Author: Vishal Chawla, The Block; Translated by: Songxue, Golden Finance
The crypto industry has faced challenges with hackers and protocol vulnerabilities over the years.
This trend continues until 2023. However, there is good news: the number of hacks has dropped by more than 50% year-on-year.
Data from TRM Labs shows that the amount of cryptocurrency funds stolen by hackers this year is estimated at $1.7 billion, less than half of the $4 billion recorded in 2022. Although overall losses have decreased, individual projects have still had large sums of money stolen.
This year has seen a number of high-profile hacks affecting prominent entities such as Multichain, Euler Finance, Mixin Network, and Atomic Wallet.
Then in November, three crypto projects associated with Tron founder Justin Sun — Poloniex, HTX, and Heco Bridge — lost a total of more than $200 million in a series of breaches.
A recurring issue in many of these incidents involves private key vulnerabilities that allow criminals to access user funds. Throughout the year, North Korean hacker group Lazarus carried out multiple attacks, resulting in a total loss of more than $300 million.
This article takes a deep dive into the biggest cryptocurrency thefts of the year, examining the projects affected and the factors that led to each attack.
Mixin Network — $200 million
Hong Kong-based crypto project Mixin Network has suffered one of the largest crypto breaches of the year.
On September 23, the company had to abruptly halt operations after hackers stole a staggering $200 million from users’ hot wallets.
Mixin reported that “its cloud service provider’s database was hacked.” While the company did not provide further explanation, analysts believe the affected database may hold the private keys of user accounts — the mnemonic phrases that unlock their cryptocurrency holdings.
Euler Finance — $197 million
Few events have captured DeFi’s audacity and fragility as vividly as the March 2023 attack on lending protocol Euler, when $197 million worth of cryptocurrency disappeared in a bizarre ploy.
Who is the culprit? A hacker exploited a vulnerability in the lending protocol by manipulating the exchange rate between eDAI and dDAI, the stablecoins issued by Euler. By repeatedly calling the "donateToReserves" function with DAI, the attacker was able to drive up the eDAI/dDAI rate.
They used flash loans (a loan that is repaid in the same Ethereum transaction) to upset the balance of the liquidity pool holding the two tokens. This triggered the liquidation of borrowers’ positions denominated in dDAI, siphoning funds from the protocol.
But the story doesn’t end there. Later, the attackers returned the stolen funds in a move known as a “white hat.” With the exception of a small portion of the loot, nearly all of the bounty was returned to the team, providing relief to the victims.
Multichain — $125 million
In July, the cross-chain bridge Multichain was reportedly exploited on different blockchains it supports, with $125 million worth of cryptocurrencies being exploited, with Fantom receiving the largest amount of funds. This happened shortly after the bridge was suspended due to “multiple issues due to unforeseen circumstances.”
To date, the exact cause of the hack remains unclear as no conclusive post-mortem analysis report has been provided.
As security firm Halborn explains, one possible factor suggests that the private keys of the bridge’s smart contract were compromised by hackers exploiting a bug in its code.
There are concerns that the team itself may be responsible for the incident, and the disappearance of Multichain CEO Jun Zhao before the hack has exacerbated such concerns.
Prior to this activity, he was arrested by Chinese authorities and it was revealed that he had exclusive control over the protocol’s funds, contradicting Multichain’s previous claims of decentralization. Multichain is currently no longer operational.
Poloniex — $120 million
In November 2023, hackers suspected of being affiliated with North Korea’s Lazarus Group stole a staggering $120 million from Poloniex’s hot wallets, most likely by gaining access to private keys.
The immediate consequences were predictable: trading and withdrawals stopped. The exchange said it would compensate affected users. Poloniex has been operating as a centralized exchange since 2014. Tron founder Justin Sun acquired the exchange in 2019.
In June 2023, the user wallet accounts of the crypto wallet application Atomic were emptied. Hackers stole assets worth more than $100 million from approximately 5,500 users. The main reason behind the incident remains unclear as Atomic has not yet provided an explanation.
It is suspected that the breach may have been caused by a code vulnerability flagged by security analysts at Least Authority a year before the incident. Analysts at SlowMist also discovered the potential problem.
On-chain analytics firm Elliptic tracked more than 5,500 targeted wallets and said North Korean hacker association Lazarus Group was behind the attack.
In August, a group of victims in Russia filed a class-action lawsuit against the company behind Atomic, alleging that it failed to protect user assets. A few months later, the company responded with a motion asking a U.S. court to dismiss the lawsuit.
Heco Bridge, HTX — $99 million
In November, a large-scale vulnerability occurred in the main cross-chain bridge on Heco (the blockchain built by the HTX exchange). The perpetrators took control of the main smart contract or operator account of the cross-chain bridge, resulting in the theft of more than $86 million in various cryptocurrencies.
Initial analysis suggests that the intruder manipulated the smart contract code of the cross-chain bridge and circumvented its security protocols. This manipulation allowed the hacker to mint unauthorized tokens (through the bridge contract), which were then exchanged for Ethereum and subsequently transferred out of the cross-chain bridge.
HTX (formerly Huobi) also lost $12 million from its hot wallet. Justin Sun, HTX advisor and Tron founder, said that a white hat bounty reward had been offered to the attacker. The offer seemed to have been accepted, and the platform recovered $8 million (of the $12 million that was stolen).
Curve – $73 million
In July, Curve Finance, one of the largest decentralized exchanges in DeFi, was attacked. Due to a vulnerability in the Vyper programming language it used, multiple liquidity pools on the platform were exploited, resulting in hackers stealing approximately $73 million in various crypto assets.
The security flaw allowed an attacker to exploit its smart contract logic to maliciously drain funds. This involved a reentrancy attack, where a hacker manipulated the smart contract to withdraw funds in rapid succession.
The attack was facilitated by a malfunctioning reentry protection inside Vyper. Projects built on top of the Curve Factory pool, including JPEG’d, Metronome, and Alchemix, were affected.
The Curve team quickly fixed the vulnerability and ultimately recovered approximately $50 million (70% of the stolen funds), alleviating the concerns of many users and stakeholders. The recovered funds were either returned directly by the ethical hackers involved or held with the help of MEV bot operators such as c0ffeebabe.eth.
CoinEx – $55 million
In September, Hong Kong-based centralized cryptocurrency exchange CoinEx reported a massive hack in which hackers infiltrated the exchange’s hot wallets designed for instant trading and absconded with more than $55 million in various cryptocurrencies.
The North Korean group Lazarus is again suspected of involvement in this incident. Investigators have found a connection between the CoinEx hack and another theft from the gambling platform Stake.com, which the FBI says is linked to the Lazarus hacker group. Analysis showed that the wallet address that received the stolen funds from Stake.com had direct interaction with the wallets of the CoinEx hackers.
KyberSwap — $54 million
Decentralized exchange (DEX) aggregator KyberSwap was exploited via an attack on its Elastic platform to steal approximately $54 million in cryptocurrency.
The November 22 attack stemmed from a vulnerability in the tick interval boundaries of Kyber’s centralized liquidity pool, allowing the perpetrators to artificially double liquidity and drain its value.
In a negotiation attempt, Kyber offered the hacker a 10% white hat bounty in exchange for returning the funds. However, the hacker was not interested in accepting the bounty and made other demands in a strange on-chain message, including asking the team to take full control of the project.
The team alone recovered $4.7 million in funds that were misappropriated by a third-party MEV robot.
Stake.com — $41 million
Cryptocurrency-based gambling platform Stake.com fell victim to a possible exploitation of its wallet’s private keys. On September 4, 2023, an estimated $41 million worth of cryptocurrency was stolen from the platform.
The FBI attributed the attack to Lazarus in a report based on an analysis of addresses on the Ethereum, BNB Chain, and Polygon networks that received the stolen funds from Stake.com.