CRYPTO LOSSESIN 2023
PREPARED BY IMMUNEFI

01

Overview

302

Top 10 Losses in 2023

503

Losses by quarter in 2023

6

04

Top losses by quarter in 2023

905

Monthly Losses in 2023

10

06

Major Exploits in 2023 Analysis

11

07

Hacks vs. Frauds Analysis

13

08

DeFi vs. CeFi Analysis

14

09

Losses by Chain

15

10

Funds Recovery

16

11

In Focus: Crypto Losses YTD - Monthly Overview

1712Web3 security in 2024

21

13

Crypto Losses in Q4 2023

222

Crypto Losses in 2023
PREPARED BY IMMUNEFIThe team at Immunefi, the leading bug bounty and security services platform for web3 which protects over $60 billion in user funds, has assessedthe volume of crypto funds lost by the community due to hacks and scams in 2023.

OVERVIEW
The global web3 space was valued at over $934 billion in 2022. That capital represents an unparalleled and attractive opportunity for blackhat
hackers.
We have reviewed all instances where blackhat hackers have exploited various crypto protocols, as well as cases of protocols that have allegedly
performed a rug pull in 2023. We have located 319 such instances, including both successful and semi-successful hacking attempts, as well as
alleged fraud.
In total, we have seen a loss of $1,803,050,600 across the web3 ecosystem in 2023. $1,699,632,321 was lost to hacks in 2023 across 247 specificincidents and $103,418,279 was lost to fraud in across 110 specific incidents. Most of that sum was lost by two specific projects: Mixin Network, atransactional network for digital assets, and Euler Finance, a DeFi protocol.
This number represents a 54.2% decrease compared to total losses in 2022, when hackers and fraudsters stole $3,948,856,037.

3

Crypto Losses in 2023
KEY TAKEAWAYS IN 2023
• The two major exploits of the year, Mixin Network and Euler Finance, alone accounted for $397,000,000, representing 22% of all losses in 2023.
• In 2023, hacks continued to be the predominant cause of losses at 94.3% in comparison to frauds, scams, and rug pulls, which amounted toonly 5.7% of the total losses.
• The Lazarus Group was responsible for $308,600,000 stolen in 2023, representing 17% of the total year losses. The group was allegedly behindthe high-profile attacks on Atomic Wallet, CoinEx, Alphapo, Stake, and CoinsPaid.
• In 2023, DeFi continued to be the main target of successful exploits at 77.3% as compared to CeFi at 22.7% of the total losses.
• The two most targeted chains in 2023 were BNB Chain and Ethereum. BNB Chain suffered the most individual attacks with 133 incidents,
representing 41.6% respectively. Ethereum witnessed 95 incidents representing 29.8% of the total losses across targeted chains. Polygon camein third with 10 incidents, representing 3.1% of total losses across chains. Avalanche followed with 6 incidents.
• In total, $241,701,085 has been recovered from stolen funds in 19 specific situations. This number makes up 13.4% of the total losses in 2023.
• The number of attacks spiked: the number of single incidents increased 89.8% YoY from 168 in 2022 to 319 in 2023. At the same time, the total
number of losses decreased by 54.2% compared to 2022, amounting to $3,948,856,037. The more active projects are out there, the easier it isfor hackers to find vulnerabilities at least somewhere.
• BNB Chain surpassed Ethereum and became the most targeted chain.
• While most of the hackers' interest is directed toward DeFi, organized hacker groups like Lazarus have switched to primarily targeting CeFi,
most likely due to their outsized returns. ​4

Top 10 Losses in 2023
Mixin Network$200,000,000

Euler Finance$197,000,000

Multichain$126,000,000

Poloniex$126,000,000

BonqDAO$120,000,000

Atomic Wallet$100,000,000

Heco Chain$85,400,000

CoinEx$70,000,000

Alphapo$60,000,000

KyberSwap$48,300,000

5Losses by quarter in 2023
OVERVIEW
In 2023, Q3 took the lead with $685,510,444 in total losses across 75 incidents, representing 38% of the total losses.

$685,970,444$437,483,543$414,115,094$265,481,519

Q1

Q2

Q3

Q4

6

Losses by quarter in 2023
2022 VS 2023
In 2022, Q4 took the lead with $1,620,138,807 in total losses across 55 incidents, representing 41% of the total losses.
In 2023, Q3 took the lead with $685,970,444 in total losses across 75 incidents, representing 38% of the total losses.
2022

2023
$1,620,138,807$1,229,500,867$670,698,280$437,483,543

Q1$265,481,519

Q2$685,970,444$438,324,902

Q3$414,115,094

Q4

7

Losses by quarter in 2023
Q1 2023

Q3 2023

The total losses in Q1 2023 were $437,483,543. This number
represents a 64.4% decrease compared to Q1 2022, when
hackers and fraudsters stole $1,229,500,867. Most of that sum
was lost by two specific projects: Euler Finance and BonqDAO.
These projects together amounted to a total loss of $317,000,000.

The total losses in Q3 2023 were $685,970,444. This number
represents a 56.5% increase compared to Q3 2022 when hackers
and fraudsters stole $438,324,902. Most of that sum was lost by
two specific projects: Mixin Network and the Multichain. These
projects together amounted to a total loss of $326,000,000.

Q2 2023

Q4 2023

The total losses in Q2 2023 were $265,481,519. This number
represents a 60.4% decrease compared to Q2 2022, when
hackers and fraudsters stole $670,698,280. Most of that sum waslost by two specific projects: Atomic Wallet and Fintoch. These
projects together amounted to a total loss of $131,600,000.

The total losses in Q4 2023 were $414,115,094. This number
represents 74.4% decrease compared to Q4 2022, when hackers
and fraudsters stole $1,620,138,807. Most of that sum was lostby two specific projects: Poloniex and Heco Chain. These projects
together amounted to a total loss of $211,400,000.

8

Top losses by quarter in 2023
Q4

Q3

Q2

Q1
Euler Finance$197,000,000

Atomic Wallet$100,000,000

Mixin Network$200,000,000

Poloniex$126,000,000

BonqDAO$120,000,000

Fintoch$31,600,000

Multichain$126,000,000

Heco Chain$85,400,000

Angle Protocol$17,000,000

Ethereum MEV*

$25,000,000

CoinEx$70,000,000

KyberSwap$48,300,000

Balancer$11,900,000

Bitrue$23,000,000

Alphapo$60,000,000

HTX Exchange$30,000,000

MyAlgo$9,200,000

GDAC$14,000,000

Curve/Vyper$57,842,000

HXA Token$29,586,973

Platypus$8,500,000

Yearn Finance$11,600,000

Stake$41,300,000

Kronos Research$26,000,000

Safemoon$8,500,000

Jimbos Protocol$7,500,000

CoinsPaid$37,300,000

dYdX$9,000,000

LendHub$6,000,000

Hundred

$7,400,000

Fortress$15,700,000

Fantom*$7,359,282

Idle Finance$5,900,000

Deus Finance$6,380,000

Poly Network$10,201,612

Raft Protocol$3,250,000

Shata Capital$5,140,000

Terraport*$4,000,000

HTX_Global*$8,000,000

Stars Arena$3,000,000

Ethereum MEV bots*, Hundred Finance*, Terraport Finance*, HTX_Global (Huobi)*, Fantom Foundation*

9

Monthly Losses in 2023
OVERVIEW
In total, the ecosystem has witnessed $1,803,050,600 in losses year-to-date (YTD) across 319 specific incidents. Overall, Q3 in 2023 recorded thehighest losses, primarily driven by more than $320 million in July and over $340 million in September.

$340,890,564$320,498,660$343,038,810$263,789,868$152,671,875$107,526,738$98,610,392$59,344,389$24,581,220$21,021,800
January

February

March

April

May

June

July

August$25,706,429

September October$45,369,855

November December

10Major Exploits in 2023 Analysis
Most of the 2023 loss sum was lost by two specific projects, Mixin Network and Euler Finance, totalling $397,000,000. Together, thesetwo projects represent 22% of 2023 losses alone.

MIXIN NETWORK, $200 MILLIONEULER FINANCE, $197 MILLION• On September 23rd, 2023, the decentralized Mixin network
was breached, and cybercriminals took $200 million-worth ofdigital tokens at the time.

• On March 13th, 2023, Euler Finance, a DeFi lending protocol,
suffered a flash-loan attack that resulted in a $197 million loss. The
attacker drained several assets, including $136 million of stETH, $34
million of USDC, $19 million of WBTC, and $8.7 million of DAI.

Mixin Network$200,000,000

Multichan$197,000,000

Total Losses

Total Losses$1,803,050,600

million dollars$1,803,050,600

11Major Exploits in 2023 Analysis
LAZARUS GROUP IN FOCUS• The Immunefi team produced a report assessing the volume of crypto funds lost due to the attacks of the Lazarus Group, a North Koreaaffiliated hacker group. The Lazarus Group was responsible for $308,600,000 stolen in 2023, representing 17% of the total year losses. The
group was allegedly behind the high-profile attacks on Atomic Wallet, CoinEx, Alphapo, Stake, and CoinsPaid.

$100,000,000$70,000,000$60,000,000$41,300,000

Atomic Wallet

CoinExAlphapoFor more information about the Immunefi Lazarus Group Report, please visit immunefi.com/research.

Stake$37,300,000

CoinsPaid

12

Hacks vs. Fraud Analysis
In 2023, hacks continue to be the predominant cause of losses as compared to
frauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts
for 5.7% of the total losses in the 2023, while hacks account for 94.3%.

Fraud
5.7%

OVERVIEW• Hacks
In total, we have seen a loss of $1,699,632,321 to hacks in 2023 across 219
specific incidents. These numbers represent a 54.9% decrease compared to2022, when losses caused by hacks totalled $3,773,906,837• Fraud
In total, we have seen a loss of $103,418,279 to fraud in 2023 across 100 specificincidents. These numbers represent a 40.9% increase compared to 2022 whenlosses caused by frauds, scams, and rug pulls totalled $174,949,200.
Hacks
94.3%

13

DeFi vs. CeFi Analysis
In 2023, DeFi continues to be the main target for exploits, compared to CeFi. DeFi
represents 77.3% of the total losses, while CeFi represents 22.7% of the total
losses.

OVERVIEW

CeFi
22.7%

• DeFi
DeFi has suffered $1,394,142,600 in total losses in 2023 across 306 incidents.
These numbers represent a 56.1% decrease compared to 2022 when DeFi losses
totalled $3,180,023,103.
• CeFi
CeFi has suffered $408,908,000 in total losses in 2023 across 13 incidents. These
numbers represent a 46.8% decrease compared to 2022 when DeFi losses
totalled $768,832,934.
DeFi
77.3%

14

Losses by Chain
The two most targeted chains in 2023 were BNB Chain and Ethereum. BNB Chain
suffered the most individual attacks with 133 incidents, representing 41.6%
respectively. Ethereum witnessed 95 incidents representing 29.8% of the total
losses across targeted chains.

Others71

OVERVIEW• Ethereum and BNB Chain represent more than half of the chain losses in 2023.
• Polygon came in third with 10 incidents, representing 3.1% of total losses acrosschains. Avalanche followed with 6 incidents.

Ethereum95

Polygon10
Avalanche
6

BNB Chain
133

15

Funds Recovery
OVERVIEW
In total, $241,701,085 has been recovered from stolen funds in 19 specific situations. This number makes up 13.4% of the total losses in 2023.
StolenRecovered

Sentiment$969,000$862,569$1,463,400

MetaPoint$920,000$63,000$901,000$720,800

FilDA$700,000$560,000

GMBL.COMPUTER$800,000$382,000

EDE Finance$580,000$420,000

Euler Finance$197,000,000$177,000,000

Allbridge$570,000$465,000

SperaxUSD$250,000.00$250,000

Stars Arena$3,000,000$2,677,077

Atomic Wallet$100,000,000$1,000,000

Astrid$228,000$182,000

Deus Finance$6,380,000$5,500,000

HTX Exchange$30,000,000$8,200,000

SushiSwap$3,340,000$723,450

KyberSwap$48,300,000$4,670,000

PeapodsFinance$230,000$207,000

StolenRecoveredCurve/Vyper$57,842,000$38,093,189

MetronomeDAO$1,626,000

Palmswap

16

In Focus: Crypto Losses 2023 | Monthly Overview
TOTAL LOSSES: HACKS VS. FRAUDAPRILJANUARY$12,669,800

Hacks

Fraud

$8,352,000

Fraud

Fraud

$152,671,875$253,247,414$10,542,454$38,725,390

JUNE

MARCH

Fraud

$20,618,999

Hacks
Fraud

$0

Hacks

$4,045,700

MAY

FEBRUARY
Hacks$94,564,692

Hacks$105,338,438

Hacks
Fraud

$2,188,300

17In Focus: Crypto Losses 2023 | Monthly Overview
TOTAL LOSSES: HACKS VS. FRAUDJULYOCTOBER$305,929,271

Hacks
Fraud

$14,569,389

NOVEMBER$17,027,809

Hacks$7,553,411

Fraud

Fraud

$7,464,660

DECEMBER$340,353,500$537,064$335,574,150

Hacks

SEPTEMBER
Hacks$7,299,584

Fraud

AUGUST

Fraud$18,406,845

Hacks$43,229,528

Hacks
Fraud

$2,140,327

18

“In 2023, despite a reduction in overall losses compared tothe previous year, the Web3 sector experienced asubstantial surge in hacking attempts and fraud incidents,
with the frequency of such cases nearly doubling.
Unfortunately, more projects are becoming susceptible toattacks. While decentralized finance remained the primarytarget of successful exploits, this year marked a significant
shift as CeFi began to draw more attention from hacker
groups, including the notorious Lazarus.
Mitchell Amador
Founder and CEO at Immunefi

Crypto Losses 2023
HACKS VS. FRAUDTOTAL LOSSES YTD$1,803,050,600$1,699,632,321

Hacks
Fraud

IN 2022$103,418,279$3,948,856,037
DEFI VS. CEFI
MAJOR LOSSES$200$1,394,142,600

DeFi

$197

$408,908,000

CeFi

$126

$126

$120

TOP LOSSES BY CHAIN
Ethereum

O
A
Dq
n
oB

xe
i
n
ol
o
P

re
l
uE

n
i
ah
c
it
l
uM

e
c
na
n
iF

kr
o
w
t
eN
ni
x
iM

million dollars

For more information about the Crypto Losses Report, please visit immunefi.com/research.

95

BNB Chain
PolygonAvalanche

133
10
6

Web3 security in 2024
KEY TRENDS IN 2024
• In 2024, the number of new protocols and projects will likely continue to grow.
• With the persistent rise in cryptocurrency prices, next year may see the most substantial losses in Web3 ever.
• The ongoing challenges related to the project's infrastructure will remain a major source of vulnerabilities, as the general approach within theindustry is not changing fast enough.
• While the DeFi sector may experience an increase in individual attacks, organized groups are expected to focus on CeFi projects due to theirpotential of outsized returns.

21

IN FOCUS

CRYPTO LOSSESIN Q4 2023

Crypto Losses in Q4 2023
Overview of the volume of crypto funds lost by the community due to hacks and scams in Q4 2022, as assessed by Immunef.

OVERVIEW
In total, we have seen a loss of $414,115,094 across the web3 ecosystem in Q4 2023. $397,210,523 was lost to hacks in Q4 2023 across 50 specificincidents and $16,904,571 was lost to fraud in across 40 specific incidents. This number represents a 74.4% decrease compared to Q4 2022, when
hackers and fraudsters stole $1,620,138,807.
Most of the sum in Q4 was lost by two specific projects: Poloniex, a cryptocurrency exchange, and Heco Chain, a decentralized public chain.

KEY TAKEAWAYS IN Q4 2023
• The 2 major exploits of the quarter totalled $211,400,000 alone, accounting for 51.1% of all losses in Q4 2023.
• In Q4 2023, hacks continued to be the predominant cause of losses at 95.9% in comparison to frauds, scams, and rug pulls, which amounted toonly 4.1% of the total losses.
• In Q4 2023, DeFi continued to be the main target of successful exploits at 55.5% as compared to CeFi at 44.5% of the total losses.
• The two most targeted chains in Q4 2023 were BNB Chain and Ethereum. BNB Chain suffered the most individual attacks, with 39 incidents
representing 43.3% of the total losses across targeted chains. Ethereum witnessed 36 incidents, representing 40% respectively. Avalanche
followed with 3 incident.
• In total, $15,729,077 has been recovered from stolen funds in 4 specific situations. This number makes up 3.8% of the total losses in Q4 2023.

23

Top 10 Losses in Q4 2023
Poloniex$126,000,000

Heco Chain$85,400,000

KyberSwap$48,300,000

HTX Exchange$30,000,000

HXA Token$29,586,973

Kronos Research$26,000,000

dYdX$9,000,000

Fantom Foundation$7,359,282

Raft Protocol$3,250,000

Stars Arena$3,000,000

24Major Exploits in Q4 Analysis
Most of the Q4 loss sum was lost by two specific projects: Poloniex and Heco Chain, totalling $211,400,000. Together, these two
projects represent 51.1% of Q4 losses alone.

POLONIEX, $126 MILLIONHECO CHAIN, $85,4 MILLION• On October 10, 2023, a crypto exchange, Poloniex, saw morethan $126 million worth of crypto assets exit one of its wallets
due to a hack.

• On October 22, 2023, $85.4 million worth of cryptocurrency
has been stolen from the cryptocurrency platform Heco Chain.

Heco Chain$85

Poloniex$126

Total Losses$411
Million dollars

Million dollars

Total Losses$411
25

Hacks vs. Fraud Analysis
In Q4 2023, hacks continue to be the predominant cause of losses as compared to
frauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts
for 4.1% of the total losses in the Q4 2023, while hacks account for 95.9%.

Fraud
4.1%

OVERVIEW• Hacks
In total, we have seen a loss of $397,210,523 to hacks in Q4 2023 across 50
specific incidents. These numbers represent a 73.5% decrease compared to Q42022 when losses caused by hacks totalled $1,499,813,207.
• Fraud
In total, we have seen a loss of $16,904,571to fraud in Q4 2023 across 40
specific incidents. These numbers represent a 85.9% decrease compared to Q42022, when losses caused by frauds, scams, and rug pulls totaled $120,325,600.

Hacks
95.9%

26

DeFi vs. CeFi Analysis
In Q4 2023, DeFi continues to be the main target for exploits, compared to CeFi.
DeFi represents 55.5% of the total losses, while CeFi represents 44.5% of the total
losses.

OVERVIEW• DeFi
DeFi has suffered $229,715,094 in total losses in Q4 2023 across 86 incidents.
These numbers represent a 75.4% decrease compared to Q4 2022, when DeFi
losses totaled $933,040,173.
• CeFi
CeFi has suffered $184,400,000 in total losses in Q4 2023 across 4 incidents.
These numbers represent a 73.1% decrease compared to Q4 2022, when DeFi
losses totaled $687,098,634.

CeFi
44.5%
DeFi
55.5%

27

Losses by Chain
The two most targeted chains in Q4 2023 were BNB Chain and Ethereum. BNB
Chain suffered the most individual attacks, with 39 incidents representing 43.3% of
the total losses across targeted chains. Ethereum witnessed 36 incidents,
representing 40% respectively.

OVERVIEWOthers9
Avalanche
3
Solana2
Polygon1• BNB Chain and Ethereum represent more than half of the chain losses in Q4
2023. Avalanche came in third with 3 incidents, representing 3.3% of total losses
across chains.
• Solana followed with 2 incidents and Polygon with 1.

Ethereum36

INSIGHTS• In Q4 2023, BNB Chain surpassed Ethereum and became the most targeted
chain.

BNB Chain
39

28

In Focus: Q4 2022 vs. Q4 2023
TVL (USD) ETHEREUM

TVL (USD) ALL PROTOCOLS$100B

Q4 2023

Q4 2022$60B

Q4 2023

Q4 2022

$80B
$40B

$60B
$40B

$20B

$20B
$0
October 1

November 1
Total Value Locked

December 1$0
October 1

November 1

December 1

Total Value Locked29

In Focus: Q4 2022 vs. Q4 2023
HACKS VS. FRAUDS

73.5%

85.9%

Hacks
Losses are down 73.5%
when compared to theprevious period.

Fraud
Losses are also down
85.9% when comparedto the previous period.

30

In Focus: Q4 2022 vs. Q4 2023
DEFI VS. CEFI

75.4%

73.1%

DeFi
Losses are down 75.4%
when compared to theprevious period.

CeFi
Losses are down 73.1%
when compared to theprevious period.

31

Immunefi
Immunefi is the leading bug bounty and security services
platform for web3 protecting over $60 billion in user funds.
Immunefi features a massive community of whitehat hackers
who review projects’ blockchain and smart contract code, findand responsibly disclose vulnerabilities, and get paid formaking crypto safer. With Immunefi, whitehat hackers are
rewarded based on the severity of the vulnerability that they
discover, creating incentives for as many experts as possible
to examine project code for vulnerabilities.
Immunefi has pioneered the scaling web3 bug bounties
standard, meaning that rewards should be priced accordinglywith the severity of an exploit and the volume of funds at risk,
which resulted in the company building the largest communityof security talent in the web3 space.

TOTAL BOUNTIES PAID

Immunefi has paid out over $80 million in total bounties, while saving over $25
billion in user funds.

TOTAL BOUNTIES AVAILABLE

Immunefi offers over $155 million in available bounty rewards.

SUPPORTED PROJECTS

Trusted by established, multi-billion dollar projects like Chainlink, Wormhole,
MakerDAO, TheGraph, Synthetix, and more, Immunefi now supports more than
300 projects across multiple crypto sectors.

LARGEST BUG BOUNTY PAYMENTS IN THE
HISTORY OF SOFTWARE

Immunefi has facilitated the largest bug bounty payments in the history ofsoftware:• $10 million for a vulnerability discovered in Wormhole, a generic cross-chain
messaging protocol.
• $6 million for a vulnerability discovered in Aurora, a bridge, and a scaling
solution for Ethereum.
• $2.2 million for a vulnerability discovered in Polygon, a decentralized
Ethereum scaling platform that enables developers to build scalable, userfriendly dApps.

Disclaimer:• Immunefi uses publicly available data and news reports in order to access and collect alleged frauds, scams, and rug pulls. Including such incidents
in this report does not constitute a determination from Immunefi that a fraud, scam, or rug pull event did occur.
• The full dataset can be found here.
Notes:• The Total Value Locked (USD) data has been extracted from DefiLlama.
• Immunefi assesses the volume of crypto funds lost by the community due to hacks and scams by reviewing, validating, and classifying publicly
available data. In this report, Immunefi considered only rug pulls for its fraud category. A rug pull is a project that creates an image of credibility
and attracts outside capital through token sales or other means with the sole purpose of stealing deposited user funds and disappearing.

More:• If you’re a developer thinking about a bug-hunting career in web3, we got you. Check out our Web3 Security Library, and start taking home someof the over $155M in rewards available on Immunefi — the leading bug bounty platform for web3.
For more information, please visit https://immunefi.com/