A crypto exploit is an attack that takes assets by using a defect in code rather than by deceiving a person. The defect can sit almost anywhere in the stack, and where it sits decides who is affected and what can be done afterwards.
The layers an exploit can hit
- Smart contracts — a flaw in a protocol's logic lets an attacker withdraw more than they put in. Recurring forms include reentrancy, manipulated price inputs and broken access control.
- Bridges — code that mints an asset on one chain against a deposit on another. A defect in the proof-checking lets an attacker mint without ever depositing.
- Key generation and wallets — if the software that creates a private key does not draw on enough randomness, the resulting keys can be derived by brute force. Nothing is "hacked" at the moment of theft; the attacker simply computes the key and signs.
- Consensus rules — a defect in a chain's own validation logic, which can admit invalid blocks or unauthorised minting.
- Operational surfaces — compromised front-ends, malicious signing prompts, leaked staff credentials.
Why the layer matters more than the headline number
Two incidents of the same dollar size can have very different consequences. A contract flaw is usually patchable, and the protocol can pause, fork or compensate. A flaw in how keys were generated is not patchable for anyone already holding an affected key: a software fix protects keys created after it, and funds sitting behind an older key stay exposed until they are moved.
Exploit, scam and physical attack are not synonyms
An exploit uses a defect in code. A scam persuades the owner to sign or send. A physical attack coerces them. Loss tallies published by research firms combine these categories differently, which is a common reason totals for the same period disagree.
In MoonWire analysis
We track incidents by layer and by what the response revealed — see our comparison of three firms' disagreeing theft counts and the crypto security hub. Related reading: self-custody. A description of an incident is not a security recommendation.