How do attackers use a DeFi exploit?

How DeFi Exploits Work in Practice

DeFi attacks usually do not “break” the blockchain itself. They abuse how a protocol prices assets, calculates collateral, or sequences state changes. The exploit succeeds when the attacker can create a false economic state long enough for the contract to accept a loss-making action as valid, then move value out before the protocol corrects itself.

A useful way to think about the attack is that the code often behaves exactly as written, but the assumptions around it fail. That is why lending, swapping, and liquidation logic are frequent targets: if the protocol trusts a manipulated price, an unexpected token behaviour, or an inconsistent accounting state, the attacker can turn that logic into a payout path.

For readers who want the broader defensive model around smart contract weaknesses, the Smart Contract Security Guide is the best starting point because it ties exploit classes to the coding and design patterns that create them.

Why DeFi Exploits Succeed

The most common weakness is trust placed in inputs that the protocol should treat as adversarial. Price feeds can be thin, delayed, or composable in ways that let an attacker shift the observed market price. Re-entrancy, unsafe callbacks, and accounting mistakes can let the same value be counted twice or withdrawn before balances settle. Flash loans amplify this because they give an attacker temporary capital to distort conditions without needing long-term funding.

Another recurring failure mode is overconfidence in protocol invariants. If the system assumes reserves, collateral ratios, or liquidation thresholds will only change through “normal” user behaviour, an attacker can combine several otherwise ordinary actions in one transaction or block to violate those assumptions. The exploit is often a sequence problem, not a single bug.

DeFi defenders should also treat the interface between on-chain code and external market data as part of the attack surface. The Web3 and Crypto Security Guide is useful here because it covers oracle risk, custody dependencies, and the operational controls that matter when protocol logic depends on live market conditions.

What to Watch During and After an Exploit

When a defi exploit is underway, the observable pattern is usually abnormal state change, not just a single suspicious transaction. Watch for sharp borrowing spikes, reserve depletion, repeated liquidations against the same asset pair, sudden price divergence between venues, and rapid contract interactions that chain swaps, borrows, and repayments in one burst.

Post-incident, the main question is whether the exploit only extracted funds or also left the protocol in a compromised state. A vulnerable reserve model, a broken oracle path, or a privileged admin route may remain exploitable even after the first loss. That is why responders should validate whether the attacker’s path is reusable, whether any bridged or wrapped assets were affected, and whether governance or upgrade controls can still be abused.

For teams prioritising how to triage exploitability and exposure, the Zero-Day and Exploited Vulnerabilities Guide helps frame the difference between a theoretical flaw and active exploitation, including when to move from analysis to emergency mitigation.

Risk and Threat Considerations

DeFi exploits create fast-moving financial loss because the attacker can often convert a logic flaw into immediate value extraction. The risk is highest where the protocol depends on external pricing, cross-protocol composability, or highly privileged contract actions that can change balances or thresholds instantly.

Failure mechanism: The attacker manipulates the economic state the contract trusts, then triggers lending, swapping, or liquidation logic before the protocol can reprice, pause, or recover.

Impact: Losses can cascade into drained reserves, bad debt, broken liquidations, and loss of market confidence, especially if the same flaw can be reused across pools or related contracts.

Practitioner Guidance

What to verify: Confirm whether the protocol’s key assumptions still hold under adversarial ordering, temporary liquidity distortion, and cross-transaction chaining. The practical test is not whether a path works in an isolated unit test, but whether it still behaves safely when inputs are manipulated at block speed.

Decision rule: If a weakness can change balances, prices, or collateral eligibility in a single transaction window, treat it as an immediate containment issue rather than a normal backlog item. If patching is delayed, prioritize pausing the affected flow, constraining privileged actions, and monitoring for the same exploit path being replayed through adjacent pools or contracts.

Practitioner takeaway: In DeFi, the real control question is whether the protocol can survive an attacker controlling timing, liquidity, and inputs at the same time, because that is what turns a coding flaw into a financial drain.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?