The story of DeFi hacks 2024 is not a story of broken cryptography or novel smart contract bugs. It is a story about people. Across roughly $1.5 billion stolen in 2024, the single dominant attack vector was access control — compromised private keys, manipulated signing interfaces, and malware on developer machines. Six of the eight largest incidents traced back to a human in the custody chain being tricked, coerced, or turned. The cryptography held. The humans did not. This recap walks through the year's biggest crypto hacks 2024, what each revealed about where custody is fragile, and why multisig alone was not enough to stop any of them.
The 2024 Loss Picture: One Vector, Two-Thirds of the Money
Before diving into individual incidents, it helps to see the shape of the year. Four major security reports — CertiK, Hacken, Immunefi, and De.Fi — each tallied 2024 losses using slightly different methodologies, and they disagree on the headline number (anywhere from $1.46 billion to $2.36 billion depending on whether phishing and scams are included). But every report agrees on the dominant pattern.
De.Fi's REKT report counted $1.457 billion lost across 165 incidents, with access control exploits accounting for $946 million — 65% of the total — across just 35 incidents. Hacken put access control at 75 to 78% of hack losses, roughly $1.7 billion, up sharply from 50% in 2023. CertiK separately tracked $855 million in private key compromises. Immunefi's $1.49 billion figure was driven almost entirely by two access control incidents — DMM Bitcoin and WazirX — which together accounted for $540 million, 36% of all 2024 losses. The takeaway is consistent: 2024 was the year access control stopped being a background risk and became the central threat. Smart contract bug exploits, the category that produced the legendary DAO hack and the Wormhole bridge drain, contributed only about 14% of hack losses per Hacken. Among defi exploits 2024, the money moved because someone let an attacker in the front door.
Why Access Control, Why Now
Access control covers any attack where the attacker gains authorized access to a system that should have denied them — a stolen private key, a compromised signer, a manipulated signing interface, a rogue insider with privileged contract roles. In 2024, four forces converged to make this the dominant vector. Smart contract auditing matured, pushing attackers toward the softer human and infrastructure layer. North Korea's state hackers industrialized social engineering against crypto employees. Multisig adoption created false security — teams assumed multiple signatures meant multiple independent humans had to be compromised, when the signing interface itself became the single point of failure. And cross-chain bridges and multi-chain exchanges meant a single key-storage compromise could drain assets across seven or ten networks at once.
The Eight Biggest DeFi Hacks 2024
The year's major incidents, in chronological order, reveal how these forces played out in practice.
Orbit Bridge — January 1, 2024 — $81.5 Million
The year opened with a bridge hack. Orbit Bridge, a Korean cross-chain bridge operated by Ozys connecting the Orbit Chain and Klaytn ecosystems to Ethereum, was drained of approximately $81.5 million in the first hours of New Year's Day — 9,500 ETH, 30 million USDT, 10 million USDC, 231 WBTC, and 10 million DAI.
The bridge enforced a 7-of-10 signer threshold on outbound asset movements from its Ethereum vault. The extraction transactions carried valid threshold signatures, meaning at least 7 of the 10 signer keys were under attacker control. The simultaneity of a 7-of-10 compromise is far more consistent with a shared signing infrastructure failure — a compromised signing server, key-management procedure, or build pipeline — than with seven independent phishing attacks. The team's post-mortem revealed that a former internal security officer had made unauthorized firewall policy changes before the attack, likely facilitating the credential theft. The funds were swapped to ETH and DAI, distributed to eight wallets, and remained unmoved. Lazarus Group was suspected. Orbit Bridge was the first major data point of the year: a multisig with a high threshold (7-of-10) provided essentially no protection when the key storage layer itself was compromised.
Munchables — March 26, 2024 — $62.5 Million (Recovered)
Munchables was the strangest incident of the year, and the only major hack with a happy ending. It was an NFT and GameFi protocol on Blast, an Ethereum layer-2. On March 26, a developer who had been on the Munchables smart contract team for months exploited privileged access to assign themselves an internal balance of 1,000,000 ETH, then withdrew 17,413.96 ETH — about $62.5 million.
The attack was an insider job. ZachXBT identified the developer as one of four overlapping GitHub identities believed to be a single North Korean individual hired under fabricated personas. The lock contract had been engineered before deployment to allow the developer to assign themselves up to 1 million ETH, then upgraded to a new implementation that concealed the vulnerability. As auditor 0xQuit noted, if you never knew about the original implementation, the contract would look perfectly fine.
Then came the anomaly. Within roughly 24 hours, the attacker returned the entire $62.5 million — no ransom, no bounty. They transferred the private keys to a multisig controlled by the Blast team, with ZachXBT as custodian. The reason was not ethical. The attacker had off-ramped only about $6,220 to a MEXC deposit address before hitting Blast's bridge liquidity limits (third-party bridges capped transfers at around 3 ETH) and the 14-day mandatory withdrawal delay. They were sitting on illiquid stolen funds they could not move. Protocol design — liquidity friction and withdrawal delays — made the theft unprofitable even after access control failed.
DMM Bitcoin — May 31, 2024 — $305 Million
The largest crypto theft of 2024 was a Japanese centralized exchange, and the attack path ran through a third-party wallet software company. DMM Bitcoin lost 4,502.9 BTC — worth $305 million at the time, later valued at over $440 million — in a single transaction on May 31.
In December 2024, the FBI, the Department of Defense Cyber Crime Center, and Japan's National Police Agency jointly attributed the theft to North Korea's TraderTraitor group (also tracked as Jade Sleet, UNC4899, and Slow Pisces). The attack chain was a textbook social-engineering pipeline. In late March, a North Korean operative posing as a LinkedIn recruiter contacted an employee at Ginco, a Japan-based wallet software company handling DMM's deposits and withdrawals. The operative sent a URL to a malicious Python script disguised as a pre-employment test on GitHub. The victim copied the code to their personal GitHub and was compromised. In mid-May, the attackers used stolen session cookies to impersonate the employee and access Ginco's unencrypted communications. In late May, they manipulated a legitimate transaction request from a DMM employee, resulting in the 4,502.9 BTC drain.
DMM secured 55 billion yen (about $367 million) in loans to cover the loss, but in December 2024 the exchange announced it would close. The DMM hack is the clearest 2024 example of the supply-chain pattern: the attacker never touched DMM directly. They compromised a vendor employee, pivoted through the vendor's communications, and manipulated a transaction that looked legitimate to everyone involved.
BtcTurk — June 22, 2024 — $55 Million
BtcTurk, one of Turkey's largest cryptocurrency exchanges with over five million users, was hit on June 22. The attacker drained approximately $55 million from ten hot wallets across roughly ten blockchains in a near-simultaneous window. Cold wallets, holding the majority of assets, were unaffected.
The incident is a canonical case of key-storage-surface compromise. BtcTurk's hot wallets were protected by multisig, but multisig protects against single-signer compromise — it does not protect when a shared signing pipeline yields multiple keys at once. The simultaneity of the multi-chain drain indicates the attacker compromised the key storage layer itself. Binance assisted and froze $5.3 million. BtcTurk covered losses from reserves. The lesson: a multisig threshold is only as strong as the independence of its key storage. If all keys live on the same signing server, the threshold is an illusion.
WazirX — July 18, 2024 — $235 Million
WazirX, a leading Indian cryptocurrency exchange based in Mumbai, lost approximately $235 million — nearly half of its $500 million in reserves — in a July 18 breach. The hack targeted a Gnosis Safe multisig wallet using a 4-of-6 scheme: five WazirX signers plus one Liminal (custody infrastructure) signer.
The attack exploited a discrepancy between what the Liminal interface displayed and what was actually signed. The signers saw a benign-looking transaction, but the actual payload replaced the multisig's implementation with a malicious contract the attacker had deployed eight days earlier. Once swapped, the attacker bypassed both the multisig threshold and Liminal's address whitelist. The malicious transaction carried three WazirX signatures and one Liminal signature — a valid 4-of-6. WazirX and Liminal publicly blamed each other; Elliptic attributed the hack to North Korean hackers. WazirX halted withdrawals, calling it a force majeure event.
The WazirX hack is the definitive 2024 example of signing-UI manipulation. The multisig threshold was met. The whitelist was honored. The hardware wallets signed. Every checkpoint passed because the interface lied about what was being signed. This is the same class of failure that would, months later, produce the Bybit hack of February 2025 — the largest crypto theft in history.
Penpie — September 3, 2024 — $27 Million
Penpie was the exception. A DeFi yield-boosting protocol built on Pendle Finance, Penpie was drained of approximately $27 million (11,113.6 ETH) across Ethereum and Arbitrum on September 3. Unlike every other major 2024 hack, this was a genuine smart contract vulnerability — a reentrancy bug — not an access control failure.
The root cause was a missing reentrancy guard in Penpie's PendleStakingBaseUpg::batchHarvestMarketRewards() function. The precondition was Penpie's permissionless registerPenpiePool function, which accepted any Pendle market as valid without checking legitimacy. The attacker registered a fake Pendle market with a malicious SY contract, took out a flash loan, and called the reward-harvesting function. During harvesting, the malicious SY contract re-entered the deposit function, repeatedly adding flash-loaned deposits and inflating reward accounting. The attacker then drained the inflated rewards — wstETH, sUSDe, agETH, rswETH.
Pendle paused its contracts on Ethereum at 18:45 UTC, saving approximately $70 million that could otherwise have been drained. The vulnerable code had been deployed after Penpie's earlier audits closed, and the registerPenpiePool flow had never been audited. Proceeds were laundered through Tornado Cash. Penpie is the reminder that smart contract bugs did not disappear in 2024 — they became the minority threat — and a cautionary tale about post-audit code and permissionless extension points. An audit is a point-in-time snapshot; a permissionless registration function is perpetual attack surface.
BingX — September 20, 2024 — $52 Million
BingX, a Singapore-based centralized exchange, was hit on September 20. The attacker drained hot wallets across seven EVM-compatible chains — Ethereum, BNB Chain, Base, Optimism, Polygon, Arbitrum, and Avalanche — beginning around 4:00 AM Singapore time. Initial estimates from PeckShield placed losses at $26 million, but Cyvers and SlowMist revised the total to over $52 million as additional drains landed.
The attack unfolded in two phases over a multi-hour window, consistent with sustained attacker access rather than a one-shot exploit. At least ten exploit addresses fanned out the proceeds, swapped to ETH — a pattern consistent with North Korea's Lazarus Group. The proximate cause was compromise of BingX's hot-wallet key material, with the simultaneity pointing to a single shared signing pipeline. BingX committed to full reimbursement from reserves; cold wallets were unaffected. The BingX hack reinforced the same lesson as BtcTurk: when one key-storage surface controls hot wallets across many chains, a single compromise becomes a multi-chain catastrophe.
Radiant Capital — October 16, 2024 — $50 Million
Radiant Capital, a DeFi lending protocol on Arbitrum and BSC, was hit on October 16 in what the project called one of the most sophisticated hacks in DeFi history. Approximately $50 million was drained from core markets, plus additional funds through exploited open user approvals. This was Radiant's second hack of the year — a January flashloan attack had cost $4.5 million — but the October incident was an order of magnitude larger.
Radiant used a 3-of-11 multisig with hardware wallets, and its signers were geographically distributed. On paper, the setup was robust. The attack bypassed every layer. According to Radiant's post-mortem and Mandiant's investigation, the attack began on September 11 when a developer received a Telegram message from what appeared to be a trusted former contractor, including a link to a zipped PDF — Penpie_Hacking_Analysis_Report.zip — seeking feedback.
The ZIP delivered macOS malware called INLETDRIFT. It established a persistent backdoor while displaying a legitimate-looking PDF, and communicated with atokyonews[.]com. The malware spread among developers as they shared the file. Once installed, the compromised devices manipulated transaction data at the device level: the Safe{Wallet} frontend displayed legitimate data while malicious transactions were signed in the background. Traditional checks — Tenderly simulation, manual review, industry SOPs — showed no discrepancies because the deception occurred beneath the interface layer.
The attackers collected three multisig approvals for a transferOwnership action and drained approximately $50 million. Mandiant attributed the attack to Citrine Sleet (UNC4736 / AppleJeus) — a North Korean state-aligned group. Radiant is the most alarming 2024 hack because every best practice was followed and none of it helped. Hardware wallets, multisig, geographic distribution, transaction simulation, manual review — the attackers defeated all of it by compromising the device that displayed the transaction. If the screen lies, the signature is meaningless.
The Common Thread: Access Control and the Human Bottleneck
Step back from the individual incidents and the pattern is unmistakable. Six of the eight major 2024 hacks were access control failures. Orbit Bridge lost 7-of-10 keys to a shared infrastructure compromise. Munchables was an insider backdoor planted by a DPRK developer. DMM Bitcoin was a vendor employee phished via LinkedIn. BtcTurk and BingX both lost multi-chain hot wallets to key-storage-surface compromises. WazirX was a signing-UI mismatch. Radiant was malware on developer devices spoofing the Safe frontend. Only Penpie was a pure smart contract bug.
Multisig Did Not Save Anyone
This is the uncomfortable lesson of 2024. WazirX had a 4-of-6 multisig. Radiant had a 3-of-11 multisig with hardware wallets and geographic distribution. Orbit Bridge had a 7-of-10 threshold. BtcTurk had multisig on its hot wallets. None of it prevented the theft. Multisig raises the cost of attack in theory — you need to compromise multiple independent signers — but in 2024 practice it failed for three distinct reasons.
First, when keys share a storage surface, the threshold collapses. BtcTurk and BingX both lost multiple hot wallets at once because the keys lived in one signing pipeline. Orbit Bridge lost 7 keys simultaneously because the signing infrastructure, not seven individuals, was compromised. Second, when the signing interface lies, every signer independently confirms the same lie. WazirX's signers all saw a benign transaction in the Liminal UI. Radiant's developers all saw legitimate data in the Safe frontend. The multisig threshold was met with valid signatures on a malicious payload. Third, when a single insider holds privileged contract roles, no threshold applies. Munchables' developer could assign themselves an ETH balance by virtue of their role. The cryptography was never broken. The bottleneck is the interface between the human and the signature: what the signer sees, what they believe they are approving, and how the keys are stored. Multisig addresses none of these.
DPRK Industrialized Social Engineering
North Korea's state-sponsored groups were linked to at least four of the top eight 2024 hacks: DMM Bitcoin (TraderTraitor, FBI-attributed), WazirX (Elliptic attribution), Munchables (DPRK insider per ZachXBT), and Radiant (Citrine Sleet per Mandiant). The same social-engineering template was reused across three platforms. For DMM, the lure was a LinkedIn recruiter offering a coding test. For Radiant, a Telegram message from a fake former contractor sharing a zipped PDF. For Munchables, a pseudonymous job-board hire that placed a DPRK individual inside the project. Three platforms, three payload formats (Python script, macOS malware in a ZIP, insider placement), one actor cluster. The template targets the same constant: a human with access who trusts a message that looks legitimate.
What Would Have Prevented These Hacks
The defenses that follow are not theoretical. Each one maps directly to a 2024 failure mode.
1. Air-gapped or offline signing. If the signing machine has no internet connection — loading transaction data via QR code or microSD from a separately connected machine — signing-UI manipulation cannot reach the signer. WazirX and Radiant both failed because the interface that displayed the transaction was the same interface connected to the internet.
2. Independent transaction simulation. A second system, separate from the signing UI, that independently simulates the transaction and reports the expected state change — "this replaces the multisig implementation, not a transfer" — would have caught the WazirX and Radiant payloads. Radiant ran Tenderly simulation, but on the same compromised device that spoofed the frontend. Independence is the point.
3. Key-storage segregation. No two keys in a multisig should share a signing server, key repository, or key-management procedure. BtcTurk and BingX both lost multiple hot wallets because one compromise yielded many keys. Orbit Bridge lost 7-of-10 keys to a shared infrastructure failure. Segregation means an attacker who compromises one key gets one key, not the threshold.
4. Developer endpoint hardening. The DMM, Radiant, and Munchables attacks all entered through a developer machine. Endpoint Detection and Response (EDR), hardware security keys for infrastructure access, session token rotation, and a strict policy against opening untrusted ZIP files and PDFs would have raised the cost significantly. INLETDRIFT arrived in a zipped PDF shared via Telegram — a vector basic endpoint hygiene should have blocked.
5. Insider vetting and privileged-upgrade escrow. Munchables failed because a pseudonymous developer was hired without identity verification and granted privileged contract roles. Verifying developer identities, requiring multi-party review for any contract upgrade touching storage slots, and escrowing privileged changes with a time delay would have caught the backdoor.
Frequently Asked Questions
How much was stolen in DeFi hacks 2024? Aggregate estimates range from $1.46 billion (De.Fi, 165 incidents) to $1.49 billion (Immunefi, 232 incidents) to $2.36 billion (CertiK, 760 incidents including phishing). The largest single incident was DMM Bitcoin at $305 million. DMM and WazirX together accounted for $540 million, roughly 36% of all 2024 losses per Immunefi.
What was the biggest crypto hack of 2024? The DMM Bitcoin hack on May 31, 2024 — 4,502.9 BTC worth $305 million stolen from the Japanese exchange. The FBI attributed it to North Korea's TraderTraitor group. The attack compromised an employee at Ginco, DMM's wallet software vendor, via a fake LinkedIn recruiter offering a malicious Python coding test.
Why did access control dominate 2024 crypto hacks? Access control exploits accounted for 65 to 78% of 2024 hack losses. Smart contract auditing matured, pushing attackers toward the human and infrastructure layer. North Korea industrialized social engineering against crypto employees. Multisig adoption created false confidence because signing interfaces and key storage became the new single points of failure. Multi-chain exchanges meant one key compromise could drain assets across many networks at once.
Was the WazirX hack an access control failure? Yes. WazirX lost $235 million when attackers exploited a discrepancy between the Liminal custody interface display and the actual transaction payload. The signers approved what looked benign; the real payload replaced the multisig implementation with an attacker-controlled contract. The multisig threshold was met with valid signatures on a malicious payload — a classic signing-UI manipulation attack.
Was the Radiant Capital hack a smart contract bug? No. Despite draining $50 million from a DeFi lending protocol, the Radiant hack was a malware attack on developer devices. INLETDRIFT malware, delivered via a fake Telegram message and a zipped PDF, compromised at least three developers' macOS machines. The malware spoofed the Safe{Wallet} frontend so signers saw legitimate transactions while malicious ones were signed in the background. Mandiant attributed it to North Korea's Citrine Sleet.
Did multisig prevent any 2024 hacks? No major 2024 hack was prevented by multisig alone. WazirX (4-of-6), Radiant (3-of-11), Orbit Bridge (7-of-10), and BtcTurk all had multisig and all were drained. Multisig raises the theoretical cost of attack but fails when keys share a storage surface, when the signing interface lies, or when a single insider holds privileged roles. The 2024 lesson is that multisig is necessary but insufficient.
Was any stolen money recovered in 2024? Recovery rates remained low — about 8.8% per De.Fi. The standout exception was Munchables, where the full $62.5 million was returned within 24 hours — not from generosity, but because the attacker could not off-ramp the funds due to Blast's bridge liquidity limits and 14-day withdrawal delay. Binance froze $5.3 million of BtcTurk's stolen funds. Once funds reached mixers like Tornado Cash, they were effectively unrecoverable.
Was North Korea behind the 2024 DeFi hacks? North Korean state-sponsored groups were linked to at least four of the eight largest 2024 hacks. The FBI formally attributed DMM Bitcoin to TraderTraitor. Mandiant attributed Radiant Capital to Citrine Sleet. ZachXBT linked the Munchables attacker to DPRK. Elliptic attributed WazirX to North Korean hackers. Immunefi estimated DPRK-linked attacks profited a combined $285 million in 2024, about 16% of total crypto losses.