Immunefi Crypto Losses Q3 2024 Report

The team at Immunefi, the leading onchain crowdsourced security platform, has assessed the volume of crypto funds lost by the community due to hacks and scams in Q3 2024.

Overview

There is nearly $90 billion in capital locked across web3 protocols as of September 2024. That capital represents an unparalleled and attractive opportunity for blackhat hackers.

We have reviewed all instances where blackhat hackers have exploited various crypto protocols, as well as cases of protocols that have allegedly performed a rug pull in Q3 2024. We have located 34 such instances, including both successful and semi-successful hacking attempts, as well as alleged fraud.

In total, we saw a loss of $423,994,499 across the Web3 ecosystem in Q3 2024. $420,906,947 was lost to hacks across 34 specific incidents, and $3,087,552 was lost to fraud across 3 specific incidents. Most of that sum was lost by two specific projects: WazirX, India's leading domestic crypto exchange, which suffered an attack that resulted in $235,000,000 lost, and BingX, a Singapore-based cryptocurrency exchange, which incurred a loss of $52,000,000.

The total loss of Q3 2024 represents a 38% decrease compared to Q3 2023 when hackers and fraudsters stole $685,970,444.

Key Takeaways in Q3 2024

• The 2 major exploits of the quarter totaled $287,000,000 alone, accounting for 68% of all losses in Q3 2024.
• In Q3 2024, hacks continued to be the predominant cause of losses at 99.3% in comparison to fraud, which accounted for only 0.73% of the total losses.
• CeFi was the main target of successful exploits at 73% as compared to DeFi at 27% of the total losses.
• The two most targeted chains in Q3 2024 were Ethereum and BNB Chain. Ethereum suffered the most individual attacks with 17 incidents, followed by BNB Chain with 8 incidents, and Base with 2 incidents.
• In total, $14,900,000 has been recovered from stolen funds in 2 specific situations. This number makes up 3.5% of the total losses in Q3 2024.

Key Insights in Q3 2024

• $1,344,934,577 was lost due to hacks and fraud year-to-date, down by 3.2% compared with the previous period at $1,388,935,506.
• Q3 2024 was marked by a decrease in the total number of losses, down by 38.2% compared to Q3 2023, when losses totaled $685,970,444.
• Overall, July and September witnessed the highest volume of losses in Q3 2024. July reached $281,919,252 in total losses, and September reached $115,940,247.
• The number of individual successful attacks decreased by 51% from 75 in Q3 2023 to 37 in Q3 2024.
• In Q3 2024, Ethereum once again surpassed BNB Chain, becoming the most targeted chain compared to the previous period.
• In Q3 2024, funds recovery has proven less effective than in the previous period. To date, 3.5% of stolen funds have been recovered, compared to the 8.9% recovered in Q3 2023.

Top 10 Losses in Q3 2024

• WazirX — $235,000,000
• BingX — $52,000,000
• Penpie — $27,000,000
• Indodax — $22,000,000
• Ronin — $12,000,000
• LI.FI protocol — $10,000,000
• Bittensor — $8,000,000
• RHO Markets — $7,600,000
• Casper Network — $6,700,000
• Delta Prime — $6,000,000

Major Exploits in Q3 Analysis

Most of the sum was lost by two specific projects, WazirX and BingX, totaling $287,000,000. Together, these two CeFi projects represent 68% of Q3 losses alone.

WazirX, $235 Million

• On July 18, 2024, WazirX, an Indian crypto exchange, was hacked, resulting in a massive loss of $235 million.

BingX, $52 Million

• On September 20, 2024, BingX, a Singapore-based crypto exchange, suffered an attack that resulted in $52 million in lost funds.

Hacks vs. Fraud Analysis

In Q3 2024, hacks continued to be the predominant cause of losses compared to fraud. An analysis of the losses shows that fraud accounts for only 0.8% of the total losses in Q3 2024, while hacks account for 99.3%.

Overview

• Hacks — In total, we have seen a loss of $420,906,947 to hacks in Q3 2024 across 34 specific incidents. These numbers represent a 37% decrease compared to Q3 2023, when losses caused by hacks totaled $663,310,580.
• Fraud — In total, we have seen a loss of $3,087,552 to fraud in Q3 2024 across 3 specific incidents. These numbers represent a 86.4% decrease compared to Q3 2023, when losses caused by frauds, scams, and rug pulls totaled $22,659,864.

DeFi vs. CeFi Analysis

In Q3 2024, CeFi was the main target for exploits, representing 73% of total losses, while DeFi represented 27%.

Overview

• DeFi — DeFi suffered $114,994,499 in total losses across 34 incidents in Q3 2024. These numbers represent a 77% decrease compared to Q3 2023 when DeFi losses totaled $500,270,444.
• CeFi — CeFi suffered $309,000,000 in total losses in Q3 2024 across 3 incidents. These numbers represent a 66.4% increase compared to Q3 2023, when CeFi losses totaled $185,700,000.

Losses by Chain

The two most targeted chains in Q3 2024 were Ethereum and BNB Chain. Ethereum suffered the most individual attacks, with 17 incidents representing 47.2% of the total losses across targeted chains. BNB Chain witnessed 8 incidents, representing 22.2% respectively.

Overview

• In Q3 2024, Ethereum and BNB Chain accounted for over half of the chain losses, totaling 69.4%.
• Base came in third with 2 incidents, representing 5.6% of total losses across chains. Blast, Solana, Arbitrum and Bitcoin follow with 1 incident each.

Insights

• In Q3 2024, Ethereum once again surpassed BNB Chain, becoming the most targeted chain compared to the previous period.

Funds Recovery

Overview

In total, $14,900,000 has been recovered from stolen funds in 2 specific situations. This number makes up 3.6% of the total losses in Q3 2024.

• Ronin Network — Stolen: $12,000,000 — Recovered: $10,000,000
• ShezmuTech — Stolen: $4,900,000 — Recovered: $4,900,000

In Focus: Crypto Losses YTD

Monthly Overview

In total, the ecosystem has witnessed $1,344,934,577 in losses year-to-date (YTD) across 172 specific incidents. Overall, the losses were primarily driven by over $358 million lost in May and over $281 million lost in July.

• January — $133,412,617
• February — $79,203,400
• March — $133,235,200
• April — $72,606,827
• May — $358,523,484
• June — $141,558,550
• July — $281,919,252
• August — $15,135,000
• September — $126,940,247

Total Losses YTD: Hacks vs. Fraud

January

• Hacks — $129,339,800
• Fraud — $4,072,817

February

• Hacks — $77,551,400
• Fraud — $1,652,000

March

• Hacks — $126,694,200
• Fraud — $6,541,000

April

• Hacks — $69,329,627
• Fraud — $3,277,200

May

• Hacks — $356,770,184
• Fraud — $1,753,300

June

• Hacks — $138,139,000
• Fraud — $3,419,550

July

• Hacks — $278,961,700
• Fraud — $2,957,552

August

• Hacks — $15,135,000
• Fraud — $0

September

• Hacks — $126,810,247
• Fraud — $130,000

In Focus: Q3 2023 vs. Q3 2024

Hacks vs. Frauds

• Hacks — Losses are down 37% when compared to the previous period.
• Fraud — Losses are down 86% when compared to the previous period.

DeFi vs. CeFi

• DeFi — Losses are down 77% when compared to the previous period.
• CeFi — Losses are up 66% when compared to the previous period.

Crypto Losses Q3 2024 — Summary

Total Losses in Q3: $423,994,499

YTD: $1,344,934,577

Hacks vs. Fraud

• Hacks — $420,906,947
• Fraud — $3,087,552

DeFi vs. CeFi

• DeFi — $114,994,499
• CeFi — $309,000,000

Major Losses

• WazirX — $235.00M
• BingX — $52.00M
• Penpie — $27.00M
• Indodax — $22.00M
• Ronin — $12.00M
• LI.FI protocol — $10.00M

Top Losses by Chain

• Ethereum — 17
• BNB Chain — 8
• Base — 2
• Blast — 1
• Arbitrum — 1
• Solana — 1

Download the full report here.

Get the full dataset here.

For questions about this study or Immunefi itself, reach out at press@immunefi.com

About Immunefi

Immunefi is the leading security platform for crypto, protecting more than $180 billion in user funds, and securing protocols across the full development lifecycle, from pre-deployment through production.