Throughout 2023, cybercriminals relentlessly targeted the crypto industry, executing thefts and scams that led to substantial losses, reaching hundreds of millions in stolen cryptocurrency and impacting both individual wallets and platforms.
Given the billions lost to crypto theft in the past decade, it’s unlikely that scams and hacks will vanish soon. Increasingly sophisticated cybercriminal tactics, coupled with insecure platforms and inexperienced investors, contribute to the ongoing vulnerability.
In this article, we delve into a detailed examination of notable crypto hacks that have occurred in 2023 thus far.
-
Mixin Network Hack September 23, 2023, $200 Million
On September 23, 2023, the Mixin Network experienced a significant hack, causing a loss of $200 million. This event has had a profound impact on the cryptocurrency community. Mixin Network, a decentralized messaging and payment protocol, utilizes a multi-signature wallet system for security and scalability. However, using a centralized database to store transaction information made it vulnerable to the attack.
Hackers took advantage of a weakness in Mixin’s database to siphon assets from the main network, including various cryptocurrencies like Bitcoin, Ethereum, and USDT.
After the hack, Mixin Network halted all deposits and withdrawals, initiating an investigation to uncover the attack’s origin. The company plans to resume services once vulnerabilities are identified and fixed, though the exact timeline remains uncertain.
The Mixin Network hack serves as a reminder that even well-established cryptocurrency platforms can be targeted. Cryptocurrency users must take precautions, including storing their funds in a secure wallet.
-
Euler Finance Hack March 13, 2023, $197 Million
On March 13, 2023, Euler Finance, a DeFi lending protocol on Ethereum, fell victim to a flash loan attack. This platform enables users to lend and borrow cryptocurrencies, utilizing mathematical principles to establish non-custodial protocols for high performance on Ethereum and other blockchains.
The hacker exploited a flaw in Euler Finance’s smart contracts, bypassing intended safeguards. This highlights that well-funded and audited protocols can have vulnerabilities. Additionally, the hacker utilized flash loans from other protocols, like Aave and dYdX, to access significant funds without risking their own money.
The hacker borrowed $197 million in various assets, including $136 million in staked ether (stETH), $34 million in USDC, $19 million in wrapped bitcoin (WBTC), and $8.7 million in DAI. They drained these assets from the protocol, repaid the loan, and left Euler Finance empty-handed. The details of how the hacker executed this and their identity remain unclear. Euler Finance’s team is collaborating with security experts and law enforcement and will provide more information later.
-
Multichain Hack July 6, 2023, $126 Million
Approximately $126 million was stolen from the Multichain cross-chain router protocol. The CyVers platform, based on AI, identified the bridge exploit on Thursday, July 6. The team promptly alerted Multichain and the Web3 community, aiming to minimize the risk of further losses.
Hackers removed assets from various token bridges, extensively depleting Multichain’s Fantom bridge, including wBTC, USDC, USDT, and some altcoins. Although Multichain didn’t officially confirm the hack’s cause, Certik, a blockchain security firm, investigated and suggested a compromised private key as the likely culprit.
Multichain verified the assets were sent to an unauthorized address, but the exact nature of the incident remains unclear. As a precaution, they advise users to suspend all services. CyVers speculates the exploit might be a hack, rug pull, or an insider job involving a compromised private key.
-
BonqDAO Hack February 01, 2023, $120 Million
On February 1, 2023, BONq DAO, an Ethereum-based lending platform, experienced a major breach, leading to an estimated loss of $120 million. BONq DAO operates as a non-custodial, decentralized lending platform enabling users to secure loans against their digital assets.
The attack occurred through an oracle manipulation, influencing the price of AllianceBlock’s $ALBT tokens using the Tellor Oracle. The attacker took advantage of a bug in BonqDAO’s price feed smart contract, enabling them to alter the $ALBT token price and borrow 100 million $BEUR stablecoins.
The attack was possible due to a flaw in the smart contract’s price feed, which provides the Bonq protocol with ALBT price information from the Tellor Oracle, resulting in a significant financial loss.
-
HECO Bridge and HTX Hack November 23, 2023, $115 Million
Entrepreneur Justin Sun’s entities, HTX exchange, and Heco Chain faced major cyberattacks, resulting in a significant $115 million loss. The hackers exploited vulnerabilities in blockchain bridges, leading to the theft of various cryptocurrencies like USDT and Ether.
HTX took action by strengthening security, temporarily pausing services, and pledging compensation for affected users. The team is actively looking into the attack’s source and taking swift measures to safeguard user holdings.
-
Atomic Wallet Hack June 03, 2023, $100 Million
Atomic Wallet, a non-custodial cryptocurrency wallet, experienced a significant hack on June 3, 2023. The attackers stole over $100 million in cryptocurrency by exploiting a vulnerability in the wallet’s code to take users’ private keys. With these keys, the attackers could sign transactions and proceed to steal the cryptocurrency.
The hack impacted at least 5,500 Atomic Wallet users. However, the actual number of affected users might be higher since Atomic Wallet hasn’t disclosed a complete list of affected addresses.
Atomic Wallet responded to the hack by fixing the vulnerability in its code, initiating efforts to retrieve the stolen funds, and providing compensation to affected users.
-
CoinEx Hack September 12, 2023, $70 Million
CoinEx, a cryptocurrency exchange in Hong Kong, lost over $70 million in tokens due to compromised private keys. The unauthorized transfer of funds from CoinEx’s hot wallets signals a significant security breach, and initial evidence suggests a potential compromise of private keys.
CoinEx is still investigating the individuals behind the security breach. Some blockchain security firms suspect North Korean “Lazarus Group” hackers are responsible. The exchange is also in communication with the hackers to explore a potential resolution.
-
Curve Finance Hack July 30, 2023, $60 Million
On July 30, Curve Finance suffered a hack where hackers exploited a reentrancy vulnerability in an older version of the Vyper compiler, resulting in the draining of over $60 million from the protocol. This affected various pools, including $13.6 million from Alchemix’s alETH-ETH pool, $11.4 million from JPEGd’s pETH-ETH pool, and $1.6 million from Metronome’s sETH-ETH pool. Curve itself lost about $24 million, and other protocols like Alchemix, Metronome, and JPEG’D, reliant on Curve for liquidity, also faced significant fund losses.
The hacker gave back $12.7 million, returning 4,820 alETH and 2,258 ETH to Alchemix Finance. While the fund return is usually positive, the accompanying message in one transaction conveyed a sense of superiority, stating “I’m smarter than all of you.” The hacker clarified that the refund wasn’t out of fear of getting caught but to prevent harm to the project.
To find the hacker, Curve and other impacted protocols offered a 10% bug bounty on August 3, amounting to over $6 million. Even though the hacker returned assets to Alchemix and JPEGd, refunds to other affected pools remained incomplete. Since the deadline has passed, anyone who can identify the attacker will be rewarded with assets worth $1.85 million.
-
Kyber Network Hack November 22, 2023, $54.7 Million
Kyber Network faced a significant exploit on November 22, causing a loss of over $54.7 million in digital assets and funds. This event raised concerns about the security of decentralized platforms in the DeFi space.
This attack stood out because it was exceptionally complex. The attacker had to carefully perform a specific series of on-chain actions to exploit a weakness in Kyber Network’s system.
Kyber Network halted deposits, initiated an inquiry, reached out to concerned parties, and engaged in discussions with the attacker to aid users in recovering funds. This includes providing a 10% reward to the hacker as part of the negotiation.
-
Stake.com Hack September 04, 2023, $41 Million
Stake.com, the biggest crypto casino globally, experienced a hack leading to a $41.3 million loss. The platform suspended deposits and withdrawals, causing inconvenience for users unable to access their funds. Cyvers, a crypto-security firm, identified irregular transactions associated with Stake.com’s hot wallet.
Most of the stolen funds, $17.8 million, were taken from Stake.com’s hot wallet on the Binance Smart Chain. The remaining funds were withdrawn, with $15.7 million on Ethereum and the last $7.8 million on Polygon. The recovery of all funds by Stake remains uncertain after this incident.
-
CoinsPaid Phishing Scam July 22, 2023, $37 Million
CoinsPaid, a crypto payment company, faced a $37 million attack by suspected North Korean hackers from the Lazarus Group. While the company lost funds from its reserves, customer deposits remained unaffected. CoinsPaid apologized for the incident’s impact on its platform and thinks the hackers expected a more successful outcome.
Following the attack, CoinsPaid improved security measures and resumed transactions. The Lazarus Group is known for participating in significant cryptocurrency thefts, and there are claims that some stolen funds supported North Korea’s nuclear weapons program.
-
Kronos Research Hack November 19, 2023, $26 Million
Kronos Research, a crypto trading firm based in Taipei, recently faced a security breach resulting in a substantial $26 million hack. The incident was attributed to unauthorized access to Kronos Research’s API keys. This breach had broader implications, leading to the temporary suspension of trading activities on the Woo network.
The Woo network is a crypto trading platform that heavily relies on Kronos Research, making the impact more widespread within the crypto trading ecosystem. The security breach and subsequent halt in trading activities have raised concerns about the vulnerabilities in crypto trading platforms and the need for robust security measures to safeguard digital assets.
The firm assured stakeholders of its stability and promised to cover all losses without affecting partners. However, detailed information about the hack was not provided.
-
Bitrue Exchange Hack April 14, 2023, $23 Million
Bitrue, a centralized exchange in Singapore, suffered an exploit resulting in around $23 million in token losses. Although Bitrue acted swiftly to prevent further exploitation, the attackers managed to steal $23 million from the hot wallet, withdrawing digital assets like ETH, QNT, GALA, SHIB, HOT, and MATIC.
For security reasons, the platform halted withdrawals until April 18, and it’s important to note that only one hot wallet was impacted. Bitrue assured that all users affected by the theft would receive full compensation.
-
Safemoon Hack March 28, 2023, $9 Million
SafeMoon, a DeFi platform on the Binance Smart Chain, experienced a major security breach on March 28, 2023, leading to a loss of nearly$9 million. The incident occurred due to an access control vulnerability in the platform’s burn() function, unintentionally introduced during a smart contract upgrade by the SafeMoon Deployer.
The attacker exploited the vulnerability to manipulate the token’s value, causing significant financial losses for both SafeMoon and its users.
The exploiter and Safemoon developers reached an agreement, resulting in a return of $7.1 million, and the exploiter kept 20% as a bug bounty. This incident highlighted the need for thorough smart contract audits and community vigilance to avoid future exploits.
-
dYdX Hack November 17, 2023, $9 Million
dYdX Exchange experienced a sophisticated hack on November 17, resulting in a $9 million loss from its Version 3 insurance funds. The attack focused on the Yearn Finance token market, an unconventional choice with lower trading volumes, making it more effective.
The exploit manipulated the market, creating unusual trade surges and causing substantial losses covered by the insurance fund, depleting 40% of its reserves. However, personal funds remained safe, and investigations are ongoing to determine the full impact of the hack.
The team tried to reduce the impact by adjusting margin ratios for $YFI, but the hacker withdrew a significant amount of USDC just before the crash, suggesting a deliberate manipulation to deplete funds.
-
LendHub Hack January 12, 2023, $6 Million
LendHub, a decentralized lending platform on Binance Smart Chain (BSC) and Huobi Eco Chain (HECO), encountered a major security breach on January 12, 2023. The exploit, disclosed on LendHub’s Twitter account, led to a significant loss of around $6 million.
This incident was mainly caused by a vulnerability due to the presence of both an old, retired IBSV cToken and a newly introduced token in the platform’s market.
The old IBSV token, still present in the old market, had the same price as the new IBSV, creating an exploitable loophole. The exploiter used this oversight to manipulate the lending protocol, resulting in significant financial loss for LendHub.
LendHub is committed to a thorough investigation. They started by seeking help from crypto exchanges to locate the asset and reached out to security firms to expedite the inquiry.
-
Deus Finance Hack May 05, 2023, $6 Million
Deus Finance, a DeFi protocol, suffered a security breach, losing over $6 million in its stablecoin DEI. PeckShield, a blockchain security firm, reported that hackers took advantage of a vulnerability in the Binance Smart Chain (BSC) on May 5.
A bot initiated a hack on bscted, causing over $1.3 million in damages. Attackers also targeted the Arbitrum Network, with Arb/ETH deployments costing over $5 million. Twitter mentioned that the root cause of the token contract issue was a functional implementation error. The protocol acknowledged the attack, suspended all contracts, and burned DEI tokens to prevent additional harm.
Reacting to the attack, the protocol halted all contracts and burned DEI tokens to avoid more damage. This isn’t the first time Deus Finance faced a hack; in March 2022, a flash-loan attack led to over $3 million in losses in Dai (DAI) and Ether (ETH).
-
Trust Wallet Hack February 08, 2023, $4 Million
During a daring heist in Rome, Italy, an elusive criminal organization successfully stole $4 million worth of USDC from the Trust Wallet. The masterminds behind this theft employed social engineering to carry out their audacious exploit.
The hackers tricked the unsuspecting victim into moving funds from a multi-sig Trust wallet, which needed multiple signatures, to a single Trust wallet they controlled. Using a digital non-disclosure agreement and fake customer information, the thief deceived the victim with seemingly harmless documents.
Trust Wallet suspects that the fake NDA might have contained malware, enabling the criminal to steal the cryptocurrency.
-
Balancer Hack September 19, 2023, $238K
Balancer, a DeFi automated market maker (AMM) protocol on Ethereum, cautions users to steer clear of its website due to an attack on its frontend. Users are advised to refrain from interacting with the Balancer user interface until further notice. This marks the second attack on Balancer in less than a month, following a previous vulnerability that led to an exploit of around $1 million. Users are recommended to exit affected pools to prevent additional exploits.
Balancer advised its users to avoid using the Balancer UI until further notice. This incident underscores the importance of enhancing security measures in the DeFi ecosystem and thoroughly auditing smart contracts.
The Balancer attack is part of a trend of security breaches in the DeFi space.
As DeFi grows, it attracts more attention from hackers. To safeguard protocols and users, the industry must take proactive security measures.
In Conclusion,
- The connection between social media and cryptocurrencies has opened doors for scams. Smart contract vulnerabilities and the substantial amount of assets held on crypto exchanges increase the risks of unauthorized access and losses.
- Users are advised to stay alert, use advanced security tools like hardware wallets, and enable two-factor authentication. It’s crucial to carefully evaluate DeFi platforms and investments to protect against potential threats and maintain a secure crypto environment.
Disclaimer: This article is intended solely for informational purposes and should not be considered trading or investment advice. Nothing herein should be construed as financial, legal, or tax advice. Trading or investing in cryptocurrencies carries a considerable risk of financial loss. Always conduct due diligence.
If you would like to read more articles (news reports, market analyses) like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
