Crypto Losses From Hacks and Scams Drop to $413M in Q3

According to the latest report from Immunefi, a Web3 bug bounty and security services platform, the crypto sector lost $413 million to hacks and scams during the year’s third quarter.

This reflects a 28% decline from the $573 million lost in Q2 and a 40% drop compared to Q3 2023, when $686 million was stolen. Year-to-date losses due to hacks and fraud have surpassed $1.3 billion, a 4% decrease from the same timeframe last year, according to Immunefi data.

Cybercriminals Target DeFi

Decentralized finance (DeFi) remains a prime target for cybercriminals, with 31 out of the 34 incidents in Q3 occurring within this sector. However, centralized finance (CeFi) experienced more significant financial impacts, with losses accounting for 74.8% ($309 million) of the total, compared to 25.2% ($104 million) for DeFi.

The most significant attack occurred on July 18, when the Indian centralized exchange WazirX lost $235 million to bad actors. The exploit was followed by a $52 million security breach at Singapore-based BingX on September 20.

Together, these incidents accounted for the bulk of the losses, totaling $287 million, representing 69.5% of all losses incurred during the quarter.

Hacks Dominate Q3 Losses

July saw the highest monthly losses in Q3 at $282 million, while August’s losses plummeted to $15 million. September recorded an additional $116 million in losses, with $14.9 million (3.6%) of the stolen funds recovered from the Ronin Network and ShezmuTech exploits.

Hacks dominated the losses in Q3, representing 99.3% ($409.9 million) of total losses across 31 incidents, while fraud and scams accounted for just 0.7% ($3.1 million) across three incidents.

Ethereum and BNB Chain remained the most targeted networks, with Ethereum facing 15 incidents, accounting for 44.1% of losses on targeted chains, followed by eight incidents on BNB Chain at 23.5%.

Immunefi has paid over $100 million in bounties to ethical hackers and researchers, arising from more than 3,000 bug bounty reports, including a $10 million award for a vulnerability found in Wormhole’s cross-chain protocol.