54 Major Crypto Events, 2010–2025: A Timeline of Exchange Failures, DeFi Hacks, Stablecoin De-pegs and Regulatory Shocks

Introduction: A list for those who come after

In February 2018 a small Italian exchange called BitGrail announced that it had been hacked and would shut down, and a court in Florence later found that the exchange had failed to implement safeguards and to report the losses. Its users could no longer reach the assets they held on the platform. That situation runs through almost every entry in this archive.

This article puts 54 major crypto events on a single timeline. The bar for inclusion is that there is a public record to check and a lesson that is still useful today; major incidents at venues that are still operating are included on the same terms. It covers some that other lists leave out — the 2010 CVE-2010-5139 value overflow incident, the China regulatory cycles, and the USDC depeg of March 2023.

The article is structured in seven chapters:

• Chapter 1: Exchange thefts and failures, 2011–2020, 12 events.
• Chapter 2: ICO-era frauds and disputes, 5 events.
• Chapter 3: DeFi exploits and cross-chain bridge attacks, 8 events.
• Chapter 4: The 2022 cascade — six from May to November 2022 plus one in January 2023, 7 events.
• Chapter 5: Stablecoin depeg history, 3 events.
• Chapter 6: Thefts and shutdowns, 2023–2025, 9 events including the Bybit theft of February 2025.
• Chapter 7: Five project-level events that did not fit the earlier chapters (including the SVB-induced USDC depeg) plus five macro-level policy events — three Chinese regulatory crackdowns, COVID Black Thursday, and the Tornado Cash sanctions.
• Twelve lessons drawn from these 54 events.

The chapters can be read in order or jumped to via the table of contents. The twelve lessons at the end are my own, each tied to specific entries.

TL;DR · Key Numbers

Chapter 1: Exchange Thefts and Failures (2011–2020)

The twelve entries in this chapter are in date order. Some ended in bankruptcy or liquidation; others were thefts after which the venue covered the loss and still operates today (Bitstamp, Bitfinex, Coincheck, Binance, KuCoin). The DAO was not an exchange — it was a smart contract that was attacked — and sits here because it belongs to the same period.

1. Mt.Gox early breach (June 2011)

On June 19, 2011, a stream of fraudulent trades drove the nominal price of a bitcoin on Mt.Gox down to one cent. By the public record, the hacker used credentials taken from a Mt.Gox auditor's compromised computer; within minutes the price was back at its normally traded level (Wikipedia · Mt. Gox). In February 2014 Mt.Gox publicly blamed a withdrawal halt on a "transaction malleability" bug, and filed for bankruptcy protection that same month with 850,000 BTC missing — though WizSec later established that the hot wallet keys had been stolen as early as September 2011 (see entry 2).

2. Mt.Gox formal bankruptcy (February 2014)

Loss: about 850,000 BTC (750,000 customer + 100,000 corporate), roughly $480 million at the time. Cause: Mt.Gox itself put the problem down to the transaction-malleability bug; WizSec's 2017 investigation concluded that the hot wallet private keys (wallet.dat) were stolen in September 2011 and roughly 630,000 BTC was drained out gradually through mid-2013. On March 20, 2014 Mt.Gox announced it had found about 200,000 BTC in an old-format wallet. Resolution: civil rehabilitation replaced bankruptcy in 2018; first base repayments to creditors began in July 2024. In October 2025, with many creditors still unpaid, the trustee pushed the repayment deadline from October 31, 2025 to October 31, 2026. For the complete reconstruction, see Shipwreck Annals Volume One.

3. Bitstamp phishing hack (January 2015)

Loss: 18,866 BTC (about $5 million at the time). Cause: a system administrator was phished into opening a Word document (UPE_application_form.doc) carrying a malicious VBA macro; attackers then extracted the hot wallet keys remotely. Resolution: Bitstamp paused operations for roughly a week, raised replacement capital from existing investors, and reimbursed all customers in full. It did not declare bankruptcy. Significance: the first time the crypto industry saw an exchange absorb a hack rather than collapse from it. Bitstamp is still operating.

4. Cryptsy collapse (January 2016)

What happened: roughly 11,325 BTC was moved out in July 2014; withdrawals stopped in January 2016. Resolution: customers brought a class action. In July 2017 US District Judge Kenneth Marra entered a civil default judgment: founder Paul Vernon was held liable to the plaintiff class in the principal sum of $8.2 million, and the 11,325 BTC stolen on July 29, 2014 was declared the property of the class. Vernon had not responded to the allegations in court, which is why the judgment was entered by default (CoinDesk, July 28, 2017).

5. The DAO hack (June 2016)

The DAO hack of June 2016 began, like most reentrancy attacks, with a function that asked one question in the wrong order: send the ether, then update the balance. By the time the contract had finished asking itself whether the caller still held tokens, the attacker had recursively invoked splitDAO again, and again, and again — eventually draining roughly 3.6 million ETH (about $50 million at the time) before the contract ran empty. What followed differed from the 2010 value-overflow incident (entry 45) in one crucial way: that was a soft fork to fix a bug, whereas this time a hard fork rewrote the chain's state to claw back stolen funds. The Ethereum community split into two camps: a majority that backed a hard fork to undo the attack — the fork that became the Ethereum we use today — and a minority that refused on principle, arguing that "code is law" meant something only if you accepted the bad outcomes with the good. That minority kept the original chain alive as Ethereum Classic. Reentrancy is now lesson one in every Solidity textbook, and the attacker's identity has never been publicly confirmed.

6. Bitfinex 120K BTC hack (August 2016)

Loss: roughly 120,000 BTC (about $72 million at the time). Cause: Bitfinex's BitGo-backed multisig hot wallet was compromised. The exact technical method has never been completely disclosed. Resolution: Bitfinex did not declare bankruptcy. All customer balances were written down by about 36%, and customers were issued BFX tokens as compensation, later convertible to equity in its parent iFinex. 2022 recovery: in February 2022 US federal authorities charged Ilya Lichtenstein and Heather Morgan with conspiring to launder the bitcoin, and recovered and seized a portion of the stolen coins, then worth about $3.6 billion. Both later pleaded guilty; Lichtenstein was sentenced to 60 months in prison and Morgan to 18 months (Wikipedia · 2016 Bitfinex hack). In October 2025, 127,271 BTC was frozen as part of a US Department of Justice investigation into Prince Group chairman Chen Zhi, which the Wikipedia entry describes as the largest cryptocurrency seizure to date (Wikipedia · Prince Group).

7. Coincheck NEM hack (January 2018)

Loss: approximately $534 million worth of NEM tokens (523 million NEM). Cause: hot wallet private keys were inadequately protected. Multisig had not been implemented. A disproportionate share of customer NEM was held in online hot storage rather than cold storage. Resolution: Coincheck used corporate funds to compensate customers ¥46.3 billion (about $420M) in full Japanese yen equivalent. In April 2018 the company was acquired by Monex Group. It remains operational. Significance: the largest single crypto theft in Japanese history. Triggered Japanese Financial Services Agency (FSA) supervision of all crypto exchanges in Japan, including mandatory multisig hot wallet, cold wallet segregation, and customer asset segregation.

8. BitGrail $170M NANO (February 2018)

Loss: approximately 17 million NANO (about $170 million at the time). What happened: on February 9, 2018 the Italian exchange BitGrail announced that it had been hacked and would shut down; users could no longer reach the assets held on the platform, and victims brought a class action against its owner, Francesco Firano. Resolution: in January 2019 the court in Florence ruled against the exchange, finding that it had failed to implement safeguards and to report the losses (Wikipedia · Nano).

9. Cryptopia hack (January 2019)

Loss: the blockchain analytics firm Elementus estimated the stolen assets at around NZ$24 million at the time they were taken (Wikipedia · Cryptopia). Cause: a New Zealand exchange whose hot wallet was breached in January 2019. Resolution: the company went into liquidation in May 2019, with Grant Thornton as liquidator. In 2020 the New Zealand High Court held that cryptocurrency is a form of property capable of being held on trust. The liquidators are distributing coin by coin, in kind.

10. QuadrigaCX collapse (January 2019)

Loss: according to the review published by staff of the Ontario Securities Commission (OSC) in June 2020, more than 76,000 clients were owed a combined C$215 million in assets and ultimately lost at least C$169 million; the bankruptcy trustee, Ernst & Young, recovered or identified only about C$46 million. What happened: on January 14, 2019 Quadriga announced that founder Gerald Cotten had died in India the previous month; on February 5 the platform ceased operations and filed for creditor protection. Cause: OSC staff's assessment is that most of the shortfall resulted from Cotten's fraudulent conduct, not from keys lost with his death — about C$115 million came from his trading against real clients on his own platform using alias accounts and fictitious balances, and a further C$28 million was lost trading client assets on three external platforms without authorization (OSC report). These are the conclusions of regulatory staff and have not been tested before a court. Significance: when one person has sole control of an entire exchange with no outside oversight, clients have no means of verifying what the platform says about where their assets are. Full account in Shipwreck Annals · Vol. IV: QuadrigaCX.

11. Binance hot wallet theft (May 2019)

Loss: 7,000 BTC (roughly $40 million at the price of the day). What happened: on May 7, 2019 Binance announced that its BTC hot wallet had been breached and 7,000 BTC withdrawn in a single transaction; the announcement said the hot wallet held about 2% of its total BTC. Resolution: Binance said it would use the SAFU fund to cover the incident in full (Binance Security Breach Update, May 7, 2019). This remains the only publicly confirmed use of SAFU; see SAFU Explained.

12. KuCoin $281M hack (September 2020)

Loss: approximately $281 million in mixed cryptocurrencies. Cause: hot wallet private keys were exfiltrated (the exact method has not been publicly disclosed). Resolution: KuCoin remained operational. In a February 2021 blog post, CEO Johnny Lyu wrote that $222 million (78%) had been recovered together with exchange and project partners and $17.45 million (6%) together with law enforcement and security institutions, and that the insurance fund covered the remaining $45.55 million or so (16%) (Wikipedia · KuCoin). Customers experienced zero net loss. Significance: a rare case of "hacked but customers zero out at end" demonstrating that industry-wide cooperation can mitigate even large hacks.

Chapter 2: ICO-Era Frauds and Disputes (2014–2019)

Of the five entries in this chapter, four were frauds (BitConnect, OneCoin, Centra Tech, PlusToken) and one was an ICO governance dispute (Tezos). The four frauds promised guaranteed high returns, claimed blockchains or products that did not exist, and recruited through multi-level referral structures. Nobody at Tezos was found to have committed fraud; the problem there was who controlled the money that had been raised.

13. BitConnect $2.4 billion Ponzi (January 2018 collapse)

BitConnect was, in a sense, the most honest Ponzi in crypto history — it told you exactly what it was, then asked if you wanted in. The pitch was an "automated trading bot" supposedly producing 1% per day, which annualizes to 365% and which no actual trader in any market has ever sustained. Users converted BTC to BCC, locked the BCC on the platform, and received "interest." The SEC alleged the money was not used for the trading it described and was diverted for the promoters' own benefit. New deposits paid old withdrawals, exactly as the textbook describes. When two US state securities regulators, Texas and North Carolina, issued cease-and-desist orders in January 2018, the platform closed its "lending" product and the BCC price collapsed. In February 2022 the US Justice Department indicted founder Satish Kumbhani on charges including fraud and money laundering, and its press release put the scheme at $2.4 billion (Wikipedia · Bitconnect). The case left two legacies: a chilling effect on celebrity-promoted Ponzi schemes, and the Carlos Matos "Hey hey heyyy!" YouTube clip, which remains the most cited Ponzi exhibit in crypto culture and a useful reminder that the loudest sales pitch in any room is the warning sign you are meant to ignore.

14. OneCoin $4 billion+ (2014-2019)

Loss: at least $4 billion across approximately 3.5 million investors in 175 countries. Scheme: Bulgarian founder Ruja Ignatova built OneCoin as a multi-level-marketing pyramid claiming to be a "Bitcoin killer." OneCoin had no blockchain — all "transactions" were entries in an internal database. Recruitment commissions paid for downline growth, not actual product sales. Country-by-country regulatory evasion through layered corporate structures. Resolution: Ignatova disappeared from a Greek airport in October 2017. She has never been located and remains on the FBI's Top Ten Most Wanted list. Her brother Konstantin Ignatov was arrested in the US in 2019 and is cooperating with prosecutors. Multiple country prosecutions continue. The BBC podcast The Missing Cryptoqueen investigated her disappearance.

15. Tezos ICO governance dispute (2017-2018)

What happened: on July 1, 2017 the Tezos Foundation raised $232 million in bitcoin and ether. By October the founders, Arthur and Kathleen Breitman, and foundation president Johann Gevers were in a dispute over control of the project, and the launch was delayed. Resolution: Gevers resigned in 2018 and the mainnet went live in September 2018; the lawsuits investors had brought over the fundraiser were settled in 2020, with the Tezos Foundation paying $25 million (Wikipedia · Tezos). Significance: when it is not settled at the outset whether the foundation or the founding team controls the money raised, it gets settled later through disputes and lawsuits.

16. Centra Tech celebrity ICO (2017)

Loss: more than $32 million in ICO funds. Scheme: claimed to be launching a crypto debit card backed by Visa and Mastercard, and paid celebrities to tout the offering on social media. Reality: according to the SEC's complaint of April 2, 2018, Centra had no relationships with Visa or Mastercard, and co-founders Sohrab Sharma and Robert Farkas had created fictional executives with impressive biographies (SEC press release 2018-53). Resolution: on November 29, 2018 Floyd Mayweather and DJ Khaled settled SEC charges of failing to disclose the payments they had received from Centra Tech, without admitting or denying the findings, and paid disgorgement and penalties (SEC press release 2018-268). Significance: a project paying a celebrity to front it does not mean anyone has done diligence on your behalf.

17. PlusToken Ponzi (2019 collapse)

Loss: the final ruling of the Yancheng Intermediate People's Court in Jiangsu found that it absorbed assets worth at least 14.8 billion yuan (about $2.2 billion at the period's lowest prices) from more than 2.6 million members (The Block's account of the ruling). Scheme: pitched as a high-yield wallet with "arbitrage" returns and grown through multi-level referral commissions; the court found that the arbitrage trading platform it advertised did not exist. Resolution: six Chinese nationals were arrested in Vanuatu in June 2019 and deported to China; in July 2020 China's Ministry of Public Security announced the arrest of 27 major suspects and 82 key members (Wikipedia · PlusToken). In the final judgment of November 19, 2020, 15 people were sentenced to between two and eleven years, and the seized crypto assets were to be processed according to law with the proceeds forfeited to the national treasury. Full version: Shipwreck Annals · PlusToken.

Chapter 3: DeFi Exploits & Bridge Attacks (2020-2022)

After the DeFi explosion of 2020, new attack surfaces emerged: smart contract vulnerabilities, flash loan composability attacks, multisig flaws in cross-chain bridges. Five of the eight events in this chapter took place in 2022.

18. bZx flash loan attacks (February 2020)

Loss: two attacks totaling roughly $1 million. Cause: the first wave of DeFi flash-loan composability attacks. The attacker borrowed massive uncollateralized capital → used it to manipulate Uniswap price oracles → exploited bZx leverage products at the manipulated price. Significance: revealed that any DeFi protocol consuming third-party price oracles is vulnerable to flash-loan manipulation. Subsequent major DeFi protocols moved to time-weighted average pricing (TWAP) or Chainlink-style oracles with anti-manipulation logic.

19. Iron Finance / TITAN (June 2021)

Iron Finance collapsed in June 2021. The mechanism was IRON, a partial-algorithmic stablecoin backed partly by USDC collateral and partly by the TITAN governance token; the assumption was that TITAN would be liquid enough to absorb minor pressure on the peg. It wasn't. A handful of whale sellers pushed TITAN price down, arbitrageurs read the script correctly and kept minting and dumping into the falling price, and within twenty-four hours TITAN had fallen to effectively zero, with roughly $2 billion in market cap erased. Iron Finance's own post-mortem called it the world's first large-scale crypto bank run (CoinDesk, June 17, 2021). With eleven months of hindsight, it reads as a full dress rehearsal for the Luna collapse of May 2022. Anyone who took the time to understand the Iron Finance mechanism in June 2021 was, eleven months later, unsurprised — and probably short.

20. Poly Network $611M hack (August 2021)

Loss: approximately $611 million across multiple chains. Largest DeFi attack at the time. Cause: cross-chain bridge contract vulnerability. The attacker discovered that EthCrossChainManager allowed forged cross-chain messages, and crafted a single message redirecting all bridged assets to attacker-controlled addresses. Resolution: the attacker returned the entire stolen amount within two weeks, claiming to be a "white hat" demonstrating the vulnerability. Poly Network publicly granted the attacker a "Chief Security Advisor" title and a $500,000 bounty. Significance: one of the rare large-scale crypto attacks in which the attacker voluntarily returned all of the funds (the other is Euler in 2023, see entry 48). The true identity has never been confirmed.

21. Wormhole Bridge $326M (February 2022)

In February 2022 someone discovered that Wormhole's Solana–Ethereum bridge would accept a forged "Ethereum side has burned" signature without anyone actually burning Ethereum, and minted 120,000 wETH on Solana for free — approximately $326 million in stolen value, second only to Poly Network ($611M) at the time. What happened next was unusual. Jump Crypto, Wormhole's parent, wired $326 million of its own capital into the bridge within twenty-four hours, restoring the peg between wrapped and native ETH and ensuring users experienced zero net loss. It is one of the only bridge attacks in this archive that ends without customer harm — and that outcome came from a parent firm willing to write a $326 million cheque, not from any resilience in the protocol itself.

22. Ronin Network $625M Axie (March 2022)

The attack on Ronin Network began with a job interview. A senior engineer at Sky Mavis, the studio behind Axie Infinity, received what looked like an offer letter as a PDF attachment. The attachment delivered malware. From there, North Korea's Lazarus Group — later named explicitly by the FBI — had a foothold on 4 of the 9 validator nodes that secured the bridge. The remaining hurdle was a fifth signature, which arrived courtesy of a node that Axie DAO had temporarily delegated and never revoked. With five-of-nine in hand the attackers signed off a withdrawal that took 173,600 ETH plus $25.5 million USDC out of the bridge — roughly $625 million in March 2022 dollars. Sky Mavis raised a $150 million equity round led by Binance, added money from its own balance sheet, and made every user whole when the bridge reopened on June 28, 2022 — roughly three months after the attack. The structural lesson that bridges have absorbed since then is uncomfortable but obvious in hindsight: a 5-of-9 multisig in which 4 of the 9 nodes are operated by a single party is functionally a 1-of-2 multisig, regardless of how it looks on a slide deck.

23. Beanstalk governance attack (April 2022)

The paradox of Beanstalk was that the attacker followed the rules exactly as written. In April 2022, voting power in this algorithmic stablecoin protocol came from Stalk, which you earned by depositing into its Silo, and a proposal could be executed through emergencyCommit once it had existed for 24 hours and gathered a two-thirds majority. On April 16 the attacker submitted a proposal to send all protocol funds to an address they controlled. Once the 24 hours were up, they flash-borrowed more than $1 billion in DAI, USDC and other assets from Aave, deposited it into the Silo for enough Stalk, pushed the proposal through emergencyCommit on the spot, and repaid the loan — all inside a single transaction. Roughly $182 million walked out the front door, with no funds recovered and Beanstalk forced offline to rebuild its governance from scratch. It was the first major attack to combine flash loans with on-chain voting, and the lesson it taught was structural rather than technical: a 24-hour waiting period on proposals is not enough on its own. If voting power can be borrowed inside a single transaction and a proposal executed the moment the votes land, the waiting period protects nothing.

24. Nomad Bridge $190M free-for-all (August 2022)

Loss: approximately $190 million. Cause: Nomad bridge contract had an initialization flaw — a deployment upgrade left the trustedRoot field at the 0x00 default value. As a result, any forged call to the bridge contract was treated as valid. Unique feature: this was the only "free-for-all" crypto hack in history. Once the vulnerability was discovered, anyone capable of copy-pasting a transaction could drain funds. Hundreds of addresses ultimately participated, with stolen amounts ranging from $100 to several million each. Resolution: Nomad publicly asked "white hat" participants to return funds; approximately 22% of the stolen amount was eventually returned. Significance: a case study in how a single deployment misconfiguration can trigger industry-scale free-for-all theft.

25. BNB Chain bridge BSC Token Hub (October 2022)

Loss: BNB Chain's official announcement says a total of 2 million BNB was withdrawn. What happened: on October 6, 2022 the BSC Token Hub cross-chain bridge on BNB Chain was attacked. BNB Chain stopped the chain by contacting validators one by one, and said the vast majority of the funds remained under control. The announcement gives 26 active validators at the time, 44 in total. Resolution: what to do next was put to on-chain governance votes, including whether to freeze the hacked funds and whether to use BNB Auto-Burn to cover the remainder (BNB Chain Ecosystem Update, October 7, 2022). This was a matter at the BNB Chain level, not compensation for user assets at the exchange, and SAFU was not drawn on. Significance: a chain that can be halted by reaching a couple of dozen validators has a way to stop the bleeding — and that same fact shows how small a circle controls it.

Chapter 4: 2022 Cascade Year

Six of this chapter's seven events fall in the seven months from May to November 2022; the seventh, Genesis, came in January 2023. The links run like this: Luna fell → 3AC was ordered into liquidation → lenders to 3AC such as Voyager and Genesis were left with holes → FTX collapsed in November → BlockFi, which had taken a credit line from FTX, filed for bankruptcy → in January 2023 Genesis filed for bankruptcy and Gemini Earn customers' funds were frozen.

26. TerraUSD / Luna collapse (May 2022)

Loss: almost $45 billion in market capitalization wiped out within a week (Wikipedia · Terra). Cause: algorithmic stablecoin death spiral. UST depeg → arbitrageurs swapped UST for LUNA → LUNA supply ballooned → LUNA price collapsed to virtually zero → UST fell to about 10 cents over that week. Full version: see Shipwreck Annals · Volume Two · The Terra/Luna Collapse, Day by Day. Do Kwon status: arrested in Montenegro in March 2023, extradited to the United States on December 31, 2024, pleaded guilty to two fraud charges in August 2025, and was sentenced to 15 years on December 11, 2025 (Wikipedia · Do Kwon).

27. Three Arrows Capital liquidation (June 2022)

Scale: roughly $10 billion in assets under management (Bloomberg, 2022). Cause: 3AC, the crypto hedge fund founded by Su Zhu and Kyle Davies, held leveraged positions in LUNA, stETH and other assets. The Luna collapse did the initial damage; the stETH depeg in June 2022 compounded it, and 3AC could not meet margin calls. Resolution: a British Virgin Islands court ordered liquidation on June 27, 2022, overseen by Teneo. In late September 2023 Su Zhu was arrested at Changi Airport in Singapore under a committal order, issued over his failure to cooperate with the liquidators, that sentenced him to four months in prison; Kyle Davies is subject to the same order (Wikipedia · Three Arrows Capital). Systemic effect: Voyager had lent 3AC about $670 million (entry 29) and Genesis $2.4 billion (entry 32); when 3AC failed, those loans could not be recovered. BlockFi held on with an emergency credit line from FTX until November and ultimately went down with FTX (see entry 31).

28. Celsius Network $4.7B (June 2022)

Loss: approximately $4.7 billion in customer deposits frozen. Cause: Celsius promised 17% annual yield on deposits. The actual yield was generated by deploying customer funds into Anchor Protocol (19.5%) + stETH arbitrage. The Luna collapse killed Anchor; the stETH depeg compounded the loss; Celsius paused withdrawals on June 13, 2022. Resolution: former CEO Alex Mashinsky pleaded guilty in December 2024 to two counts of fraud and agreed to forfeit $48 million in gains tied to manipulating the price of the CEL token; he was sentenced to 12 years in May 2025 (Wikipedia · Celsius Network). Significance: identical mechanism to Anchor — promised yields require ongoing subsidy from the project sponsor. When the subsidy stops, the mechanism collapses.

29. Voyager Digital $1.65B (July 2022)

Loss: approximately $1.65 billion in customer assets. Cause: Voyager was a crypto brokerage listed on the Toronto Stock Exchange (TSX). It had extended approximately $670 million in customer-funded loans to a single counterparty — Three Arrows Capital. In June 2022 Voyager announced that 3AC had not repaid loans totaling $666 million, and on July 5 it filed for Chapter 11 bankruptcy protection (Wikipedia · Voyager Digital). Resolution: the court approved the plan in May 2023 and withdrawals opened in June with a first-round recovery of 35.72%; another $445 million was held back pending the outcome of Alameda's preference claim, with further distributions to follow. Significance: a textbook case of single-counterparty concentration risk — a large block of customer funds staked on one counterparty, which took Voyager down with it when it failed.

30. FTX $8B collapse (November 2022)

FTX collapsed in nine days. On November 2, 2022, CoinDesk published a leaked Alameda Research balance sheet showing concentration in FTT — the exchange's own token — held as collateral against its affiliated trading firm's largest positions. The withdrawal run that followed cracked open something far worse: Alameda, the trading firm controlled by Sam Bankman-Fried, had been misappropriating FTX customer deposits for years, and the shortfall was approximately $8 billion. John J. Ray III, the bankruptcy administrator who had previously served the same role at Enron, would later put it more plainly than any prosecutor managed: "Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here." Bankman-Fried was convicted on all 7 counts in November 2023, sentenced in March 2024 to 25 years' imprisonment and about $11 billion in forfeiture. On June 12, 2026 the US Court of Appeals for the Second Circuit affirmed the conviction, the sentence and the forfeiture order, and in September 2026 he petitioned the Supreme Court (Wikipedia · Sam Bankman-Fried). Customers have been paid in stages since 2025, in dollars at their November 2022 value. The full nine-day reconstruction lives in Shipwreck Annals Volume Three.

31. BlockFi bankruptcy (November 2022)

Loss: approximately $300 million in customer assets frozen. Cause: BlockFi had accepted a $400M emergency credit line from FTX in mid-2022 (believing FTX was a stable backstop). When FTX collapsed, BlockFi's exposure to FTX/Alameda combined with its 3AC exposure became unrecoverable. Bankruptcy filed November 28, 2022. Resolution: BlockFi emerged from bankruptcy in October 2023, shut its web platform in May 2024 and made interim distributions through Coinbase; in July 2024 the plan administrator announced a sale of its FTX claims that would allow a 100% final distribution on allowed customer claims. Significance: a clear case of "the entity you thought was rescuing you was actually the systemic risk" — BlockFi assumed FTX was its lifeline; in reality, FTX collapsed first.

32. Genesis Global Capital (January 2023)

Loss: more than $3.5 billion owed to its top 50 creditors alone. Cause: Genesis had lent $2.4 billion to 3AC (disclosure came after the fact); the loss was unrecoverable. Simultaneously $175M in Alameda deposits was also lost when FTX collapsed. Bankruptcy filed January 19, 2023. Cascading effect: Gemini's customer-facing "Earn" product was operated through Genesis. When Genesis paused withdrawals, about $900 million in Gemini Earn customer funds was frozen.

Chapter 5: Stablecoin Depeg History

This chapter consolidates the stablecoin-specific events. The lesson here is that Terra/UST was not the first algorithmic stablecoin to fail. It was the latest in a long lineage.

33. NuBits (June 2016 / March 2018)

Loss: cumulative market cap erosion of roughly $15 million across two depeg events. Mechanism: NuBits was an algorithmic stablecoin paired with NuShares governance token — almost identical to the Luna/UST design six years later. Outcome: first depeg June 2016 to $0.21, briefly recovered; second depeg March 2018 to $0.04, never recovered. Significance: the original death-spiral case in crypto history.

34. BitUSD repeated depegs (2014 onward)

Loss: difficult to quantify precisely but significant ecosystem damage. Mechanism: BitShares-backed BTS collateral stablecoin; over-collateralized BTS to mint BitUSD. Outcome: BTS price declines caused BitUSD to depeg repeatedly to the $0.70-0.80 range; lost effective liquidity by 2018. Classification: BitUSD required collateral and held its peg through margin calls and settlement, which is not the same path as the zero-collateral, governance-token-absorbs-everything design of NuBits and UST; it sits in this chapter because it, too, depegged repeatedly.

35. Neutrino USDN (April 2022)

Loss: USDN depeg to $0.70; indirect $500 million loss across the Waves chain ecosystem. Mechanism: Waves chain algorithmic stablecoin using WAVES governance token to absorb price volatility — similar to UST. Outcome: April 2022 first depeg, briefly recovered; June 2022 (one month after Luna collapse) depegged again and never recovered. Significance: occurred during a window when market trust in algorithmic stablecoins was already in free-fall post-Luna; recovery was no longer possible.

Chapter 6: Thefts and Shutdowns, 2023–2025

The nine events of this chapter fall into roughly four groups: attacks attributed to North Korean hackers (DMM / WazirX / Atomic / Bybit), single-point failures (PlayDapp / Multichain), a compiler vulnerability (Curve), and a breached cloud provider (Mixin), plus HTX's two hot-wallet thefts.

36. Atomic Wallet $100M (June 2023)

Loss: approximately $100 million across multiple chains and currencies. Cause: Atomic Wallet App users observed widespread unauthorized fund movements on June 2, 2023. The exact mechanism was never fully disclosed publicly. Attribution: Elliptic on-chain analysis attributed to North Korea's Lazarus Group. Significance: "non-custodial wallet apps" can themselves be a single point of failure.

37. Curve Finance Vyper vulnerability (July 2023)

Loss: approximately $65 million across multiple Curve pools. Cause: not Curve's own code — Vyper compiler versions 0.2.15, 0.2.16, and 0.3.0 had a reentrancy protection failure. Pools written in those versions were vulnerable. Related risk: Curve founder Michael Egorov had borrowed nearly $60 million in stablecoins on Aave against about $175 million in CRV, a position at risk of liquidation if CRV fell considerably. He sold CRV over the counter to buyers including Justin Sun (5 million), DCFGod (4.25 million), Machi (Jeffrey Huang, 3.75 million) and DWF Labs (2.5 million) to repay part of that debt (The Block, August 1, 2023). Significance: revealed the supply chain risk inherent to smart contracts — your protocol can be perfectly secure, but if the compiler has a bug, you are still vulnerable.

38. Multichain shutdown (July 2023)

Loss: approximately $126 million in user funds frozen. What happened: Multichain (formerly Anyswap) was a cross-chain bridge protocol. In July 2023 the team announced it could not continue operations, and cross-chain assets could not be moved out. Significance: a cross-chain bridge depends on a small number of core people. When the team becomes unavailable, the funds freeze where they are.

39. Mixin Network $200M (September 2023)

Loss: approximately $200 million. Cause: Mixin is a Hong Kong-based crypto company. According to its September 2023 announcement, the database of its cloud service provider was attacked by hackers, resulting in the loss of some assets (TechCrunch, September 25, 2023). Resolution: Mixin said at the time that it would announce how the losses would be handled later. Significance: added "cloud service provider" as a new attack vector in the crypto risk framework. Your protocol may be secure, but if your cloud provider is breached, your protocol is exposed.

40. HTX (Huobi) hacks (September and November 2023)

Loss: about $8 million in September 2023; in November, about $26.2 million from HTX hot wallets plus about $87 million from the Heco cross-chain bridge the same month — roughly $120 million including the bridge. Cause: HTX reported back-to-back hot wallet breaches in September and November 2023. Resolution: after the November incident Justin Sun posted that HTX would fully compensate for the losses from HTX's hot wallets (CoinDesk, November 22, 2023). Significance: like KuCoin in 2020, a case of an exchange saying it would absorb the loss itself after being hacked.

41. PlayDapp $290M mint exploit (February 2024)

Loss: approximately $290 million in PLA token supply impact (about 1.79 billion PLA minted and partly sold). Cause: private key compromise gave the attacker mint authority over the PLA token contract. The attacker minted 200 million PLA on February 9 and another 1.59 billion on February 12 — about 1.79 billion in total, roughly three times the 577 million PLA in circulation beforehand — and gradually dumped them on exchanges. Resolution: PlayDapp coordinated with major exchanges to freeze some stolen tokens, but PLA price collapsed irreversibly; PlayDapp announced a migration to a new secure system based on a snapshot, with new tokens issued. Significance: brought the relatively under-attended "smart contract mint authority management" risk to the forefront. Many tokens have mint authority that was never revoked after initial deployment — if those keys are compromised, the token can be infinitely diluted.

42. DMM Bitcoin $308M Japan (May 2024)

Loss: approximately $308 million at the time (4,502.9 BTC). Cause: Japanese exchange; the way in was its wallet software vendor, Ginco. In late March 2024 the attackers, posing as a LinkedIn recruiter, sent a Ginco employee with access to the wallet management system a malicious Python script dressed up as a pre-employment test. From mid-May they used a stolen session cookie to impersonate that employee inside Ginco's unencrypted communications system, and in late May most likely used that access to tamper with a legitimate transfer request initiated by a DMM employee. Attribution: the FBI, the US Department of Defense Cyber Crime Center (DC3) and Japan's National Police Agency jointly attributed the theft to North Korean cyber actors tracked as TraderTraitor (commonly grouped under the Lazarus umbrella). Resolution: DMM Group (a large Japanese parent conglomerate) injected capital to cover all customer losses in full. In December 2024 DMM announced it would close its crypto exchange business; customer assets were transferred to SBI VC Trade. Significance: the first major case of "hacked → reimbursed in full → voluntarily exit the market." Demonstrates that even fully-reimbursed events can break operator confidence to the point of exit.

43. WazirX $230M India (July 2024)

Loss: approximately $230 million. Cause: India's largest crypto exchange. The compromised multisig wallet had six signers — five from WazirX and one from its custody provider, Liminal — and a transfer needed approval from three WazirX signers before Liminal gave final approval. At the time of the attack, what Liminal's interface displayed did not match what was actually signed; WazirX suspects the transaction was swapped for one that handed control of the wallet to the attacker. Attribution: on-chain analysis attributed to North Korea's Lazarus Group. Resolution: WazirX went through a court-sanctioned scheme of arrangement in Singapore — a restructuring, not a bankruptcy liquidation. The Singapore High Court approved it on 13 October 2025, it took effect on 15 October, and trading resumed on 24 October. WazirX says eligible users received a first distribution of roughly 85% of their admitted claims (valued at the reference pricing date) within 10 business days of the restart, with the rest tied to future recoveries through Recovery Tokens. Significance: multisig only checks whether enough people signed, not whether each signer signed the transaction they were shown. Once the signers' interface was tampered with, a higher threshold just meant more people signing the same wrong transaction — the same class of problem that hit Bybit seven months later.

44. Bybit $1.5B theft (February 2025)

On February 21, 2025 Bybit announced it had been hacked: approximately 400,000 ETH (around $1.5 billion, per the FBI) had moved, making this the largest single hack in crypto history. The attack exploited Bybit's multisig wallet setup and was facilitated by compromised infrastructure at Safe{Wallet}, a third-party provider (Wikipedia · Bybit). The FBI publicly attributed it to North Korea and refers to the activity as TraderTraitor (commonly grouped under the Lazarus umbrella). Bybit says it replenished its reserves within 72 hours. The vulnerability class was familiar — Ledger Connect Kit had shown in 2023 what happens when the tooling signers rely on is itself compromised — but the scale was more than 2,000x larger, and the lesson that hardware wallets prevent private key theft but not "signing wrong content" was, finally, no longer abstract.

Chapter 7: Project Addenda + Macro/Policy Black Swans

The previous six chapters covered 44 project-level events. This chapter adds ten more: five project-level events that did not fit the first six chapters, and five macro/policy-level black swans — events that did not target any specific project but hit the entire crypto market at once through sovereign regulation, a global liquidity crisis or sanctions policy, a kind of risk that no project-level control can defend against. The numbered entries therefore total 54: 49 project-level plus 5 macro/policy-level.

A. Project Addenda

45. CVE-2010-5139 Value Overflow Incident · 184.4B BTC Inflation (August 15, 2010)

Loss: 184.4 billion BTC minted out of thin air at block 74638 (on-chain reality, zero dollar loss because BTC had essentially no market price at the time). Cause: CVE-2010-5139 — a Bitcoin transaction output value overflow vulnerability. The attacker crafted a single transaction that minted 184.4 billion BTC directly into two output addresses. At block height 74638 and 50 BTC per block, no more than about 3.73 million BTC could have existed at the time, so the issuance was roughly 49,000 times the circulating supply. Resolution: Satoshi Nakamoto and other core developers released version 0.3.10 within 5 hours. The fix was a soft fork that tightened the consensus rules, and the chain reorganized at block 74691, orphaning approximately 53 blocks. Significance: the first major on-chain disaster in crypto history. Established that "blockchain immutability" yields to "community consensus" in extreme circumstances. Six years later the DAO response also overturned transactions by community consensus (entry 5), but that time it took a hard fork.

46. Mango Markets Price-Oracle Incident (October 11, 2022)

Loss: more than $110 million (the CFTC's figure; the SEC put it at about $116 million). Cause: according to the CFTC's January 2023 announcement of its complaint, Avraham Eisenberg used two accounts on Mango Markets (a Solana-based DEX perpetuals protocol) to take large offsetting positions in MNGO perpetual swaps, then bought MNGO heavily on the three exchanges that fed the protocol's price oracle; the oracle price jumped more than 13-fold in 30 minutes. He used the inflated value of his swap position as collateral to borrow and withdraw more than $110 million in digital assets, and later returned about $67 million to Mango Markets (CFTC release 8647-23). Resolution: a criminal complaint from the US Attorney's Office for the Southern District of New York was unsealed on December 27, 2022, and the SEC's January 2023 release says he had been arrested and detained in Puerto Rico (SEC release 2023-13). Eisenberg admitted making the trades but maintained they were legal. In April 2024 a jury convicted him of commodities fraud, commodities manipulation and wire fraud; on May 23, 2025 Judge Arun Subramanian overturned all three convictions under Rule 29 — the two commodities counts for improper venue, and the wire-fraud count also for lack of a material misrepresentation (TRM Labs, May 2025). Prosecutors have appealed (DL News, January 7, 2026). Significance: when a low-liquidity token is accepted as collateral, a small amount of money can push its spot price up and then borrow a protocol's funds against the inflated collateral — a problem in oracle and collateral design. As to whether that is a crime, the trial judge threw out all the convictions, and prosecutors have appealed that ruling.

47. USDC depeg · SVB Bank Crisis (March 10-13, 2023)

On the afternoon of March 10, 2023, Silicon Valley Bank declared failure, and within hours Circle disclosed that of its $40 billion USDC reserve, approximately $3.3 billion — about 8.25% — was held as cash at SVB. The math the market did over the next 24 hours was simple and brutal: if SVB depositors were not made whole, Circle's balance sheet would have an immediate shortfall, and USDC could not honor 1:1 redemption. By Saturday morning USDC was trading at $0.88 on Curve 3pool and Uniswap, the entire stablecoin market was in panic selling, and the largest depeg a fiat-reserve stablecoin had ever suffered was already underway. The resolution arrived on Sunday, March 12, when the US Treasury, FDIC, and Federal Reserve jointly announced full protection of all SVB depositors. Circle reclaimed its full USDC reserves that night, and USDC restored its $1.00 peg within 36 hours. The lesson stuck: a "100% cash-backed stablecoin" still carries systemic banking risk — a failure mode entirely separate from the algorithmic spiral that took NuBits and UST. Every compliance-focused stablecoin in the months that followed quietly increased its Treasury holdings and reduced its bank deposit exposure.

48. Euler Finance $197M Hack-Returned (March 2023)

Loss: approximately $197 million (largest single DeFi attack of 2023 at the time of the event). Cause: Euler V1 lending protocol's donateToReserves function had a flaw — the attacker used self-borrow-self-collateralize plus flash loan combinations to bypass the protocol's health factor check and drain multiple pools (DAI / WBTC / USDC / stETH). Resolution: after on-chain negotiation the attacker began returning funds in batches from March 16, and by April 3 everything recoverable — about $240 million at then-current prices — had been returned; affected users got back those returned assets. Significance: like Poly Network 2021, a large DeFi hack in which the attacker voluntarily returned all recoverable funds. Established "on-chain public negotiation" as a recognized, occasionally-effective non-standard option in crypto incident response.

49. Solana Mainnet Outages History (2021-2024)

Loss: no direct asset loss per incident, but every outage halted all Solana DeFi protocols, CEX deposit/withdrawal flows, and NFT trading, causing significant indirect economic damage. Major outages recorded: September 2021 — 17 hours (IDO Grape Protocol traffic crash); April-May 2022 — about 8 hours (NFT minting traffic + validator memory exhaustion); June 2022 — 4 hours; February 2023 — 19 hours (a validator broadcast an oversized block that overwhelmed Turbine's deduplication); February 2024 — brief outage. Significance: Layer-1 mainnet failures are not uncommon in crypto but are generally ignored by markets. Solana is the highest-frequency offender — roughly one mainnet outage every 6-9 months between September 2021 and February 2024. Anyone custodying assets on a Layer-1 network should treat "chain outage" as a routine risk consideration, not a tail event.

B. Macro / Policy Black Swans

50. China Central Bank Five-Ministry Ban (December 5, 2013)

Market impact: on December 5, BTC China opened at ¥7,005 and saw a lowest bid of ¥4,521, and the CoinDesk index fell 22.5% on the day; the drop below ¥3,000 came only after BTC China stopped accepting yuan deposits on December 18. Cause: the People's Bank of China, Ministry of Industry and Information Technology, China Banking Regulatory Commission, China Securities Regulatory Commission, and China Insurance Regulatory Commission jointly issued the "Notice on Preventing Bitcoin Risks" — prohibiting financial institutions from providing bitcoin services, denying bitcoin's monetary status, and requiring third-party payment institutions to stop serving crypto exchanges. Result: the three then-largest Chinese exchanges (Huobi, OKCoin, BTCChina, collectively the global top three at the time) had their fiat on-ramps cut within 60 days, and rapidly lost market share to offshore exchanges. Significance: the first time crypto markets fell sharply due to sovereign regulatory action. Established the template "Chinese regulatory document + global market drop" that would be replicated in 2017 and 2021.

51. China 9.4 ICO Ban (September 4, 2017)

Market impact: BTC fell from $4,900 to $3,000 (-39%), ETH from $390 to $220 (-44%). Cause: the People's Bank of China and six other ministries (Cyberspace Administration of China, Ministry of Industry and Information Technology, State Administration for Industry and Commerce, China Banking Regulatory Commission, China Securities Regulatory Commission, China Insurance Regulatory Commission) jointly issued the "Notice on Preventing Risks from Token Offerings and Financing" — banning ICOs, ordering closure of domestic exchanges, and requiring ICO projects to refund proceeds to investors. Result: Huobi, OKCoin, BTCChina stopped CNY trading within 60 days (most rebranded as offshore "international editions"). The ICO model in mainland China was effectively terminated; global ICO fundraising fell from a Q3 2017 peak of $6.6 billion to near-zero by 2019. Significance: the first time crypto entered "global bear market acceleration mode" due to single-country regulatory action. Also catalyzed the migration from ICO to offshore operations and decentralized fundraising, foreshadowing the DeFi era.

52. Black Thursday · COVID Liquidity Crisis (March 12, 2020)

Market impact: BTC fell about 39% on the day — the worst single-day drop in seven years — and hit a low of $3,867 in the early hours (UTC) of March 13, about -50% over two days from $7,900. Cause: COVID-19 pandemic-induced global liquidity crisis. All risk assets sold off in synchrony, but crypto fell 2-3x more than equity markets due to 24/7 trading combined with globally distributed retail leverage. BitMEX and other perpetual futures exchanges experienced cascading liquidations. Resolution: total daily liquidations exceeded $1.8 billion. BTC recovered to $5,500 within 48 hours and was back above pre-event levels by late April. Significance: demonstrated that crypto is not a "safe haven asset" in macro liquidity crises — it is a "risk-amplification asset." Permanently changed the pre-2020 narrative that "BTC is digital gold"; directly motivated DeFi protocols to introduce flash-crash-resistant oracle mechanisms.

53. China's May 2021 Crackdown Crash (May 19, 2021)

Market impact: BTC fell from $43,000 to $30,000 in a single day (-30%), ETH simultaneously -40%. Cause: on May 18 three Chinese industry associations (the National Internet Finance Association, the China Banking Association and the Payment & Clearing Association) issued a joint risk warning, and the market crashed the next day; on May 21 the 51st meeting of the State Council Financial Stability and Development Committee then explicitly called to "crack down on bitcoin mining and trading activity." Subsequently Inner Mongolia, Xinjiang, Sichuan, Qinghai, and Yunnan provinces successively issued specific cleanup policies. Result: global BTC hashrate fell from 180 EH/s to 90 EH/s (-50%) within 60 days. Miners migrated en masse to North America (Texas predominantly), Kazakhstan, and Russia. BTC block time stretched from 10 minutes to over 18 minutes. Significance: the largest geographic redistribution of hashrate in crypto history. Demonstrated that a single country can push roughly half of global hashrate out within 60 days.

54. Tornado Cash OFAC Sanctions · Open-source Code Precedent (August 8, 2022)

Market impact: relatively muted (BTC -5%) but the developer community impact was enormous; TORN governance token -50%; Ethereum addresses associated with Tornado Cash were proactively blacklisted by major DeFi protocols (Aave, Uniswap, dYdX). Cause: the US Treasury's Office of Foreign Assets Control (OFAC) added Tornado Cash, an open-source code mixer, to the Specially Designated Nationals list. This was the first time the US sanctioned a piece of "open-source software" rather than a specific company or individual. On August 10 developer Alexey Pertsev was arrested in Amsterdam; on May 14, 2024 a Dutch court sentenced him to 5 years and 4 months. Subsequent developments: on August 23, 2023 US prosecutors charged Roman Storm and Roman Semenov with assisting in money laundering, and Storm was arrested in Washington State; his trial opened in July 2025, and he was found guilty on one of three charges, conspiracy to operate an unlicensed money transmitting business. On November 26, 2024 the US Fifth Circuit Court of Appeals ruled that Tornado Cash's immutable smart contracts do not qualify as "property" under federal law and that OFAC lacked authority to sanction them directly; on March 21, 2025 the US Treasury lifted the sanctions on Tornado Cash (Wikipedia · Tornado Cash). Significance: pushed the foundational legal question "can code itself be sanctioned" to the US federal courts for the first time. The outcome remains ambiguous — it established a legal precedent that "open-source code should not be directly sanctioned" but produced a significant chilling effect on developers of all privacy and anonymity tools.

12 Lessons

These twelve lessons are a working checklist drawn from the 54 events above. Each is paired with the specific entries behind it.

A. Centralized exchange custody (lessons 1-3)

1. Pick exchanges by Proof of Reserves, not CEO charisma. Coverage is paid for; PoR is something you can check. Look for regular publication, a verifiable proof of what is owed to account holders, and a lookup that lets you confirm your own balance was inside the snapshot; a report issued by an independent third party is more credible. See What Is Proof of Reserves.
2. Affiliated trading firms without segregation are blueprints for collapse. FTX-Alameda and Celsius's internal book shared this pattern. Voyager was not affiliated with 3AC, but it bet a large block of customer funds on that one counterparty and ended the same way. Look at whether the exchange's parent operates an unrelated market maker, hedge fund, or undisclosed proprietary trading book.
3. A withdrawal pause is a top-level alarm. Mt.Gox, FTX, Celsius, Voyager, Cryptopia and Multichain all paused withdrawals and never returned to normal operation. Bitstamp could reopen a week later in 2015 only because someone put up the money to fill the hole on the spot; WazirX, hit in 2024, did not resume trading until it had completed a Singapore debt restructuring in October 2025. When you see a withdrawal pause blamed on a temporary technical issue, prepare for the worst case.

B. Stablecoins (lessons 4-5)

4. "Stablecoin" is a marketing label — always check the actual reserve mechanism. Centrally-reserved (USDT/USDC/FDUSD) depends on the issuer's solvency + banking partner safety (USDC SVB 2023 demonstrated the second). Algorithmic (UST/USDN/NuBits) depends on continued faith in a governance token. Both can fail in different ways.
5. Purely algorithmic stablecoins are structurally dead. NuBits, Iron Finance/TITAN, Terra/UST, Neutrino USDN — four cases proving the death spiral pattern. Don't be persuaded by "Algorithmic Stablecoin 2.0" marketing.

C. DeFi and cross-chain (lessons 6-8)

6. Cross-chain bridges were the single largest attack surface of 2021-2022 — use them minimally. Poly $611M, Wormhole $326M, Ronin $625M, Nomad $190M, Multichain $126M, Heco $87M — six incidents, just under $2 billion in total (Poly's $611M was later returned in full), plus the 2 million BNB withdrawn from BSC Token Hub.
7. Flash loan plus governance attacks make any low-liquidity governance token pool vulnerable. Beanstalk demonstrated the pattern. Check whether voting power in your DeFi protocols can be borrowed inside a single transaction. Beanstalk already made proposals wait 24 hours and was still executed on the spot with flash-borrowed votes — a waiting period alone is not enough; if voting power can be rented, the pool is sitting on a live charge.
8. Hardware wallets stop private-key theft but not signing wrong content. Bybit 2025 ($1.5B), Ledger Connect Kit 2023 ($600K), and the Permit2 approval phishing that keeps recurring all involved users signing hijacked content on properly-functioning hardware. The hardware wallet is necessary but not sufficient — you also have to read what you sign.

D. Self-custody (lesson 9)

9. Never concentrate in a single vector. Keep on an exchange only what you actually trade, and move long-term holdings to a cold wallet whose keys you control. Multisig and custodians are not a separate safe bucket — entries 6, 43 and 44 were all multisig setups that were breached. FTX all-in customers had everything frozen on Nov 11, 2022, and were paid in stages only from 2025. Most got back about 118% of their allowed claims on paper, but in dollars at the November 2022 value — two-plus years frozen and none of the crypto upside.

E. ICO / projects (lessons 10-11)

10. "Guaranteed yield" is almost always a Ponzi marker. BitConnect 1% daily, OneCoin opaque returns, Anchor Protocol 19.5%, Celsius 17%, PlusToken's high monthly returns — all promised yields they could not actually generate. Any project that cannot explain its yield source in three sentences should be defaulted to Ponzi.
11. Celebrity endorsement is not project validation. A project paying a celebrity to front it does not mean anyone has done diligence on your behalf. Regulators have fined undisclosed paid promotion (see entry 16, Centra Tech), but enforcement lags market exposure. Discount any project that leans on celebrity attention.

F. Meta-lesson (lesson 12)