HAPI Protocol

2022 was rife with a number of security-related incidents in DeFi. There is a lot to cover but we compiled a very concise and informative piece for you to enjoy. Get acquainted with the biggest, most impactful, and divisive occurrences in the DeFi security space in the year of 2022 created by HAPI Labs and our newly founded Analytics and Research Team!2022 Was a Rough Year for Web3 IndustryWeb3 space is a breeding ground for a lot of exploits and hacks. This is not to bash Web3 as a whole but rather to follow up with reasons for why it is so. Security is lacking and Web3 entrepreneurs tend to neglect some of the more evident ways of avoiding these security breaches, be it a low priority or unwillingness to explore available options. As such, we have a diverse set of fraud and exploits propagating itself within DeFi that would be easier to divide into: premeditated and “natural”. Premeditated in this context means everything related to scams perpetrated by the entrepreneurs themselves. Never intended to build and establish a revenue stream, they instead rely on various schemes to exploit those holding their tokens or interacting with their platform. Natural means exploits and hacks that happen not because of some orchestrated scheme by the founders but instead by negligence and lack of security measures in place.So 2022 had a bit of everything and a dollop of surprise to boot. Exploits and hacks are becoming mundane at this point and many tend to hyperfocus on these two. Understandably so, we have seen around 3.7 billion dollars lost in 2022 and that’s a conservative estimate. It becomes even more conservative if we are to accept the fact that hacks and exploits are only one of the few potential avenues of users losing assets as we have established above.And you guessed it, FTX has been one of those “dollops of surprise”. FTX bankr(un)uptcy has incurred an immense damage to every party imaginable. VCs, FTX Partners, Media Personalities, Web3 as a whole, and Users all have suffered an immense reputational and/or financial damage.However, even the FTX scandal doesn’t stand a chance against one of the most outrageous and damaging incidents of the year passed — Terra Luna calamity. Many claim Luna UST de-peg (divergence of a stablecoin from its 1$ peg) has been the culprit, the catalyst of what had followed after. The Terra Luna incident has caused arguably one of the most damning losses in the history of finances, around $40 billion lost, and it certainly caused cracks in the foundation of the Web3 space.Now, with the two most major incidents mentioned, we can move into analysis itself.General State of 2022 — In RetrospectWe have investigated 359 different incidents that have occurred in 2022. These numbers may not seem so intimidating to some. And they will be correct. Compared to the previous year’s staggering 661 incidents, we have seen an almost twofold decline in incidents related to the loss of assets.188 cases, respectively 52.37 %, were related to hacks and exploits. This is 23.68% higher than 2021’s 152 cases. 133 out of 188 incidents were related to DeFi Protocols or 70.74% respectively.In 2022 we have also been witness to 171 (47,63% of the total number) cases of bankruptcies, exit scams, rugpulls and other fraudulent contrivances of various kinds. Interestingly, this is still lower than the figure from 2021 which tallies at an incredible 509 incidents in total. Out of 171 cases, the majority of them or 90% to be exact (154) were the tried and true classic rugpulls.There were 148 days total in 2022 without any kind of incidents. In turn 217 days out of the year had one or more incidents. The longest streak without any incidents was 6 days, from 19.04 to 24.04. Conversely, the longest streak WITH incidents was 12 days with 27 incidents recorded in total, from 02.06 to 13.06. The major incidents in this period were related to Celsius, Maiar DEX, and EvoDeFi Bridge. The hottest day was recorded on 11.10, 6 different incidents were detected, including QAN Platform Bridge Bridge exploit, Rabby Wallet, Mango Markets, and TempleDAO. Also, 2 rugpull events were recorded on BNB Chain<img src="https://miro.medium.com/v2/resize:fit:1400/0*x8SMGi_X8AstgxBr" />The Biggest Loss in One YearDespite 2021 having a lead in the number of cases throughout the year, 2022 crushes the record with the total losses in one year. A staggering $63.956 billion lost, and cryptocurrency yet again garnering a bad rep and unwanted attention from the regulators.At the moment of writing, about $861 million have been retrieved which accounts for a modest 1.35% of the total number. This number might not have been this imposing if it were not for the Terra Luna debacle which accounted for 62.55% of the total losses.<img src="https://miro.medium.com/v2/resize:fit:1400/0*PFK5GVruHRRG8zEs" />Bankruptcy — The Main Catalyst of DamageBesides Terra Luna, 2022 has been quite lavish in bankruptcy cases which led to users losing their assets or those assets being in the state of limbo. The total of 6 major incidents accounted for $57.694 billion in losses or 90.21% in total. None of these incidents were related to DeFi in the direct sense. 5 out 6 incidents were related to the custodial platforms, reaffirming once again the old adage of “not your keys — not your assets”.<img src="https://miro.medium.com/v2/resize:fit:1400/0*2S_yJJYilQ-7jsfe" />All of the cases mentioned above followed a similar pattern: overweening economic models, founders entangled in fraud and commingling of user assets or both.It’s also worth mentioning that the total number of losses from exploits and hacks has amounted to $3.817 billion or 5,97%. This indicates a 43.55% rise compared to 2021’s $2.659 billion. The top 10 of the biggest exploits account for a total of $2.861 billion or 74.95%.<img src="https://miro.medium.com/v2/resize:fit:1400/0*8KTiExfaqQUsq2Qt" />Cross-Chain Bridge — The Most Exploited DeFi Instrument11 cross-chain bridges were exploited in total, amounting to $1.882 billion. This is 49.3% of all the exploited assets and similar attacks. Case in point, bridges hold the top spot of the most vulnerable Web3 products in 2022.In 2021 there were “only” two incidents of Cross-chain bridges being exploited, tallying the total at $624 million which is one third of the total loss bridges accounted for in 2022.<img src="https://miro.medium.com/v2/resize:fit:1400/0*u-OhR_b5NgwfrZNK" />Previously mentioned DeFi Protocols exploits and hacks incidents have also been prominent in 2022. Hackers received $735 millions or 19.26% of the total sum stolen. The top 10 of the incidents accounted for 71.70% or $527 million of the total losses.<img src="https://miro.medium.com/v2/resize:fit:1400/0*HElwudsAgtfOFiEq" />CeFi and Algo Stablecoins Causing The Most DamageIn contrast to hacks and exploits, fraudulent schemes and manipulations have caused unparalleled levels of losses in 2022, accounting for 94.03% of the total number or $63.956 billions for all security incidents in 2022. Algorithmic stablecoins and custodial platforms have been the most unstable ones, causing a ripple effect throughout the whole Web3 space in 2022 and beyond.9 total incidents related to Algorithmic stablecoins were recorded on seven blockchains, totaling the number of losses at unfathomable $40.288 billions (63% of the total number of losses in 2022). Amongst the “leading” incidents apart from UST are worth mentioning cases with Beanstalk, Cashio, Acala Dollar, FUSD and DEI.2022 vulgarly showcased a current infeasibility of Algorithmic stablecoins, causing some to wholly abandon the idea to nullify any risks. For example, NEAR Foundation fully compensated their USN stablecoins holders and completely scrapped the idea altogether. Some algorithmic stable coins such as SpiceUSD, USDN, USDX have still not been rectified or compensated and continue to trade below their original $1 peg.When it comes to CeFi, 5 of the biggest platforms have incurred on their creditors a substantial $8.696 billion loss or 13.60% of the global annual damage.<img src="https://miro.medium.com/v2/resize:fit:1400/0*JNq8Vap915ELgnIN" />Out of the few biggest crypto creditors, NEXO is the only lending giant that avoided being caught up in the whirlwind that is FTX and Alameda while shirking away from Terra Luna chaos. NEXO managed to adroitly control their risks despite a squall of FUD and even settle their dispute with SEC by paying $45 million which is a far better outcome than bankruptcy.2022 was also a high season for Ponzi Schemes, accounting for $928 million. As expected, rugpulls were the most frequent with 154 incidents in total causing victims a $237 million damage. In contrast to CeFi, the mighties DeFi rugpull has enjoyed a “humble” $60 million damage, and top 10 of all rugpulls accounted for 72.15% of the total sum.<img src="https://miro.medium.com/v2/resize:fit:1400/0*tf2z6FqTcU_SzDyd" />NFT, MetaVerse, and Gaming Losing SteamInterestingly, in the NFT / Gaming / Metaverse segment, a total loss of $ 97 million was recorded across 42 projects, which is only 0.15% of the global loss for 2022. NFTs are no longer of the same interest that we saw in 2021, not only for users, but also for exploiters.<img src="https://miro.medium.com/v2/resize:fit:1400/0*qLRN-llKmekNOIhV" />No Blockchain Remained “Uneventful”The imagination and variety of methods attackers employed knows no bounds, they were looking for any way to appropriate what is yours, and almost no major blockchain remained unscathed. 26 blockchains were affected in 2022, including sidechains, parachains and layer-2 solutions.At the same time, the damage to users of centralized platforms is 19.680 billion dollars, or 30.77% of all losses in the year. This number exceeds the damage of almost any chain by dozens of times (for example, Ethereum 1.068 billion dollars (1.67%), BNB Chain 946 million dollars (1.48%)), of course, except for Terra, mentioned in this analysis more than once, the collapse of which “outshines” anything we have ever seen.The collapse of Terra Luna and the galore of bankruptcies of centralized platforms in 2022 reduced the percentage of Ethereum in the amount of damage by about twenty times compared to previous years. The average share of Ethereum in the amount of losses in previous years reached 34%.As for the number of incidents in the context of each blockchain, in recent years we are less and less aware of the petty scams on the Tron network that we observed a few years ago. For the launch of unaudited tokens, protocols, as well as for rugpulls and other exit scams, BNB Chain stands undefeated.<img src="https://miro.medium.com/v2/resize:fit:1400/0*Xba1zhLh0REuqnMX" />BNB Chain is the undisputed leader in the number of incidents, with 201 incidents in 2022. Most of them are classic rugpulls. A total of 130 rugpulls for a total of $114 million, which corresponds to 84.42% of the total and 48.10% of the total amount of all rugpulls in all chains. Thus, in the BNB Chain network, there were about 2.5 rugpulls a week on average throughout 2022.<img src="https://miro.medium.com/v2/resize:fit:1400/0*O6lF_adMAopyNpf2" />Auditing and Auditing CompaniesThere will be a separate analysis of Smart Contract audits and their impact on the space. Right now we will only briefly touch upon Audits. Of the 359 incidents we tracked in 2022, only 93 were publicly audited. This certainly speaks volumes of audits.The audit market leader, Certik audited 9 projects from the list, 8 of which were successfully attacked by cybercriminals in the amount of about $ 10 million. The ninth project on the list of victims was the infamous Luna / UST link, but one can hardly throw a stone at Certik for auditing the smart contract, because no one hacked Terra Luna. The Terra ecosystem was doomed from the very beginning due to the unstable economic model of the UST stablecoin and the Certik smart contract audit had nothing to do with it.<img src="https://miro.medium.com/v2/resize:fit:1400/0*dVOqYIJVfQS9ZmB0" />As for the activities of Certik in 2022, the company in its annual report reported an increase in the number of audits carried out to an incredible number. To date, Certik has audited at least 5,046 projects in total. Growth for 2022 by 73%, which indicates 2129 inspections carried out in 2022. It’s really impressive, Certik has audited an average of 41 projects every week over the past year. Against this background, 9 incidents per year account for only 0.42% of the total number of Certik audits. You can consider this as a statistical error and accept the fact that there are no equals in the market for Certik auditors at the moment.Afterword and What’s Next for Web3 Security and RegulationsWith the proliferation of bankruptcies, hacks, exploits, frauds and such within the space, it is only reasonable to expect regulators to further crack down and increase the pressure of regulatory measures for Web3.US Regulators are not the only protagonist trying to rein in Web3. MAS (Monetary Authority of Singapore) unveiled their vision of managing digital asset medium. In June, right after the collapse of Terra Luna, US, UK, Singapore, and other jurisdictions published official statements and recommendations in regard to stablecoins.The bankruptcy of FTX/Alameda and several of the largest crypto lenders, led by Genesis Global Capital, has accelerated the process of creating digital asset frameworks by regulators around the world. The European Parliament, the White House (USA), Singapore and Asia Pacific, the UAE, the UK, Brazil and Latin America, to name a few, are calling for increased regulation of the Web3 industry.With a number of high-profile events in 2022, we certainly expect even more moves from regulators in 2023. Emphasis will be placed on the fight against money laundering, hacking and sanctions evasion.HAPI brings together several products, projects and teams whose common mission is to develop and implement new cybersecurity standards used in the development of decentralized networks, as well as in working with existing solutions in the field of blockchain and Web3. We have taken on the role of specialists who will promote the ideas of modern methods of building cybersecurity for projects in the field of Web3&#43;.The HAPI Protocol is the core of the system and our contribution to decentralization. The center of the protocol is an on-chain database with risk scores. Any dApp or service can, through the API or through a direct call to our smart contract, get information about the wallet that is trying to interact with it.To work with a huge amount of data, we created the HAPI Labs department, which analyzed data from all sources to fill in the genesis of the HAPI Protocol database. It grew into something more. Within the framework of HAPI Labs, the Analytics &amp; Research Department began to work. We were able to analyze the work of external cybersecurity solutions, understand their strengths and weaknesses, compare databases and the approaches they use. And we realized at what early stage everyone is, how much work still remains for everyone. We started experimenting and building instruments for ourselves.It is important to understand that we are not trying to replace or change the classic methods of building cybersecurity. Our goal is to complement existing methods with new tools that will solve the problem of the “last mile” security of Web3 solutions. This is the mile that allows attackers to use the very logic of Web3’s openness to launch an attack.%

Annual 2022 Overview of the Web3 Cybersecurity by HAPI Labs

hapione

Other articles published on Apr 13, 2023

CTSI Foundation Reserve Transparency Report — April 2023

Blockchain Association Supports Tornado Cash

80% of Twitter Workforce Fired: Elon Musk Confirms Mass Layoffs

Wombat integrates Wormhole for cross-chain development

Elon Musk Comments on India's Strict Laws and BBC's Modi Documentary

Hong Kong Virtual Bank to Offer Crypto Conversions and Accounts: Report

Join our free newsletter for daily crypto updates!