2024 Stolen Crypto Exceeds $2.5 Billion｜PandaLY Web3 Security Annual Report

HASH:e27d3a91876168f2bee3c65d719eba4d48544131

In 2024, the global cryptocurrency ecosystem continued to evolve amidst significant security risks. This year saw a sharp rise in hacks and phishing scams, with phishing-related losses surging by 140.66% year-over-year, amounting to a staggering $2.513 billion. Despite the industry’s efforts to bolster blockchain security, incidents of stolen funds remained frequent, underscoring the urgent need for enhanced technology and defense systems. [Some data below sourced from Chainalysis and Beosin]

2024 Trends in Crypto Hacks

1. Record-Breaking Stolen Amounts

• Total stolen crypto in 2024 reached $2.513 billion, a 21.07% year-over-year increase, marking the fifth consecutive year with thefts exceeding $1 billion.
• Hacks: $1.792 billion (131 incidents)
• Rug Pulls: $148 million (68 incidents)
• Phishing Scams: $574 million

2. Increase in Attack Frequency The number of incidents rose from 282 in 2023 to 303 in 2024, highlighting the continued prevalence of hacking activities.

Attack Type Breakdown:

• DeFi Projects: Most targeted, accounting for 50.7% of attacks.
• CEXs (Centralized Exchanges): Largest losses, totaling $724 million.
• Private Key Leaks: Most damaging, with 35 incidents resulting in $1.306 billion in losses.

3. Notable Mid-Year Fluctuations

• From January to July, thefts reached $1.58 billion, an 84.4% year-over-year increase.
• Post-July, the growth in attack intensity and value plateaued, potentially linked to geopolitical events.

Major Incidents in 2024

DMM Bitcoin Hack

• Date: May 31, 2024
• Losses: $304 million
• Method: Private key leak
• Details: Exploited infrastructure vulnerabilities to conduct unauthorized withdrawal transactions.

PlayDapp Hack

• Date: February 9, 2024
• Losses: $290 million
• Method: Private key leak
• Details: Hackers profited by minting PLA tokens repeatedly and laundering assets through multiple exchanges.

WazirX Phishing Attack

• Date: July 18, 2024
• Losses: $235 million
• Method: Multi-signature phishing attack via contract upgrade inducement.

Gala Games Privileged Access Exploit

• Date: May 20, 2024
• Losses: $216 million
• Method: Leveraged privileged address access to mint tokens.

Chris Larsen Wallet Hack

• Date: January 31, 2024
• Losses: $112 million
• Method: Private key leak.

Attack Patterns by Platform and Method

1. DeFi and Centralized Services Shift

• DeFi Platforms: Remained prime targets in Q1.
• Centralized Services: Became focal points in Q2 (e.g., DMM Bitcoin and WazirX).
• Private Key Thefts: Accounted for 43.8% of total losses.

2. Fund Laundering Strategies Hackers increasingly utilized cross-chain bridges, DEXs, and mixers to obfuscate fund movements. Traditional mixers saw reduced usage, with more dispersed laundering paths complicating investigations.

3. Global Anti-Money Laundering Measures The success rate for recovering stolen funds rose to 21.13%, reflecting the effectiveness of anti-money laundering tools and inter-agency collaboration.

Characteristics of North Korean Hacking Activities

1. Growth in Both Value and Frequency

• Amount Stolen: $1.34 billion, a 102.88% year-over-year increase, representing 61% of total stolen funds in 2024.
• Incident Count: Rose from 20 in 2023 to 47 in 2024, making up 20% of total attacks.

2. Evolution in Attack Scale North Korean hackers frequently executed mid-to-large-scale attacks ($50 million–$100 million and above), with smaller-scale attacks (<$50 million) also increasing.

3. Key Case: DMM Bitcoin In May 2024, North Korean hackers exploited private key management vulnerabilities to steal $305 million worth of Bitcoin from DMM Bitcoin, exposing weaknesses in centralized platform security.

Shifts in North Korea-Russia Alliance and Attack Patterns

1. Post-June Summit Trends

• North Korean Activity: Daily stolen amounts dropped by 53.73%.
• Non-North Korean Activity: Theft rose by 5%.
• Speculation suggests resource shifts toward the Ukraine conflict, though further evidence is needed.

2. IT Worker Infiltration Strategies North Korean agents infiltrated Web3 companies via remote work positions, using advanced tactics to steal assets and data, further expanding their impact.

Conclusions and Recommendations

1. The Need for Stronger Industry Defense Measures

• Enhance private key management and identity verification protocols.
• Foster public-private partnerships to establish comprehensive security frameworks.

2. Monitor North Korea and Geopolitical Dynamics

• Closely track the North Korea-Russia alliance for potential shifts in attack patterns.
• Maintain heightened vigilance during holidays to counter high-risk attacks.

Looking Ahead

As the blockchain ecosystem continues to expand, security challenges will persist. However, technological innovation and international collaboration are driving the development of stronger defense systems. By advancing tool capabilities, refining regulatory environments, and raising industry awareness, we can look forward to a safer blockchain future.

🔗 Linktr |Official Website| Twitter