Most Crypto Hacks Don’t Start With Stolen Wallets—They Start in the Code

Like
Liked

Date:

Published

on

<!– View count beta – CS

| 22 views

–>

Graphics & Design

A banner showing a collage of a few charts along with the text "Fraud in Data is a visual editorial series decoding the modern fraud landscape through data."
Series button that says 01 Fraud Vulnerability
Series button that says 02 Social Engineering Types
Series button that says 03 Employee Embezzlement
Series button that says 04 Hacker Techniques
Series button that says 05 Top Crypto Hacks
Series button that says 06 Fraud Predictions

Most Crypto Hacks Don’t Start With Stolen Wallets—They Start in the Code

Early crypto hacks often focused on stealing wallet credentials. Today, many of the industry’s biggest losses stem from vulnerabilities hidden in platform software.

This graphic, created in partnership with Inigo, breaks down the top 10 ways hackers steal crypto. 

Ranking the Top 10 Crypto Hacking Methods

From May 2025 to April 2026, the most costly method was a type of infrastructure attack known as cross-chain data manipulation

These attacks target systems that move assets between different blockchains. Hackers take advantage of weaknesses in how chains communicate, allowing them to manipulate transactions or steal funds during transfers. 

Technique Primary Risk Category % of Crypto Losses
Cross-Chain Data Manipulation Infrastructure 19%
Admin Compromise + Token Manipulation* Smart Contract 18%
Spoof Token Exploit Smart Contract 14%
Private Key Compromised Custody 11%
Liquidity Pool Exploit Smart Contract 8%
Hot Wallet Hack Custody 6%
Re-Entrancy Exploit Smart Contract 3%
Third-Party API Compromise Infrastructure 3%
Bonding Curve Exploit Smart Contract 2%
Price Oracle Manipulation Smart Contract 2%
Other N/A 14%

* Involves both custody and smart contract risks. Source: DeFiLlama based on losses from hacks between May 1, 2025 and April 30, 2026.

Attacks on code within smart contracts make up five of the top 10 most costly methods. In these cases, hackers are exploiting flaws in the rules that automatically move, price, or manage assets. 

To make the ranking easier to understand, here’s what each remaining hacking method means in plain English.

Admin Compromise + Token Manipulation

Hackers gain access to privileged admin controls where they can then exploit the code to approve fake assets as collateral from the inside.

Spoof Token Exploit

Attackers use code to create fake or misleading tokens that trick users or platforms into treating them as real. This can be used to trigger fraudulent trades or drain funds.

Private Key Compromised

A private key functions like the password to a crypto wallet. If hackers steal it, they can gain full access to the wallet and transfer funds out instantly. Often, hackers use phishing or other forms of social engineering to trick victims into handing over sensitive credentials.

Liquidity Pool Exploit

Hackers target the pools of assets that power decentralized trading platforms. These code attacks often exploit flaws in pricing, trading, or withdrawal logic.

Hot Wallet Hack

Hot wallets are connected to the internet, making them convenient but more exposed. If attackers gain access, they can quickly transfer funds out.

Re-Entrancy Exploit

These attacks trick a smart contract into sending funds repeatedly before it updates its balance. It is one of the best-known examples of a bug hidden in crypto code.

Third-Party API Compromise

Crypto platforms often rely on outside software connections to send or receive data. If those connections are compromised, attackers may be able to manipulate transactions or platform behavior.

Bonding Curve Exploit

Some crypto projects use automated formulas to set token prices. Hackers exploit weaknesses in those formulas to manipulate prices for profit.

Price Oracle Manipulation

Price oracles feed market prices into apps. If hackers manipulate that price data, they can trigger profitable trades, loans, or liquidations.

The Biggest Crypto Risks Are Evolving

As crypto platforms become more complex, many of the industry’s biggest security threats are shifting away from stolen credentials and toward vulnerabilities embedded in the systems themselves. Staying aware of emerging attack methods—and continuing to strengthen platform security—will be critical as the industry evolves.

Visual Capitalist Logo

In 2026, turning insight into action will define who stays ahead of fraud. Explore a data-driven view of risk at Inigo’s insights hub.


You may also like

Subscribe

ALT-Lab-Ad-1

Recent Articles