$1,000,000 in security audit grants are live now, Apply here →
Get a quote

← Resource Hub

Time to Exploit in Crypto: Data From 17 Attacks

By the Guardian team Updated 7 min read

Time to Exploit in Crypto: Data From 17 Attacks

Quick answer. In Guardian's sample of 17 attacks on 11 disclosed crypto flaws, 13 came after the flaw was public. Seven hit within seven days; the other six came 60 to 392 days later, mostly in forks and old deployments.

Watch: Time to Exploit in Crypto: Data From 17 Attacks 1:42
Video transcript

How fast are crypto flaws exploited after disclosure? In Guardian's data, either within a week, or months later.

Guardian timed 17 attacks on 11 disclosed crypto flaws from public sources. In 13 cases, the flaw was already public. The sample shows patterns, not rates.

Those 13 split in two, with nothing between 7 and 60 days. Seven were hit within a week, a median of 3.2 days. Six came 60 to 392 days later.

All four warnings from the maintainer of the exact code were exploited within five days. Their forks were hit just as fast. BNB Smart Chain, a geth fork, was hit 12 minutes before Ethereum.

Slow cases hit code still running. Compound v2 forks, an old Saddle metapool, a Uniswap V1 pool, and keys made with Profanity, likely behind Wintermute's loss of about 160 million dollars.

Do not wait for CISA's catalog of known exploited vulnerabilities. None of its 1,768 entries lists a crypto wallet, node client, smart contract compiler or contract library. Watch maintainers directly.

Treat a maintainer's warning on code you run as an incident, not a ticket. Act within a day, map your forks, sweep old deployments, and retire flawed keys.

Guardian's Managed Security matches new disclosures against your system in real time, and an engineer helps you patch. Read the full report, or talk to Guardian at guardian.security.

Time to exploit is the gap between a flaw going public and the first attack on it.

Mandiant measures it for enterprise software. We built a small dataset for the crypto stack.

Every date and count here is Guardian's compilation from public sources.

It pairs with our report on how fast crypto hacks are detected.

How We Counted

Each case has two times, both in UTC.

  • Disclosure: the first dated public notice of the flaw. An advisory, a security release, a maintainer's warning, a public issue or a write-up.
  • Exploitation: the first dated attack on the affected project. We use the block time of the cited exploit transaction where one exists.
  • Time to exploit: exploitation minus disclosure, in days. Below zero means exploited before disclosure.

A fix shipped with no security notice does not count as disclosure.

Sample rule

  • A flaw in crypto software: a client, wallet or key tool, compiler, library or protocol contracts.
  • Exploited in production, with a loss of funds or a chain split.
  • Both dates in a public source we read.
  • The flaw was public before the attack, or sat in code or tools others also ran.
  • One row per affected project, so a forked copy counts on its own.
  • Curve's four pools hit through Vyper count as one row, not four.

Seventeen cases from 11 flaws qualify. Ten are in protocol contracts; seven in clients, wallets, key tools, a compiler and a library.

They were exploited from April 2020 to May 2024. That is where we found both dates in sources we could read, not a cutoff we chose.

Limits. This is a curated sample, not a census. Seventeen cases show patterns, not rates for crypto as a whole.

We did not assess incidents after May 2024, such as Balancer's November 2025 exploit and its forks.

Most hacks hit a project's own code with no earlier notice, so they fall outside it. The first known attack may not be the first attack.

Weak dates

CaseWe time fromCaveatCould be
Midas, Onyx, SonneRekt's write-up, Apr 18, 2023Hundred's own warning may be up to 3 days earlier63, 200 and 395 days
Uniswap V1 imBTCOpenZeppelin's write-up, Jul 28, 2019A ConsenSys audit dated Jan 11, 2019 flagged it firstUp to 463 days
Trust WalletExploits in December 2022Month only, via the Milk Sad team's quote of Trust WalletStill before disclosure

None changes the counts or the gap between 7 and 60 days. The slow range could run from 63 to 463 days.

Two Speeds of Exploitation

In 13 cases, the flaw was public before the first attack. Their times split in two, with no case between 7 and 60 days.

Project hitDisclosureDisclosedExploitedDays
Multichain routerMultichain warningJan 17, 2022Jan 18, 20221
thirdweb contracts (TIME)thirdweb security postDec 5, 2023Dec 6, 20231.9
BNB Smart ChainUpstream geth releaseAug 24, 2021Aug 27, 20213.2
Ethereum geth nodesgeth 1.10.8 security releaseAug 24, 2021Aug 27, 20213.2
Balancer boosted poolsBalancer warningAug 22, 2023Aug 27, 20235
Beethoven XBalancer warningAug 22, 2023Aug 27, 20235
Nerve BridgeSynapse metapool noticeNov 7, 2021Nov 14, 20217
Midas CapitalHundred Finance write-upApr 18, 2023Jun 17, 202360
Saddle FinanceSynapse metapool noticeNov 7, 2021Apr 30, 2022174
Onyx ProtocolHundred Finance write-upApr 18, 2023Nov 1, 2023197
WintermuteProfanity GitHub issueJan 17, 2022Sep 20, 2022246
Uniswap V1 imBTC poolOpenZeppelin write-upJul 28, 2019Apr 18, 2020265
Sonne FinanceHundred Finance write-upApr 18, 2023May 14, 2024392

Fast: one to seven days

Seven cases were attacked within a week, a median of 3.2 days.

All four warnings from the maintainer of the exact code were exploited within five days: Multichain, thirdweb, geth and Balancer.

In this sample, forks were hit as fast when the notice was fresh.

  • BNB Smart Chain, a geth fork, was hit 12 minutes before Ethereum.
  • Beethoven X, a Balancer fork, was hit on Fantom the same day as Balancer.
  • Nerve, a Saddle fork, fell a week after Synapse's notice.

Slow: two months to a year

Six cases came 60 to 392 days later, a median of 221.5 days. The flaw was public, but vulnerable code or keys stayed in use.

  • Forks. Midas, Onyx and Sonne ran Compound v2 code with the empty-market flaw that hit Hundred Finance.
  • Old deployments. Saddle fixed its library, but its sUSD V2 metapool still ran the old one.
  • Old code. The Uniswap V1 imBTC pool was drained 265 days after OpenZeppelin's write-up.

Sonne's own audit had flagged "Unclear protection against Hundred Finance attack vector," Rekt reports. It lost about $20 million.

Wintermute shows what starts the clock. It lost about $160 million; Rekt named Profanity's weak keys as the likely cause.

A GitHub issue flagged Profanity's weak seed 246 days before the hack. 1inch showed how to exploit it five days before.

Clients, Wallets and Libraries

  • geth. Version 1.10.8 shipped on August 24, 2021 at 07:07 UTC. An attacker triggered the bug at 12:50 UTC on August 27, splitting unpatched nodes.
  • thirdweb. Its post went up at 5 PM PT on December 4, 2023. The earliest attack OpenZeppelin lists, for 84.59 ETH, landed 46 hours later.

Exploited before disclosure

Four flaws were exploited before the first public notice we could date.

  • Curve pools (Vyper compiler). Three pools were drained before Vyper's 16:44 UTC notice on July 30, 2023. A fourth fell at 19:08.
  • Libbitcoin Explorer (bx). The main theft, about 29.65 BTC, came 27 days before the August 8, 2023 disclosure.
  • Trust Wallet extension. Exploits began in December 2022, Trust Wallet says, about four months before disclosure.
  • Hundred Finance. Hit on April 15, 2023. The first write-up we could date came three days later.

Silent fixes

Two of those flaws had public fixes first, with no security notice.

Vyper 0.3.1 fixed the lock bug on December 1, 2021, listed as a storage slot fix. Curve was drained 606 days later.

Trust Wallet committed its fix publicly on November 21, 2022. Exploits followed from December, about $170,000 in total.

Compared With Enterprise Data

Mandiant tracked 138 vulnerabilities disclosed and exploited in 2023. Average time to exploit fell to five days, excluding 15 outliers, from 63 days in 2018 to 2019.

About 70% were zero-days. Of the 41 n-days, 12% were exploited within a day, 29% within a week and 56% within a month.

Mandiant counts from the patch release; we count from the first public notice.

VulnCheck found exploitation evidence within a day of the CVE's publication for 28.3% of the 159 CVEs first reported exploited in Q1 2025.

Exploited after disclosureMandiant 2023 n-daysOur 13 cases
Within one day12%8% (1)
Within one week29%54% (7)
Within one month56%54% (7)

Thirteen cases cannot carry a statistical comparison. Here, flaws were hit within a week or after two months, never in between.

KEV does not list the crypto stack

CISA's Known Exploited Vulnerabilities catalog held 1,768 entries in its November 4, 2026 version.

None lists a crypto wallet, blockchain node client, smart contract compiler or contract library as its vendor or product. None of the four CVEs in our sample is listed.

What This Means for Patch SLAs

A maintainer's warning on code you run is an incident, not a ticket.

  1. Act within a day. One maintainer warning here was exploited the next day.
  2. Watch maintainers directly. Follow advisories, releases, Discord and X for every dependency. KEV will not flag them.
  3. Map your forks. List the upstream code you copied, and check it after every upstream disclosure.
  4. Sweep old deployments. Deprecated pools and markets still hold funds. Patch, pause or drain them.
  5. Read release notes as diffs. A fix without a notice is still a signal.
  6. Retire flawed keys. Move funds off addresses made with a broken tool. Do not wait.

Fixing the code runs on a separate clock; see our mean time to remediate report.

How Guardian Helps

Guardian's Managed Security ingests vulnerability disclosures in real time and matches them against your system.

Where one reaches you, an engineer confirms the exposure and works with you to patch it immediately.

Frequently Asked Questions

What is time to exploit?

The time from a flaw's first public disclosure to its first known exploitation. Mandiant defines it as the average time taken to exploit a vulnerability before or after a patch is released.

How fast are crypto vulnerabilities exploited after disclosure?

In our sample, 13 cases were disclosed before the first attack. Seven were exploited within seven days, a median of 3.2 days; the other six 60 to 392 days later. All four maintainer warnings were exploited within five days.

Does CISA KEV cover crypto software?

Not in the November 4, 2026 catalog. None of its 1,768 entries lists a crypto wallet, blockchain node client, smart contract compiler or contract library as vendor or product, and none of our sample's four CVEs is listed.

What patch SLA should crypto teams set?

For a critical flaw in code you run, act within a day: pause, revoke approvals, upgrade nodes or move funds. Then check forks and old deployments of the same code, which attackers reached months later in our sample.

Sources

Close the window after a disclosure

Guardian matches new disclosures against what you run and works the fix with you immediately.

Talk to Guardian Explore Managed Security