<p>In August 2022, the deBridge Finance project was <a href="https://twitter.com/AlexSmirnov__/status/1555586334378676225?s=20&amp;t=46EJsRn9zi-N7FT-s4_Dag">the target of an attempted phishing attack</a>.&nbsp; The sophisticated attack tried to trick recipients into opening a malicious PDF that would compromise their machine.</p><h2>Exploring the Attempted Hack on deBridge</h2><p>The attempted phishing attack used a spoofed email address mimicking that of Alex Smirnov, deBridge co-founder.  The email claimed to include a shared PDF with a link that, on a Windows machine, pointed to a ZIP folder containing a password-protected PDF and a file named Password.txt.lnk.  </p><p>Clicking on the LNK file downloaded malware that scanned for antivirus on the system, and, if not found, installed backdoor malware on the system.</p><p>After installation, the malware communicates with a command and control server and collects information about the infected computer and its user.&nbsp;&nbsp;</p><p>However, this design also allows the attacker to run any command on the infected computer, so the malware could easily search for passwords or private keys stored on the infected device, install a keylogger to collect them, or deploy malware to change the destination or contents of transactions.</p><h2>Phishing Attacks Pose a Major Threat to DeFi Security</h2><p>The tools and techniques from the deBridge phishing attack are very similar to those used by the Lazarus Group, an Advanced Persistent Threat (APT) group associated with North Korea.&nbsp;&nbsp;</p><p>While the attack was unsuccessful in this case, future campaigns could have significant impacts.</p><p>Phishing attacks are a common tactic of cyber threat actors because they work.&nbsp; David Schwed, Halborn’s COO, recently commented on the attack <a href="https://bitcoinist.com/hackers-suspects-in-debridge-attack/">in Bitcoinist</a>: “These types of attacks are pretty prevalent… they rely on the inquisitive character of people by labeling the files something that would spark their curiosity, such as salary information.”</p><p>Companies and individuals can protect themselves against these phishing attacks by following security best practices such as:</p><ul><li>Validating the sender’s address when receiving an email</li><li>Being suspicious of unsolicited files and links sent via email or other channels</li><li>Keeping a reputable antivirus running and up-to-date on your computer</li></ul><p>For more information about keeping your DeFi project secure against cyberattacks, reach out to our security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

In August 2022, the deBridge Finance project was the target of an attempted phishing attack. Halborn explains what happened.

Attempted deBridge Hack Underscores Threat of Phishing Attacks

<p>DeFi thefts have grown astronomically in recent years.&nbsp; According to Chainalysis’ <a href="https://go.chainalysis.com/2022-Crypto-Crime-Report.html">Crypto Crime Report 2022</a>, the number of DeFi hacks more than doubled between 2020 and 2021 from 117 to 250.&nbsp; These hacks were also much more valuable with about $3.2 billion in cryptocurrency stolen, compared to about $800 million the previous year, a 1,330% increase.</p><p>Many different drivers have contributed to the rise of DeFi hacks.&nbsp; Here are 5 reasons why these DeFi hacks are growing more common and more expensive.</p><h2>1. Increased DeFi Adoption</h2><p>One of the reasons why the number and value of DeFi hacks are going up is that there is simply more money to steal.&nbsp; At the end of 2020, DeFi protocols <a href="https://www.defipulse.com/">had a total value locked</a> (TVL) of about $25 billion.&nbsp; A year later, DeFi projects held about $88 billion.</p><p>This 3.5x increase is only a little lower than the 4x growth in the value of DeFi hacks in the same period.&nbsp; This indicates that the amount of value stolen from DeFi projects is roughly keeping pace with the growth in the value of these projects.</p><h2>2. Open Source Code</h2><p>DeFi is built around the open-source mindset, and most DeFi projects open source their code for analysis and for reuse by other projects.&nbsp; As a result, many DeFi projects are built using components forked or copied from existing projects.</p><p>This use of open-source code can bring significant benefits.&nbsp; For example, OpenZeppelin’s library contracts are high-quality and enable users to avoid common smart contract vulnerabilities.</p><p>However, open source also has its downsides.&nbsp; With the low barrier to entry, it is easier for scammers to roll out projects for <a href="https://halborn.com/what-is-a-rug-pull-in-crypto/">rug pulls</a>, enabling them to steal value invested by users.&nbsp;&nbsp;</p><p>Code reuse also can cause vulnerable code to pop up in multiple places or create a false sense of security if a DeFi project uses trusted libraries but tweaks them, as was the case in the <a href="https://halborn.com/explained-the-qubit-hack-january-2022/">Qubit hack</a>.</p><h2>3. Widespread Vulnerabilities</h2><p>Another impact of open source is that it makes it easier for attackers to identify the vulnerabilities that exist in smart contract code.&nbsp; With access to application source code, attackers can search for vulnerabilities and use static code analysis tools to find bugs.</p><p>Vulnerability exploitation is a growing attack vector in the DeFi space.&nbsp; Between 2020 and 2021, <a href="https://halborn.com/what-is-code-exploitation/">code exploits</a> grew from accounting for about 40% to over 50% of attacks.&nbsp; In 2019, a code exploitation attack was relatively unknown in the DeFi space.</p><h2>4. Ecosystem Complexity</h2><p>Smart contract platforms are already complex ecosystems.&nbsp; <a href="https://halborn.com/what-is-a-smart-contract/">Smart contracts</a> are programs that run on top of the blockchain and can interact with other blockchain-based programs.&nbsp; Increased complexity makes security more challenging.</p><p>As the DeFi space grows more mature, the complexity of these protocols and their interactions continues to increase.&nbsp; Today, DeFi protocols implement sophisticated functionality, and bridges enable interactions between smart contracts hosted on other blockchains.&nbsp; This increased complexity makes business logic errors more likely and makes it harder to identify and correct vulnerabilities in smart contract implementations.</p><h2>5. Lack of Security Audits</h2><p>Security audits are essential to the security of DeFi projects.&nbsp; These audits can help to identify smart contract vulnerabilities and business logic issues before they are deployed to the blockchain and put the project and its users at risk.</p><p>A lack of <a href="https://halborn.com/services/smart-contract-audits/">smart contract audits</a> is one of the leading causes of the rise in DeFi hacks.&nbsp; Of the ten most expensive DeFi hacks in 2021, <a href="https://rekt.news/leaderboard/">not a single one had undergone a security audit</a>.&nbsp; This “test in prod” approach to DeFi security led to over $1 billion in losses from these ten projects alone.</p><h2>Addressing the Risk of DeFi Hacks</h2><p>DeFi is a promising and rapidly-growing application of blockchain technology.  However, widespread hacks damage its reputation and can hinder growth and adoption. <br></p><p>In our <a href="https://halborn.com/the-10-biggest-defi-hacks-of-2021-a-recap/">Top 10 DeFi Hacks of 2021</a> article, we noticed a common trend: a lack of security audits.  Slowing the rise of DeFi hacks requires auditing smart contracts before deployments.  To learn more about how to improve the security of your DeFi project through smart contract auditing and advanced penetration testing, reach out to our blockchain security experts at halborn@protonmail.com.</p>

Why are DeFi hacks on the rise? Blockchain security firm Halborn offers 5 reasons why DeFi hacks are growing more common and more expensive.

5 Reasons Why DeFi Thefts Are on the Rise

<p>The year 2021 saw nearly $2 BILLION hacked in the crypto space alone. That is the amount that DeFi protocols were reported to have lost in the last 365 days to cyber attacks and other vulnerability exploits &#8211; a staggering increase of more than 1,300% over a relatively “small” $134 million lost the year prior, in 2020. And for even more context, the largest DeFi hack of 2020, a $34 million loss suffered by Harvest Finance in a <a href="https://halborn.com/what-is-a-flash-loan-attack/">flash loan attack</a>, has been dwarfed now by the top DeFi hacks of 2021.</p><p>Below, we’ve recapped the 10 biggest DeFi hacks of 2021, including the largest ever DeFi security exploit of over $600 million that, amazingly, ended pretty well for all parties involved! All of the top ten hacks of this year resulted in fund leaks of at least $45 million. So let’s count down the worst crypto hacks of 2021, and have a look at what each of these infamous exploits involved.</p><h2>#10 <a href="https://halborn.com/explained-the-pancakebunny-protocol-hack-may-2021/">PancakeBunny &#8211; $45 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-pancakebunny-protocol-hack-may-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/PancakeBunny-Hack-3.jpg" alt="" class="wp-image-1403"/></a></figure><p>On May 19, 2021, PancakeBunny, a yield management platform operating on BSC and Polygon, became a victim of yet another flash loan attack. The attacker borrowed a large amount of BNB on PancakeSwap; proceeded to manipulate the price of the platform’s native token, BUNNY, in the BUNNY/BNB pool; and dumped massive amount of BUNNY in the market, causing the price of the token to plunge. The attacker then paid the borrowed BNB back on PancakeSwap. The hack affected the platform’s BSC operations, sparing its Polygon-based pools. The entire manipulation resulted in $45 million of value lost.</p><p><em>Read Halborn’s in-depth analysis of the PancakeBunny hack </em><a href="https://halborn.com/explained-the-pancakebunny-protocol-hack-may-2021/"><em>here</em></a><em>.</em></p><h2>#9: <a href="https://halborn.com/explained-the-uranium-finance-hack-april-2021/">Uranium Finance &#8211; $50 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-uranium-finance-hack-april-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Uranium-Finance-Hack.jpg" alt="" class="wp-image-1405"/></a></figure><p>Uranium Finance is a decentralized exchange (DEX) on Binance Smart Chain (BSC). In late April 2021, the platform suffered a loss of $50 million during its token migration process. The hacker stole funds from the platform in an array of cryptocurrencies &#8211; mostly in BNB and BUSD, but also in USDT, BTC, ETH, DOT, ADA, and U92, Uranium’s native crypto.</p><p>Given the nature of the exploit, a smart contract hack at the upgrade stage, allegations of the hack’s internal nature were rife online in the aftermath of the incident. Uranium posted a<a href="https://uraniumfinance.medium.com/exploit-d3a88921531c"> detailed outline</a> of the hack on their Medium page.</p><p>Despite appealing to BSC’s security team for help in identifying the attacker or preventing the funds from leaving the chain, the stolen amount has since not been recovered.</p><p><em>Read Halborn’s in-depth analysis of the Uranium Finance hack </em><a href="https://halborn.com/explained-the-uranium-finance-hack-april-2021/"><em>here</em></a><em>.</em></p><h2>#8: <a href="https://halborn.com/explained-the-belt-finance-hack-may-2021/">Belt Finance &#8211; $50 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-belt-finance-hack-may-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Belt-Finance-Hack.jpg" alt="" class="wp-image-1406"/></a></figure><p>Exactly one month after the attack on Uranium Finance, another BSC-based DEX, Belt Finance, suffered a hack that resulted in a loss of $50 million. The incident was a result of a<a href="https://halborn.com/what-is-a-flash-loan-attack/"> flash loan attack</a>. </p><p>The attacker used the PancakeSwap platform to manipulate flash loans. Most of the damage was inflicted on the BeltBUSD pool. While the overall loss amounted to around $50 million, the hacker themselves pocketed approximately $6.2 million.</p><p>Just as in the case with Uranium Finance, the hacker has not been identified, nor have they returned the stolen funds.</p><p><em>Read Halborn’s in-depth analysis of the Belt Finance hack </em><a href="https://halborn.com/explained-the-belt-finance-hack-may-2021/"><em>here</em></a><em>.</em></p><h2>#7: <a href="https://halborn.com/explained-the-bzx-hack-november-2021/">bZx &#8211; $55 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-bzx-hack-november-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/bZx-Hack.jpg" alt="" class="wp-image-1407"/></a></figure><p>bZx, a margin trading decentralized protocol on the BSC and Polygon chains is no newcomer to the painful world of DeFi hacks, with three such incidents suffered by the platform in the year 2020 alone.</p><p>bZx had been operating largely without any major security issues until November 2021. On November 5, the protocol was hacked when its private key was compromised, allowing the attacker to steal $55 million. Both chains used by bZx, BSC and Polygon, were affected by the hack.</p><p>Three days after the attack, bZx announced that it was cooperating with cryptocurrency exchanges to recover the stolen funds. So far, there has been no update on the success of the recovery efforts.</p><p>Meanwhile, in more recent news, bZx and Ooki, another protocol for margin trading, have reportedly joined forces, with bZx’s BZRX token migrating to the Ooki platform. The move is likely the end of bZx as a stand-alone protocol of its own.</p><p><em>Read Halborn’s in-depth analysis of the bZx hack </em><a href="https://halborn.com/explained-the-bzx-hack-november-2021/"><em>here</em></a><em>.</em></p><h2>#6: <a href="https://halborn.com/explained-the-easyfi-hack-april-2021/">EasyFi &#8211; $59 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-easyfi-hack-april-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/EasyFi-Hack.jpg" alt="" class="wp-image-1408"/></a></figure><p>EasyFi, a multi-chain Layer 2 lending protocol, lost around $80 million in April when the private key to the MetaMask wallet operated by the platform’s CEO, Ankitt Gaur, was compromised.</p><p>The hacker stole the funds from EasyFi’s official wallet, and the losses included around $6 million siphoned off the stablecoin pools on the platform and $53 million in the platform’s native EASY tokens. Four days after the incident, EasyFi retired EASY and introduced the new EZ token to replace it as part of the platform’s hard fork.</p><p>The hack affected EasyFi’s pools linked to all three chains it operates on –&nbsp; Polygon, BSC, and Ethereum. Similar to the hacks listed above, the attacker was not identified, nor were the funds recovered.</p><p><em>Read Halborn’s in-depth analysis of the EasyFi hack </em><a href="https://halborn.com/explained-the-easyfi-hack-april-2021/"><em>here</em></a><em>.</em></p><h2>#5: <a href="https://halborn.com/explained-the-badgerdao-hack-december-2021/">BadgerDAO &#8211; $120 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-badgerdao-hack-december-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/BadgerDao-Hack.jpg" alt="" class="wp-image-1409"/></a></figure><p>Badger, a lending protocol that uses Bitcoin collaterals and operates on Ethereum, lost $120 million in early December 2021 due to an attack that targeted its user interface functionality. The attack affected a few dozens of users, and it seems unlikely that these users will be reimbursed.</p><p>Badger does have an insurance policy from crypto insurer Nexus Mutual which covers some potential hacks, however, the policy only covers smart contract hacks, not user interface breaches. Nexus has already stated that this attack was classified as “front-end”, and therefore no compensation under the policy will be paid.</p><p><em>Read Halborn’s in-depth analysis of the BadgerDAO hack </em><a href="https://halborn.com/explained-the-badgerdao-hack-december-2021/"><em>here</em></a><em>.</em></p><h2>#4: <a href="https://halborn.com/explained-the-paid-network-hack-march-2021/">Paid Network &#8211; $127 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-paid-network-hack-march-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Paid-Network-Hack.jpg" alt="" class="wp-image-1410"/></a></figure><p>Paid Network, a decentralized app (DApp) on Ethereum providing smart contract-based agreement services to businesses, was hit by one of the biggest hacks in DeFi history, with an attacker using a previously <a href="https://halborn.com/stolen-keys-3-ways-you-can-keep-your-private-keys-safe/">compromised private key</a>.</p><p>Using the key, the attacker replaced the original smart contract on the platform with a modified version. This allowed them to burn the existing PAID tokens and mint a large supply of new ones. Some of the newly minted tokens were swapped to ETH on Uniswap before the breach was identified and the PAID/ETH swap pair was blocked.</p><p><em>Read Halborn’s in-depth analysis of the Paid Network hack </em><a href="https://halborn.com/explained-the-paid-network-hack-march-2021/"><em>here</em></a><em>.</em></p><h2>#3: <a href="https://halborn.com/explained-the-cream-finance-hack-august-2021/">Cream Finance &#8211; $130 Million Lost</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-cream-finance-hack-august-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Cream-Finance-Hack.jpg" alt="" class="wp-image-1411"/></a></figure><p>In late October, Cream Finance, a multi-chain lending protocol, suffered a flash loan attack that wiped out an estimated $130 million from its Ethereum-based liquidity pools. It is not reported whether funds held at other chains, BSC, Fantom, Polygon, and Avalanche, are affected.</p><p>However, given that the official statement from the platform mentioned only Ethereum pools, it is likely that the attack targeted only the pools held at the world’s largest DeFi chain.&nbsp;</p><p>This was the third hack involving Cream Finance this year, as just two months before the $130 million breach, the platform had been hit with a $19 million hack, also involving a flash loan attack.</p><p><em>Read Halborn’s in-depth analysis of the Cream Finance hack </em><a href="https://halborn.com/explained-the-cream-finance-hack-august-2021/"><em>here</em></a><em>.</em></p><h2>#2: Compound Finance &#8211; $147 Million Lost</h2><figure class="wp-block-image size-full"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Compound-Finance-Hack.jpg" alt="" class="wp-image-1412"/></figure><p>Compound Finance, an Ethereum-based lending and borrowing protocol, is among the biggest DeFi projects out there, with a total value locked (TVL) of around $10 billion as of the time of writing.&nbsp;</p><p>On September 30, 2021, the protocol erroneously paid out vast sums in its native cryptocurrency COMP to some users who provided only miniscule levels of collateral in ETH, USDC, and DAI. An error in the protocol’s smart contract was suspected as the cause of the malfunction.</p><p>It is still unclear whether the erroneous distribution of the COMP tokens was a planned attack or an honest mistake by the protocol’s developers. Compound’s CEO, Robert Leshner, did not deliberate on it too long, though.&nbsp;</p><p>Within hours of the incident, he went on Twitter, asking recipients of the funds to return them. Leshner promised 10% of the amounts as a reward for returning, and, in the same tweet, threatened to report non-responders to the IRS. It is unknown precisely how much of the total lost amount has been recovered thanks to Leshner’s online arm-twisting, but it remains to be seen.</p><h2>#1: <a href="https://halborn.com/explained-the-poly-network-hack-august-2021/">Poly Network &#8211; $610 Million Lost (and Returned)</a></h2><figure class="wp-block-image size-full"><a href="https://halborn.com/explained-the-poly-network-hack-august-2021/"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/01/Poly-Network-Hack.jpg" alt="" class="wp-image-1413"/></a></figure><p>The DeFi industry’s largest hack ever occurred on August 10, 2021, and involved a cross-chain crypto swap provider, Poly Network. The attacker hacked a smart contract on the platform and transferred a total of $610 million to their addresses on Ethereum and BSC.</p><p>Funds were drained from all three chains used by Poly Network: Ethereum, BSC, and Polygon. The losses on Ethereum amounted to $273 million, while the BSC and Polygon operations of the platform lost $253 million and $85 million, respectively.</p><p>Poly Network appealed to the hacker to return the funds. The next day after the incident, on August 11, the hacker returned around $260 million.</p><p>On August 12, the hacker engaged in an online conversation with Poly Network, introducing themselves as “Mr. Whitehat.” A day later, Mr. Whitehat assured the platform that he would return all the remaining funds, justifying that his actions were the result of demonstrating the vulnerability of crypto platforms.</p><p>By August 23, Mr. Whitehat had returned all the hacked funds. In the course of his online public conversation with Poly Network, the hacker was first offered $500,000 and then a position of a Chief Security Advisor (CSA) on the platform. Both of the offers were turned down by the mysterious author of the largest DeFi hack in history.</p><p><em>Read Halborn’s in-depth analysis of the Poly Network hack </em><a href="https://halborn.com/explained-the-poly-network-hack-august-2021/"><em>here</em></a><em>.</em></p><h2>Key Insights into 2021’s Biggest DeFi Hacks</h2><p>The year’s top 10 DeFi hacks amounted to over $1.5 billion of total stolen value. This figure includes the funds returned to the platform, as was the case with the Poly Network hack, and represents the lion’s share of the nearly $2 billion lost to hackers on DeFi platforms in 2021.</p><figure class="wp-block-image"><img decoding="async" src="https://lh6.googleusercontent.com/UjpqEwsyTGiAeZkWZOuN6zPn6IY3U-FgLnkEvWesz8e9COjkFYpgQtI2JjDhn7xbZqgG4o9jKVm5tgPsPOga6zpN980mh59ffv_RMEamBL5-Nna4Zn6-9KdbaKI4J7_DXjMFhsyD" alt=""/></figure><p>While the year 2020 produced only 16 DeFi hacks where any monetary losses were suffered, there were 55 such hacks in 2021.</p><figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/9HdVerHJyJqEzFWdL5GudAkN_DCAcitI0sHxfLIlohz5GuTxQLReiFrMosOVFlcXnIHPF5IxMecrmM3qgMMQrtk7t1IFQcDQbMuqx2y54RdqnCSc5CnyIngx66fZ22nIbzV3JYkV" alt=""/></figure><p>The average size of a DeFi hack in 2021 also increased substantially compared to the 2020 figure. While in 2020, a DeFi hack resulted in an average loss of $8.3 million, the respective figure for 2021 is nearly $36 million.</p><figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/z7qV0xKSei1VeTq39QXlunp71UN9EREWbQv96tFyANyzhKNn8VHcaVwZCPP-O-f8yach7EGdvGn3KvB29QvRDbULb5YP2b3D9G2utwwuzUAvpDsoYf_5YugRA1LNa5d6fYOjXNu-" alt=""/></figure><p>The year 2021 has seen a massive increase in DeFi hacks compared to 2020. In 2021, we witnessed the largest DeFi hack on record so far, with those funds fortunately being returned. Unfortunately, however, most of the other top hacks did not have kind enough hackers, and the funds were not recovered.&nbsp;This is all a stark reminder to any DeFi user, developer, or operator that crypto cybercriminals are always on the lookout for platform vulnerabilities to exploit. </p><p></p><p>So if you want to ensure that your project, digital assets and sensitive information are as secure as possible, be sure to reach out to our blockchain cybersecurity experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a> to inquire about smart contract security audits, and a number of other ways to protect your organization and stakeholders.</p>

Blockchain cybersecurity firm Halborn recaps the top 10 biggest DeFi hacks of 2021, which resulted in nearly $2 Billion lost.

The 10 Biggest DeFi Hacks of 2021: A Recap

<p><em>$45 million stolen in the </em><a href="https://halborn.com/explained-the-pancakebunny-protocol-hack-may-2021/"><em>Pancakebunny Protocol hack</em></a><em>.</em></p><p><em>2804.96 ETH and 462,079,976 AMP tokens stolen as part of the </em><a href="https://halborn.com/explained-the-cream-finance-hack-august-2021/"><em>CREAM Finance hack</em></a><em>.</em></p><p><em>And in the biggest DeFi hack to date, The Poly Network suffered </em><a href="https://halborn.com/explained-the-poly-network-hack-august-2021/"><em>an exploit</em></a><em> of over $600 million.</em></p><p>Headlines like these exemplify the growing trend of attacks on Decentralized Finance (DeFi) protocols and the damage they’ve done to various projects and their investors. On the surface, these attacks highlight the inherent weaknesses found in many DeFi protocols. However, beneath the surface, many in the crypto space believe these attacks will help with the long-term advancement of the DeFi space.</p><p>Everything from developers having to create new tech to better protect the sector, to compliance-based safeguards for investors, DeFi hacks force the sector to move forward and provide an increasingly secure user experience.  So in this article we’ll look at how this is taking shape.</p><h2><strong>How and Why DeFi Protocols Get Hacked</strong></h2><p>Cryptocurrency has a hacking problem, and DeFi is on the forefront of the issue. Of all crypto hacks in 2021, DeFi attacks accounted for over 75% of them, as noted in CipherTrace’s Cryptocurrency Crime <a href="https://ciphertrace.com/cryptocurrency-crime-and-anti-money-laundering-report-august-2021/">Report</a>. And even though crypto crime on a whole is down compared to last year, DeFi related attacks are up almost 300%. We’ve covered quite a number of these hacks on our <a href="https://halborn.com/blog/">blog</a>, especially in our <em>Explained</em> series, but let’s take a look at how and why DeFi protocols typically get exploited.</p><h3>Explosive Growth in the DeFi Sector</h3><p>DeFi is still a relatively new sector and growth has exploded &#8211; as total value locked (<a href="https://medium.com/multi-io/defi-explained-the-tvl-metric-99187587f8f0">TVL</a>) went from less than $2 million in 2017 to well over <a href="https://www.statista.com/statistics/1237821/defi-market-size-value-crypto-locked-usd/">$80 billion</a> in 2021. This incredible growth undoubtedly included growing pains, and when a sector grows as fast as DeFi has, it’s no surprise that it also attracts a drove of hackers looking to exploit the inherent shortcomings of new technology.</p><h3>Transparency and Anonymity </h3><p>Some of the hallmarks of the crypto space are that it is permissionless and anonymous. These are characteristics that have allowed crypto and DeFi projects to change the face of finance and provide a foundation that is rapidly changing how people do things. But on the other hand, these same advantages also serve as the perfect foundation for hackers to wreak havoc on DeFi projects and their investors. </p><p>Hackers can usually do a few things quite easily to aid in any given exploit:</p><ol><li>Obtain a full copy of the blockchain and study its codebase</li><li>Study the entire business model of the protocol including how it interacts with third-party applications and then look for any weaknesses</li><li>Build their own model and test how the hack could be carried out in a real environment</li></ol><p>This gives hackers time to perfect their attack before it even happens, and it’s one of the many reasons DeFi hacks have become so widespread. </p><h3>Flash Loan Attacks</h3><p>A flash loan is a type of loan that happens on the blockchain with the use of smart contracts. These loans provide many advantages in finance that were not possible before blockchain technology, but with that comes a host of vulnerabilities that hackers exploit in the form of flash loan attacks.</p><p>One of the most infamous flash loan attacks occurred on the <a href="https://www.coindesk.com/tech/2020/02/27/the-defi-flash-loan-attack-that-changed-everything/">DeFi protocol bZx</a>, and it perfectly illustrates how these kinds of attacks can work.</p><ul><li>The attacker took out a flash loan and converted part of it the sUSD stablecoin, which has a pegged value to the US dollar</li><li>The attacker then put in a large order of sUSD using borrowed ETH, which artificially inflated the price of sUSD on Kyber Network</li><li>The bZx protocol thought that sUSD was worth 2X more than it really was, and the attacker used this price inflation to borrow 2X the amount of ETH than it would otherwise be allowed to under normal circumstances </li><li>The attacker repaid the loan at the normal value, and stole the rest (inflated value difference)</li></ul><p>Flash loans and their use of smart contacts only arrived on the Ethereum blockchain in 2020 so the technology is still relatively young. And one of the big debates in this area revolves around how simple it is for hackers to manipulate a protocol with very little upfront investment &#8211; where traditionally, in order to manipulate a protocol, a hacker would be forced to put up so much capital and resources it effectively wouldn’t be profitable. This was one of the major points of Satoshi Nakamoto’s original Bitcoin whitepaper.</p><h2><strong>DeFi Hacks Call For Stronger Governance and More Compliance</strong></h2><p>Relatively speaking, DeFi protocols are developed quickly and operate under little to no regulation &#8211; the kinds of conditions that attract hackers. But now, financial compliance entities including the Security Exchange Commission (SEC) are stepping in “to protect investor interests” (or so they put it). Many people in the crypto space believe that government regulation generally goes against the original ethos of cryptocurrency, but there’s no denying that some form of compliance will force the DeFi sector and crypto as a whole to move forward and do a better job of protecting its users. So below, we’ll look at some of the ways this is happening.</p><h3>Government Regulation</h3><p>DeFi services are accessible without KYC (Know Your Customer) guidelines, but governing and anti-money laundering entities are looking to change that. SEC Chair Gary Gensler is on record as saying DeFi projects are not immune to regulation being that many of the protocols, in the eyes of regulators, have features that make them resemble the kinds of projects the SEC would oversee. In addition to the SEC’s stance, organizations like Financial Action Task Force (FATF), who combat money laundering, have also taken focus on DeFi projects in an effort to protect investors, and possibly bring peace of mind to new people entering the space.</p><h3>Better Overall Security </h3><p>One of the clear ways that hacks on DeFi protocols affect the space is in the area of security. With each hack, major holes in these projects are highlighted and hackers may even go so far as to siphon funds and then return them with notes to the protocol developers on how to make the project safer, as seen in the <a href="https://halborn.com/explained-the-poly-network-hack-august-2021/">Poly Network attack of August 2021</a>. </p><p>Some of the ways DeFi security is improved as a result of hacks include:</p><p><strong>Better Security Protocols</strong> &#8211; More secure protocols help avoid a number of attack vectors including frontrunning attacks, 51% attacks, inaccurate liquidity pool calculations and more as we’ve explained in this <a href="https://halborn.com/top-defi-and-blockchain-security-issues/">article</a>.</p><p><strong>Slower Development Cycles</strong> &#8211; Slower development cycles means more time for rigorous testing and proper smart contract audits, where mistakes in code can be found. </p><p><strong>Compliance Tools</strong> &#8211; Exchanges like Binance have started using compliance tools like CipherTrace to adhere to the FATF’s travel rule that identifies both parties in any given transaction, and “detect hacks and exploits of decentralized finance (DeFi) applications on Binance Smart Chain” as reported in <a href="https://www.coindesk.com/markets/2021/07/01/binance-deploys-ciphertrace-tool-for-travel-rule-compliance/">CoinDesk</a>.</p><p><strong>Mandatory Bug Bounty Programs</strong> &#8211; Bug bounty programs provide compensation that will incentivize ethical hackers to get help make DeFi protocols more secure. This can also lead to the hacker working for the project long term which brings even more value to both sides and long-term security to DeFi protocols. </p><p>For more information on DeFi security, smart contract audits and how to prevent exploits on your project, be sure to reach out to our security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>. </p>

Blockchain security firm Halborn explains why there are so many DeFi hacks and why some hacks may actually help crypto advance.

Crypto Hacks: Why They Happen and Why Some May Be a Good Thing

<p>Blockchain technology is designed to make it possible to maintain a digital ledger in a decentralized and distributed fashion.  An essential and challenging part of this is ensuring that there is only one official version of the ledger at any given time and protecting against double-spend attacks.  While blockchain technology has solutions in place to accomplish this, it does not always work, and it can be difficult to differentiate between a simple error and a legitimate attack.</p><h2>The Longest Chain Rule and Chain Reorgs</h2><p>Blockchain consensus algorithms are designed to achieve a decentralized consensus regarding the state of the distributed ledger.  This includes ensuring that there is only one accepted version of every block in the blockchain.</p><p>However, many blockchain consensus algorithms only provide a probabilistic proof of consensus.  For example, Proof of Work is designed to make it unlikely that more than one version of a given block will be found within a specific interval.  However, it is entirely possible that two versions of a block will be found.  In fact, this happens quite frequently and is what makes double-spend attacks possible.</p><p>The<strong> longest chain rule</strong> is blockchain’s way of addressing these conflicts.  It states that, if an honest node is presented with two valid versions of the blockchain, it should accept and build upon whichever one is “longer”.  While definitions of “longer” can vary, the rule itself is pretty simple.</p><p>It is important to note that the longest chain rule doesn’t place any limitations on when conflicting chains can be produced.  The theory is that the odds of a divergent chain catching up after a long period of time are essentially zero.  However, these deep chain reorganizations are still possible.</p><h2>Inside Two “Double Spends”</h2><p>Within the first two months of 2021, two double-spend attacks were publicly reported.  However, only one of these was an actual attack.</p><h3>1. Bitcoin Double-Spend Attack in January 2021</h3><p>In January 2021, news outlets reported a double-spend on the Bitcoin blockchain.  This report was based on the fact that two different versions of the same transaction were included in two divergent versions of the Bitcoin blockchain.</p><p>However, this was not evidence of malice on behalf of the user.  Instead, the user in question <a href="https://twitter.com/LucasNuzzi/status/1352325295999754241">was taking advantage</a> of a function called Replace By Fee (RBF).  An RBF transaction is identical to the original transaction but has higher fees.  It comes with a note requesting that miners include it in the blockchain rather than the original transaction.</p><p>At the time the user created the initial transaction, the Bitcoin network was busy, forcing up transaction fees.  The user’s initial transaction fee was too low, causing it to sit for over a day without being added to a block.  As a result, the user used an RBF transaction to raise the transaction fee, and, several hours later, a second RBF to raise the fee again.</p><p>A couple hours later, the blockchain experienced a natural split into two versions.  At this point, the transaction fees had lowered as well, meaning that all three versions of the user’s transaction would have been acceptable to miners.  One version of the blockchain followed the chain of RBFs and added the third version of the transaction, while the other included the original transaction.</p><p>As a result, the two versions of the blockchain included a “double spend” since different versions of the blockchain contained mutually compatible transactions.  However, these two transactions were the same transaction (with different fees), and one version of the blockchain would lose to the other under the longest chain rule.  In the end, only a single version of the transaction would be accepted and included in the digital ledger.</p><div class="is-layout-flex wp-container-2 wp-block-columns"><div class="is-layout-flow wp-block-column" style="flex-basis: 100%;"><h3>2. Verge Double-Spend Attack in February 2021</h3></div></div><p>In February 2021, Verge underwent <a href="https://twitter.com/LucasNuzzi/status/1361392168989036545">“likely the deepest reorg that has ever taken place in a ‘top 100’ cryptocurrency”</a>.  The attacker was able to replace <a href="https://cointelegraph.com/news/verge-of-disaster-200-days-transactions-wiped-from-blockchain">over 560k blocks in the blockchain</a>, creating a version of the ledger that last matched the official one in August 2021.  As a result, many months of transactions and wallet balances were suddenly wiped out.</p><p>This attack leveraged the longest chain rule and GPU mining for malicious purposes.  Since the hash functions that Verge uses can be mined using a GPU, an attacker can rent enough hash power to create a malicious version of the blockchain that is longer than the original one.  If successful, the attacker can perform double-spend attacks and make money off of the rewards earned for mining blocks.</p><p>It is likely that this attack included attempted double-spend attacks, but it is difficult to say due to the scale of the reorg.  In the end, the Verge community was able to reverse the attack by outspending the attacker, mining enough blocks so that the official version of the blockchain became and remained the longer version.  However, accomplishing this required breaking the rules since legitimate nodes “should” have switched over to and stayed on the longer of the two chains when the malicious one became public.</p><h2>Securing the Blockchain Ledger</h2><p>Blockchain is built on decentralization, and it is <a href="https://twitter.com/SatoshiLite/status/1082491687169998848">impossible to have a fully decentralized cryptocurrency that is immune to 51% attacks</a> like the one performed against Verge.  If a blockchain has a way to overcome a 51% attack, then it has some level of centralization.  This is made evident by Verge’s ability to “break the rules” as a community to overcome the attack that they faced.</p><p>Maintaining the security of a fully decentralized blockchain requires ensuring that the incentives and protections built into the blockchain protocol actually work.  This involves building a large base of block creators (to make a 51% attack expensive) and ensuring that a blockchain protocol doesn’t contain vulnerabilities or features that make it possible to perform a double-spend attack with less than 51% of hash power, as occurred in an <a href="https://blog.theabacus.io/the-verge-hack-explained-7942f63a3017?gi=dff31f12ae6c">earlier attack against Verge</a>.</p><p><br />Halborn can’t help you build up a base of block creators.  But we can help you to identify and fix the issues that make a cryptocurrency more vulnerable to attack. Get in touch at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a> to find out how.</p>

Blockchain technology is designed to make it possible to maintain a digital ledger in a decentralized and distributed fashion.  An essential and challenging part of this is ensuring that there is only one official version of the ledger at any given time and protecting against double-spend attacks.  While blockchain technology has solutions in place to

Double-Spends vs. Blockchain Reorganizations

<p>Decentralized finance (DeFi) is the use of decentralized ledgers (like Ethereum) for financial transactions.  A major part of the DeFi space is trading, where traders take advantage of fluctuations in market prices and exchange rates to make a profit.</p><p>Understanding the potential for profit in the DeFi space (and how some traders are “hacking” it) requires a bit of background knowledge:</p><ul><li><strong>Transactions:</strong> A blockchain “transaction” is a set of actions taken at the same time on a blockchain.  A single blockchain transaction can contain several financial transactions (loans, trades, etc.).</li><li><strong>Flash Loan:</strong> A flash loan is a loan that is taken out and paid off within a single transaction.  These loans do not require collateral since they are guaranteed to be paid off.  Failed Ethereum transactions are rolled up as if they never happened.</li><li><strong>Slippage:</strong> Slippage is a disconnect between an exchange’s exchange rate for an asset and the actual market rate.  Traders can take advantage of slippage to make a profit.</li></ul><p>Putting all of these different factors together, a DeFi “hacker” can make large guaranteed profits within a single transaction on the blockchain.</p><h1>Exploiting Flash Loan Functionality</h1><p>One example of the impact of DeFi hacking is the first hack against the bZx exchange.  This hack enabled the attacker to make a profit of about $355,880 in Ether by the end of the transaction.</p><p><img decoding="async" loading="lazy" src="https://lh5.googleusercontent.com/LnM8P6fObcVX8QsrJOxZBWGUfvGJHH-_mT5m67kdQmoLchJ3il0VHwBou_NGf8_59rF1FijqylRMooi2cM2MWNgiOS2ME0wvF7eLMk4N4rfGDE1pOZH5vPG2QnTAjilO8yoi3aM" /></p><p>The image above shows the flow of events that enabled the attacker to make this profit:</p><ol><li>The attacker takes a 10,000 ETH flash loan out from dYdX</li><li>Using 5,500 of this loan as collateral, the attacker borrows 112 wBTC from Compound</li><li>With 1,300 of the original loan, the attacker takes out 5x leverage on ETH/wBTC from bZx Fulcrum
<ol><li>To service this, Fulcrum purchases 51 wBTC with 4,338 ETH from Kyberswap.  This causes slippage since Kyberswap had limited liquidity, driving up the value of ETH relative to wBTC</li></ol></li><li>The 112 wBTC borrowed from Compound is traded for 6871 ETH at Kyberswap</li><li>10,000 ETH of the attacker’s 10,071 ETH (6871 from step 4 and 3,200 left over from the original flash loan) goes to pay off the original flash loan.  The rest goes to the attacker.</li><li>The attacker pays off the Compound loan, trading 112 wBTC (worth about 4,300 ETC) for the original collateral of 5,500 ETH.</li></ol><p>In the end, the attacker has a net profit of 1,271 ETH (71 from step 5 and 1200 from step 6), worth about $355,880.  The entire operation was made possible by a bug in the bZx code (since fixed) that failed to check for slippage before making the purchase (in 3a) from Kyberswap.</p><h1>White Hat or Black Hat Hacking?</h1><p>Whether or not the bZx attacker “hacked the system” isn’t really a question.  The attacker took advantage of the flaw in the code to use bZx’s resources to dramatically change the wBTC/ETH exchange rate on Kyberswap.  This allowed the attacker to cash out their wBTC at the expense of bZx.</p><p>However, the attacker accomplished this by doing exactly what they were supposed to do under the “rules” of DeFi.  Tools like <a href="https://furucombo.app/">Furucombo</a> are designed to help traders to build transactions like this to make a profit.  The bZx hacker only “cheated” by taking advantage of a flaw in bZx Fulcrum’s code to have a much bigger payoff than expected.</p><p>This vulnerability could have been identified by an in-depth security audit and penetration test of bZx.  But was the attacker wrong to take advantage of it and play the DeFi game “too well”?</p>

Decentralized finance (DeFi) is the use of decentralized ledgers (like Ethereum) for financial transactions.  A major part of the DeFi space is trading, where traders take advantage of fluctuations in market prices and exchange rates to make a profit. Understanding the potential for profit in the DeFi space (and how some traders are “hacking” it)

// Blog

DeFi Hacks

Articles