Over $2.3 Billion Stolen in Crypto Hacks and Frauds in 2024

by

As a seasoned analyst with years of experience in the tumultuous world of cryptocurrencies, I can confidently say that this year’s crypto hacks and frauds are not just numbers on a screen – they represent hard-earned savings, dreams deferred, and trust shattered. With over $2.3 billion stolen this year, it’s clear that the crypto industry has a long way to go in terms of security.

2021 has seen a staggering total of $2.3 billion in losses due to cyber attacks and frauds within the cryptocurrency sector, underlining the ongoing security concerns plaguing this industry. This amount encompasses 165 separate incidents, representing a significant 40% rise from last year’s numbers.

Although the overall loss is less than the $3.7 billion from 2022, the persistent increase in cyber-attacks suggests that the current defense strategies are still insufficient to combat sophisticated threats within the industry.

Ethereum and Access Control Failures Dominate Losses

Based on Cyvers’ yearly review, it was found that access control weaknesses were the main cause of financial losses, accounting for an astounding 81% of all funds that were stolen.

Despite making up only about 41.6% of all incidents, these instances had a significant impact, highlighting the risks associated with poor security management. This year, Ethereum suffered the most among blockchains, reporting over $1.2 billion in total losses.

A rather disturbing trend this year was the prevalence of “Pig Butchering” scams. These elaborate fraud schemes swindled over $3.6 billion from unsuspecting users, with most activity concentrated on the Ethereum blockchain. 

Cybers emphasized to BeInCrypto that the rise in security breaches through access control and advanced scams such as Pig Butchering highlight the necessity of incorporating AI-driven risk evaluation, transaction verification, and abnormality detection systems. In order to remain one step ahead of attacks that are becoming more intricate and collaborative, security measures must adapt accordingly.

Furthermore, smart contract vulnerabilities were prevalent in the realm of cyberattacks, especially within Decentralized Finance (DeFi). The third quarter of 2024 saw the highest number of losses, totaling approximately $790 million being taken during that timeframe.

To prevent being targeted by hackers, crypto platforms should implement strong security systems for detection and prevention, and integrate these with their crisis management plans. According to Cyvers data, nearly all smart contracts that were successfully hacked had been audited and underwent rigorous testing. However, this level of security seems insufficient, as the researchers at Cyvers pointed out.

On the other hand, Q4 showed noticeably less action, implying a momentary pause in harmful activities.

Biggest Crypto Hacks of 2024: WazirX, Radiant Capital, and DMM Bitcoin

This year’s most significant isolated events served as stark warnings, highlighting the potential weaknesses in the cryptocurrency infrastructure.

Back in July, I faced a heart-wrenching incident when WazirX, my preferred Indian crypto exchange, was hit by a massive hack. The loss amounted to an astounding $234.9 million. The culprits managed to breach the security of the exchange’s multisignature wallets, thereby unlawfully gaining control over the funds.

As an analyst, I’ve observed that multisig wallets, which demand several private keys for transaction validation, are generally considered more secure. Yet, a recent incident has underscored the potential danger lurking in the inadequate implementation of such systems. These oversights can unfortunately lead to devastating security breaches.

WazirX temporarily paused trading and withdrawal activities to carry out thorough security checks and minimize any potential harm. However, the platform is still inoperable as they work towards obtaining necessary regulatory permissions to restart their services.

As a crypto investor, I’m eagerly waiting for the court’s approval of the Scheme at the soonest possible moment. Assuming that all legal and regulatory conditions are met, the platform will be back online for trading post the effective date of the Scheme. [WazirX recently shared this on their platform (originally tweeted by them on X)].

As an analyst, in the month of November, I found myself involved in investigations regarding a cyberattack on WazirX. Indian authorities apprehended a suspect connected to this hack, yet the primary culprit remains at large. Unfortunately, during our investigation, Liminal Custody, the firm tasked with securing WazirX’s digital wallets, fell short in providing crucial information that could have expedited the probe. This oversight has drawn criticism from investigators.

This year, another well-known blockchain lending company, Radiant Capital, suffered a significant setback. In October, they experienced a multi-chain assault that resulted in losses exceeding $50 million.

As a researcher delving into recent cybersecurity incidents, it appears that unauthorized individuals have apparently obtained access to three private keys within our platform, potentially granting them the ability to transfer assets from multiple networks such as Arbitrum, Binance Smart Chain, Base, and Ethereum.

It’s been determined that the recent cyberattack was orchestrated by groups supported by North Korea, who are growing more aggressive in their attempts to penetrate the cryptocurrency market using sophisticated strategies. The hack of Radiant Capital serves as a reminder of the elevated dangers inherent in multi-chain transactions and underscores the immediate need for improved management of private keys.

2024 marked an unfortunate turning point for me as a researcher, particularly when it came to my study of the Japanese cryptocurrency exchange, DMM Bitcoin. In May of that year, we experienced one of the most devastating incidents in our history. Our platform suffered a significant loss of around 4,502.9 Bitcoins, equivalent to approximately $320 million at the time, following an attack on a private key. Despite our tireless efforts to retrieve the stolen assets and reassure our customers, we were forced to announce our closure in December. This event served as a stark reminder of the challenges and risks inherent in the digital currency exchange industry.

Since then, the platform has started moving user accounts over to SBI VC Trade, signaling the end of its services. This event underscores the catastrophic consequences that can arise from insufficient security measures, especially for centralized systems.

CeFi Risks and Emerging Threats from Advanced Technologies

Decentralized financial systems (DeFi), on the other hand, are consistently encountering notable difficulties. Vulnerabilities like single points of weakness, for instance, centralized reserves, and inadequate supervision over crucial management functions make them appealing prey for cybercriminals.

Instead of relying heavily on multi-signature wallets that can be compromised in specific scenarios, this only serves to amplify the associated risks. Cutting-edge technologies like quantum computers and artificial intelligence could potentially make attacks more sophisticated, as they provide means for developing intricate assault strategies.

To stay ahead of constantly changing security threats, it’s crucial to adopt forward-thinking safety measures. Incidents similar to those at WazirX and Radiant Capital might have been prevented if proactive threat detection systems had been employed.

It’s clear that major hacks, like the $235 million WazirX incident and the $50 million Radiant Capital breach, might have been prevented entirely if the companies had employed certain security measures. This could have safeguarded all their funds according to Cyvers.

This year’s significant surge in harmful actions underscores the crucial importance of robust defense mechanisms throughout the cryptocurrency sector. Those platforms that lack real-time surveillance and proactive safety measures are particularly susceptible to hacks, potentially endangering users’ assets.

The industry must prioritize adopting advanced security measures and fostering greater collaboration between stakeholders to address these ongoing threats effectively.

Experts from Cyvers point out that zero-day attacks are unforeseeable as they don’t follow established patterns. Without continuous surveillance, immediate detection systems, and proactive defense tools, it is impossible for crypto platforms to respond promptly and effectively to such unexpected threats.

With the increasing expansion of the cryptocurrency market, so does the creativity of hackers aiming to capitalize on its weaknesses. It has become evident this year that merely responding to threats isn’t enough; proactive measures are now necessary.

Read More

2024-12-21 05:45