Last week, we published the ‘SlowMist Blockchain Security and Anti-Money Laundering Annual Report’ for 2023. In the following article , we will divide the report into four articles for interpretation, dissecting the key contents of the report to help readers understand more comprehensively and deeply the key security challenges and opportunities in the current blockchain ecosystem.This article mainly focuses on the current security landscape of the blockchain ecosystem.<h2 id="header-0">Current Security Landscape</h2>Amidst the global economic unrest influenced by macroeconomic and geopolitical tensions, along with the remnants of various catastrophic events from 2022, the blockchain industry has also suffered incredible turmoil. In the past year, several crypto-friendly banks have collapsed, compounded by a series of security attacks initiated by North Korean hacker group Lazarus Group and various phishing collectives like Wallet Drainers. These incidents have further highlighted the lack of user security awareness and the inadequacy of regulatory policies.According to statistics from SlowMist’s blockchain hacking incident archive (SlowMist Hacked), there were a total of 464 security incidents in 2023, with losses amounting to $2.486 billion. In comparison, there were 303 incidents in 2022, with losses around $3.777 billion. Although there was a 34.2% decrease in losses year-over-year, the number of security incidents increased by approximately 53.13%. Despite the reduction in losses, the number of security incidents is on the rise.<img src="https://miro.medium.com/v2/resize:fit:700/0*cmVBtZ0Z5u4v31cf" />Next, we will interpret the 2023 blockchain security situation from three aspects: project hacks, blockchains, and cause of incidents.Project HacksIn terms of project hacks, DeFi (Decentralized Finance) is the sector with the most security incidents and the greatest losses. The development of DeFi has brought new innovations and opportunities, but it has also led to more potential risks and attack surfaces. Additionally, DeFi projects, due to their significant capital scale and user base, have become attractive targets for hackers.In 2023, there were a total of 282 DeFi security incidents, accounting for 60.77% of all incidents, with losses amounting to $773 million. Compared to 2022, which saw 183 incidents with losses around $2.075 billion, the losses from DeFi security incidents in 2023, although reduced by 62.73%, saw an increase in incident numbers by 54.64%. This highlights that the DeFi sector still faces severe challenges in preventing and handling security issues.<img src="https://miro.medium.com/v2/resize:fit:700/0*V-Of-_BJabvSh_7G" /><img src="https://miro.medium.com/v2/resize:fit:700/0*IYyfi3ME1rb54RJ5" />Losses by BlockchainFrom a blockchain perspective, Ethereum, being the preferred platform for numerous smart contracts and decentralized applications, has always been the primary target for hackers. This resulted in the greatest losses of approximately $487 million. Following Ethereum is Polygon, a Layer 2 scaling solution built on Ethereum, which also faces significant security threats. There were six security incidents in the Polygon ecosystem, leading to losses of $123 million. Notably, the non-custodial lending platform BonqDAO and the crypto infrastructure platform AllianceBlock were compromised due to vulnerabilities in BonqDAO’s smart contracts, leading to a loss of around $120 million.<img src="https://miro.medium.com/v2/resize:fit:700/0*oHI6NPrqbkFA5yEi" />Cause for Incidents<img src="https://miro.medium.com/v2/resize:fit:700/0*LFg0Xkotn7YH3vx2" /><ul><li>In 2023, there were 117 security incidents caused by project operators absconding, resulting in losses of about $83 million. Among these, the Base ecosystem suffered the highest losses, reaching $32.5 million, followed by the BSC ecosystem with losses of $23.05 million.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/0*o4tA9RUJJS3-tzuC" />Investors often find it difficult to recover losses after project operators abscond. Absconding is a form of active malfeasance by project operators, such as initiating initial liquidity, pumping the price, and then withdrawing liquidity, or leaving backdoor codes in the project.<img src="https://miro.medium.com/v2/resize:fit:700/0*1x_xkXo89j9o_kMi" /><ul><li>There were 57 incidents in 2023 due to contract vulnerabilities, resulting in losses of about $75.82 million. However, the exploitation of contract vulnerabilities often involves tactics like flash loan attacks and price manipulation. In 2023, there were 34 flash loan attacks initiated by hackers, causing losses of about $225 million; price manipulation attacks numbered 14, causing losses of about $140 million.</li></ul>Contract vulnerabilities usually occur due to insufficient review of the contract code. Continuous auditing of contracts is essential. Furthermore, development teams should adopt the best security practices. Our Security Team has made it publicly available the <a href="https://github.com/slowmist/SlowMist-Learning-Roadmap-for-Becoming-a-Smart-Contract-Auditor" rel="noopener noreferrer nofollow">Smart Contract Security Audit Skill Tree on GitHub</a>, <a href="https://github.com/slowmist/Web3-Project-Security-Practice-Requirements" rel="noopener noreferrer nofollow">Web3 Project Security Practice Requirements</a>, and <a href="https://github.com/slowmist/solana-smart-contract-security-best-practices" rel="noopener noreferrer nofollow">Solana Smart Contract Security Best Practices</a> for those interested in reading more.<ul><li>In 2023, there were 70 incidents of various entity accounts being hacked. With the rapid development of Web3, attacks against users and project operators have become increasingly frequent, especially those targeting media platforms like Discord and Twitter.</li></ul>Hackers often impersonate administrators after gaining access and post phishing links to induce users to authorize and transfer assets. It’s recommended that project operators use two-factor authentication, set strong passwords, and stay alert to traditional network attacks and social engineering attacks.<ul><li>According to the SlowMist blockchain hacked incident archive, there were 11 major scams in the blockchain industry in 2023. Among them was the JPEX incident in Hong Kong, which lured investors with the promise of “low risk, high return”. As of December 18, 2023, the Hong Kong police had arrested 66 people and received reports from 2,623 victims, involving about HK$1.6 billion. It is alleged that the JPEX collapse could become the largest financial fraud case in Hong Kong’s history.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/0*4maIyJXs4b10ollj" /><h2 id="header-1">Recommendations to Stay Secure</h2>For project:- Continuously audit smart contracts to ensure the security and stability of the code, preventing contract vulnerabilities.- Introduce multi-level defense measures in contracts, including permission controls, safety checks, and insurance mechanisms, to minimize the risk of attacks.- Establish an emergency response mechanism to promptly address attacks and control the extent of losses.- Adopt security practices such as two-factor authentication and strong passwords to reduce the risk of account breaches.For individual users, following these safety rules and principles can avoid most risks:Two Key Safety Rules:1. Zero Trust: Maintain skepticism at all times.2. Continuous Verification: Trust needs to be backed by the ability to verify your doubts and turn this into a habit.Safety Principles:- Verify online information using at least two sources, cross-checking and maintaining skepticism.- Diversify your assets — don’t put all your eggs in one basket.- For wallets holding significant assets, avoid unnecessary updates. If it works, it’s sufficient.- What you see is what you sign: Ensure that what you’re signing is exactly what you expect, to avoid regret later.- Pay attention to system security updates and act immediately when they are available.- Avoid downloading untrustworthy programs.Recommended readings: <a href="https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook/tree/main" rel="noopener noreferrer nofollow">Blockchain Dark Forest Self-Guard Handbook</a>.To download the complete report:<a href="https://www.slowmist.com/report/2023-Blockchain-Security-and-AML-Annual-Report%28EN%29.pdf" rel="noopener noreferrer nofollow">https://www.slowmist.com/report/2023-Blockchain-Security-and-AML-Annual-Report(EN).pdf</a>

Analysis of the SlowMist 2023 Blockchain Security & AML Report

Table of Contents

SlowMist

Other articles published on Jan 15, 2024

Google Cloud Joins Flare Network as a Validator, FLR Surges 37%

Bitcoin ETF Launch Sparks $1 Million Prediction Amid Market Surge

Deciphering Bitcoin’s Trajectory: An Analyst’s Insightful Perspective

HugeWin Announces New Crypto Casino

Crypto investment products get $1.18b inflows amid spot Bitcoin ETF launch

Cosmos Ecosystem Chains Affected By CosmWasm Vulnerability

Join our free newsletter for daily crypto updates!