CYVERS Year-to-Date Web3 Security Report

Executive Summary: January to September 2023 vs. 2024 Comparison

Overview:

The year 2024 has already shattered records, with losses skyrocketing past the total for all of 2023.

The explosive increase in hacks and breaches showcases an escalating threat landscape that demands urgent attention and action.

In Q3 2024, Cyvers played a critical role in detecting all the reported attacks within the crypto ecosystem (about half of which were detected exclusively).

Through AI-powered real-time monitoring and alert systems, Cyvers's proactive threat detection prevented further financial losses, underscoring the value of advanced threat detection technologies in protecting digital assets and minimizing financial impact.

Key Highlight:

Losses for the 3 first quarters of 2024 have already reached more than $2.114B (all time high) and exceeded the annual losses for 2023.

Hacking incidents in CeFi entities have grown by almost 1,000% YoY
Losses from wallet and custodian breaches have almost doubled
Losses from DeFi platform hacks were reduced by 25%

Total Value Lost:

January to September 2023: $1.23 billion
January to December 2023: $1.69 billion
January to September 2024: $2.114 billion (~72% increase over the same period in 2023)

These figures highlight that 2024 saw a significant increase in overall losses, surpassing the total for 2023. The impact of high-profile incidents remains considerable, emphasizing the need for better security protocols.

CeFi vs. DeFi Incidents:

CeFi Hacks:
2024 Trends: Centralized exchanges (CeFi) saw a 984% year-on-year increase in the number of hacks, largely driven by a few high-profile attacks. 

In Q2 2024, centralized exchanges experienced a notable surge in hacks, culminating in a total loss of approximately $401 million across five significant incidents.

The most prominent of these was the DMM Bitcoin exchange breach, which resulted in a staggering $305 million loss, marking it as one of the year's largest CEX breaches.

Additionally, BtcTurk, a Turkish exchange, was hit hard with a $55 million loss. Other affected platforms included Lykke, Rain Exchange, and FixedFloat, further contributing to the overall figure.

The surge in CeFi vulnerabilities underscores the need for improved access control mechanisms and regulatory oversight.

DeFi Incidents:

2024 Trends: DeFi platforms exhibited a 25% reduction in losses compared to Q2 2023, reflecting a more resilient ecosystem.

However, $171.3 million was still lost across 62 incidents in Q2 2024, showing that DeFi remains vulnerable due to the complexity of smart contracts and decentralized protocols.

Ethereum and BNB Chain remain the primary targets for DeFi exploits, reflecting their extensive ecosystems.

Vulnerabilities Breakdown:

Access Control Vulnerabilities:

January to September 2023: $742.6 million
January to September 2024: $1.62 billion (99% increase)
Smart Contract Vulnerabilities:
January to September 2023: $429.6 million
January to September 2024: $380.4 million (19% decrease)

Incident Breakdown:

January to September 2024:

Total Incidents: 131
Smart Contract Exploits: 79 incidents
Access Control Violations: 51 incidents

January to September 2023:

Total Incidents: 44 incidents (197% increase in 2024)
Smart Contract Exploits: 28 incidents (182% increase)
Access Control Violations: 16 incidents (218% increase)

Strategic Recommendations:

The report highlights the critical importance of enhancing cross-chain security protocols, adopting real-time threat detection technologies, and evolving regulatory frameworks to address emerging risks like AI-driven attacks and quantum computing vulnerabilities.

Moreover, global regulatory efforts, including those led by IOSCO, must prioritize real-time monitoring and incident response strategies to counteract the evolving dynamics of crypto-related crimes effectively.

In conclusion, 2024 saw a substantial rise in incidents across both centralized and decentralized platforms. CeFi platforms experienced a dramatic increase in high-profile attacks, while DeFi platforms, though more resilient, continue to face ongoing threats.

Moving forward, it is imperative that the industry adopts proactive security measures and regulatory oversight to mitigate future risks and build a secure, resilient Web3 ecosystem.