Centralized exchanges are the target of hackers, with $1.4 billion stolen so far this year

Author: Alex O’Donnell, Cointelegraph; Compiler: Baishui, Golden Finance

According to the mid-year Web3 security report from cybersecurity firm Cyvers, the total amount of cryptocurrency funds stolen so far this year is close to $1.4 billion, as centralized exchanges become a new source of vulnerability attacks.

Total cryptocurrency losses exceeded $600 million in the second quarter of 2024, up 100% from the same period last year. The surge in stolen funds was mainly due to a 900% increase in losses at centralized exchanges, the report said.

“This quarter saw a significant shift in attack vectors, with centralized exchanges (CEX) bearing the brunt of major incidents, while decentralized finance (DeFi) protocols have shown greater resilience,” the report said. “This trend may be attributed to the concentration of assets on centralized platforms and potentially lax security measures at some exchanges.”

Access control vulnerabilities, often in the form of phishing attacks, accounted for the vast majority of stolen funds, with around $490 million lost in the second quarter alone, Cyvers said. That figure far exceeds losses from smart contract vulnerabilities, which accounted for less than $70 million during the same period.

Source: Cyvers

Decentralized finance (DeFi) protocols quickly acted to freeze compromised smart contracts, protecting users, but Cyvers warned that the risk of exploits remains prevalent as hackers find new vulnerabilities in complex contracts. The report noted that cross-chain bridges are also becoming a significant attack vector, citing the $1.44 million vulnerability exploited in XBridge in April.

Cyvers’ second-quarter data was heavily impacted by the high-profile hack of Japanese cryptocurrency exchange DMM in May. The hack was reportedly caused by a compromised private key and resulted in losses of up to $300 million. Another notable outlier was Turkish cryptocurrency exchange BtcTurk, which lost about $50 million in a June hack.

The report notes that identified victims have had more success than before in recovering lost funds, with total funds recovered in the second quarter up 42% from the same period last year. However, the vast majority of lost funds, about 76%, have not yet been recovered.

Cyvers said that Web3 users should continue to be wary of emerging threats posed by artificial intelligence and quantum computing, which could provide hackers with sophisticated new tools to bypass on-chain security measures.