---
title: "What Is a Crypto Exploit? How Attacks on Code, Keys and Contracts Differ"
term: "Crypto exploit"
type: glossary_term
canonical: https://www.moonwire.org/insights/glossary/crypto-exploit.html
---

# What Is a Crypto Exploit? How Attacks on Code, Keys and Contracts Differ

> A crypto exploit is an attack that uses a defect in software - a smart contract, a bridge, a wallet or a chain's own rules - to move assets without the owner's consent. It differs from a scam, which relies on persuading the owner to act.

A **crypto exploit** is an attack that takes assets by using a defect in code rather than by deceiving a person. The defect can sit almost anywhere in the stack, and where it sits decides who is affected and what can be done afterwards.

## The layers an exploit can hit

- **Smart contracts** — a flaw in a protocol's logic lets an attacker withdraw more than they put in. Recurring forms include reentrancy, manipulated price inputs and broken access control.
- **Bridges** — code that mints an asset on one chain against a deposit on another. A defect in the proof-checking lets an attacker mint without ever depositing.
- **Key generation and wallets** — if the software that creates a private key does not draw on enough randomness, the resulting keys can be derived by brute force. Nothing is "hacked" at the moment of theft; the attacker simply computes the key and signs.
- **Consensus rules** — a defect in a chain's own validation logic, which can admit invalid blocks or unauthorised minting.
- **Operational surfaces** — compromised front-ends, malicious signing prompts, leaked staff credentials.

## Why the layer matters more than the headline number

Two incidents of the same dollar size can have very different consequences. A contract flaw is usually patchable, and the protocol can pause, fork or compensate. A flaw in how keys were generated is not patchable for anyone already holding an affected key: a software fix protects keys created after it, and funds sitting behind an older key stay exposed until they are moved.

## Exploit, scam and physical attack are not synonyms

An exploit uses a defect in code. A scam persuades the owner to sign or send. A physical attack coerces them. Loss tallies published by research firms combine these categories differently, which is a common reason totals for the same period disagree.

## In MoonWire analysis

We track incidents by layer and by what the response revealed — see our comparison of [three firms' disagreeing theft counts](/insights/sector-rotation-2026-07-31.html) and the [crypto security hub](/insights/topics/crypto-security.html). Related reading: [self-custody](https://www.moonwire.org/insights/glossary/self-custody.md). A description of an incident is not a security recommendation.

## Further reading

- [Wikipedia: Cryptocurrency and crime](https://en.wikipedia.org/wiki/Cryptocurrency_and_crime)
- [Wikipedia: Smart contract](https://en.wikipedia.org/wiki/Smart_contract)

## Where this appears in MoonWire analysis

- [Prognosis daily - choppy holds, a fresh downside lean on XRP](https://www.moonwire.org/insights/prognosis-daily-2026-07-14.md) — Jul 13, 2026
- [Hedera turns down as the tape stays choppy; the book holds at cap](https://www.moonwire.org/insights/prognosis-daily-2026-07-13.md) — Jul 12, 2026

---

*MoonWire surfaces and summarizes public crypto news.*

**General information only — not financial advice.** MoonWire Ltd. is not licensed by ASIC and holds no AFSL. This content does not consider your objectives, financial situation, or needs, and is not a recommendation to buy, sell, or hold any asset.

*This analysis is generated by artificial intelligence and may be inaccurate, incomplete, or fabricated. Independently verify before acting.*

© 2026 MoonWire Ltd. · [Terms](https://www.moonwire.org/legal/TOS) · [Risk Disclosure](https://www.moonwire.org/legal/RISK_DISCLOSURE) · [Privacy Policy](https://www.moonwire.org/legal/PRIVACY_POLICY)