<p><span>May 2023 saw a relatively high number of large-scale DeFi hacks and </span><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/what-is-a-rug-pull-in-crypto"><u><span>rug pulls</span></u></a><span>. This included high-profile hacks — such as an </span><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-tornado-cash-hack-may-2023"><u><span>exploit of Tornado Cash</span></u></a><span>’s decentralized governance mechanism — as well as some exploits of smart contract vulnerabilities and several high-value rug pulls.</span></p><h2><span>Contract Exploits</span></h2><p><span>Several of the biggest DeFi hacks of May 2023 involved smart contract vulnerabilities. Some major exploits include:</span><br></p><ul><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-deus-dao-hack-may-2023"><strong><u><span>Deus DAO</span></u></strong></a><strong><span>:</span></strong><span> The Deus DAO smart contract’s burnFrom function had an error in the ordering of its arguments. An attacker was able to create allowances for their address on other users’ accounts, allowing them to drain about $6.5 million from users’ wallets.</span></p></li><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-jimbos-protocol-hack-may-2023"><strong><u><span>Jimbos Protocol</span></u></strong></a><strong><span>:</span></strong><span> The Jimbos protocol suffered a flashloan attack enabled by a lack of slippage protections. By creating an imbalance in a trading pair, an attacker was able to steal an estimated $7.5 million via highly profitable swaps.</span></p></li><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-level-finance-hack-may-2023"><strong><u><span>Level Finance</span></u></strong></a><strong><span>:</span></strong><span> The Level Finance project suffered a $1.1 million hack in May 2023. The reward claiming code was missing a check that validated that referral rewards were only claimed once per epoch, allowing the attacker to drain value from the protocol.</span></p></li><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-swap-lp-hack-may-2023"><strong><u><span>Swap-LP</span></u></strong></a><strong><span>:</span></strong><span> The Swap-LP exploiter took advantage of an exposed low-level function in the project’s smart contract that allowed them to transfer all WDZD tokens in a trading pair to be transferred to the factory address. This unbalanced the trading pair, enabling the attacker to steal approximately $1 million from the protocol.</span></p></li></ul><h2><span>Governance Exploits</span></h2><p><span>In May 2023, an attacker </span><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-tornado-cash-hack-may-2023"><u><span>exploited Tornado Cash’s governance system</span></u></a><span> via a malicious proposal to steal about $2,173,500 from governance vaults. The proposal had a self-destruct function that allowed the attacker to replace benign code with malicious functionality that issued them enough governance tokens to completely control the system. This control allowed them to drain tokens from governance vaults and to perform a denial-of-service (DoS) attack against the Tornado router.</span></p><h2><span>Rug Pulls and Exit Scams</span></h2><p><span>May 2023 also saw several high-value rug pulls and exit scams, with the Arbitrum blockchain especially targeted. The most high-value rug pulls include:</span><br></p><ul><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-fintoch-rug-pull-may-2023"><strong><u><span>Fintoch</span></u></strong></a><strong><span>:</span></strong><span> The BSC-based Fintoch blockchain financial platform was a Ponzi scheme that resulted in a $31.6 million rug pull after user funds were locked in the protocol.</span></p></li><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-swaprum-rug-pull-may-2023"><strong><u><span>Swaprum</span></u></strong></a><strong><span>:</span></strong><span> Swaprum’s founders used a backdoor add() function in its smart contract to steal deposited liquidity pool tokens, which allowed them to drain about $3 million from the project.</span></p></li><li><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-xirtam-rug-pull-may-2023"><strong><u><span>XIRTAM</span></u></strong></a><strong><span>:</span></strong><span> The Arbirtrum-based XITRAM project performed a rug pull for about $3.5 million, draining value collected during a recent fund-raising round.</span></p></li></ul><h2><span>Protecting Against DeFi Hacks</span></h2><p><span>With the exception of the Tornado Cash governance hack, most of the major DeFi hacks in May 2023 were preventable. Several involved the exploitation of smart contract vulnerabilities, and the rest were rug pulls that used backdoor functions built into the protocol’s smart contracts.</span></p><p><span>While rug pull backdoors are intentional features, both they and the vulnerabilities exploited in these hacks could have been detected and remediated as part of a smart contract audit. To learn more about protecting your Web3 project against a major hack, </span><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/contact"><u><span>get in touch</span></u></a><span> with Halborn.&nbsp;</span></p>

Biggest DeFi Hacks in May 2023.jpg

Web3 security firm Halborn recaps the biggest DeFi hacks and rug pulls that occurred in May 2023. 

Biggest DeFi Hacks in May 2023

<p>Compared to the first three months of the year, April 2023 suffered a greater number of large-scale ($1M+) DeFi hacks. This month, several protocols were hacked, major rug pulls were carried out, and even MEV operators suffered significant losses.</p><h2>April 2023 DeFi Hacks Recap</h2><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-sentiment-hack-march-2023"><u>Sentiment</u></a></h3><p>The Sentiment hack was enabled by a read-only reentrancy vulnerability. By exploiting this error, the attacker was able to steal $1 million from the protocol.</p><p>In this case, exploiting the reentrancy vulnerability caused the vulnerable contract to miscalculate the number of tokens in its pool. This caused it to miscalculate the value of those tokens, allowing the attacker to take out a loan that stole $1 million from the protocol.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-sushi-swap-hack-march-2023"><u>SushiSwap</u></a></h3><p>A vulnerability in SushiSwap’s RouteProcessor2 contract was exploited by an attacker only a few days after launch. The attacker took advantage of a failure to validate user-provided input to steal about $3.3 million from the protocol.</p><p>The issue was that an attacker could manipulate the previous pool address, which is used to validate a future request. By pointing the pool address to a malicious pool, the attacker was able to drain value from users with existing approvals for the new RouteProcessor2 contract.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-yearn-finance-hack-april-2023"><u>Yearn Finance</u></a></h3><p>In April 2023, Yearn Finance suffered another major hack. In this case, the attacker exploited a vulnerability that lurked in the protocol’s smart contracts for years.</p><p>A copy-paste error in an old Yearn contract used the address of a Fulcrum USDC contract rather than the intended USDT contract. An attacker exploited this mismatch to manipulate the value of yUSDT tokens and steal approximately $10 million from the protocol.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-hundred-finance-hack-april-2023"><u>Hundred Finance</u></a></h3><p>In April 2023, Hundred Finance suffered a $7.4 million hack. The attacker exploited the fact that two, duplicate WTC hToken contracts were set up by the protocol.</p><p>The attacker donated value to the unused contract, changing the WTC/hWTC exchange rate. This allowed the attacker to drain value from the contract, an issue exacerbated by a rounding error in the value calculation.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-mev-bots-hack-april-2023"><u>MEV Bots</u></a></h3><p>Frontrunning bots usually steal value from others, but a vulnerability in mev-boost-relay allowed a malicious validator to turn the tables. In this case, the issue cost bot operators approximately $25 million.</p><p>Normally, a block proposer for a MEV relay only sees the block’s contents after it has signed the block header. In this case, a proposer who was also a validator sent an invalid block to the relay. The block contents were sent to the validator but not submitted to the network, allowing the validator to perform a sandwich attack and claim $25 million that the exploited bots planned to claim.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-ordinals-finance-rug-pull-april-2023"><u>Ordinals Finance</u></a></h3><p>In April 2023, Ordinals Finance performed a $1 million rug pull. The contract had built-in functions that allowed the owner to drain the value deposited in it.</p><h3><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-merlin-dex-hack-april-2023"><u>Merlin DEX</u></a></h3><p>In April 2023, Merlin DEX was the victim of a $1.8 million hack. The new protocol was undergoing a Liquidity Generation Event when an attacker exploited the protocol’s centralized permissions.</p><p>The Feeto address used to launch the protocol had full access, allowing it to drain liquidity being deposited into the project. The potential rug pull exploited issues marked as resolved in a security audit but never actually fixed.</p><h2>Lessons Learned in April 2023</h2><p>April 2023 saw DeFi hacks exploiting a wide range of security issues. In some cases, smart contracts contained exploitable vulnerabilities. In others, deployment errors placed funds at risk. Finally, rug pulls exploited centralized control over smart contract functionality. </p><p>In most cases, these issues could and should have been identified and fixed as part of a smart contract audit. To learn more about securing your smart contracts, <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/contact"><u>contact us</u></a>.</p>

Biggest DeFi Hacks in April 2023.jpg

Web3 security firm Halborn recaps the biggest DeFi hacks that occurred in April 2023.

Biggest DeFi Hacks in April 2023

<p><span>In March 2023, the biggest news in the financial sector was the collapse of Silicon Valley Bank (SVB) and Signature Bank. These incidents — caused by a combination of lax regulation, under-diversification, and rising interest rates — threatened bank runs across the sector.</span></p><p><span>The impact of these incidents on DeFi was minimal as only a few organizations had holding in these banks, and the US Fed elected to guarantee all deposits. However, the DeFi industry had a few major security incidents of its own this month.</span></p><h2><span>March 2023 DeFi Hacks Recap</span></h2><h2><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-safe-moon-hack-march-2023"><u><span>SafeMoon</span></u></a></h2><p><span>In March 2023, SafeMoon was exploited via vulnerability introduced in the latest upgrade to the protocol. This upgrade created a publicly-accessible burn function that was used to drain approximately $8.9 million in value from the project’s SFM/BNB pool.</span></p><p><span>This vulnerability was so basic that it was suggested that it may have been the result of compromised private keys and a malicious update. In the end, the attacker claimed to be a whitehat MEV operator and discussed returning some funds to the protocol.</span></p><h2><span>Euler Finance</span></h2><p><span>The March 2023 hack of Euler Finance was one of the largest to date, draining approximately $197 million from the protocol. The attack was made possible by a vulnerability in an update to the protocol’s smart contracts made in July 2022.</span></p><p><span>The updated code was missing checks to verify the health of a user’s position when donating eTokens to the project’s reserves. By creating bad debt on one contract, donating its collateral, and liquidating it at a discount with another, the attacker was able to drain value from the protocol, affecting both it and other projects who had integrated with it.</span></p><h2><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/blog/post/explained-the-swerve-finance-hack-march-2023"><u><span>Swerve Finance</span></u></a></h2><p><span>Technically, Swerve Finance wasn’t hacked in March 2023. However, the defunct project easily could have been to the tune of $1.3 million.</span></p><p><span>Swerve Finance uses a decentralized governance structure that allows users to make proposals and vote on them. A failed attack on the protocol in March 2023 tried to claim $120K in admin fees and $1.3 million in locked value using a malicious proposal. However, the attacker failed to muster the votes, needed to carry out the attack successfully.</span></p><h2><span>Lessons Learned in March 2023</span></h2><p><span>In March 2023, the biggest DeFi hacks exploited a variety of different vulnerabilities including unprotected burn functions and incomplete validation. Protecting against these types of attacks requires a comprehensive analysis of smart contracts’ code and business logic. For more information, reach out to our </span><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.halborn.com/contact"><u><span>Web3 security experts</span></u></a><span>.</span></p>

Biggest DeFi Hacks in March 2023.jpg

Web3 security firm Halborn recaps the DeFi hacks that occurred during March 2023. 

Biggest DeFi Hacks in March 2023

<p><span style="color: rgb(0, 0, 0)">While February 2023 was quieter than many months, there were still a few significant DeFi hacks. In general, these DeFi attackers exploited common and avoidable vulnerabilities and security errors.</span></p><h2><span style="color: rgb(0, 0, 0)">February 2023 DeFi Hacks Recap</span></h2><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-bonqdao-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">BonqDAO</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">In February 2023, BonqDAO was the victim of a price oracle manipulation attack. By taking advantage of the protocol’s price update mechanisms, the attacker was able to drain approximately $120 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">The root cause of the incident was the fact that BonqDAO allows users to request updates to price information that are immediately applied. By strategically increasing and decreasing the perceived value of a token, the attacker was able to inflate the amount of value that they could redeem deposited tokens for and then liquidate other users’ deposits for a profit.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-dforce-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">dForce</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">The February 2023 dForce hack exploited a known reentrancy vulnerability in the protocol’s Curve Finance vaults. By targeting certain vaults on the Arbitrum and Optimism blockchains, the attacker was able to steal about $3.6 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">The reentrancy vulnerability was exploited via a classic flashloan attack. The attacker used the vulnerability to drive down the perceived price of an asset, enabling them to liquidate the positions of other users. In the end, the stolen $3.6 million was returned to the protocol.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-liangopay-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">LianGoPay</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">The LianGoPay attack was made possible by compromised private keys. The attacker deployed fake contracts and tricked users into deposits that allowed them to steal $1.6 million from the protocol.</span><br></p><p><span style="color: rgb(0, 0, 0)">This hack was obviously performed by someone with access to the project’s private keys because the attacker was able to create fake pledge pools using malicious contracts with similar addresses to real ones. These contracts were created at nearly the same time as a legitimate one and used deception to fool users into depositing funds into the wrong ones.</span></p><h2><a target="_blank" rel="" href="https://www.halborn.com/blog/post/explained-the-orion-protocol-hack-february-2023"><u><span style="color: rgb(17, 85, 204)">Orion</span></u></a></h2><p><span style="color: rgb(0, 0, 0)">Like dForce, Orion was the victim of a reentrancy attack. The attacker exploited the reentrancy vulnerability to steal about $3 million from the project.</span><br></p><p><span style="color: rgb(0, 0, 0)">The Orion attacker created a fake ATK token and performed a swap using it within the Orion smart contract. The call to the token contract to make the transfer allowed the attacker to exploit the reentrancy vulnerability and inflate the balance of their account within the Orion contract. Then, the attacker could simply withdraw this balance to steal $3 million from the protocol.</span></p><h2><span style="color: rgb(0, 0, 0)">Exploiting Avoidable Mistakes</span></h2><p><span style="color: rgb(0, 0, 0)">The biggest DeFi hacks of February 2023 weren’t very sophisticated. </span><a target="_blank" rel="" href="https://www.halborn.com/blog/post/what-is-a-re-entrancy-attack"><u><span style="color: rgb(17, 85, 204)">Reentrancy</span></u></a><span style="color: rgb(0, 0, 0)"> is a well-known vulnerability, price oracle manipulation is common, and </span><a target="_blank" rel="" href="https://www.halborn.com/blog/post/stolen-keys-3-ways-you-can-keep-your-private-keys-safe"><u><span style="color: rgb(17, 85, 204)">protecting private keys</span></u></a><span style="color: rgb(0, 0, 0)"> is fundamental to blockchain security. However, attackers were able to steal millions from DeFi projects by exploiting these flaws.</span></p><p><br><span style="color: rgb(0, 0, 0)">A common thread among these and other victims of DeFi hacks is that the protocols were unaudited or the attack targeted vulnerabilities outside the scope of the audit. To learn more about protecting your project from these and other common attacks, reach out to Halborn’s smart contract auditors </span><a target="_blank" rel="" href="https://www.halborn.com/contact"><u><span style="color: rgb(17, 85, 204)">here</span></u></a><span style="color: rgb(0, 0, 0)">.</span></p>

Biggest DeFi Hacks in February 2023.jpg

Web3 security firm Halborn recaps the biggest DeFi hacks that occurred in February 2023.

Biggest DeFi Hacks in February 2023

<p>January 2023 started off the new year relatively quietly in terms of DeFi hacks.&nbsp; While a few large hacks occurred against DeFi protocols, many of the most significant hacks targeted individuals.</p><h2>January 2023 DeFi Hacks Recap</h2><p>Normally, attacks against major DeFi projects are the ones that make headlines.&nbsp; However, in 2023, many of the biggest attacks were against <a href="https://halborn.com/nft-scams-how-to-protect-your-assets-from-targeted-crypto-hacks/">individuals instead of projects</a>.&nbsp; Some of the people in the crypto space that were targeted in January 2023 include the following:</p><ul><li>Kevin Rose</li><li>NFT God</li><li>Nikhil Gopalani</li><li>CryptoNovo</li><li>Luke Dashjr</li></ul><p>In January 2023, MetaMask also reported a new attack vector in which cybercriminals take advantage of laziness when copy-pasting addresses.&nbsp; Learn more about these <a href="https://halborn.com/metamask-warns-of-new-address-poisoning-crypto-scam/">address poisoning attacks in our blog</a>.</p><h2>The <a href="https://halborn.com/explained-the-lendhub-hack-january-2023/">LendHub Hack</a></h2><p>While major DeFi hacks were rarer in January 2023, they were not non-existent.&nbsp; An attack against <a href="https://halborn.com/explained-the-lendhub-hack-january-2023/">LendHub</a> exploited a failure to disable a deprecated IBSC token contract when replacing it, which caused two versions of the token to be live at once.&nbsp; The attacker exploited discrepancies between the two tokens’ liability calculations to steal about $6 million from the project.</p><h2>Protecting Against DeFi Attacks</h2><p>Most months, the leading DeFi hacks exploit vulnerabilities in smart contracts.  However, in January 2023, all of the major hacks involved either personal wallet security or the exploitation of poor security practices when upgrading smart contracts.</p><p><br>An effective cybersecurity strategy is one that considers all potential areas of risk to a project and its users.  If you’re planning to release or upgrade a DeFi project, reach out to our Web3 security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a> for help with ensuring a secure rollout.</p>

Biggest-DeFi-Hacks-in-January-2023-1.jpg

Blockchain security firm Halborn provides a recap of the biggest DeFi hacks that occurred in the month of January in 2023.

Biggest DeFi Hacks in January 2023

<p>In the last month of 2022, DeFi hackers closed out the year with a bang with multiple major hacks.&nbsp; This month’s top hacks used a range of techniques, including compromised private keys, phishing attacks, data breaches, and flashloan exploits.</p><p>As usual, December 2022 saw tens of millions of dollars stolen from DeFi projects.&nbsp; Below is a recap of some of the biggest and most novel crypto attacks that occurred in December 2022:</p><h2><a href="https://halborn.com/explained-the-ankr-and-helio-hacks-november-2022/">Ankr and Helio</a></h2><p>In December 2022, the private key governing Ankr contracts on BNB Chain was leaked in the midst of an update.&nbsp; With access to this key, the attacker was able to perform a malicious update to the contract that made the mint function publicly accessible.&nbsp; The attacker then minted 60 trillion aBNBc tokens with a total value of over $5 million.&nbsp; This and copycat attacks crashed the value of the token.</p><p>A follow-on attack against Helio exploited this vulnerability and a delayed price oracle used by the Helio smart contracts.&nbsp; An attacker minted 183,000 aBNB tokens and deposited them into Helio before taking out a loan for $16 million in HAY stablecoin.</p><h2><a href="https://halborn.com/explained-the-lodestar-finance-hack-november-2022/">Lodestar</a></h2><p>The Lodestar protocol suffered a $7 million hack in December 2022.&nbsp; The attacker exploited a vulnerability in how the project tracked token prices.&nbsp; The smart contract allowed token values to be updated within a single block via donations, making it vulnerable to flashloan attacks.</p><p>After taking out an initial flashloan, the attacker began a cycle of depositing tokens into the platform and taking out loans against these deposits.&nbsp; This allowed the attacker to accumulate a large supply of lplsGLP.&nbsp; After manipulating the perceived value via donations, the attacker was able to cash out at a high profit, draining approximately $7 million from the protocol.</p><h2><a href="https://halborn.com/explained-the-raydium-hack-november-2022/">Raydium</a></h2><p>Raydium is another example of a major DeFi hack in December 2022 that exploited a compromised private key.&nbsp; In this case, a Trojan attack against the project pool manager was used to access the private key.</p><p>Access to this key allowed the attacker to manipulate how the platform managed fees.&nbsp; Manipulating the parameters of this function allowed the attacker to increase fees and drain over $4,395,000 from nine vulnerable pools.</p><h2><a href="https://halborn.com/explained-the-defrost-hack-december-2022/">DeFrost</a></h2><p>The December attack against the DeFrost protocol was actually two different attacks.&nbsp; The first was a flashloan attack exploiting a lack of reentrancy protections in one version of the protocol.&nbsp; By manipulating the price of LSWUSDC used by the project, the attacker stole about $173,000.</p><p>The other attack involved a compromised private key for the protocol’s contracts.&nbsp; With this key, the attacker was able to add a fake collateral token and a malicious price oracle.&nbsp; This combination allowed the attacker to mint 100 million H20 tokens and liquidate users to drain about $12 million from the project.</p><h2><a href="https://halborn.com/explained-the-bitkeep-hack-december-2022/">BitKeep</a></h2><p>The BitKeep attack is a lesson in doing your own research before trusting a site.&nbsp; Attackers used phishing sites to deliver malicious versions of the BitKeep Android app.&nbsp; Users who downloaded the malicious apps had value drained from their blockchain accounts via unauthorized transactions after they provided their private key or mnemonic seed to the malicious app.</p><h2><a href="https://halborn.com/explained-the-3commas-breach-december-2022/">3Commas</a></h2><p>The 3Commas hack demonstrates the risks of trusting centralized institutions with private keys and other data that controls blockchain accounts.&nbsp; The 3Commas platform suffered a data leak of API keys that allowed attackers to transfer approximately $20 million in tokens from users’ accounts on exchanges that they linked to the platform.</p><h2>Securing DeFi Smart Contracts</h2><p>In December 2022, the biggest threat to DeFi smart contracts appeared to be <a href="https://halborn.com/stolen-keys-3-ways-you-can-keep-your-private-keys-safe/">private key security</a>.  Multiple attacks exploited compromised private keys, underscoring the importance of using multi-signature wallets for critical accounts.  Additionally, multiple projects were exploited via <a href="https://halborn.com/what-is-a-flash-loan-attack/">flashloan attacks</a> due to reentrancy and price manipulation vulnerabilities.</p><p><br>Many of these major DeFi hacks could have been prevented by a security audit that found and fixed these issues before deployment.  To learn more about securing your blockchain project’s smart contracts, reach out to our Web3 security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Biggest-DeFi-Hacks-in-December-2022.jpg

Web3 security firm Halborn recaps the biggest DeFi hacks that took place in December 2022, including the 3Commas breach.

Biggest DeFi Hacks in December 2022

<p><a href="https://halborn.com/biggest-defi-hacks-in-october-2022/">October 2022</a> was one of the biggest months in the history of DeFi hacks.&nbsp; After that, November 2022 was relatively quiet in terms of hacked DeFi projects.</p><p>However, that isn’t to say that nothing happened in November 2022.&nbsp; This month, FTX, the third-largest cryptocurrency exchange, announced bankruptcy and experienced a follow-on hack.&nbsp; In addition to these, there were a few other notable hacks in November 2022.&nbsp;</p><h2>November 2022 DeFi Hacks Recap</h2><p>The majority of DeFi hacks performed in November 2022 were for relatively small amounts as DeFi hacks go.&nbsp; However, a few incidents stood out from the crowd:</p><h3>FTX</h3><p>Most of the FTX headlines from November 2022 focused on the company’s bankruptcy declaration.&nbsp; Poor internal auditing and mismanagement of customer funds led to low liquidity and a bank run on the cryptocurrency exchange.&nbsp; As a result, the company declared bankruptcy, leading to further revelations.</p><p>In the midst of this bankruptcy declaration, FTX also <a href="https://halborn.com/explained-the-ftx-hack-november-2022/">lost approximately $338 million</a> in tokens to an attacker.&nbsp; The chaos around the company’s bankruptcy declaration and the resultant move of tokens to cold wallets for storage made details difficult to determine and resulted in claims of an insider threat and malware being deployed in FTX apps.</p><h3>Skyward Finance</h3><p>In November 2022, <a href="https://halborn.com/explained-the-skyward-finance-hack-november-2022/">Skyward Finance made history</a> as the first NEAR-based DeFi project on the Rekt leaderboard of the biggest DeFi hacks.&nbsp; The attacker exploited vulnerabilities in the project’s token redemption code to perform multiple redemptions and withdrawals for the same Skyward tokens.&nbsp; In total, the attacker drained $3.2 million from the project.</p><h3>DFX</h3><p>DFX is a decentralized cryptocurrency exchange that specializes in stablecoins.&nbsp; In November 2022, two attackers, including a frontrunning bot, <a href="https://halborn.com/explained-the-dfx-finance-hack-november-2022/">stole $7.5 million in total</a> from the project.</p><p>This attack was enabled by reentrancy vulnerabilities in the project’s flashloan functionality.&nbsp; The attacker took out loans from the contract and redeposited those loans.&nbsp; The contract mistakenly recorded that the loan was repaid and also that the attacker had made a deposit, allowing them to withdraw that deposit for a profit.</p><h2>Securing DeFi Smart Contracts</h2><p>Like many DeFi hacks, most of the hacks that occurred in November 2022 were entirely preventable.  Unaudited projects containing common vulnerabilities — such as poor input validation and reentrancy — are the main targets of successful DeFi attacks<br>A security audit before deployment can help to find these vulnerabilities and save a DeFi project and its users millions.  To find out more, reach out to our DeFi security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Biggest-DeFi-Hacks-in-November-2022.jpg

Web3 security firm Halborn recaps the biggest DeFi hacks that took place in November 2022, including the major FTX incident.

Biggest DeFi Hacks in November 2022

<p>October 2022 was unusual for the sheer volume of DeFi hacks that occurred.&nbsp; On October 11th, a <a href="https://halborn.com/a-hat-trick-of-defi-hacks-underscores-the-importance-of-defi-security/">“hat trick” of hacks</a> — and one false positive — resulted in over $104 million being stolen.&nbsp; The week before, a BNB Chain hack <a href="https://rekt.news/leaderboard/">took third place on the Rekt Leaderboard</a> with $586 million in losses. In this article, part of our new Month in Review series, we’ll break down the biggest DeFi hacks of the month.&nbsp;</p><h2>October 2022 DeFi Hacks Recap</h2><p>Dozens of DeFi projects were targeted by attackers in October 2022.&nbsp; These are some of the largest and most novel attacks that we observed that month.</p><h3>Transit Swap</h3><p>Transit Swap is a cross-chain DEX aggregator that <a href="https://halborn.com/explained-the-transit-swap-hack-october-2022/">suffered a $21 million hack</a> in October 2022.&nbsp; The attacker took advantage of a lack of input validation in the claimTokens function when transferring tokens.&nbsp; An attacker was able to specify the address of the token contracts and extract tokens from the accounts of users who had existing DeFi approvals.</p><h3>BNB Chain</h3><p>The BSC Beacon cross-chain bridge <a href="https://halborn.com/explained-the-bnb-chain-hack-october-2022/">suffered a $586 million hack</a> in October 2022, placing it in the top three DeFi hacks to date.&nbsp; The attacker was able to fake transfers on the chain and perform two withdrawals of 1 million BNB.&nbsp; After the hack was discovered, BNB Chain validators halted operations, freezing the bulk of the stolen funds on-chain.</p><h3>Rabby Swap</h3><p>An attack on Rabby Swap was one of three hacks performed on October 11, 2022.&nbsp; The attacker took advantage of a vulnerability in the Rabby Swap function to drain value from users of the Rabby cryptocurrency wallet who had created DeFi approvals.&nbsp; In total, approximately $200,000 in tokens was stolen.</p><h3>Temple DAO Stax</h3><p>The Temple DAO Stax attacker took advantage of the fact that the contract’s migrateStake function was publicly accessible and lacked input validation.&nbsp; On October 11, the attacker was able to transfer stake from a fake old address, enabling them to drain about $2.3 million from the protocol.</p><h3>Mango Markets</h3><p>Mango Markets was the third hack to occur on October 11, 2022.&nbsp; In this case, the attacker took advantage of flaws in how the contract tracked the value of collateral.&nbsp; By artificially amplifying the perceived value of collateral invested in the contract, the attacker was able to take out large loans for about $100 million in profit.</p><h3>Sovryn</h3><p>Sovryn, a Rootstock-based project, <a href="https://halborn.com/explained-the-sovryn-hack-october-2022/">was exploited for approximately $1 million</a> in October.&nbsp; A flashloan attack exploited an unsafe external call by the Sovryn contract.&nbsp; This unsafe call to the attacker’s contract allowed the attacker to mint tokens and take advantage of the price manipulation vulnerability to burn them for more tokens than were used to create them.</p><h3>BitKeep</h3><p>The <a href="https://halborn.com/explained-the-bitkeep-hack-october-2022/">October 2022 hack of BitKeep</a> took advantage of DeFi approvals created by the project’s users.&nbsp; An attacker managed to take over the BitKeep swap/router and used these approvals to drain approximately $1 million in tokens from users’ accounts via these approvals.</p><h3>OlympusDAO</h3><p>OlympusDAO was piloting its new OHM Bonds project when the Bond protocol controls used for the pilot <a href="https://halborn.com/explained-the-olympusdao-hack-october-2022/">were exploited by an attacker</a>.&nbsp; An input validation error in the contract’s redeem function allowed the attacker to steal $292,000 in tokens.&nbsp; Since this was a limited pilot, the damage was limited and, ironically, lower than the bug bounty payout on Immunefi would have been.</p><h2>Securing DeFi Smart Contracts</h2><p>In October 2022, the DeFi space experienced a high volume of hacks as well as some high-impact ones, such as the hack of the BNB Chain.  These hacks were made possible by various different factors; however, poor input validation and exploitation of DeFi approvals showed up in multiple examples.<br></p><p>In many cases, the vulnerabilities that enabled these attacks could have been identified and resolved via a smart contract audit before launch.  To learn more about enhancing the security of your DeFi contracts, reach out to our blockchain security experts at <a href="mailto:halborn@protonmail.com">halborn@protonmail.com</a>.</p>

Biggest-DeFi-Hacks-in-October-2022.jpg

Blockchain security firm Halborn breaks down the biggest and most notable DeFi hacks of the month of October 2022.

// Blog

Month in Review

Articles