Halborn Logo

TOP 100 ALL-TIME HACKS

2016-2023

Discover the comprehensive review of the top 100 DeFi hacks and their implications on the blockchain ecosystem.
Download the full report now to stay informed and protect your assets.

Halborn logotext
Top Hacks Hero
Breaking Down the Top 100 DeFi Hacks

2016-2023

Comprehensive

Report

Halborn H

/ Scroll down to find out the surprising trends and data we uncovered /

//STATS & FINDINGS

5 KEY FINDINGS

$7.35 BILLION in total losses¹

Total Loss Graph

2016-2023

  • TOTAL LOSSES

    from top 100
    Halborn Slash

    $7.35

    BILLION

    Halborn Slash
  • Largest Hack

    The $624 million Ronin Network hack in 2022
    Halborn Slash

    $624

    MILLION

    Halborn Slash
  • Most attacked chains

    Ethereum, Binance Smart Chain, Polygon
    Halborn Slash

    ETH, BSC,
    POLYGON

    Halborn Slash
  • Common Exploits

    • Direct contract exploitation: 33%
    • Compromised private keys: 27%
    • Price manipulation: 27%
    Halborn Slash

    33%

    direct contract exploitation

    Halborn Slash
  • Audited vs Unaudited

    • Only 20% of hacked were audited
    • Audited protocols accounted for 14.3% of the total value lost
    Halborn Slash

    39%

    not audited

    Halborn Slash

//Defi Hacks

A Growing Trend

NUMBER OF ATTACKS PER YEAR¹

Attacks Per Year Graph
The number of attacks peaked in 2021, with 38% of the top 100 hacks occurring in that year. The trend showed a slight decline in 2022 and 2023 but remained significant.

AMOUNT OF MONEY LOST PER YEAR¹

Money Lost Per Year Graph
Losses peaked in 2021 and 2022, highlighting the increasing scale of DeFi and the high stakes involved.

//Ethereum and Binance Smart Chain

The Most Targeted Chains

Distribution of Attacks per Chain¹

Distribution of attacks per chain Graph
Ethereum leads in both the number of attacks and total value lost, followed by Binance Smart Chain and Polygon.

Rankings by Chain and Number of Attacks¹

Distribution of attacks per chain Graph
This indicates a correlation between TVL and attack frequency, although some chains are disproportionately targeted relative to their size.

//The Achilles Heel of DeFi

Smart Contract Vulnerabilities

DeFi protocols face diverse vulnerabilities, with input validation flaws and logic errors being most frequent. Proof verification errors, while less common, lead to significant losses. 
Robust auditing and validation processes are essential to mitigate these risks and protect against substantial financial damage. By focusing on comprehensive input validation, secure contract logic, and thorough proof verification, projects can enhance their security posture.
Investing in regular security audits, adopting industry best practices, and utilizing established libraries can further minimize the risk of exploits and ensure the integrity of DeFi systems.

Main Smart-Contract Related Vulnerability Types¹

Smart Contract Vulnerability Types

Losses by Vulnerability Type¹

Smart Contract Vulnerability Types
"Although hacks have seemed to decrease in both number and severity over the past year, they still present a significant threat to the Web3 space. This report shows that protocols need to secure not only their on-chain components but also their off-chain ones. Understanding which types of vulnerabilities are more likely to be attack vectors in specific protocols and chains can also help developers and auditors identify and mitigate potential threats in order to improve an organization’s security."
Mar Aguilar Avatar

Mar Aguilar

Lead Security Architect and Researcher, Author of the Top 100 DeFi Hacks Report

//STAY AHEAD OF HACKERS

5 Best Practices for Preventing DeFi Breaches

  • Implement Comprehensive Security Audits: Regular and thorough audits of smart contracts and the entire ecosystem can identify and mitigate vulnerabilities before they are exploited.

  • Use Multi-Signature or Multi-Party Computation (MPC) Wallets: These wallets enhance security by requiring multiple signatures or computations for transactions, reducing the risk of single-point failures.

  • Regular Updates and Patches: Keeping smart contracts updated with the latest security patches can prevent known vulnerabilities from being exploited.

  • Robust Key Management Practices: Employing cold wallets for storing private keys and ensuring strong encryption and storage practices can protect against key compromises.

  • Monitor for Suspicious Activities: Implementing real-time monitoring and conducting regular security assessments can help detect and respond to potential threats swiftly.

Want to stay ahead?

Sign up to receive future reports and updates from our research team

Need Help? WE've GOT YOUR BACK!

Reach out to our experts for tailored advice and security solutions.

¹ It should be noted that 2018 and 2019 do not appear throughout the datasets. This is because none of the attacks during those years were big enough to make it to the top 100 list.

Data Sea
© Halborn 2024. All rights reserved.