2016-2023
Comprehensive
Report
/ Scroll down to find out the surprising trends and data we uncovered /
//STATS & FINDINGS
5 KEY FINDINGS
$7.35 BILLION in total losses¹
2016-2023
TOTAL LOSSES
from top 100
$7.35
BILLION
Largest Hack
The $624 million Ronin Network hack in 2022$624
MILLION
Most attacked chains
Ethereum, Binance Smart Chain, PolygonETH, BSC,
POLYGONCommon Exploits
- Direct contract exploitation: 33%
- Compromised private keys: 27%
- Price manipulation: 27%
33%
direct contract exploitation
Audited vs Unaudited
- Only 20% of hacked were audited
- Audited protocols accounted for 14.3% of the total value lost
39%
not audited
//Defi Hacks
A Growing Trend
NUMBER OF ATTACKS PER YEAR¹
AMOUNT OF MONEY LOST PER YEAR¹
//Ethereum and Binance Smart Chain
The Most Targeted Chains
Distribution of Attacks per Chain¹
Rankings by Chain and Number of Attacks¹
//The Achilles Heel of DeFi
Smart Contract Vulnerabilities
Main Smart-Contract Related Vulnerability Types¹
Losses by Vulnerability Type¹
Mar Aguilar
Lead Security Architect and Researcher, Author of the Top 100 DeFi Hacks Report
//STAY AHEAD OF HACKERS
5 Best Practices for Preventing DeFi Breaches
Implement Comprehensive Security Audits: Regular and thorough audits of smart contracts and the entire ecosystem can identify and mitigate vulnerabilities before they are exploited.
Use Multi-Signature or Multi-Party Computation (MPC) Wallets: These wallets enhance security by requiring multiple signatures or computations for transactions, reducing the risk of single-point failures.
Regular Updates and Patches: Keeping smart contracts updated with the latest security patches can prevent known vulnerabilities from being exploited.
Robust Key Management Practices: Employing cold wallets for storing private keys and ensuring strong encryption and storage practices can protect against key compromises.
Monitor for Suspicious Activities: Implementing real-time monitoring and conducting regular security assessments can help detect and respond to potential threats swiftly.
Want to stay ahead?
Sign up to receive future reports and updates from our research team
¹ It should be noted that 2018 and 2019 do not appear throughout the datasets. This is because none of the attacks during those years were big enough to make it to the top 100 list.
