Increased Crypto Theft Through Hacks and Exploits in H1 2024

YoY increase in total value lost

The first half of 2024 witnessed a significant rise in cryptocurrency thefts through hacks and exploits. Total losses reached a staggering $1.49 billion, a 120% increase compared to the $675.8 million stolen in H1 2023. While the number of attacks decreased by 41.7% (103 attacks in H1 2023 vs. 60 in H1 2024), this data reveals that attackers are now focusing on larger, more lucrative exploits.

For a deeper understanding of common attack vectors and mitigation strategies, reference our HackHub Report. This comprehensive resource delves into real-world hacking incidents, providing valuable insights into how attackers operate and how organizations can effectively protect their platforms and assets.

Ethereum: The Prime Target

Among blockchains, Ethereum bore the brunt of these attacks, accounting for 42.35% of the total losses. This targeted selection may indicate a preference for exploiting established blockchain ecosystems with potentially larger pools of readily accessible assets. In terms of tokens, Bitcoin and its wrapped variants on other blockchains emerged as the assets stolen the most, accounting for 35.26% of the total amount stolen.

       Blockchains Exploited

    Tokens Exploited

Increasing Focus on Smart Contract Vulnerabilities

A particularly concerning trend lies in the increased targeting of smart contract vulnerabilities. In H1 2023, such vulnerabilities contributed only 14.89% to total losses. However, this figure skyrocketed to 45.83% in H1 2024. This shift is further emphasized by analyzing the top hacks of each period. While H1 2023 saw no SC vulnerability exploits in the top 5, H1 2024 witnessed 2 SC exploits of more than $200 million each among the top 5 hacks.

The Growing Threat to Layer 2 Blockchains

While Layer 2 (L2) blockchains have yet to experience any major exploits, their vulnerability is becoming increasingly evident now. Compared to H1 2023, where L2 chains accounted for just 4.67% of total losses, the first half of 2024 witnessed a sharp rise. L2 chains such as ARB, BLAST, Linea, OP, and zkSync now represent more than double the losses (almost 13.85%). Furthermore, the number of attacks on L2 chains accounted for 12.6% in H1 2023, while one-third of attacks in H1 2024 have targeted L2 chains. 

Access Control Issues: Leading Cause of Losses in 2024

Alarmingly, access control issues in smart contracts have re-emerged as the leading cause of losses in 2024, accounting for a staggering 42.66% of all losses. Hot wallet attacks (26.66%) and private key leaks (12.73%) were also significant contributors but paled in comparison to the impact of access control vulnerabilities.

Total Loss by Vulnerability

The first half of 2024 paints a ciritcal picture of blockchain platforms and their security. While the overall number of attacks decreased, the total value stolen skyrocketed, driven by a shift towards larger exploits and a rise in smart contract vulnerabilities. This trend highlights the growing sophistication of attackers and the need for stringent security measures across the entire blockchain ecosystem. By acknowledging these trends and implementing robust security measures, we can work towards a more secure future for the cryptocurrency ecosystem as a whole.

Mitigating Crypto Threats: Strategies for Organizational Defense

So, what can be done to protect your assets from these evolving threats? Here's a multi-layered defense strategy to consider:

Regular Smart Contract Audits: Implement a rigorous and ongoing smart contract audit process. Partner with reputable security firms to proactively identify and patch vulnerabilities in your codebase, minimizing potential attack surfaces.

Robust Encryption Protocols: Employ strong cryptographic algorithms to safeguard sensitive data, both at rest (stored on a system) and in transit (being transmitted). Utilize industry-standard encryption methods to ensure the confidentiality and integrity of your data.

Multi-Signature Wallets (Multi-Sig): Enforce shared control over permissions by implementing multi-sig wallets. This requires multiple authorized parties to approve transactions, significantly reducing the risk of unauthorized access and single points of failure.

Threat Intelligence & Monitoring: Stay updated by actively monitoring for emerging attack vectors and vulnerabilities. Utilize threat intelligence feeds and vulnerability databases to proactively adapt your defenses and address potential threats before they are exploited.

Security Awareness Training: Educate your employees on best practices for handling crypto assets and identifying common scams. Regular security awareness training programs can significantly reduce human error and phishing attacks, which are often the initial entry points for attackers.

Remember, no single security measure is foolproof. By implementing a combination of these strategies, you can create a defense-in-depth architecture that significantly reduces the threat and makes it much harder for attackers to succeed.