Crypto Cybercrime Cost Dips to $920M in 2023

Hackers kept pace with the rapid evolution of blockchain systems, stealing about $920 million in the first half of 2023. Cybercriminals attacked smart contracts, phished victims and stole from crypto exchanges in dozens of security incidents through June 30.

See Also: Live Webinar | Reclaim Control over Your Secrets – The Secret Sauce to Secrets Security

“As the application of blockchain expands and penetrates deeper, attackers are becoming more cunning and sophisticated, constantly breaching and exploiting vulnerabilities in the blockchain systems, leading to significant losses,” security firm SlowMist said in a report.

While the quality of attacks seemingly has improved, the amount stolen has fallen significantly so far this year. Losses from cyber incidents decreased 54% year-over-year, and hackers collected $2 billion in stolen cryptocurrency. The number of attacks was about the same. The company identified 185 attacks in 2023, compared to 187 incidents in the first half of 2022.

Like last year, most attacks this year focused on decentralized platforms and bridges. Events involving DeFi platforms, bridges and non-fungible tokens made up 131 incidents, and losses amounted to $487 million.

Wallet security incidents were rare, with just five hacks, but accounted for $109 million in losses.

DeFi applications often rely on smart contracts to execute various functions, and offer privacy and anonymity in a relatively lagging regulatory environment. This makes the sector an “attractive target for hackers,” SlowMist said.

In the first half of the year 111 DeFi security incidents were recorded, including those on Euler Finance and BonqDAO, leading to losses of up to $480 million. The number was only 18% lower than the same period last year, when 93 incidents with losses of $587 million were recorded.

The Ethereum ecosystem suffered the most losses at $276 million, followed by Polygon at $122 million.

“In response to the recurrent emergence of contract security flaws, developers are compelled to engineer smart contracts that are not only robust and secure but also resilient. They must adopt a comprehensive and focused approach, leaving no stone unturned when it comes to safety,” SlowMist said. Third-party audits, vulnerability disclosure and regulatory compliance mechanisms are “crucial shields” to protect DeFi projects from potential attacks, SlowMist said.

Bridges, on the other hand, offer the infrastructure to integrate features such as interoperability between multiple blockchains. This can involve complex protocols and technologies. The complexity, SlowMist said, “leads to a greater probability of vulnerabilities and attacks.”

This year, seven such security incidents occurred, resulting in losses of up to $1.37 million – significantly lower than last year’s first-half figure of $1 billion.

“Whether it is false deposit issues, private key leaks or multiple signature verification problems, the security of bridges is often tied to design logic, a key challenge brought about by their interoperability. If bridges have security vulnerabilities or are subject to attacks, user assets may be at risk of being stolen or manipulated as bridges deal with the locking, unlocking and transfer of assets,” the company said.

SlowMist said companies can mitigate risk by increasing the proportion of signatories. This means that more people need to sign off for transactions to pass through, making it harder for fraudulent ones to get past checks. Third-party audits and bug bounty programs can also help.

NFTs, which are meant to enable unique ownership of digital assets, were the focus of 13 security incidents in the first half of the year, resulting in losses of up to $6.31 million. In more than half of these incidents, hackers exploited vulnerabilities inherent to the projects, while phishing attacks on Discord and Twitter accounted for 46%.

Among the five attacks on wallets, where users can store digital assets on centralized and decentralized platforms, the attack on Atomic Wallet was the biggest so far; hackers stole $109 million. The cause of the June 3 theft is still unknown.

Return of Stolen Funds

Hackers returned $219 million of the $232 million they stole in 10 hacks so far this year.

“The return of stolen assets may become a new trend, whether through a bounty or reasonable negotiation. However, this requires a complete and comprehensive strategy; otherwise, you may once again become prey to attackers,” SlowMist said.

To give their companies the best chance of recovery, victims should notify relevant institutions, contact involved centralized exchanges to freeze funds, and engage with the community, stakeholders and experts for assistance.