Major Event Analysis: Security Incidents and Crises

Introduction

Security incidents and crises are an indispensable part of the crypto industry's development history. Each crisis exposed the industry's vulnerabilities at specific stages. While bringing tremendous pain, they also drove the industry's maturation and evolution from the reverse direction.

1. Terra/Luna Collapse (May 2022)

• Event Background: Terra was a public blockchain ecosystem founded by Do Kwon. Its core was the algorithmic stablecoin UST, which was not backed by fiat currency or real assets, but maintained its 1:1 peg to the US dollar through an algorithmic mechanism involving arbitrage with its sister token LUNA. The mechanism roughly worked as follows: when UST price exceeded $1, users could burn $1 worth of LUNA to mint 1 UST for profit; when UST price fell below $1, users could burn 1 UST to exchange for $1 worth of LUNA. Additionally, Terra's lending protocol Anchor provided nearly 20% annual yield for UST deposits, attracting hundreds of billions of dollars in funds.
• Event Details: In early May 2022, against a backdrop of declining macro markets, UST faced massive selling pressure, with its price depegging slightly for the first time. This triggered market panic, and more users began converting UST to LUNA and selling, causing LUNA prices to plummet. LUNA's price collapse further weakened its ability to support UST value, making UST's depeg more severe, creating a "death spiral" between the two. Within just a few days, UST's price fell to near zero, LUNA's price also dropped over 99.99% from its peak, and the entire Terra ecosystem's approximately $40 billion market cap evaporated completely.
• Direct Impact:
  • Massive Investor Losses: Countless individual and institutional investors who believed in algorithmic stablecoins and high-yield narratives lost everything.
  • Industry Chain Reaction: Multiple crypto hedge funds (like Three Arrows Capital) and lending platforms (like Celsius) heavily involved in the Terra ecosystem suffered severe damage, laying groundwork for their later bankruptcies.
• Long-term Significance:
  • Failure of Algorithmic Stablecoins: Terra's collapse demonstrated in an extremely brutal way the fragility of stablecoin models relying purely on algorithms and market confidence. It proved that under extreme market pressure, such systems without real asset backing cannot maintain stability.
  • Sounding "High Yield" Alarm: Anchor protocol's unsustainable 20% annual yield was considered a "Ponzi" lure attracting massive funds. The incident made the market deeply reflect that any unrealistic super-high yields inevitably come with enormous, even fatal risks.
  • Escalated Regulatory Focus on Stablecoins: After the incident, global regulatory agencies listed stablecoins, especially algorithmic stablecoins, as key regulatory targets and accelerated related legislative processes.
• Lessons Learned: Don't be misled by complex algorithms and narratives; return to common sense. Stablecoins without sufficient collateral backing are castles in the air. Promises of risk-free super-high yields are often shortcuts to disaster.
• Subsequent Development: Founder Do Kwon faces fraud charges in multiple countries and has been arrested. After the Terra ecosystem collapsed, its community attempted rebuilding through forks and other means, but could not restore user trust. Industry exploration of algorithmic stablecoins entered a downturn.

2. FTX Exchange Collapse (November 2022)

• Event Background: FTX was founded by Sam Bankman-Fried (SBF) and was one of the world's top three cryptocurrency exchanges at the time. SBF, with his high intelligence, MIT education, and enthusiasm for charity and political donations, became an industry figurehead as a "genius prodigy," deeply admired by mainstream media and investment institutions. FTX's affiliated trading company Alameda Research was also one of the most active market makers and funds.
• Event Details: In early November 2022, a leaked Alameda Research balance sheet showed its assets were filled with large amounts of FTX-issued platform token FTT and other illiquid tokens, with extremely unstable financial conditions. Binance founder Changpeng Zhao subsequently announced he would sell all held FTT, triggering market panic and FTT price collapse. Massive users attempted to withdraw funds from FTX, which quickly suspended withdrawals due to inability to handle the bank run and declared bankruptcy within days. Bankruptcy filings revealed FTX had illegally misappropriated billions in user deposits to Alameda Research for high-risk investments, and Alameda's losses created over an $8 billion funding hole at FTX.
• Direct Impact:
  • Industry Earthquake: The incident's severity was comparable to a "Lehman moment." FTX's collapse froze millions of users' assets and triggered another chain reaction, with lending platforms like BlockFi successively going bankrupt, plunging the entire industry into deep bear market again.
  • Trust Collapse: SBF's image as industry spokesperson completely collapsed, with his behavior proven to be naked fraud. The incident severely damaged the entire industry's reputation among the public and regulators.
• Long-term Significance:
  • Renewed Warning of Centralized Institution Risks: Following Mt.Gox, the FTX incident once again exposed in the most extreme way the enormous risks of opaque, unregulated centralized crypto institutions. It proved that even the most glamorous, most acclaimed platforms could harbor fatal internal governance and moral risks.
  • Promoting Proof of Reserves: After the incident, to regain user trust, major centralized exchanges began providing "Proof of Reserves," using on-chain data and third-party audits to prove they hold sufficient user assets. This is becoming an industry standard for exchanges.
  • Strengthening "Self-Custody" Concepts: The incident once again reinforced the "not your keys, not your coins" philosophy, promoting user adoption of hardware wallets and self-custody solutions.
  • Catalyst for Global Regulatory Tightening: FTX's collapse directly dispelled many regulators' illusions about crypto industry "self-regulation" and prompted them to adopt tougher, more comprehensive regulatory measures to protect investors.
• Lessons Learned: Never blindly trust any individual's "halo." Transparency and verifiability are far more important than founder backgrounds and narratives. Centralized institutions must accept strict, traditional finance-like regulation and auditing.
• Subsequent Development: SBF was convicted of fraud, conspiracy, and other charges and sentenced to long-term imprisonment. FTX's bankruptcy reorganization process continues, with clients expected to recover most funds, but this is mainly due to frozen crypto assets appreciating significantly during the bull market rather than bankruptcy management results.

3. Tornado Cash Sanctions and Their Reversal (2022 - 2025)

• Event Background: Tornado Cash was a set of Ethereum smart contracts that broke the on-chain link between a deposit address and a withdrawal address. Because the core contracts were immutable, no person or company could switch them off, pause them, or filter who used them. Privacy advocates used the tool to shield ordinary transactions; North Korea's Lazarus Group used it to launder proceeds from exchange and bridge hacks, including the Ronin bridge theft.
• Event Details: On August 8, 2022, the US Treasury's Office of Foreign Assets Control (OFAC) added Tornado Cash and dozens of associated Ethereum addresses to the Specially Designated Nationals list, making it illegal for US persons to interact with the protocol. This was the first time sanctions targeted autonomous software rather than a person, company, or state. A Dutch prosecution of developer Alexey Pertsev and US charges against Roman Storm and Roman Semenov followed.
• Direct Impact:
  • Infrastructure Compliance Cascade: Front-ends, RPC providers, and DeFi protocols began screening addresses that had ever touched Tornado Cash, including users who received unsolicited "dusting" transfers from the mixer.
  • Developer Chilling Effect: The prosecution of developers who wrote and published open-source code raised the question of whether publishing privacy software constitutes operating a money transmitting business.
• Long-term Significance:
  • Can Code Be Sanctioned?: The core legal question was whether an immutable smart contract can be "property" that OFAC has authority to block. In November 2024, the Fifth Circuit held in Van Loon v. Department of the Treasury that immutable smart contracts are not property of a foreign national or entity, and that OFAC had exceeded its statutory authority. On March 21, 2025, the Treasury formally delisted Tornado Cash.
  • Privacy Versus Sanctions Enforcement: The episode framed a conflict that remains unresolved. Sanctions regimes assume an intermediary that can be ordered to stop; permissionless protocols have no such intermediary. Regulators have since shifted attention toward the people who build and operate front-ends rather than the contracts themselves.
• Lessons Learned: Regulatory tools designed for institutions map poorly onto autonomous code. When they are applied anyway, the compliance burden lands on ordinary users who have no way to control what arrives in their wallets.
• Subsequent Development: Criminal cases against the developers continued after the delisting. In August 2025, a New York jury convicted Roman Storm on one count of conspiring to operate an unlicensed money transmitting business, while deadlocking on the money laundering and sanctions charges. The split verdict left the boundary between writing privacy software and operating a money transmitter only partially defined.

4. Bybit Hack — The Largest Theft in Crypto History (February 2025)

• Event Background: By 2025, exchanges had spent a decade hardening their systems after Mt. Gox and FTX. Cold storage with multi-signature approval was considered the gold standard: keys held offline, every transfer requiring several independent human signers. Bybit, a Dubai-based exchange among the largest in the world, used exactly this arrangement.
• Event Details: On February 21, 2025, attackers stole roughly $1.5 billion in ether and related assets from a Bybit cold wallet during a routine transfer to a hot wallet. The attack did not break the cryptography or the multi-signature scheme. Instead, the attackers compromised a developer machine at Safe{Wallet}, the multi-signature interface Bybit used, and injected code that displayed a legitimate-looking transaction to each signer while the payload they actually approved handed control of the wallet to the attackers. On February 26, the FBI publicly attributed the theft to North Korea, referring to the activity as "TraderTraitor" and releasing dozens of associated addresses.
• Direct Impact:
  • Scale Without Precedent: The theft was several times larger than any previous crypto hack, exceeding the $611 million Poly Network exploit of 2021 and surpassing what North Korean actors had stolen across all of the previous year.
  • Bybit Stayed Solvent: Unlike Mt. Gox and FTX, Bybit processed withdrawals throughout the crisis, covering the shortfall with its own capital and bridge loans. The exchange survived, which itself marked a change in industry balance-sheet resilience.
  • Rapid Laundering: The stolen funds were converted and dispersed across thousands of addresses on multiple chains within days, moving through decentralized exchanges, cross-chain bridges, mixers, and a small number of no-KYC swap services.
• Long-term Significance:
  • The Signing Interface Is the Attack Surface: The incident shifted the industry's security model. If the screen showing a transaction can lie, then cold storage and multi-signature approval provide far less protection than assumed. Independent transaction verification on separate hardware moved from best practice to baseline requirement.
  • Supply Chain as the Weak Link: The breach entered through a vendor's developer workstation, not through Bybit. Third-party tooling in the signing path became a first-class risk category.
  • State Actors at Industrial Scale: The theft confirmed that a nation-state treats crypto exchanges as a strategic revenue source and can conduct operations at a scale no ordinary criminal group can match.
• Lessons Learned: Security assumptions must be tested against the whole path a transaction travels, including the software that renders it for human approval. A control that everyone trusts and nobody verifies is not a control.
• Subsequent Development: The attack accelerated adoption of hardware-based transaction simulation and independent verification tooling across exchanges and custodians. Losses to hacks in the first half of 2026 fell well below the 2025 total, though largely because no single incident matched Bybit's scale; the two largest 2026 exploits, at Drift Protocol and KelpDAO in April, again stemmed from operational and infrastructure compromises rather than flaws in on-chain code.