Crypto hacks down 70% in Q1 2023

Around USD 400 million was stolen across nearly 40 cryptocurrency attacks in the first three months of 2023 - down 70% from the same period in 2022, according to new research from TRM Labs. In fact, the amount stolen through crypto hacks in Q1 2023 was less than any quarter in 2022. The fall in value was significantly greater than the fall in crypto prices during this period (around 45% for Ethereum).

The average hack size also took a hit in Q1 2023 – to USD 10.5 million from nearly USD 30 million in the same quarter of 2022, even as the number of incidents was similar (around 40).

To date, hacking victims have recovered over half of all stolen funds in Q1 2023. For example, in March 2023, a hacker exploited a bug in Tender.fi’s code that allowed the attacker to steal over USD 1.5 million. The hacker later contacted Tender.fi and agreed to return the funds in exchange for a bug bounty of 62.15 ether, worth USD 850,000.

‍

Some Possible Explanations 

There is no one obvious explanation for the lull. However, two recent events may have provided a temporary discouragement to would-be attackers:

• In December 2022, US authorities arrested Avraham Eisenberg, who carried out a USD 116 million price manipulation attack against the DeFi platform Mango Markets in October of that year. 

Although Eisenberg had returned a portion of the funds, on the apparent understanding that he would not face legal action, the SEC charged him with violating anti-fraud and market manipulation provisions of the securities laws. He was then also sued by Mango Markets for USD 47 million in damages plus interest. Avraham’s prosecution may have signaled to would-be attackers that even an agreement from the victim not to pursue legal action may not confer protection.

• In August 2022, the US Treasury sanctioned the cryptocurrency mixer Tornado Cash on the grounds that it has been used to launder more than USD 7 billion worth of virtual currency since its creation in 2019. Tornado Cash had been used extensively by hackers to obscure the source of funds, including in the USD 600 million hack of Axie Infinity by North Korea-aligned Lazarus Group in March 2022 and a USD 100 million attack on Harmony bridge in June 2022.  The use of sanctions by the US government against crypto targets may have raised the potential costs of carrying out such attacks and made it more difficult to launder the proceeds.

The industry has also seen the continued implementation of anti-money laundering standards by virtual asset service providers (VASPs), increased efforts by law enforcement and regulators to go after bad actors, and the growing sophistication of blockchain intelligence tools.

‍

Hack Respite Unlikely to Last

Unfortunately, this slowdown is most likely a temporary reprieve rather than a long-term trend.  The nature of cryptocurrency hacks, the size of the slowdown, and insights gleaned from previous cycles provide a stronger indication of what might be at play.

A few large-scale attacks account for most of the amount stolen from crypto platforms and users, which can cause the total amount stolen to fluctuate dramatically month-to-month. The ten largest hacks in 2022 accounted for approximately 75% of the total amount stolen in 2022, according to a review of 2022 hacks and exploits by TRM Labs. 

Individual quarters also offer poor predictions of how much money will be lost to hacks during the whole year. The amount stolen and number of incidents in the first quarter of 2023 mirrors that of the third quarter of 2022. That was followed by a record setting number of hacks that turned 2022 into a record year.  

Hacks and exploits in the cryptocurrency ecosystem can result in massive losses for investors, traders, DeFi projects, and exchanges, in addition to  damaging the reputation and trust of the industry. Although we are likely to see crypto hacks rebound, widespread adoption of industry security measures and increased user education, can help prevent the industry from revisiting or exceeding the record-setting USD 3.7 billion stolen in 2022.