Ethereum Smart Contract Security
Research Dashboard

1. 1 North Korean state actors dominate the threat landscape. The Lazarus Group is confirmed or credibly attributed in Wormhole ($320M, 2022), Ronin ($625M, 2022), Harmony Horizon ($100M, 2022), Radiant Capital ($50M, 2024), and Bybit ($1.4B, 2025). This single threat actor has stolen an estimated $2.5B+ from Ethereum-related protocols. Their evolution from code exploitation to hardware wallet MITM and supply chain attacks represents a qualitative escalation that no smart contract audit addresses.
2. 2 Cross-chain bridges are the highest-value attack surface in DeFi history. Six of twenty-four documented exploits targeted bridges (Poly Network, Wormhole, Ronin, Nomad, Harmony, Multichain), accounting for over $1.8B in net losses. Bridges concentrate large assets behind trust assumptions that are architectural rather than code-level, making them irreducible targets until ZK-proof-based bridges achieve scale deployment.
3. 3 Smart contract audits are necessary but provably insufficient. Euler Finance was audited 10 times by 6 firms before losing $197M. Wormhole was audited by the firm that later wrote the exploit post-mortem. Beanstalk was audited by Halborn. Being audited prevents some attacks; it is not a safety guarantee. Automated tools catch only 8–20% of exploitable bugs (IEEE, 2024).
4. 4 Flash loan oracle manipulation dominated 2020–2022. bZx, Harvest Finance, PancakeBunny, Cream Finance (Oct 2021), and Beanstalk all used flash loans to manipulate spot-price oracles or governance. This attack class caused over $400M in losses and was essentially made possible by DeFi protocols using Uniswap spot prices as trusted data feeds. TWAP oracles and Chainlink feeds have substantially mitigated this class since 2022.
5. 5 The attack surface extends far beyond smart contract code. BadgerDAO ($120M), Vulcan Forged ($140M), Radiant Capital ($50M), and Bybit ($1.4B) were all compromised via Web2 infrastructure, supply chain, or social engineering vectors that no on-chain audit can detect. In 2024, 55% of incidents involved stolen private keys or compromised accounts.
6. 6 Access control failures are the highest-dollar-impact category in recent years. $953.2M in documented 2024 losses were attributed to access control failures and private key compromise, making it the dominant loss driver — ahead of reentrancy, oracle manipulation, and flash loan attacks. This category is largely invisible to static analysis tools.
7. 7 A 40–50% reduction in annual losses is achievable through systemic adoption of best practices. Requiring audits for all significant protocols, universal multisig for admin keys, Slither + Foundry fuzzing in CI/CD, and timelocks on governance functions would address the majority of documented attack vectors. The constraint is adoption economics and attacker adaptation, not tool availability.

Note: DeFi-specific losses shown. 2025 figure includes Bybit ($1.5B CeFi/exchange). Source: Chainalysis. See full statistics page for methodology notes.