Bugs

Ethereum has had expensive bugs, such as the following:

• the DAO vulnerability (CTRL+F vulnerability) and Ethereum Classic replay attacks that occurred from the ensuing hard fork;
• Parity multisig library contract issue 1: the first bug was fixed in this pull request. "On Wednesday 19th July, 2017 a bug found in the multi-signature wallet ("multi-sig") code used as part of Parity Wallet software was exploited by parties unknown... The bug was in a pair of extremely sensitive functions designed to allow the set-up of "multi-sig" wallets in the Parity Wallet software. The functions should have been protected in order that they be usable only in one specific circumstance, as the contract was being created. However, they were entirely unguarded, which allowed the attacker to reset the ownership and usage parameters of existing wallets arbitrarily."1. 2, 3,
• Parity multisig library contract issue 2: [4, 5, 6, 7]

Following the fix for the original multi-sig vulnerability that had been exploited on 19th of July (function visibility), a new version of the Parity Wallet library contract was deployed on 20th of July. Unfortunately, that code contained another vulnerability which was undiscovered at the time - it was possible to turn the Parity Wallet library contract into a regular multi-sig wallet and become an owner of it by calling the initWallet function. It is our current understanding that this vulnerability was triggered accidentally on 6th Nov 2017 02:33:47 PM +UTC and subsequently a user deleted the library-turned-into-wallet, wiping out the library code which in turn rendered all multi-sig contracts unusable and funds frozen since their logic (any state-modifying function) was inside the library.

All dependent multi-sig wallets that were deployed after 20th July functionally now look as follows:

contract Wallet {
function () payable {
Deposit(...)
}
}

This means that currently no funds can be moved out of the multi-sig wallets.

• reclaiming of ether in common classes of stuck accounts, which gives more examples such as sending to an empty address, e.g. 1 and 2;
• "On 2016-11-24, a consensus bug occurred due to two implementations having different behavior in the case of state reverts. 3. The specification was amended to clarify that empty account deletions are reverted when the state is reverted... Details: Geth was failing to revert empty account deletions when the transaction causing the deletions of empty accounts ended with an an out-of-gas exception. An additional issue was found in Parity, where the Parity client incorrectly failed to revert empty account deletions in a more limited set of contexts involving out-of-gas calls to precompiled contracts; the new Geth behavior matches Parity’s, and empty accounts will cease to be a source of concern in general in about one week once the state clearing process finishes." The source is here..
• the padding bug mapping two public keys (EthereumJS bug) (sources are e.g. here and here.