Immunefi Crypto Losses 2024 Report

The team at Immunefi, the leading onchain crowdsourced security platform, has assessed the volume of crypto funds lost by the community due to hacks and scams in 2024.

Overview

The global crypto market cap surpassed $3 trillion in 2024, with over $137 billion in Total Value Locked (TVL) in Decentralized Finance (DeFi). This capital represents an unparalleled and attractive opportunity for blackhat hackers.

We have reviewed all instances where blackhat hackers have exploited various crypto protocols, as well as cases of protocols that have allegedly performed a rug pull in 2024. We have located 232 such instances, including both successful and semi-successful hacking attempts, as well as alleged fraud.

In total, we have seen a loss of $1,495,487,055 across the web3 ecosystem in 2024. $1,467,448,336 was lost to hacks in 2024 across 192 specific incidents and $28,038,719 was lost to fraud in across 40 specific incidents. The year was marked by two major attacks: DMM Bitcoin, a Japanese crypto exchange, and WazirX, India's leading domestic crypto exchange.

This number represents a 17% decrease compared to total losses in 2023, when hackers and fraudsters stole $1,803,290,600.

Key Takeaways in 2024

• The two major exploits of the year, DMM Bitcoin and WazirX, alone accounted for $540,000,000, representing 36% of all losses in 2024.
• In 2024, hacks continued to be the predominant cause of losses at 98.1% in comparison to frauds, scams, and rug pulls, which amounted to only 1.9% of the total losses.
• In 2024, DeFi continued to be the main target of successful exploits at 51.4% as compared to CeFi at 48.6% of the total losses. While most of the hackers' interest is directed toward DeFi, CeFi is experienced higher losses, most likely due to their outsized returns.
• The two most targeted chains in 2024 were Ethereum and BNB Chain. Ethereum witnessed 104 incidents representing 44% of the total losses across targeted chains. BNB Chain suffered 71 incidents, representing 39% respectively. Arbitrum came in third with 16 incidents, representing 6.8% of total losses across chains. Solana, Optimism, Blast, and Base followed with 6 incidents each.
• North Korean hackers have allegedly been responsible for two notable attacks, WazirX and Radiant Capital, profiting a combined total of $285 million and representing 16% of total crypto losses in 2024.
• In total, $115,577,966 has been recovered from stolen funds in 14 specific situations. This number makes up 7.7% of the total losses in 2024.
• The number of successful attacks decreased: single incidents decreased 27.5% YoY from 320 in 2023 to 232 in 2024, along with the total number of losses.

Top 10 Losses in 2024*

• DMM Bitcoin — $305,000,000
• WazirX — $235,000,000
• Orbit Bridge — $81,680,000
• Munchables — $62,800,000
• BtcTurk — $55,000,000
• BingX — $52,000,000
• Radiant Capital — $50,000,000
• Hedgey — $44,600,000
• PlayDapp — $32,350,000
• Penpie — $27,000,000

Losses by Quarter in 2024

Overview

In 2024, Q2 took the lead with $572,688,861 in total losses across 72 incidents, representing 38% of the total losses.

• Q1 — $348,251,217
• Q2 — $572,688,861
• Q3 — $423,994,499
• Q4 — $150,552,478

2023 vs 2024

In 2023, Q3 took the lead with $685,970,444 in total losses across 75 incidents, representing 38% of the total losses. In 2024, Q2 took the lead with $572,688,861 in total losses across 72 incidents, representing 38% of the total losses.

• Q1 — 2023: $437,483,543 | 2024: $348,251,217
• Q2 — 2023: $265,481,519 | 2024: $572,688,861
• Q3 — 2023: $685,970,444 | 2024: $423,994,499
• Q4 — 2023: $414,355,094 | 2024: $150,552,478

Quarterly Overview

Q1 2024: The total losses in Q1 2024 were $348,251,217. This number represents a 20.4% decrease compared to Q1 2023, when hackers and fraudsters stole $437,483,543. Most of that sum was lost by two specific projects: Orbit Bridge and Munchables. These projects together amounted to a total loss of $144,480,000.

Q2 2024: The total losses in Q2 2024 were $572,688,861. This number represents a 115.7% increase compared to Q2 2023, when hackers and fraudsters stole $265,481,519. Most of that sum was lost by two specific projects: DMM Bitcoin and BtcTurk. These projects together amounted to a total loss of $360,000,000.

Q3 2024: The total losses in Q3 2024 were $423,994,499. This number represents a 38% decrease compared to Q3 2023 when hackers and fraudsters stole $685,970,444. Most of that sum was lost by two specific projects: WazirX and the BingX. These projects together amounted to a total loss of $287,000,000.

Q4 2024: The total losses in Q4 2023 were $150,552,478. This number represents 63.6% decrease compared to Q4 2023, when hackers and fraudsters stole $414,355,094. Most of that sum was lost by two specific projects: Radiant Capital and Thala. These projects together amounted to a total loss of $75,500,000.

Top Losses by Quarter in 2024

Q1

• Orbit Bridge — $81,680,000
• Munchables — $62,800,000
• PlayDapp — $32,350,000
• FixedFloat — $26,100,000
• Curio Ecosystem — $16,000,000
• GMEE — $15,000,000
• Prisma Finance — $11,600,000
• NFPrompt — $10,400,000
• WOOFi — $8,750,000
• Coinspaid — $7,500,000

Q2

• DMM Bitcoin — $305,000,000
• BtcTurk — $55,000,000
• Hedgey — $44,600,000
• Lykke — $23,600,000
• Gala Games — $21,000,000
• SonneFinance — $20,000,000
• UwU Lend — $19,300,000
• Rain — $14,800,000
• Holograph — $14,400,000
• Velocore — $6,800,000

Q3

• WazirX — $235,000,000
• BingX — $52,000,000
• Penpie — $27,000,000
• Indodax — $22,000,000
• Ronin — $12,000,000
• LI.FI protocol — $10,000,000
• Bittensor — $8,000,000
• RHO Markets — $7,600,000
• Casper Network — $6,700,000
• Delta Prime — $6,000,000

Q4

• Radiant Capital — $50,000,000
• Thala — $25,500,000
• DEXX — $21,000,000
• M2 — $13,700,000
• PolterFinance — $12,000,000
• DeltaPrime — $4,750,000
• Tapioca DAO — $4,405,600
• MetaWin — $4,000,000
• Sunray Finance — $2,700,000
• CoinPoker — $2,000,000

Monthly Losses in 2024

Overview

In total, the ecosystem has witnessed $1,495,487,055 in losses year-to-date (YTD) across 232 specific incidents. Overall, Q2 in 2024 recorded the highest losses, primarily driven by more than $358.5 million in May, followed by Q3, with over $281.9 million in July losses.

• January — $133.4M
• February — $81.6M
• March — $133.2M
• April — $72.6M
• May — $358.5M
• June — $141.6M
• July — $281.9M
• August — $15.1M
• September — $126.9M
• October — $74.0M
• November — $72.7M
• December — $3.9M

Major Exploits in 2024 Analysis

The year was marked by two major attacks on DMM Bitcoin and WazirX, totalling $540,000,000. Together, these two projects represent 36% of 2024 losses alone.

DMM Bitcoin, $305 million

• On May 31st, 2024, the Japanese centralised cryptocurrency exchange suffered a private key hack that caused a loss of $305 million.

WazirX, $235 million

• On July 18th, 2024, WazirX, India's leading domestic crypto exchange, suffered an attack that resulted in a $325 million loss. WazirX's Safe Multisig wallet on Ethereum was compromised. The attack has since been linked to North Korean hackers.

North Korean Hackers

North Korean Hackers in Focus

• North Korean hackers have allegedly been responsible for two notable attacks, representing 16% of total crypto losses in 2024. They have been linked to breaches of WazirX and Radiant Capital, profiting a combined total of $285 million.
• In the WazirX attack, hackers compromised the platform's Safe Multisig wallet on Ethereum. Meanwhile, Radiant's exploit involved sending a malware-laced PDF to company engineers, allowing attackers to compromise multiple developer devices. Both attacks highlight how North Korean hackers continue to often target project infrastructure and leverage sophisticated social engineering operations to compromise systems.

North Korea-linked Attacks: $285,000,000 of total $1,495,487,055

• WazirX — $235,000,000
• Radiant Capital — $50,000,000

Hacks vs. Fraud Analysis

In 2024, hacks continue to be the predominant cause of losses as compared to frauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts for 1.9% of the total losses in the 2024, while hacks account for 98.1%.

Overview

• Hacks — In total, we have seen a loss of $1,467,448,336 to hacks in 2024 across 192 specific incidents. These numbers represent a 13.6% decrease compared to 2023, when losses caused by hacks totalled $1,699,872,321.
• Fraud — In total, we have seen a loss of $28,038,719 to fraud in 2024 across 40 specific incidents. These numbers represent a 72% increase compared to 2023 when losses caused by frauds, scams, and rug pulls totalled $103,418,279.

Hacks vs. Fraud in 2024: Hacks 98.1%, Fraud 1.9%

DeFi vs. CeFi Analysis

In 2024, DeFi continues to be the main target for exploits, compared to CeFi. DeFi represents 51.4% of the total losses, while CeFi represents 48.6% of the total losses.

Overview

• DeFi — DeFi has suffered $769,287,055 in total losses in 2024 across 221 incidents. These numbers represent a 44.8% decrease compared to 2023 when DeFi losses totalled $1,394,382,600.
• CeFi — CeFi has suffered $726,200,000 in total losses in 2024 across 11 incidents. These numbers represent a 77.5% increase compared to 2023 when CeFi losses totalled $408,908,000.

DeFi vs. CeFi in 2024: DeFi 51.4%, CeFi 48.6%

In Focus: CeFi Regains Attackers' Attention

While Decentralized Finance (DeFi) remained the main focus of successful exploits, representing 51.4% of losses across 307 specific cases, attacks on CeFi saw a sharp increase. CeFi accounted for nearly half of the total losses (48.6%) despite only 11 significant cases. This hasn't happened since 2021, as successful CeFi hacks have slowed considerably over the past two years.

DeFi vs. CeFi (2023 vs 2024)

• CeFi — 2023: $408.9M | 2024: $726.2M
• DeFi — 2023: $1.4B | 2024: $769.3M

Losses by Chain

The two most targeted chains in 2024 were Ethereum and BNB Chain. Ethereum suffered the most individual attacks with 104 incidents representing 44% of the total losses across targeted chains. BNB Chain witnessed 71 incidents, representing 30% respectively.

Overview

• Ethereum and BNB Chain represent more than half of the chain losses in 2024.
• Arbitrum came in third with 16 incidents, representing 6.4% of total losses across chains. Solana, Optimism, Blast, and Base followed with 6 incidents each.

Losses by Chain

• Ethereum — 104
• BNB Chain — 71
• Others — 52
• Arbitrum — 16
• Solana — 6

Funds Recovery

Overview

In total, $115,577,966 has been recovered from stolen funds in 14 specific situations. This number makes up 7.7% of the total losses in 2024.

• Ronin Network — Stolen: $12,000,000 | Recovered: $10,000,000
• ShezmuTech — Stolen: $4,900,000 | Recovered: $4,900,000
• Bloom — Stolen: $540,000 | Recovered: $486,000
• ALEX Lab — Stolen: $4,300,000 | Recovered: $3,900,000
• Gala Games* — Stolen: $21,000,000 | Recovered: $21,000,000
• YOLO Games — Stolen: $1,500,000 | Recovered: $1,350,000
• Munchables — Stolen: $62,800,000 | Recovered: $62,800,000
• Seneca — Stolen: $6,500,000 | Recovered: $5,300,000
• Blueberry Protocol — Stolen: $1,350,000 | Recovered: $1,080,000
• Socket Bungee Bridge — Stolen: $3,300,000 | Recovered: $2,300,000
• Mozaic — Stolen: $2,400,000 | Recovered: $2,160,000
• Unizen — Stolen: $2,100,000 | Recovered: $185,000
• Saga DAO — Stolen: $60,000 | Recovered: $60,000
• MAAT — Stolen: $272,800 | Recovered: $56,966

In Focus: Crypto Losses 2024 | Monthly Overview

Total Losses: Hacks vs. Fraud

• January — Hacks: $129,339,800 | Fraud: $4,072,817
• February — Hacks: $77,551,400 | Fraud: $4,052,000
• March — Hacks: $126,694,200 | Fraud: $6,541,000
• April — Hacks: $69,329,627 | Fraud: $3,277,200
• May — Hacks: $356,770,184 | Fraud: $1,753,300
• June — Hacks: $138,139,000 | Fraud: $3,419,550
• July — Hacks: $277,151,700 | Fraud: $4,767,552
• August — Hacks: $15,135,000 | Fraud: $0
• September — Hacks: $126,810,247 | Fraud: $130,000
• October — Hacks: $73,965,600 | Fraud: $0
• November — Hacks: $72,711,500 | Fraud: $25,300
• December — Hacks: $3,850,078 | Fraud: $0

Web3 Security in 2025: Key Trends

Hacking

• Despite the slight improvement from last year's $1.7 billion in losses, threats persist. Hackers are evolving; they've infiltrated crypto projects, compromised hot wallets, and exploited vulnerabilities in the darkest corners of the ecosystem. What makes this even more pressing is the massive surge in the Total Value Locked (TVL) in DeFi, which has grown 163% this year from $51 billion to $134.17 billion. With so much at stake, the race between hackers and securing the technology for widespread adoption has never been more intense.
• Generally, losses have primarily been driven by larger-scale exploits, often resulting from private key compromises. Hackers will continue to target project infrastructure heavily, as the leakage of a key can lead to the theft of all funds controlled by it. Additionally, hackers will attempt to bypass the more mature and fortified DeFi projects, focusing more extensively on infrastructure and CeFi.

Industry

• Increasing use of automated tooling, especially Artificial Intelligence and Machine Learning (AI/ML) tooling. After years of being fairly inconsequential, AI/ML tooling are just beginning to show themselves to be effective. This trend is expected to accelerate rapidly.
• The rise of DeSec, or the decentralized security industry, complete with successful tokenized products. DeSec is likely to emerge over the next year as the first products get to maturity.

Crypto Losses 2024 — Summary

Total Losses YTD: $1,495,487,055

In 2023: $1,803,290,600

Major Losses

• DMM Bitcoin — $305M
• WazirX — $235M
• Orbit Bridge — $82M
• Munchables — $63M
• BtcTurk — $55M

Hacks vs. Fraud

• Hacks — $1,699,872,321
• Fraud — $103,418,279

DeFi vs. CeFi

• DeFi — $1,394,382,600
• CeFi — $408,908,000

Top Losses by Chain

• Ethereum — 104
• BNB Chain — 71
• Arbitrum — 16
• Solana — 6
• Optimism — 6

Crypto Losses in Q4 2024

Overview of the volume of crypto funds lost by the community due to hacks and scams in Q4 2024, as assessed by Immunefi.

Overview

In total, we have seen a loss of $150,552,478 across the web3 ecosystem in Q4 2024. $150,527,178 was lost to hacks in Q4 2024 across 58 specific incidents and $25,300 was lost to fraud in across 2 specific incidents. This number represents a 64% decrease compared to Q4 2023, when hackers and fraudsters stole $414,355,094.

Most of the sum in Q4 was lost by two specific projects: Radiant Capital, the lending protocol, and Thala, a decentralized finance firm.

Key Takeaways in Q4 2024

• The two major exploits of the quarter totaled $75,500,000 alone, accounting for 50.1% of all losses in Q4 2024.
• In Q4 2024, hacks continued to be the predominant cause of losses at 99.9% in comparison to frauds, scams, and rug pulls, which amounted to only 0.02% of the total losses.
• In Q4 2024, DeFi continued to be the main target of successful exploits at 89.5% as compared to CeFi at 10.5% of the total losses.
• The two most targeted chains in Q4 2024 were BNB Chain and Ethereum. BNB Chain suffered the most individual attacks, with 31 incidents representing 49.2% of the total losses across targeted chains. Ethereum witnessed 18 incidents, representing 29% respectively. Avalanche followed with 3 incident.
• In total, $25,556,966 has been recovered from stolen funds in 2 specific situations. This number makes up 17% of the total losses in Q4 2024.

Top 10 Losses in Q4 2024*

• Radiant Capital — $50,000,000
• Thala — $25,500,000
• DEXX — $21,000,000
• M2 — $13,700,000
• PolterFinance — $12,000,000
• DeltaPrime — $4,750,000
• Tapioca DAO — $4,405,600
• MetaWin — $4,000,000
• Sunray Finance — $2,700,000
• CoinPoker — $2,000,000

Major Exploits in Q4 Analysis

Most of the Q4 loss sum was lost by two specific projects: Radiant Capital and Thala, totalling $75,500,000. Together, these two projects represent 50.1% of Q4 losses alone.

Radiant Capital, $50 million

• On October 17, 2024, blockchain lending protocol Radiant Capital has suffered a private key compromise and lost more than $50 million.

Thala, $25.5 million

• On November 15, 2024, decentralized finance firm Thala Labs suffered a security breach, allowing the exploiter to withdraw $25.5 million. Later, Thala recovered the whole sum, after the hacker was tracked down by law enforcement and crypto sleuths.

Hacks vs. Fraud Analysis (Q4 2024)

In Q4 2024, hacks continue to be the predominant cause of losses as compared to frauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts for 0.02% of the total losses in the Q4 2024, while hacks account for 99.98%.

Overview

• Hacks — In total, we have seen a loss of $150,527,178 to hacks in Q4 2024 across 58 specific incidents. These numbers represent a 62% decrease compared to Q4 2023 when losses caused by hacks totalled $397,450,523.
• Fraud — In total, we have seen a loss of $0.02 to fraud in Q4 2024 across 2 specific incidents. These numbers represent a 99.8% decrease compared to Q4 2023, when losses caused by frauds, scams, and rug pulls totaled $16,904,571.

Hacks vs. Fraud in Q4 2024: Hacks 99.98%, Fraud 0.02%

DeFi vs. CeFi Analysis (Q4 2024)

In Q4 2024, DeFi continues to be the main target for exploits, compared to CeFi. DeFi represents 89.5% of the total losses, while CeFi represents 10.5% of the total losses.

Overview

• DeFi — DeFi has suffered $134,752,478 in total losses in Q4 2024 across 57 incidents. These numbers represent a 41.4% decrease compared to Q4 2023, when DeFi losses totaled $229,955,094.
• CeFi — CeFi has suffered $15,800,000 in total losses in Q4 2024 across 3 incidents. These numbers represent a 91.4% decrease compared to Q4 2023, when DeFi losses totaled $184,400,000.

DeFi vs. CeFi in Q4 2024: DeFi 89.5%, CeFi 10.5%

Losses by Chain (Q4 2024)

The two most targeted chains in Q4 2024 were BNB Chain and Ethereum. BNB Chain suffered the most individual attacks, with 31 incidents representing 49.2% of the total losses across targeted chains. Ethereum witnessed 18 incidents, representing 28.6% respectively.

Overview

• BNB Chain and Ethereum represent more than half of the chain losses in Q4 2024. Arbitrum came in third with 5 incidents, representing 7.9% of total losses across chains.
• Solana, Base and Polygon followed with 2 incidents each.

Losses by Chain (Q4 2024)

• BNB Chain — 31
• Ethereum — 18
• Arbitrum — 5
• Solana — 2
• Base — 2
• Polygon — 2
• Others — 3

Insights

• In Q4 2024, BNB Chain once again surpassed Ethereum and became the most targeted chain compared to the previous period.

In Focus: Q4 2023 vs. Q4 2024

Total Value Locked

The TVL across all protocols and on Ethereum both grew significantly from Q4 2023 to Q4 2024, with all-protocol TVL rising from around $125B to over $170B by December, and Ethereum TVL climbing from roughly $70B to nearly $100B over the same period.

Hacks vs. Frauds

• Hacks: 62% ↓ — Losses are down 62% when compared to the previous period.
• Fraud: 99.8% ↓ — Losses are also down 99.8% when compared to the previous period.

DeFi vs. CeFi

• DeFi: 41.4% ↓ — Losses are down 41.4% when compared to the previous period.
• CeFi: 91.4% ↓ — Losses are down 91.4% when compared to the previous period.

Download the full report here.

Get the full dataset here.

For questions about this study or Immunefi itself, reach out at press@immunefi.com

About Immunefi

Immunefi is the leading security platform for crypto, protecting more than $180 billion in user funds, and securing protocols across the full development lifecycle, from pre-deployment through production.