Munchables is the outlier worth noting: an insider attack where the funds came back within 24 hours.

Incident	Month	Loss	Vector
Orbit Chain	December 31, 2023	⚠️ ~$82M	Bridge compromise
Munchables	March 2024	🟢 ~$62M recovered 🏆 Only full recovery in table	Insider; keys surrendered within 24 hours
DMM Bitcoin	May 2024	🔴 ~$305M 🔴 Exchange wound down operations	Private key compromise, Lazarus suspected
WazirX	July 2024	🔴 ~$230M	Multi-sig wallet compromise
Radiant Capital	October 2024	⚠️ ~$50M	Multi-sig compromise

Flash loan attacks fell to $123 million across 48 incidents, roughly a third of the 2023 total. On the enforcement side, Bankman-Fried was sentenced to 25 years in March 2024, and Alex Mashinsky pleaded guilty to commodities and securities fraud in December.

2025: One Breach Bigger Than Most Years

Total stolen funds landed somewhere between $2.2 billion and $2.72 billion depending on the tracker. The number matters less than its distribution.

Bybit, February 2025

On February 21, attackers drained approximately 401,000 ETH, worth roughly $1.4 to $1.5 billion at the time, from wallets tied to the Dubai-based exchange. It remains the largest crypto theft on record by a wide margin.

The method is the important part. Attackers compromised a third-party developer's workstation and inserted malicious code into the transaction signing process. The transfer appeared legitimate to Bybit's signers while routing funds to attacker-controlled wallets. No smart contract was exploited. The Lazarus Group was widely attributed.

CertiK noted that without Bybit and one other incident, total 2025 losses would have stood at roughly $690 million. A single breach exceeded the entire 2023 annual total.

👉 Quick takeaway: Cetus is the recovery story of the year. Sui validators froze and returned $162 million of the roughly $220 million stolen, which is only possible on a chain where validators can coordinate that fast. That capability is also the reason critics question how decentralized Sui actually is.

Incident	Month	Loss	Notes
Phemex	January	⚠️ ~$73M	Hot wallets drained across 16 chains
Bybit	February	🔴 ~$1.4B to $1.5B 🔴 Largest crypto theft ever recorded	Developer workstation compromise
UPCX	April	⚠️ ~$70M	Malicious contract update via compromised key
Cetus Protocol	May	🔴 ~$220M 🏆 $162M frozen and returned by validators	Largest DEX on Sui
Nobitex	June	🔴 ~$90M unrecoverable	Politically motivated; funds sent to burn addresses
Balancer v2	November	⚠️ ~$120M	Access control flaw plus rounding error

October 10, 2025: The Leverage Lesson, Repeated

The largest single-day deleveraging in crypto history had nothing to do with a hack.

President Trump announced a 100% tariff on Chinese imports on the evening of Friday, October 10. Equities and commodities sold off. Crypto, trading 24/7 without circuit breakers and sitting near record open interest of $217 billion, became the pressure point.

More than $19 billion in leveraged positions liquidated in roughly 24 hours
1.6 million traders affected, with approximately $16.7 billion of that in long positions
Bitcoin fell from about $122,000 to roughly $105,000
Perpetual futures open interest contracted 43% in a day, from $217 billion to $123 billion
USDe briefly depegged to $0.65 on Binance, triggering secondary liquidations
Total market cap fell by an estimated $350 to $400 billion

At the worst point, positions liquidated at a rate of $10.39 billion per hour.

This is the 2022 lesson wearing different clothes. In 2022, the leverage sat on the balance sheets of Celsius, 3AC, and FTX, and it took six months to unwind. In 2025, the leverage sat in perpetual futures positions across dozens of venues, and it unwound in 40 minutes.

2026: Record Incidents, Lower Losses, New Weak Point

The first half of 2026 produced more crypto hacks than any six-month period on record. It also produced the lowest loss total in years.

Trackers disagree on the total, and the gap is worth understanding. TRM Labs and Immunefi both put H1 2026 at roughly $972 million across 207 incidents. CertiK's Hack3D report puts it at roughly $1.316 billion across 344 on-chain incidents. Onchain Lens reports $1.32 billion across 224 to 244 publicly disclosed hacks. The spread comes from what counts as an incident and whether frozen or recovered funds are netted out. Cite the range, not a single figure.

The Two Incidents That Defined the Half

Two April attacks accounted for roughly 44% of all H1 2026 losses. Neither exploited audited smart contract code.

Kelp DAO, April 2026. Roughly $291 million. Attackers compromised off-chain RPC nodes to exploit the LayerZero verifier setup, tricking it into releasing ETH.

Drift Protocol, April 2026. Roughly $285 million. Attackers used social engineering to gain access to the protocol's Security Council and obtain pre-signed transactions.

North Korea linked groups accounted for roughly $643 million, or about 66% of H1 losses, nearly all of it from those two incidents.

The Structural Shift

CertiK CEO Ronghui Gu put it directly: both incidents were failures in operational and infrastructure security, not code vulnerabilities in the traditional sense.

The supporting data backs that up. Access control failures produced the largest individual losses. Phishing and social engineering accounted for roughly $282 million. Oracle exploits hit Bonzo Finance, Ostium, and Blend. BonkDAO lost $21 million to a governance exploit. One incident was a $24 million physical coercion attack, sometimes called a wrench attack. Median loss per incident fell to roughly $219,000.

Meanwhile, DeFi exploit losses have fallen 74% from their 2022 peak of $2.62 billion to $680.3 million, even as attack frequency climbs. Immunefi credits larger bug bounties, routine audits, competitive security reviews, and better monitoring. Researchers reported 837 valid vulnerabilities through Immunefi in H1 2026 alone.

The conclusion writes itself. Smart contract security improved dramatically. The attackers moved to the parts of the stack that audits do not cover: developer workstations, RPC infrastructure, multi-sig signers, and the humans holding the keys.

Leverage cascades did not stop either. 2026 has already delivered multiple billion-dollar liquidation events. The February 1 cascade, nicknamed Black Sunday II, erased $2.2 billion in 24 hours, with Ethereum longs alone losing $961 million. Leverage rebuilt after each flush.

Failure Type Comparison: What Defends Against What

👉 Quick takeaway: These four failure types need four different defenses. An audit tells you nothing about whether a protocol's multi-sig signers can be phished. Proof of reserves tells you nothing about whether your leveraged position survives a 14% move. Conflating them leads to bad risk management.

Factor	CeFi Collapse	Bridge / Contract Exploit	Access Control Breach	Leverage Cascade
Root Cause	Overleveraging, opacity	Code vulnerability	Compromised keys, social engineering	Crowded positioning, thin books
Peak Era	2022	2022 to 2023	2024 to 2026	🔴 Recurring, never resolved
Scale of Loss	🔴 Billions to tens of billions	⚠️ Tens to hundreds of millions	🔴 Hundreds of millions	🔴 Billions in a single day
User Recourse	⚠️ Bankruptcy proceedings; slow and partial	🔴 Usually none	🔴 Usually none	🔴 None; liquidation is final
Primary Defense	Proof of reserves, self-custody	Code audits, bug bounties	Hardware key isolation, signer training, transaction simulation	Lower leverage, position sizing

What Regulators Did Next

The 2022 failures produced the most significant wave of crypto regulatory action since Bitcoin launched, and the follow-through continued through 2026.

OECD, December 2022. Published "Lessons from the Crypto Winter". Its core finding: crypto firms operating like banks, taking deposits and running leveraged books, had none of the safeguards banks are required to maintain. It called for disclosure requirements, reserve standards, and cross-border coordination.

MiCA, EU. Took full effect in 2024, shaped in part by the 2022 collapses. The Crypto Asset Service Provider transitional deadline landed in July 2026, pushing hundreds of platforms out of the European market entirely.

GENIUS Act, US. Signed into law July 18, 2025. Created the Permitted Payment Stablecoin Issuer category with 1:1 reserve requirements in high-quality liquid assets and monthly attestations. Key compliance requirements became enforceable July 18, 2026.

SEC and CFTC joint interpretation, March 2026. Interpretive Release 33-11412 established a five-category taxonomy for crypto assets: Digital Securities, Digital Commodities, Stablecoins, Digital Collectibles, and Digital Tools. The two agencies signed a coordination MOU on March 11, 2026.

FATF, July 2026. Published a targeted DeFi report flagging illicit-use risk, governance centralization, and the gap between protocols that call themselves decentralized and protocols that actually are.

ESMA. Continued citing 2022 contagion dynamics in its 2026 Risk Monitor, noting that automated liquidations and leverage spillovers remain live risks. October 2025 proved that point.

Where the Accountability Landed

👉 Quick takeaway: Every major 2022 CeFi executive faced criminal or civil consequences. Creditor recovery came almost entirely through bankruptcy proceedings, not regulatory settlements. The FTC's $4.72 billion judgment against Mashinsky was almost entirely suspended; he paid $10 million, none of which flows to a consumer refund program.

Executive	Firm	Outcome
Sam Bankman-Fried	FTX	🔴 25 years, March 2024 Convicted on all seven counts, November 2023
Alex Mashinsky	Celsius	🔴 12 years, May 2025 Forfeited $48.3M; lifetime CFTC ban
Changpeng Zhao	Binance	⚠️ $4.3B DOJ settlement; four months served
Do Kwon	Terraform Labs	⚠️ $4.5B SEC settlement after securities fraud finding
Caroline Ellison	Alameda Research	⚠️ Two years; cooperated with prosecutors

Creditor recovery has been better than most expected. Celsius announced a fourth bankruptcy distribution of $344.4 million in January 2026, bringing total recovery to approximately 72.1% of creditor claims against a plan targeting 67% to 85%.

How Many Crypto Projects Have Actually Failed?

The 2022 headline failures were the largest by dollar value. They were nowhere near the largest by count.

CoinGecko's research found that of over 25.2 million cryptocurrencies listed on GeckoTerminal, 13.4 million have stopped trading and are considered failed. That is 53.2%.

The timing is the surprise. 11.6 million of those tokens died in 2025 alone, representing 86.3% of all recorded failures. Q4 2025 accounted for 7.7 million on its own, directly following the October 10 liquidation cascade.

For context, GeckoTerminal listed 428,383 projects in 2021. By 2025 that number had reached roughly 20.2 million. The failure rate rose alongside the launch rate, driven largely by memecoin platforms that made token deployment nearly free.

The practical read: 2022 killed large, well-funded institutions. 2025 killed the long tail.

Bottom Line: Five Things Four Years Proved

Centralization was the common variable in 2022. Every CeFi platform that collapsed held customer funds in ways customers could not verify or withdraw freely. That is a custody problem, not a crypto problem.

Contagion moves faster than anyone models it. Terra/Luna fell in May 2022. By November, six major firms had filed for bankruptcy or frozen withdrawals. In October 2025, the equivalent unwind took 40 minutes because the leverage had moved from balance sheets to perpetual futures.

The failure mode migrates every 18 months. Bridge code in 2022. Flash loans in 2023. Private keys in 2024. Infrastructure and social engineering in 2025 and 2026. Every defense that works is a defense against the last attack.

Smart contract security genuinely improved. DeFi exploit losses fell 74% from the 2022 peak. Median loss per incident dropped 75%. Bug bounties, audits, and a larger security researcher pool worked. That is a real win and it deserves saying.

The weak point is now human. The two largest incidents of 2026 both bypassed audited code entirely. One compromised a developer's infrastructure. The other socially engineered a Security Council. Access control, signer discipline, and phishing resistance are the frontier now, and they are much harder to audit than a smart contract.

The question worth sitting with: if the largest losses in crypto history came from centralized platforms and compromised humans rather than broken code, why does most due diligence still stop at the audit report?

Frequently Asked Questions

What was the biggest crypto hack of all time?

The Bybit breach in February 2025, at roughly $1.4 to $1.5 billion. Attackers compromised a third-party developer workstation and manipulated the transaction signing process rather than exploiting a smart contract.

Was 2022 the worst year for crypto losses?

By stolen funds, yes: roughly $3.8 billion, still the highest annual total. By project failures, no. 2025 saw 11.6 million tokens stop trading, 86% of all recorded failures since 2021.

Are crypto hacks getting better or worse?

Both. H1 2026 recorded the highest incident count of any six-month period, but total losses fell below prior periods and median loss per incident dropped to roughly $219,000. More attacks, smaller average damage, with occasional very large infrastructure breaches.

Did FTX and Celsius creditors get their money back?

Partially. Celsius reached approximately 72.1% recovery as of its January 2026 distribution, against a plan targeting 67% to 85%. Recovery came through bankruptcy proceedings rather than regulatory settlements.

What is the most common crypto attack vector in 2026?

By incident count, smart contract exploits. By dollar value, access control failures including compromised keys, phishing, and social engineering. The two largest H1 2026 incidents both bypassed audited code entirely.

Why do liquidation cascades keep happening?

Crypto derivatives trade 24/7 without circuit breakers. When leverage builds and a macro shock hits, forced selling triggers more forced selling. October 10, 2025 liquidated $19 billion in 24 hours. Leverage rebuilt within months, and 2026 has already produced multiple billion-dollar repeats.

Crypto Failures 2022 to 2026: What Collapsed