Top hacks since Devcon SEA - what did we learn?

Duration: NaN:NaN:NaN

Speaker: Matthias Egli, Mudit Gupta, Unnamed speaker

Type: Workshop

Expertise: No prior knowledge

Event: Devcon

Date: Nov 2026

Security remains a core challenge for adoption, reflected in its emphasis as a CROPS topic. Improving is only possible by learning from past mistakes: this session targets a broad audience to explain what happened over the last two years and what actionable lessons can strengthen Ethereum's security going forward. We analyze the largest individual incidents down to the frequent small ones, which in aggregate carry significant volume. Much of this is first-hand, sometimes from the people most directly involved, drawing on close collaboration with SEALs like pcaversaccio, auditors, investigators and security leads of affected protocols. Hacks covered range from the big ones - Bybit, Drift, Coldcard, KelpDAO, Cetus, Balancer - spanning code failures, DPRK operations and infrastructure attacks, to mid-size and small ones like GMX, SwissBorg, Venus and the constant background of social engineering, phishing and infostealer attacks.