Crypto holders can lose millions with a single transaction. A hacked wallet isn't always involved. A wrong swap route, a copied address, the wrong network or an overly broad smart-contract approval can be enough to turn a valuable position into a near-total loss.
Crypto gives users direct control over their funds, and that also puts much of the responsibility on them. The blockchain doesn't interpret intent. Once a transaction is signed, the network executes its parameters: tokens go to the specified address, a swap uses the available liquidity, and a smart contract can use whatever access the user has granted.
Large swaps are especially vulnerable to liquidity problems. In one recent Solana case, a user tried to exchange about 7.8 million STONKS tokens worth roughly $1.8 million. The transaction went through a Raydium route with extremely thin liquidity. The user received about 26.8 RAY, worth around $25.
The network itself worked as expected. The problem was the execution price. When an order is too large for a liquidity pool, the trade can push the price against the person making it. The larger the order compared with available liquidity, the more severe the slippage can become.
A similar case occurred in March 2026. A user tried to swap about $50 million in USDT for AAVE through the Aave interface. After the transaction, the resulting tokens were worth only around $36,000.
The interface had already warned the user about extreme slippage and required an additional confirmation. The user accepted the warning on a mobile device and continued. Aave later decided to try to return around $600,000 in fees generated by the transaction.
Liquidity was also behind a major Cardano loss in November 2025. A holder exchanged 14.4 million ADA, worth about $6.9 million, for 847,695 USDA and lost roughly $6.05 million. A small test transaction beforehand didn't reveal what would happen when the full position was exchanged.
Addresses create another category of risk. In May 2024, a holder lost 1,155 WBTC, worth about $68 million at the time, in an address-poisoning attack. The attacker had created an address that looked similar to the victim's usual destination and sent a small transaction to make it appear in the wallet history.
The victim then copied the wrong address from that history. The blockchain had no reason to reject the transfer because the transaction itself was valid.
Sometimes there is no attacker at all. In 2024, a Renzo user confused their own wallet address with the address of a related technical smart contract and sent assets worth about $25 million to it. Attempts to recover the funds failed.
Even institutional players can make similar mistakes. In 2022, the Optimism Foundation sent 20 million OP tokens to a multisignature address that Wintermute had provided for receiving the funds - without confirming that Wintermute could actually control that address on the Optimism network. Two test transfers went through without issue beforehand, since receiving tokens doesn't require a contract to be deployed at all; the problem only became clear when someone tried to move the funds, and an attacker deployed a matching contract at that address first.
DeFi approvals sit in a category by themselves. Users often give contracts permission to access their tokens so that applications can perform swaps or other operations. Those permissions can remain active long after the original transaction is finished.
In January 2026, an exploit involving the DEX aggregator SwapNet caused losses of about $13.4 million. Almost the entire amount, around $13.34 million, came from a single wallet. The case involved direct approvals rather than One-Time Approval.
Across these incidents, the blockchain generally did exactly what the user had authorized. The loss came from the parameters of the transaction: the address, the network, the available liquidity or the permissions attached to a contract.
That makes self-custody very different from using a traditional financial intermediary. A bank can sometimes stop a suspicious transfer or ask for additional confirmation. With a crypto wallet, the person holding the private key can move large amounts directly.
For large transactions, a second check can therefore matter as much as the first one. The address, network, expected swap output, liquidity and existing contract approvals all deserve attention before a signature is made.
In crypto, control over the assets also means control over the transaction that moves them. Once an incorrect transaction has been signed and confirmed, there may be no intermediary left who can reverse it.