<p><span style="color: rgb(0, 0, 0)">While February 2023 was quieter than many months, there were still a few significant DeFi hacks. In general, these DeFi attackers exploited common and avoidable vulnerabilities and security errors.</span></p><h2><span style="color: rgb(0, 0, 0)">February 2023 DeFi Hacks Recap</span></h2><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-bonqdao-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">BonqDAO</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">In February 2023, BonqDAO was the victim of a price oracle manipulation attack. By taking advantage of the protocol’s price update mechanisms, the attacker was able to drain approximately $120 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">The root cause of the incident was the fact that BonqDAO allows users to request updates to price information that are immediately applied. By strategically increasing and decreasing the perceived value of a token, the attacker was able to inflate the amount of value that they could redeem deposited tokens for and then liquidate other users’ deposits for a profit.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-dforce-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">dForce</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">The February 2023 dForce hack exploited a known reentrancy vulnerability in the protocol’s Curve Finance vaults. By targeting certain vaults on the Arbitrum and Optimism blockchains, the attacker was able to steal about $3.6 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">The reentrancy vulnerability was exploited via a classic flashloan attack. The attacker used the vulnerability to drive down the perceived price of an asset, enabling them to liquidate the positions of other users. In the end, the stolen $3.6 million was returned to the protocol.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-liangopay-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">LianGoPay</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">The LianGoPay attack was made possible by compromised private keys. The attacker deployed fake contracts and tricked users into deposits that allowed them to steal $1.6 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">This hack was obviously performed by someone with access to the project’s private keys because the attacker was able to create fake pledge pools using malicious contracts with similar addresses to real ones. These contracts were created at nearly the same time as a legitimate one and used deception to fool users into depositing funds into the wrong ones.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-orion-protocol-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">Orion</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">Like dForce, Orion was the victim of a reentrancy attack. The attacker exploited the reentrancy vulnerability to steal about $3 million from the project.</span><br></p><p><span style="color: rgb(0, 0, 0)">The Orion attacker created a fake ATK token and performed a swap using it within the Orion smart contract. The call to the token contract to make the transfer allowed the attacker to exploit the reentrancy vulnerability and inflate the balance of their account within the Orion contract. Then, the attacker could simply withdraw this balance to steal $3 million from the protocol.</span></p><h2><span style="color: rgb(0, 0, 0)">Exploiting Avoidable Mistakes</span></h2><p><span style="color: rgb(0, 0, 0)">The biggest DeFi hacks of February 2023 weren’t very sophisticated. </span><a target="_blank" rel="" href="https://www.halborn.com/blog/post/what-is-a-re-entrancy-attack"><u><span style="color: rgb(17, 85, 204)">Reentrancy</span></u></a><span style="color: rgb(0, 0, 0)"> is a well-known vulnerability, price oracle manipulation is common, and </span><a target="_blank" rel="" href="https://www.halborn.com/blog/post/stolen-keys-3-ways-you-can-keep-your-private-keys-safe"><u><span style="color: rgb(17, 85, 204)">protecting private keys</span></u></a><span style="color: rgb(0, 0, 0)"> is fundamental to blockchain security. However, attackers were able to steal millions from DeFi projects by exploiting these flaws.</span></p><p><br><span style="color: rgb(0, 0, 0)">A common thread among these and other victims of DeFi hacks is that the protocols were unaudited or the attack targeted vulnerabilities outside the scope of the audit. To learn more about protecting your project from these and other common attacks, reach out to Halborn’s smart contract auditors </span><a target="_blank" rel="" href="https://www.halborn.com/contact"><u><span style="color: rgb(17, 85, 204)">here</span></u></a><span style="color: rgb(0, 0, 0)">.</span></p>

Web3 security firm Halborn recaps the biggest DeFi hacks that occurred in February 2023.

Biggest DeFi Hacks in February 2023

<p>January 2023 started off the new year relatively quietly in terms of DeFi hacks.&nbsp; While a few large hacks occurred against DeFi protocols, many of the most significant hacks targeted individuals.</p><h2>January 2023 DeFi Hacks Recap</h2><p>Normally, attacks against major DeFi projects are the ones that make headlines.&nbsp; However, in 2023, many of the biggest attacks were against <a href="https://halborn.com/nft-scams-how-to-protect-your-assets-from-targeted-crypto-hacks/">individuals instead of projects</a>.&nbsp; Some of the people in the crypto space that were targeted in January 2023 include the following:</p><ul><li>Kevin Rose</li><li>NFT God</li><li>Nikhil Gopalani</li><li>CryptoNovo</li><li>Luke Dashjr</li></ul><p>In January 2023, MetaMask also reported a new attack vector in which cybercriminals take advantage of laziness when copy-pasting addresses.&nbsp; Learn more about these <a href="https://halborn.com/metamask-warns-of-new-address-poisoning-crypto-scam/">address poisoning attacks in our blog</a>.</p><h2>The <a href="https://halborn.com/explained-the-lendhub-hack-january-2023/">LendHub Hack</a></h2><p>While major DeFi hacks were rarer in January 2023, they were not non-existent.&nbsp; An attack against <a href="https://halborn.com/explained-the-lendhub-hack-january-2023/">LendHub</a> exploited a failure to disable a deprecated IBSC token contract when replacing it, which caused two versions of the token to be live at once.&nbsp; The attacker exploited discrepancies between the two tokens’ liability calculations to steal about $6 million from the project.</p><h2>Protecting Against DeFi Attacks</h2><p>Most months, the leading DeFi hacks exploit vulnerabilities in smart contracts.  However, in January 2023, all of the major hacks involved either personal wallet security or the exploitation of poor security practices when upgrading smart contracts.</p><p><br>An effective cybersecurity strategy is one that considers all potential areas of risk to a project and its users.  If you’re planning to release or upgrade a DeFi project, reach out to our Web3 security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a> for help with ensuring a secure rollout.</p>

Blockchain security firm Halborn provides a recap of the biggest DeFi hacks that occurred in the month of January in 2023.

Biggest DeFi Hacks in January 2023

<p>In the last month of 2022, DeFi hackers closed out the year with a bang with multiple major hacks.&nbsp; This month’s top hacks used a range of techniques, including compromised private keys, phishing attacks, data breaches, and flashloan exploits.</p><p>As usual, December 2022 saw tens of millions of dollars stolen from DeFi projects.&nbsp; Below is a recap of some of the biggest and most novel crypto attacks that occurred in December 2022:</p><h2><a href="https://halborn.com/explained-the-ankr-and-helio-hacks-november-2022/">Ankr and Helio</a></h2><p>In December 2022, the private key governing Ankr contracts on BNB Chain was leaked in the midst of an update.&nbsp; With access to this key, the attacker was able to perform a malicious update to the contract that made the mint function publicly accessible.&nbsp; The attacker then minted 60 trillion aBNBc tokens with a total value of over $5 million.&nbsp; This and copycat attacks crashed the value of the token.</p><p>A follow-on attack against Helio exploited this vulnerability and a delayed price oracle used by the Helio smart contracts.&nbsp; An attacker minted 183,000 aBNB tokens and deposited them into Helio before taking out a loan for $16 million in HAY stablecoin.</p><h2><a href="https://halborn.com/explained-the-lodestar-finance-hack-november-2022/">Lodestar</a></h2><p>The Lodestar protocol suffered a $7 million hack in December 2022.&nbsp; The attacker exploited a vulnerability in how the project tracked token prices.&nbsp; The smart contract allowed token values to be updated within a single block via donations, making it vulnerable to flashloan attacks.</p><p>After taking out an initial flashloan, the attacker began a cycle of depositing tokens into the platform and taking out loans against these deposits.&nbsp; This allowed the attacker to accumulate a large supply of lplsGLP.&nbsp; After manipulating the perceived value via donations, the attacker was able to cash out at a high profit, draining approximately $7 million from the protocol.</p><h2><a href="https://halborn.com/explained-the-raydium-hack-november-2022/">Raydium</a></h2><p>Raydium is another example of a major DeFi hack in December 2022 that exploited a compromised private key.&nbsp; In this case, a Trojan attack against the project pool manager was used to access the private key.</p><p>Access to this key allowed the attacker to manipulate how the platform managed fees.&nbsp; Manipulating the parameters of this function allowed the attacker to increase fees and drain over $4,395,000 from nine vulnerable pools.</p><h2><a href="https://halborn.com/explained-the-defrost-hack-december-2022/">DeFrost</a></h2><p>The December attack against the DeFrost protocol was actually two different attacks.&nbsp; The first was a flashloan attack exploiting a lack of reentrancy protections in one version of the protocol.&nbsp; By manipulating the price of LSWUSDC used by the project, the attacker stole about $173,000.</p><p>The other attack involved a compromised private key for the protocol’s contracts.&nbsp; With this key, the attacker was able to add a fake collateral token and a malicious price oracle.&nbsp; This combination allowed the attacker to mint 100 million H20 tokens and liquidate users to drain about $12 million from the project.</p><h2><a href="https://halborn.com/explained-the-bitkeep-hack-december-2022/">BitKeep</a></h2><p>The BitKeep attack is a lesson in doing your own research before trusting a site.&nbsp; Attackers used phishing sites to deliver malicious versions of the BitKeep Android app.&nbsp; Users who downloaded the malicious apps had value drained from their blockchain accounts via unauthorized transactions after they provided their private key or mnemonic seed to the malicious app.</p><h2><a href="https://halborn.com/explained-the-3commas-breach-december-2022/">3Commas</a></h2><p>The 3Commas hack demonstrates the risks of trusting centralized institutions with private keys and other data that controls blockchain accounts.&nbsp; The 3Commas platform suffered a data leak of API keys that allowed attackers to transfer approximately $20 million in tokens from users’ accounts on exchanges that they linked to the platform.</p><h2>Securing DeFi Smart Contracts</h2><p>In December 2022, the biggest threat to DeFi smart contracts appeared to be <a href="https://halborn.com/stolen-keys-3-ways-you-can-keep-your-private-keys-safe/">private key security</a>.  Multiple attacks exploited compromised private keys, underscoring the importance of using multi-signature wallets for critical accounts.  Additionally, multiple projects were exploited via <a href="https://halborn.com/what-is-a-flash-loan-attack/">flashloan attacks</a> due to reentrancy and price manipulation vulnerabilities.</p><p><br>Many of these major DeFi hacks could have been prevented by a security audit that found and fixed these issues before deployment.  To learn more about securing your blockchain project’s smart contracts, reach out to our Web3 security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Web3 security firm Halborn recaps the biggest DeFi hacks that took place in December 2022, including the 3Commas breach.

Biggest DeFi Hacks in December 2022

<p><a href="https://halborn.com/biggest-defi-hacks-in-october-2022/">October 2022</a> was one of the biggest months in the history of DeFi hacks.&nbsp; After that, November 2022 was relatively quiet in terms of hacked DeFi projects.</p><p>However, that isn’t to say that nothing happened in November 2022.&nbsp; This month, FTX, the third-largest cryptocurrency exchange, announced bankruptcy and experienced a follow-on hack.&nbsp; In addition to these, there were a few other notable hacks in November 2022.&nbsp;</p><h2>November 2022 DeFi Hacks Recap</h2><p>The majority of DeFi hacks performed in November 2022 were for relatively small amounts as DeFi hacks go.&nbsp; However, a few incidents stood out from the crowd:</p><h3>FTX</h3><p>Most of the FTX headlines from November 2022 focused on the company’s bankruptcy declaration.&nbsp; Poor internal auditing and mismanagement of customer funds led to low liquidity and a bank run on the cryptocurrency exchange.&nbsp; As a result, the company declared bankruptcy, leading to further revelations.</p><p>In the midst of this bankruptcy declaration, FTX also <a href="https://halborn.com/explained-the-ftx-hack-november-2022/">lost approximately $338 million</a> in tokens to an attacker.&nbsp; The chaos around the company’s bankruptcy declaration and the resultant move of tokens to cold wallets for storage made details difficult to determine and resulted in claims of an insider threat and malware being deployed in FTX apps.</p><h3>Skyward Finance</h3><p>In November 2022, <a href="https://halborn.com/explained-the-skyward-finance-hack-november-2022/">Skyward Finance made history</a> as the first NEAR-based DeFi project on the Rekt leaderboard of the biggest DeFi hacks.&nbsp; The attacker exploited vulnerabilities in the project’s token redemption code to perform multiple redemptions and withdrawals for the same Skyward tokens.&nbsp; In total, the attacker drained $3.2 million from the project.</p><h3>DFX</h3><p>DFX is a decentralized cryptocurrency exchange that specializes in stablecoins.&nbsp; In November 2022, two attackers, including a frontrunning bot, <a href="https://halborn.com/explained-the-dfx-finance-hack-november-2022/">stole $7.5 million in total</a> from the project.</p><p>This attack was enabled by reentrancy vulnerabilities in the project’s flashloan functionality.&nbsp; The attacker took out loans from the contract and redeposited those loans.&nbsp; The contract mistakenly recorded that the loan was repaid and also that the attacker had made a deposit, allowing them to withdraw that deposit for a profit.</p><h2>Securing DeFi Smart Contracts</h2><p>Like many DeFi hacks, most of the hacks that occurred in November 2022 were entirely preventable.  Unaudited projects containing common vulnerabilities — such as poor input validation and reentrancy — are the main targets of successful DeFi attacks<br>A security audit before deployment can help to find these vulnerabilities and save a DeFi project and its users millions.  To find out more, reach out to our DeFi security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Web3 security firm Halborn recaps the biggest DeFi hacks that took place in November 2022, including the major FTX incident.

Biggest DeFi Hacks in November 2022

<p>October 2022 was unusual for the sheer volume of DeFi hacks that occurred.&nbsp; On October 11th, a <a href="https://halborn.com/a-hat-trick-of-defi-hacks-underscores-the-importance-of-defi-security/">“hat trick” of hacks</a> — and one false positive — resulted in over $104 million being stolen.&nbsp; The week before, a BNB Chain hack <a href="https://rekt.news/leaderboard/">took third place on the Rekt Leaderboard</a> with $586 million in losses. In this article, part of our new Month in Review series, we’ll break down the biggest DeFi hacks of the month.&nbsp;</p><h2>October 2022 DeFi Hacks Recap</h2><p>Dozens of DeFi projects were targeted by attackers in October 2022.&nbsp; These are some of the largest and most novel attacks that we observed that month.</p><h3>Transit Swap</h3><p>Transit Swap is a cross-chain DEX aggregator that <a href="https://halborn.com/explained-the-transit-swap-hack-october-2022/">suffered a $21 million hack</a> in October 2022.&nbsp; The attacker took advantage of a lack of input validation in the claimTokens function when transferring tokens.&nbsp; An attacker was able to specify the address of the token contracts and extract tokens from the accounts of users who had existing DeFi approvals.</p><h3>BNB Chain</h3><p>The BSC Beacon cross-chain bridge <a href="https://halborn.com/explained-the-bnb-chain-hack-october-2022/">suffered a $586 million hack</a> in October 2022, placing it in the top three DeFi hacks to date.&nbsp; The attacker was able to fake transfers on the chain and perform two withdrawals of 1 million BNB.&nbsp; After the hack was discovered, BNB Chain validators halted operations, freezing the bulk of the stolen funds on-chain.</p><h3>Rabby Swap</h3><p>An attack on Rabby Swap was one of three hacks performed on October 11, 2022.&nbsp; The attacker took advantage of a vulnerability in the Rabby Swap function to drain value from users of the Rabby cryptocurrency wallet who had created DeFi approvals.&nbsp; In total, approximately $200,000 in tokens was stolen.</p><h3>Temple DAO Stax</h3><p>The Temple DAO Stax attacker took advantage of the fact that the contract’s migrateStake function was publicly accessible and lacked input validation.&nbsp; On October 11, the attacker was able to transfer stake from a fake old address, enabling them to drain about $2.3 million from the protocol.</p><h3>Mango Markets</h3><p>Mango Markets was the third hack to occur on October 11, 2022.&nbsp; In this case, the attacker took advantage of flaws in how the contract tracked the value of collateral.&nbsp; By artificially amplifying the perceived value of collateral invested in the contract, the attacker was able to take out large loans for about $100 million in profit.</p><h3>Sovryn</h3><p>Sovryn, a Rootstock-based project, <a href="https://halborn.com/explained-the-sovryn-hack-october-2022/">was exploited for approximately $1 million</a> in October.&nbsp; A flashloan attack exploited an unsafe external call by the Sovryn contract.&nbsp; This unsafe call to the attacker’s contract allowed the attacker to mint tokens and take advantage of the price manipulation vulnerability to burn them for more tokens than were used to create them.</p><h3>BitKeep</h3><p>The <a href="https://halborn.com/explained-the-bitkeep-hack-october-2022/">October 2022 hack of BitKeep</a> took advantage of DeFi approvals created by the project’s users.&nbsp; An attacker managed to take over the BitKeep swap/router and used these approvals to drain approximately $1 million in tokens from users’ accounts via these approvals.</p><h3>OlympusDAO</h3><p>OlympusDAO was piloting its new OHM Bonds project when the Bond protocol controls used for the pilot <a href="https://halborn.com/explained-the-olympusdao-hack-october-2022/">were exploited by an attacker</a>.&nbsp; An input validation error in the contract’s redeem function allowed the attacker to steal $292,000 in tokens.&nbsp; Since this was a limited pilot, the damage was limited and, ironically, lower than the bug bounty payout on Immunefi would have been.</p><h2>Securing DeFi Smart Contracts</h2><p>In October 2022, the DeFi space experienced a high volume of hacks as well as some high-impact ones, such as the hack of the BNB Chain.  These hacks were made possible by various different factors; however, poor input validation and exploitation of DeFi approvals showed up in multiple examples.<br></p><p>In many cases, the vulnerabilities that enabled these attacks could have been identified and resolved via a smart contract audit before launch.  To learn more about enhancing the security of your DeFi contracts, reach out to our blockchain security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Blockchain security firm Halborn breaks down the biggest and most notable DeFi hacks of the month of October 2022.

// Blog

Month in Review

Articles