Crypto Hackers Nabbed $409M in Q3: Immunefi

As a seasoned researcher with years of experience in the digital frontier, I can confidently say that the third quarter of 2024 has been a rollercoaster ride in the world of cryptocurrency. The $409 million stolen, while lower than last year’s figure, is still a staggering amount that underscores the need for enhanced security measures.

In the third quarter, thieves made off with approximately $409 million in cryptocurrency, as well as an extra $3 million due to fraudulent activities, as stated in a report by Immunefi.

The figure is 40% less than in third-quarter 2023, the bug bounty platform said.

The amount of capital locked on decentralized finance (DeFi) protocols represents an “unparalleled and attractive opportunity for blackhat hackers,” Immunefi said. There is currently $87.2 billion in total value locked (TVL) across DeFi, according to DefiLlama.

In this quarter, the majority of losses were incurred due to cyber attacks on cryptocurrency exchanges. For instance, India’s WazirX suffered a loss of approximately $235 million, and Singapore’s BingX experienced a loss of around $52 million. The report revealed that 32 separate hacking incidents accounted for about 32% of the total losses.

According to Mitchell Amador, founder and CEO of ImmuneFi, there’s an increasing trend of cyber attacks on Decentralized Finance (DeFi), whereas Centralized Finance (CeFi) encounters fewer such incidents, but when they do occur, the repercussions can be severe, with some single exploits resulting in the theft of hundreds of millions of dollars.

“In CeFi, the biggest infrastructural issue is private key management, which is essential to maintaining the self-custody of crypto assets but is not typically subject to security audits. It requires rigorous key management policies, practices, and emergency plans.”

On July 18, WazirX temporarily stopped withdrawals and trading following a security breach that led to the loss of funds. The exchange is currently trying to get a court-ordered pause (moratorium) in Singapore to help them reorganize their operations.

Additionally, there were two instances where funds that had been stolen were successfully retrieved. The Ronin Network managed to recover $10 million out of a total $12 million stolen in a hack, while ShezmuTech was able to reclaim the entire $4.9 million that was taken.