DeFied Expectations — Examining Web3 Heists

This report explains how smart contract vulnerabilities—particularly reentrancy issues—are exploited to steal large sums from blockchain services and exchanges, citing historical cases such as the 2016 DAO theft (~$55M) and the 2023 Curve Finance exploit (~$70M). It outlines how smart contract external calls and improper state updates enable recursive withdrawals, notes long attacker dwell times (up to 12 months) in exchange attacks, and emphasizes the need for improved detection and secure smart contract development practices.