Can Blockchain Be Hacked? What Attackers Actually Target

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Yes, but rarely at the chain itself: Bitcoin and Ethereum have patched protocol bugs and attacks, and small chains like Ethereum Classic were 51% attacked. Most stolen crypto is lost through smart contracts, bridges, private keys and people.

Watch: Can Blockchain Be Hacked? What Attackers Actually Target 1:52

Video transcript

Can a blockchain be hacked? Yes, but rarely at the chain itself. Most stolen crypto is lost through contracts, bridges, keys and people.

In 2026, through November 2, about 8.78 billion dollars was stolen in 328 hacks, by Guardian's count of DefiLlama data.

It depends on the layer. No successful attack on Bitcoin's consensus has been reported. Small chains, contracts, bridges and keys have all been hit.

A 2010 Bitcoin bug that created over 184 billion bitcoin was patched within hours. Ethereum's best-known hack, The DAO, hit an application, not the chain.

A fifty one percent attacker controls most hash power or stake, builds a longer chain in private, then swaps it in. They can reverse their own payments, not take others' coins.

Guardian's analysis of DefiLlama data shows keys, signers, infrastructure and people caused 72 to 74 percent of reported losses in 2024 and 2025.

Ronin lost about 624 million dollars when an attacker controlled five of nine validator signatures. A compromised developer machine cost Bybit roughly 1.5 billion. Binance lost about 6.36 billion after an attacker reached its signing service.

Before using a chain, check consensus, validators, finality, track record and admin powers. Then check your keys. Most losses start there.

Guardian audits contracts, pentests offchain systems and maps every path to your keys. Read the article, or talk to Guardian at guardian.security.

Blockchains are built so that no single party can rewrite the record. That makes the chain itself a hard target.

Yet hacks keep growing. In Guardian's count of DefiLlama data, about $8.78B was stolen in 328 hacks from January 1 to November 2, 2026.

The gap comes down to which layer gets hit. Here is the answer layer by layer, with the incidents behind it.

The Short Answer by Layer

Layer	Hacked before?	Example
Consensus on Bitcoin	No	No successful 51% attack reported
Consensus on a small chain	Yes	Ethereum Classic, August 2020
Node and client software	Yes, then patched	Bitcoin's value overflow bug, 2010
Smart contracts	Yes, often	The DAO, over 3.6M ETH, 2016
Bridges	Yes, for some of the largest losses	Ronin, $624M, 2022
Private keys and signers	Yes, where most money is lost	Binance, about $6.36B, 2026

The core protocol is the hardest layer to break.

Has Bitcoin or Ethereum Been Hacked?

Bitcoin

Not at the consensus layer. The Bitcoin Wiki and Bitpanda's academy both say no 51% attack on Bitcoin has succeeded.

Its software has had serious bugs. On August 15, 2010, a bug let one transaction create over 184 billion bitcoin.

A patched client shipped within five hours. By the next day, the corrected chain had overtaken the bad one, and the transaction no longer existed on the longest chain.

Bitcoin holders lose coins in other ways. Arkham says 127,426 BTC, worth $3.5B at the time, was stolen from mining pool LuBian in December 2020.

Arkham suspects the pool's key generation was open to brute force. That is a flaw in how keys were made, not in Bitcoin.

Ethereum

Ethereum's best-known hack hit an application, not the chain. In 2016, an insecure contract called The DAO was drained of over 3.6 million ETH, ethereum.org records.

A hard fork moved the funds to a withdrawal contract. Miners who refused it kept the original chain, which became Ethereum Classic.

In September and October 2016, denial-of-service attacks hit the network itself. Two upgrades, in October and November, repriced the operations they abused.

Since September 2022, Ethereum has run on proof of stake. An attacker with over half of all staked ether could dominate which chain it follows, says ethereum.org.

It rates the risk of a successful attack as low, "certainly lower than proof-of-work equivalents."

How a 51% Attack Works

A blockchain follows the chain with the most work or stake behind it. Control most of that, and you can build a longer chain in private, then swap it in.

That lets an attacker reverse their own recent payments, a double spend. It does not let them take other people's coins.

Bitcoin's white paper puts it plainly: an attacker "can only try to change one of his own transactions to take back money he recently spent."

That is what happened to Ethereum Classic, three times in August 2020:

August 1: hash power rented for about 17.5 BTC double-spent 807,260 ETC, about $5.6M, Bitquery found.
August 6: a reorganization of more than 4,000 blocks led Binance to halt ETC deposits and withdrawals, The Block reported.
August 29: a reorganization of over 7,000 blocks, CoinDesk reported.

Small proof-of-work chains are exposed when enough hash power can be rented. Crypto51 publishes a theoretical one-hour attack cost for many proof-of-work coins.

Where Hacks Actually Happen

Most money is lost above and around the chain. In Guardian's analysis of DefiLlama data, keys, signers, infrastructure and people caused 72% to 74% of reported losses in 2024 and 2025.

Code exploits cause most incidents, but a minority of the dollars.

Smart contracts and bridges

Contracts and bridges run on a chain but are separate code. A bug in them can be exploited while the chain works perfectly.

The Ronin bridge needed five of nine validator signatures to release funds. In March 2022, an attacker controlled five and took about $624M, Rekt reported.

One of those signatures came through a temporary arrangement whose access "was never revoked."

Keys and people

A chain checks only that a signature is valid. Whoever holds the key, or tricks its holder, can move the funds.

About $6.36B left Binance wallets on October 29, 2026, which TRM Labs calls the largest hack in history. Binance says the attacker reached an internal wallet signing service.

At Bybit in February 2025, Safe says a compromised developer machine proposed a disguised malicious transaction. The FBI attributes the roughly $1.5B theft to North Korea.

The pattern holds across our biggest crypto hacks of all time: 13 of the top 20 carry DefiLlama labels for keys, people or infrastructure.

How to Judge a Specific Chain

Before you hold or build on a chain, check each layer:

Consensus size: how much hash power or stake secures it, and can it be rented?
Validators: how many sign blocks or bridge withdrawals, and who runs them?
Finality: how many confirmations before a payment cannot be reversed?
Track record: past reorganizations, halts and client bugs, and how fast each was fixed.
Admin powers: who can upgrade the chain or its bridge, and with what delay?
Your tokens: native assets, or claims on a bridge?
Your keys: where they live and who can sign. Most losses start here.

For rollups, our guide to rollup stages shows how to read who can change the chain.

For organizations, our map of blockchain security risks turns these checks into a register, with a control for each layer.

How Guardian Helps

Guardian works on the layers where hacks actually happen.

Contracts: audits by two competing teams, one manual and one AI-driven, on top of invariant fuzzing.
Offchain: pentests of web apps, APIs, cloud, keepers, extensions and SDKs.
Keys: an OpSec audit maps every path to your funds, and who can walk it.

Frequently Asked Questions

Has Bitcoin ever been hacked?

Not at the consensus layer: no successful 51% attack on Bitcoin has been reported. A 2010 bug that created over 184 billion bitcoin was patched within hours. Exchanges and wallets holding bitcoin have been hacked many times.

What is a 51% attack?

One party controls most of a chain's mining power or stake and rewrites recent blocks. It can reverse its own payments, a double spend, but cannot take other people's coins. Ethereum Classic suffered three in August 2020.

Can quantum computers hack blockchain?

Not yet. Bitcoin and Ethereum keys use ECDSA, which NIST says a cryptanalytically relevant quantum computer could break; none exists yet. NIST will deprecate ECDSA after 2030 and disallow it under its standards after 2035 (final IR 8547, October 2026).

Is blockchain safe from hackers?

The core protocols of large chains have been hard to attack. The risk sits in what is built around them: contracts, bridges, private keys, websites and the people who sign. Judge each layer separately.

Sources

Secure the layers attackers actually hit

Guardian audits your contracts and tests the keys, signers and systems around them, where most crypto is stolen.

Talk to Guardian Explore Guardian