DEF CON: 33 years of the world's biggest hacker conference

This week Las Vegas becomes the world capital of cybersecurity. Black Hat USA 2026 started last Friday (August 1) and runs through the 6th; right after that, DEF CON 34 takes over the Las Vegas Convention Center from August 6 to 9. Together, the two events make up what the community calls Hacker Summer Camp — the largest concentration of researchers, security companies, government agencies and hackers on the planet, all in the same week, on the same stretch of hot Nevada asphalt.

The question worth answering today: how did this start?

A farewell party that got out of hand (in a good way)

In June 1993, Jeff Moss was 18 years old, went by “The Dark Tangent” on the BBSs, and wanted to throw a farewell party for the operator of Platinum Net — a network of Canadian bulletin board systems that was shutting down. The idea was simple: get the Las Vegas hacker scene’s friends together for a send-off.

The Platinum Net operator had a family emergency and had to travel before the event. Jeff was left with a booked hotel, a guest list and no official theme. He decided to hold the party anyway — and invited everyone he could reach, federal agents included. The reasoning was blunt: they’d show up regardless.

DEF CON 1 took place at the Sands Hotel & Casino in Las Vegas, from June 9 to 11, 1993. No formal schedule, no signage — folding chairs as the main furniture. Roughly 100 people, 12 speakers, one tape recorder and a great deal of curiosity. According to DEF CON’s official history, each attendee chipped in one dollar per hour to cover the cost of the hotel room.

What happens at DEF CON

The format evolved over three decades. Today the event rests on four main pillars:

• Talks: presentations by researchers showing off vulnerabilities they've discovered, attack and defense techniques, and never-before-seen experiments. The material presented there tends to define what the industry debates in the months that follow.
• Villages: more than 30 independent themed spaces inside the conference. There's a Lockpicking Village, a Car Hacking Village, a Voting Machine Hacking Village, plus villages for aviation and industrial IoT devices. Each village has its own talks, challenges and hands-on labs.
• CTF (Capture The Flag): the DEF CON CTF is considered the unofficial world championship of hacking. Teams from all over the planet qualify through regional competitions across the year to compete in the live final in Las Vegas.
• Spot the Fed: a cultural tradition of the event. Any attendee can take the mic and ask someone in the audience to identify themselves as a federal agent — and win a special T-shirt if they're right.

The Wall of Sheep is another classic attraction: a board displaying credentials (with part of the name obscured) belonging to users who connected to the event’s network without adequate encryption. A hands-on lesson in why you don’t use HTTP or weak passwords on unfamiliar networks.

What's the difference between DEF CON and Black Hat?

DEF CON is grassroots, rooted in hacker culture; Black Hat is the corporate event created by the same founder for the professional market.

Jeff Moss created Black Hat in 1997 — four years after DEF CON — because companies and governments wanted a more structured format for consuming security research: a fixed schedule, tickets paid for by the company (not by individuals), speakers presenting to executives, and no competition to spot the federal agent. The first Black Hat ran from July 7 to 10, 1997, in Las Vegas, immediately before DEF CON 5.

Today Black Hat draws more than 20,000 professionals, has editions in Europe and Asia, and is the main venue where vendors receive coordinated disclosures of critical vulnerabilities. DEF CON, with around 30,000 attendees, keeps its original DNA: chaotic, cheaper, technical and radically open.

Talks that changed digital security

The real impact of DEF CON and Black Hat is measured by the research presented there. Two of those talks permanently changed what manufacturers have to defend:

• Jeep Cherokee hacked live (Black Hat/DEF CON, 2015): researchers Charlie Miller and Chris Valasek demonstrated how to take remote control of a Jeep Cherokee in motion — accelerator, brakes, transmission — over the cellular network, with no physical access to the car. Chrysler recalled 1.4 million vehicles days after the story ran in Wired. The episode forced the auto industry to treat software security as an engineering requirement, not an optional extra.
• RFID passport cloning (DEF CON 14, 2006): researchers demonstrated how the chips in the newly launched biometric passports could be read and cloned with cheap equipment. The US government updated the electromagnetic shielding requirements for passports as a direct response.

To understand how flaws presented at these events connect to real attacks, it’s worth reading about WannaCry — whose exploit was built with NSA tooling and turned into global ransomware in 2017 — and about Stuxnet, which revealed how digital weapons operate inside critical infrastructure before any conference had even named the problem.

DEF CON 34: what's happening this week

DEF CON 34 starts on Thursday, August 6, 2026, at the Las Vegas Convention Center, and runs through Sunday the 9th. Black Hat USA 2026 has been under way since Saturday, with trainings and briefings at Mandalay Bay through Wednesday.

The 2026 edition arrives at a moment when generative AI and edge computing hardware dominate the security conversation. Expect a high volume of research on LLM prompt injection, attacks on industrial IoT devices and evasion techniques against modern EDR environments. Black Hat 2026’s CFP (call for papers) received more LLM submissions than any other category — a direct reflection of how much the landscape has shifted since 2023.

If you’re not going to Las Vegas, most of the talks are published on DEF CON’s YouTube channel a few days after the event.

33 years, same energy

DEF CON moved from the Sands Hotel to the Sahara, from the Sahara to the Rio, from the Rio to Caesars, and today it occupies multiple hotels and the Las Vegas convention center. The ticket went from a dollar an hour in 1993 to a few hundred dollars today — still one of the cheapest events in the field, especially compared to Black Hat.

What hasn’t changed: the idea that security is learned by hacking, that vulnerabilities have to be exposed to get fixed, and that the best environment for that is a room full of people willing to break things. Jeff Moss built this with 100 friends and a cassette recorder. The DEF CON 34 starting this week is just the 30,000-person version of the same principle.

To see how social engineering — a recurring DEF CON topic since the earliest years — works in a real high-profile attack, read about the 2020 Twitter hack, when attackers manipulated company employees over the phone to reach internal systems.