DeFi Observatory — how DeFi gets hacked, visualized and explained

DeFi Observatory is an educational, non-commercial project that maps and explains how decentralized finance (DeFi) gets hacked. It combines source-attributed incident data from DeFiLlama's public hacks database with plain-language explanations of the vulnerability patterns behind real exploits, plus an experimental on-chain observation feed. It is not financial or security advice.

The vulnerability patterns behind DeFi hacks

Almost every DeFi exploit falls into one of a handful of repeating patterns. Each is explained on the site with a plain-language walkthrough, example code, prevention, and the real incidents of that type.

Reentrancy — a contract sends funds before updating its own books, and the recipient calls back in to drain it in a loop.
Oracle manipulation — the protocol trusts a price the attacker can move, usually with a flash loan, then borrows against the fake price.
Access control — a powerful function is missing its permission check, so anyone can call it.
Token & share accounting — inflation, donation, and rounding attacks that nudge a vault's ownership math out of balance.
Input validation — the contract trusts a proof, signature, or parameter it never properly verifies.
Bridge & cross-chain — a flawed release check lets an attacker withdraw on one chain without ever locking funds on the other.
Governance — an attacker borrows enough voting power to pass a proposal that drains the treasury.
Protocol logic — the code does exactly what it was written to do, and what it was written to do is wrong.
Market manipulation — gaming thin liquidity, funding rates, or self-liquidations rather than a single price feed.
Key compromise — the contracts were fine; someone stole the private keys. The largest single source of crypto losses.
Social engineering — the attacker hacks a person, not the code, via phishing, malware, or impersonation.
Frontend & infrastructure — the smart contracts are untouched; the website, DNS, or servers around them are compromised.
Rugpull — insiders drain funds using powers they legitimately hold: unlimited minting, admin upgrades, or pulling liquidity.

The full interactive experience — an explorable globe of every major incident, case studies of famous hacks, an inline glossary, and a beginner primer — requires JavaScript. Please enable it, or read the pattern library and incident data on the live site.

defiobservatory.com