The Block has published its annual ranking of the ten largest crypto hacks and exploits of 2024, cataloguing a year in which protocol vulnerabilities, compromised private keys and infrastructure failures again drained hundreds of millions of dollars from wallets, bridges and trading platforms.

The list, compiled by the research desk at The Block, follows the outlet's year-end convention of ordering incidents by total value lost. It spans decentralized-finance protocols, centralized exchanges and cross-chain infrastructure, the three categories that have dominated loss tallies since 2020.

What does the 2024 ranking cover?

The ten incidents selected by The Block represent the year's largest single-event losses rather than an aggregate of all exploits. The ranking methodology draws on on-chain forensics, disclosure statements from affected protocols and claims data, consistent with how the outlet assembled its 2023 edition.

Historically, this annual list has included:

• Private-key compromises at centralized custodians and exchanges;
• Smart-contract logic flaws in lending and staking protocols;
• Bridge exploits and signature-scheme failures;
• Oracle manipulation and access-control bugs.

Each entry in the 2024 edition pairs the incident with an estimated dollar loss and a technical summary of the attack vector, the detail set that security firms such as Chainalysis and CertiK also use in their own annual accounting.

Why does the annual loss tally matter?

The ranking serves as a benchmark for insurers, auditors and protocol treasuries that price security risk. A year dominated by key compromises, rather than contract bugs, shifts underwriting attention toward custody operations and signer hygiene. A year dominated by contract exploits moves budget toward repeated audits and bug-bounty expansion.

The composition of the 2024 list will also inform how regulators frame custody standards. The U.S. Securities and Exchange Commission and the Commodity Futures Trading Commission have both cited exchange security failures in past enforcement and rulemaking discussions, and the New York Department of Financial Services updated its custody guidance in late 2023 with direct reference to multi-signature and cold-storage controls.

For protocol operators, the operational consequence is concrete: teams named in loss rankings face recovery negotiations, potential reimbursement obligations and, in several past cases, offers from the exploiters to return funds in exchange for bounties. The precedent of partial returns set by the Euler Finance negotiation in 2023 remains the reference case for such settlements.

What should readers expect next?

The Block's ranking will likely be cross-checked against the full-year loss estimates that Chainalysis, CertiK and Immunefi publish each January, figures that historically diverge by tens of millions of dollars depending on whether crashed-token values and returned funds are netted out. Watch those January reports for the reconciled 2024 total.