WhatIsCrypto.info
BTC—ETH—BTC MAX SUPPLY21,000,000BTC MINED20,000,000+BLOCK REWARD3.125 BTCNEXT HALVING~2028BTC BLOCK TIME~10 MINETH BLOCK TIME12 SECETH TRANSFER21,000 GAS1 BTC100,000,000 SATS1 ETH1,000,000,000 GWEISTABLECOIN TARGET$1.00US CRYPTO FRAUD LOSSES 2025$11.4BCOINS ON COINGECKO~22,800FIRST BLOCKJAN 3 2009

Smart contract exploits and bridge hacks

You can't audit the code yourself. You can control how much you leave exposed to it.

IntermediateAbout 5 minutesReviewed November 5, 2026
The short answer

A smart contract exploit is when an attacker finds a bug or a weak key in the code that holds users' funds and drains it. Cross-chain bridges are a favourite target because they hold large pools of locked assets. As a user you can't prevent these hacks, but you can limit exposure: keep only what you need in any app, prefer long-running official bridges, revoke old approvals, and ignore anyone offering to "rescue" your funds.

The rule that never changes

Legitimate support will never ask for your seed phrase (recovery phrase) or private key. Not an exchange, a wallet maker, a lawyer, the police or the FBI. Anyone who asks for it, or asks you to type it into a website, is trying to steal from you.

Why it happens

  • Code bugs. A smart contract does exactly what its code says, including the mistakes, and once deployed it often can't be easily patched.
  • Stolen keys. Many bridges and apps rely on a small group of signers or admin keys. Steal enough of them and you control the funds.
  • Tampered front ends. The contract may be fine while the website or wallet interface that builds your transaction is compromised.

Dated examples

  • March 2022, Ronin bridge: attackers gained control of five of the nine validator keys securing the bridge for the game Axie Infinity and withdrew about $625 million. The FBI attributed it to North Korea's Lazarus Group on April 14, 2022.
  • February 21, 2025, Bybit: about $1.5 billion was stolen from the exchange's Ethereum cold wallet, the largest crypto theft on record. The FBI attributed it to North Korea on February 26, 2025. Investigators found the attackers had compromised a developer machine at the wallet provider Safe and altered its web interface, so the exchange's signers approved what looked like a routine transfer. See multisig wallets for the lesson.

What you can actually do

  1. Limit exposure. Don't keep more in any one DeFi app or bridge than you'd accept losing. Bridged and "wrapped" tokens depend on the bridge staying solvent.
  2. Prefer the official route. For moving to a layer 2, the network's own canonical bridge is usually the most battle-tested, even if slower. See how bridges work and why they get hacked.
  3. Treat audits as a minimum, not a guarantee. Audited contracts have still been drained. Track record and time without incident matter too.
  4. Revoke approvals to apps you no longer use, so a future exploit can't reach your wallet. See how to revoke approvals.
  5. After an exploit, wait for official word. Follow the project's verified accounts. Fake "migration," "refund" and "claim compensation" sites appear within hours.
  6. Never let anyone "rescue" your funds with your seed phrase.

For background, see what is DeFi?

If it happened to you

  1. Revoke your approvals to the affected contract and move funds out of any related app, if withdrawals still work.
  2. Watch only official channels for compensation or claims processes, which never require your seed phrase or an upfront payment.
  3. Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
  4. Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
  5. Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
  6. Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.

Need the steps in order? Use the emergency checklist for a compromised wallet or account.

Frequently asked questions

What is a crypto bridge?

A system that locks tokens on one blockchain and issues matching tokens on another. Because the locked pool can be very large, bridges are a prime target.

Does an audit mean a contract is safe?

No. An audit lowers the risk of known bug types but can't rule out every flaw, compromised keys or a hacked website.

Will I be compensated after a hack?

Sometimes, if the project or exchange covers losses, but there's no guarantee and no insurance like FDIC. Plan as if you won't be.

Where to next

Sources

  1. North Korea responsible for $1.5 billion Bybit hack (FBI PSA, February 26, 2025)
  2. US officials tie North Korea's Lazarus hackers to Ronin theft (CoinDesk, April 2022)
  3. Lazarus hacked Bybit via breached Safe{Wallet} developer machine (BleepingComputer)
  4. Ethereum security and scam prevention (ethereum.org)

Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.