Common DeFi Exploits Explained (And How to Stay Safe)

DeFi opens up lending, trading and earning without a bank — but it also exposes users to a catalogue of exploits, most of which lean on the same handful of tricks. This guide walks through the most common DeFi exploits in plain English, how each one works, and the practical habits that protect you from the majority of them.

Why DeFi is a target

DeFi runs on public smart contracts that hold real money and execute automatically. The code is open for anyone — including attackers — to study, transactions can't be reversed, and there's no support desk to freeze a theft. That combination makes it fertile ground for exploits.

The good news: most attacks reuse a small number of patterns. Learn the patterns and you'll spot most danger before you're in it.

Rug pulls

A rug pull is when the people behind a project drain it and vanish. It's less a clever hack than a confidence trick wearing DeFi clothes.

• Liquidity rug — developers withdraw the pool of funds that backs a token's price, leaving holders with something they can't sell.
• Hidden mint or backdoor — the contract secretly lets the team create unlimited tokens or withdraw user deposits.
• Slow rug — hype, a steady drain, then the team quietly disappears.

Flash loan and oracle attacks

These are the technical exploits behind many headline DeFi thefts. They abuse how protocols read prices and how DeFi lets you borrow huge sums for an instant.

• Flash loans let an attacker borrow a massive amount with no collateral, as long as it's repaid in the same transaction. Honest uses exist, but attackers use the borrowed firepower to manipulate a market.
• Oracle manipulation — many protocols read an asset's price from an on-chain source. By distorting that source momentarily (often with a flash loan), an attacker tricks the protocol into mispricing assets and drains the difference.
• Reentrancy — a flaw where a contract can be called again before it finishes updating its balances, letting an attacker withdraw repeatedly.

You can't prevent these yourself, but you can prefer protocols that use robust, well-tested price oracles and have survived a long time unbroken.

Malicious approvals and phishing

This is the category that most often hits ordinary users directly, and it's the one you have the most control over. Instead of breaking a protocol, the attacker tricks *you* into authorising the theft.

• Malicious approval — a fake or compromised site asks you to approve a token, and the approval grants a drainer contract permission to spend it.
• Signature phishing — a 'permit' or off-chain signature that quietly authorises moving your tokens with no obvious transaction.
• Fake airdrops and tokens — a worthless token appears in your wallet; interacting with it sends you to a draining site.
• Lookalike front-ends — a cloned version of a real DeFi site at a similar URL.

Protocol and bridge failures

Even honest, careful projects can fail. A single bug in a contract, a stolen admin key, or a connected protocol breaking can cascade through everything built on top of it.

• Code bugs in a protocol's contracts that an attacker discovers and exploits.
• Admin-key compromise — a developer's privileged key is stolen and used to drain funds.
• Bridge hacks — cross-chain bridges are a special, high-value case covered in crypto bridge hacks explained.
• Composability cascades — when one protocol depends on another, a failure in the first ripples outward.

How to stay safe in DeFi

1. Stick to established protocols with long track records and large amounts safely locked over the newest, highest-yield project.
2. Start small and test with an amount you can afford to lose before committing more.
3. Use a separate hot wallet for DeFi, kept apart from the cold storage holding your savings.
4. Read and limit token approvals, and revoke old ones regularly with a reputable approval checker.
5. Bookmark official sites and never reach a DeFi app through a link in a DM, ad, or email.
6. Treat 'guaranteed' or unusually high yields as a warning sign, not an opportunity.

Frequently asked questions