DeFi

Ronin

Nexera

WazirX

<p>The third quarter saw the smallest losses from hacks that the industry has seen in the last three years, according to a report by cybersecurity company Hacken. About $460 million was stolen across 28 incidents. Still, the recovery rate was the lowest in recent years at only 5%. Hacken breaks down this data along with the broader state of Web3 security in Q3. It also discusses major types of attacks, the most affected project categories and strategies for mitigation.&nbsp;</p>
<div style="background-color: #f0f0f0; padding: 8px 21px; font-weight: bold; color:#253137;"><a href="https://s3.cointelegraph.com/Hacken_Q3_2024_Security_Report.pdf" rel="noopener noreferrer nofollow" style="color: #253137;" target="_blank">Download a full version of the report for free here</a>
</div>
<h2 id="access-control-attacks-remain-the-most-detrimental">Access control attacks remain the most detrimental</h2>
<p>Exploits of access control mechanisms accounted for $316 million, or almost 70% of the total funds stolen in crypto hacks in Q3. The perpetrators of such attacks gain control over the keys that control smart contracts. Once in control of the keys, they can withdraw funds from the contract to their own wallets or upgrade the proxy contract implementation to activate the withdrawal function.</p>
<p><img alt="Losses across various attack types in 2024" src="https://s3.cointelegraph.com/storage/uploads/view/1b39261fa3266cab4ceac46977707618.png" title="Losses across various attack types in 2024"></p>
<p style="text-align: center;"><em>Losses across various attack types in 2024. Source: Hacken</em></p>
<p>Smart contract vulnerabilities were second in Q3 losses. Smart contracts are sometimes vulnerable to reentrancy attacks, which involve calling the withdrawal function multiple times while the contract’s state fails to properly update before a withdrawal of funds is executed. This type of attack is especially detrimental for protocols with liquidity pools, as they can be drained by a series of multiple recursive calls in a single transaction. Minterest suffered from one of the three reentrancy attacks in Q3, suffering a $1.46 million loss. The execution of the hack is described in detail in the report.&nbsp;</p>
<div style="background-color: #f0f0f0; padding: 8px 21px; font-weight: bold; color:#253137;"><a href="https://s3.cointelegraph.com/Hacken_Q3_2024_Security_Report.pdf" rel="noopener noreferrer nofollow" style="color: #253137;" target="_blank">Download a full version of the report for free here</a>
</div>
<h2 id="centralized-exchanges-endured-the-biggest-losses">Centralized exchanges endured the biggest losses</h2>
<p>Centralized exchanges were the most-exploited projects by amount of funds. The <a href="https://cointelegraph.com/news/indian-crypto-exchange-wazirx-hack-235m" rel="noopener noreferrer nofollow">biggest hack was to WazirX India</a> on July 18, when its Ethereum multisig wallet was compromised. The hacker manipulated the exchange’s multisig wallet by obtaining three signatures from employees and one from Liminal, a digital asset custody provider. With four signatures out of six, the actor was able to drain over $230 million. The stolen funds are yet <a href="https://cointelegraph.com/news/indian-crypto-exchange-wazirx-funds-hack" rel="noopener noreferrer nofollow">to be recovered</a>. The exchange and Liminal ran independent audits but found no security breaches, which has sparked debate about a possible inside job.</p>
<p>Mostly due to the magnitude of the WazirX hack, exploits of centralized exchanges recorded the highest losses in Q3. The hacks of <a href="https://cointelegraph.com/learn/what-are-defi-yield-aggregators-and-how-do-they-work" rel="noopener noreferrer nofollow">yield aggregators</a> and <a href="https://cointelegraph.com/learn/risks-of-using-cross-chain-bridges" rel="noopener noreferrer nofollow">cross-chain bridges</a> come next in the statistics. Still, bridges were only compromised on three occasions. One victim was Ronin Bridge, but luckily for its users, <a href="https://cointelegraph.com/news/ronin-bridge-hack-upgrade-script-verichains" rel="noopener noreferrer nofollow">a white hat MEV bot</a> front ran the malicious transaction and returned the funds shortly afterward.</p>
<p><img alt="Losses to crypto hacks across different project types" src="https://s3.cointelegraph.com/storage/uploads/view/e200379422c7d481823dbc581ea43974.png" title="Losses to crypto hacks across different project types"></p>
<p style="text-align: center;"><em>Losses to crypto hacks across different project types: Source: Hacken</em></p>
<p>Lending and borrowing protocols were deprived of $19.6 million in Q3. Even industry leader Aave fell victim to an exploit of a periphery contract, which resulted in a loss of $56,000. The attack on Aave was executed in one transaction, meaning that it could not have been spotted or stopped. The majority of decentralized finance (DeFi) exploits involve multiple transactions, such as a malicious proxy update or consecutive withdrawals from a pool. The consequences of such exploits can be mitigated if the state of smart contracts is constantly monitored and action is taken immediately.&nbsp;</p>
<p>The Automated Incident Response Strategy <a href="https://extractor.live/" rel="noopener noreferrer nofollow" target="_blank">system</a> developed by Hacken can be customized to provide such protections. It can be triggered to pause a smart contract if certain conditions are met or to freeze funds withdrawn in a suspicious transaction. According to Hacken, about 28.7% of the losses from DeFi hacks could have been prevented if the target companies had used monitoring and automated incident report systems.&nbsp;</p>
<div style="background-color: #f0f0f0; padding: 8px 21px; font-weight: bold; color:#253137;"><a href="https://s3.cointelegraph.com/Hacken_Q3_2024_Security_Report.pdf" rel="noopener noreferrer nofollow" style="color: #253137;" target="_blank">Download a full version of the report for free here</a>
</div>
<h2 id="the-nexera-exploit-a-case-study">The Nexera exploit — a case study</h2>
<p>A scammer exploited the DeFi protocol Nexera and drained 47.2 million NXRA, the platform's native token. He managed to swap 15 million NXRA before the team was able to pause the contract. The attack resulted in a loss of $1.5 million.&nbsp;</p>
<p>With the Automated Incident Response Strategy by Hacken, the pausing function could have been programmed to activate immediately when the proxy was upgraded. As soon as the pause function is activated, no tokens can be transferred, meaning that the stolen funds cannot be swapped. Five other such cases in which the Automated Incident Response strategy would have worked are discussed in the report. These include a reentrancy attack on Penpie causing $27 million in losses, and a Ronin bridge exploit resulting in $12 million siphoned from the protocol.&nbsp;</p>
<p><img alt="Hacks that could have been averted with the Automated Incident Response Strategy" src="https://s3.cointelegraph.com/storage/uploads/view/0eec8772bc0849d0cbb91cfb30593f92.png" title="Hacks that could have been averted with the Automated Incident Response Strategy"></p>
<p style="text-align: center;"><em>Hacks that could have been averted with the Automated Incident Response Strategy. Source: Hacken</em></p>
<p>The opinions expressed in this article are for general informational purposes only. They are not intended to provide specific advice or recommendations for any individual or on any particular security or investment product.</p>

Hackers got away with $440M in 28 exploits in Q3: Report

Table of Contents

Cointelegraph

Other articles published on Oct 4, 2024

HBO hints It has identified Bitcoin’s creator: What does this mean for the market?

Will Shiba Inu Memecoin Rally Soon?

SEC Files Appeal in XRP Lawsuit Amid Controversial Verdict

Traders Urged to Stay Calm as BTC's Uptober May Only Start After 19th

Ripple As A Major Competitor to SWIFT

Ripple Mints 42 Million RLUSD In 24 Hours: XRP As An Auto-Bridge Asset

Join our free newsletter for daily crypto updates!