Attacks and limits
The cryptography rarely fails. Real losses come from the systems layered on top: keys, bridges, contracts and humans.
In this lesson
- Name the major real-world attack classes
- Explain a 51% attack and a bridge hack
- Describe the blockchain trilemma honestly
Where the money actually goes
| Attack | What is exploited | Example class |
|---|---|---|
| 51% attack | Enough hashpower to rewrite recent history | Small proof-of-work coins, exchange double-spends |
| Bridge exploit | Weak validation between chains, multisig compromise | Ronin, Wormhole-style drains |
| Smart contract bug | Logic errors in code holding funds | Reentrancy, oracle manipulation |
| Phishing / malware | Humans and endpoints, not the protocol | Fake airdrops, poisoned seed phrases |
| Exchange insolvency | Custodial trust and internal books | Mt. Gox, FTX |
| Sybil / eclipse | Network-layer identity and peer selection | Isolating a node from honest peers |
Example · Rewriting a small chain
In 2018 several small PoW coins were reorganised by rented hashpower: attackers deposited coins to an exchange, spent them, then rewrote the chain to erase the deposits while keeping the withdrawals. The fix is deeper confirmations or a hashpower the attacker cannot rent.
Example · The bridge problem
Bridges must trust something about the other chain. Most spectacular losses came from that trust: too few signers, upgradeable contracts, or validators who never checked. The chain itself was fine — the door between chains was not.
The trilemma: at the base layer you typically optimise two of three — decentralisation, security, throughput. L2s exist precisely to sidestep it: inherit L1 security, scale execution off-chain, keep the L1 open.
Cryptography is the solved part
Sig sums, hash functions and PoW/PoS have stood up. The recurring casualties are key custody, bridge design, contract logic and operational security. Audit those first.
The chain is only as strong as its weakest interface.
Has Bitcoin ever been 51%-attacked?
Not at scale — but smaller PoW networks have been repeatedly, which is why confirmations should match the chain you are on.
Are DeFi hacks "blockchain attacks"?
Usually not: the ledger behaved as specified; the application logic or an oracle did not.
What should a beginner do?
Self-custody with a hardware wallet, verify addresses, treat unsolicited offers as hostile, and never invest more than you can lose.