CRYPTO LOSSESIN Q3 2023
PREPARED BY IMMUNEFI

01

Overview

302

Top 10 Losses in Q3 2023

503

Major Exploits in Q3 Analysis

604

Hacks vs. Frauds Analysis

805

DeFi vs. CeFi Analysis

906

Losses by Chain

1007

Funds Recovery

1108

In Focus: Q3 2022 vs. Q3 2023

122

Crypto Losses in Q3 2023
PREPARED BY IMMUNEFIThe team at Immunefi, the leading bug bounty and security services platform for web3 which protects over $60 billion in user funds, has assessedthe volume of crypto funds lost by the community due to hacks and scams in Q3 2023.

OVERVIEW
The global web3 space was valued at over $934 billion in 2022. That capital represents an unparalleled and attractive opportunity for blackhat
hackers.
We have reviewed all instances where blackhat hackers have exploited various crypto protocols, as well as cases of protocols that have allegedly
performed a rug pull in Q3 2023. We have located 74 such instances, including both successful and semi-successful hacking attempts, as well asalleged fraud.
In total, we have seen a loss of $685,510,444 across the web3 ecosystem in Q3 2023. $662,850,580 was lost to hacks in Q3 2023 across 47 specificincidents and $22,659,864 was lost to fraud in across 27 specific incidents. Most of that sum was lost by two specific projects: Mixin Network, atransactional network for digital assets, and Multichain, a cross-chain router protocol.
This number represents a 59.9% increase compared to Q3 2022, when hackers and fraudsters stole $428,718,083.

3

Crypto Losses in Q3 2023
KEY TAKEAWAYS IN Q3 2023
• The 2 major exploits of the quarter totaled $326,000,000 alone, accounting for 47.5% of all losses in Q3 2023.
• In Q3 2023, hacks continued to be the predominant cause of losses at 96.7% in comparison to frauds, scams, and rug pulls, which amounted toonly 3.3% of the total losses.
• In Q3 2023, DeFi continued to be the main target of successful exploits at 72.9% as compared to CeFi at 27.1% of the total losses.
• The two most targeted chains in Q3 2023 were Ethereum and BNB Chain. Ethereum suffered the most individual attacks with 33 incidents,
while BNB Chain witnessed 25 incidents. Base followed with 4 incidents and Optimism with 3 incidents. Polygon, Avalanche, Arbitrum, zkSync
Era, and Fantom each had 2 incidents. Solana, and others, followed with 1 incident each.
• In total, $61,169,000 has been recovered from stolen funds in 4 specific situations. This number makes up 8.9% of the total losses in Q3 2023.

KEY INSIGHTS IN Q3 2023
• In Q3 2023, the number of attacks spiked: the number of single incidents increased 147% YoY from 30 to 74 in Q3 2023. The total number oflosses increased by 59.9% when compared to Q3 2022, amounting to $685,510,444. Overall, Q3 has witnessed the highest loss in 2023.
• In Q3 2023, Ethereum surpassed BNB Chain once again and became the most targeted chain.
• Since its launch in early August, Coinbase-backed Base protocol has witnessed losses across 4 projects, sharing the top of targeted chains withEthereum and BNB Chain.
• The Lazarus Group was responsible for $208,600,000 stolen, representing 30% of the total losses in Q3 2023. The group was allegedly behindthe high-profile attacks on CoinEx, Alphapo, Stake, and CoinsPaid.

4

*Top 10 Losses in Q3 2023
Mixin Network$200,000,000

Multichain$126,000,000

CoinEx$70,000,000

Alphapo$60,000,000

Curve/Vyper$57,842,000

Stake$41,300,000

CoinsPaid$37,300,000

Fortress$15,700,000

Poly Network$10,201,612

HTX_Global (Huobi)$8,000,000

5Major Exploits in Q3 Analysis
Most of the Q3 loss sum was lost by 2 specific projects, Mixin Network and Multichain, totaling $326,000,000. Together, these twoprojects represent 47.5% of Q3 losses alone.

MIXIN NETWORK, $200 MILLIONMULTICHAIN, $126 MILLION• On September 23rd, 2023, the decentralized Mixin network
was breached, and cybercriminals took $200 million-worth ofdigital tokens at the time.

• On July 7th, 2023, Multichain experienced a hack that involved
the withdrawal of an estimated $126 million in assets.
Affected tokens included DAI, Link, USDC, WBTC and wETH.

Multichan$126Mixin Network$200

Total Losses$686
Million dollars

Million dollars

Total Losses$686
6Major Exploits in Q3 Analysis
LAZARUS GROUP IN FOCUS• The Lazarus Group was responsible for $208,600,000 stolen, representing 30% of the total losses in Q3 2023. The group was allegedly behindthe high-profile attacks on CoinEx, Alphapo, Stake, and CoinsPaid.

$70,000,000$60,000,000$41,300,000

CoinExAlphapoStake$37,300,000

CoinsPaid7

Hacks vs. Fraud Analysis
In Q3 2023, hacks continue to be the predominant cause of losses as compared tofrauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts
for 3.3% of the total losses in the Q3 2023, while hacks account for 96.7%.

Fraud
3.3%OVERVIEW• Hacks
In total, we have seen a loss of $662,850,580 to hacks in Q3 2023 across 47
specific incidents. These numbers represent a 66% increase compared to Q3
2022, when losses caused by hacks totaled $398,912,483.
• Fraud
In total, we have seen a loss of $22,659,864 to fraud in Q3 2023 across 27
specific incidents. These numbers represent a 23.9% decrease compared to Q3
2022, when losses caused by frauds, scams, and rug pulls totaled $29,805,600.

Hacks
96.7%

8

DeFi vs. CeFi Analysis
In Q3 2023, DeFi continues to be the main target for exploits, compared to CeFi.
DeFi represents 72.9% of the total losses, while CeFi represents 27.1% of the totallosses.

OVERVIEW

CeFi
27.1%

• DeFi
DeFi has suffered $499,810,444 in total losses in Q3 2023 across 69 incidents.
These numbers represent a 18.5% increase compared to Q3 2022, when DeFi
losses totaled $423,423,783.
• CeFi
CeFi has suffered $185,700,000 in total losses in Q3 2023 across 5 incidents.
These numbers represent an 3,409.14% increase compared to Q3 2022, when
DeFi losses totaled $5,294,300.

DeFi
72.9%

9Losses by Chain
The two most targeted chains in Q3 2023 were Ethereum and BNB Chain.
Ethereum suffered the most individual attacks with 33 incidents, representing
40.7% of the total losses across targeted chains. BNB Chain witnessed 25incidents, representing 30.8% respectively.

OVERVIEW• Ethereum and BNB Chain represent more than half of the chain losses in Q32023 at 71.5%. Base came in third with 4 incidents, representing 4.9% of total
losses across chains.
• Optimism followed with 3 incidents, Polygon, Avalanche, Arbitrum, zkSync Era,and Fantom with 2 incidents each. Solana, and others with 1 incident each.

Others13Polygon
2Optimism
3Ethereum
33

Base
4INSIGHTS• In Q3 2023, Ethereum surpassed BNB Chain once again and became the mosttargeted chain.
• Since its launch in early August, Coinbase-backed Base protocol has witnessed
losses across 4 projects, sharing the top of targeted chains with Ethereum andBNB Chain.

BNB Chain2510Funds Recovery
OVERVIEW
In total, $61,169,000 has been recovered from stolen funds in 4 specific situations. This number makes up 8.9% of the total losses in Q3 2023.

StolenRecoveredCurve/Vyper$57,842,000$38,093,189

MetronomeDAO$1,626,000$1,463,400

Palmswap$901,000$720,800

GMBL.COMPUTER$800,000$382,000

11In Focus: Q3 2022 vs. Q3 2023
TVL (USD) ETHEREUM

TVL (USD) ALL PROTOCOLS$120B

Q3 2023

Q3 2022$60B

Q3 2023

Q3 2022

$100B
$80B

$40B

$60B
$40B

$20B

$20B
$0
July 1

August 1
Total Value Locked

September 1$0
July 1

August 1

September 1

Total Value Locked

12In Focus: Q3 2022 vs. Q3 2023
HACKS VS. FRAUDS

66.1%

23.9%

Hacks
Losses are up 66.1%
when compared to theprevious period.

Fraud
Losses are down 23.9%
when compared to theprevious period.

13

In Focus: Q3 2022 vs. Q3 2023
DEFI VS. CEFI

18.1%

3,409%

DeFi
Losses are up 18.1%
when compared to theprevious period.

CeFi
Losses are up 3,409%
when compared to theprevious period.

14

“Q3 witnessed the highest loss in this year,
driven by large-scale attacks such as theone on Mixin Network and Multichain. Statebacked actors played a crucial role as they
were allegedly behind several cases thisquarter. Their particular focus on CeFi led toa sharp surge in losses within this sector.
Mitchell Amador
Founder and CEO at Immunefi

Crypto Losses Q3 2023
HACKS VS. FRAUDTOTAL LOSSES YTD$1,388,475,506$662,850,580

Hacks
Fraud

IN Q3

$22,659,864$685,510,444
DEFI VS. CEFI
MAJOR LOSSES$499,810,444

DeFi

$200

$185,700,000CeFi

$126
$70

$60

$41

TOP LOSSES BY CHAIN$37
Ethereum

diaPsnioCekatSopahplAxE
nioC

niahcitluMkr
owteNnixiM

Million dollars

For more information about the Crypto Losses Report, please visit immunefi.com/research.

35

BNB Chain25

Base4Optimism

3Immunefi
Immunefi is the leading bug bounty and security services
platform for web3 protecting over $60 billion in user funds.
Immunefi features a massive community of whitehat hackers
who review projects’ blockchain and smart contract code, findand responsibly disclose vulnerabilities, and get paid formaking crypto safer. With Immunefi, whitehat hackers arerewarded based on the severity of the vulnerability that they
discover, creating incentives for as many experts as possible
to examine project code for vulnerabilities.
Immunefi has pioneered the scaling web3 bug bounties
standard, meaning that rewards should be priced accordinglywith the severity of an exploit and the volume of funds at risk,
which resulted in the company building the largest communityof security talent in the web3 space.

TOTAL BOUNTIES PAID

Immunefi has paid out over $80 million in total bounties, while saving over $25
billion in user funds.

TOTAL BOUNTIES AVAILABLE

Immunefi offers over $155 million in available bounty rewards.

SUPPORTED PROJECTS

Trusted by established, multi-billion dollar projects like Chainlink, Wormhole,MakerDAO, TheGraph, Synthetix, and more, Immunefi now supports more than
300 projects across multiple crypto sectors.

LARGEST BUG BOUNTY PAYMENTS IN THE
HISTORY OF SOFTWARE

Immunefi has facilitated the largest bug bounty payments in the history ofsoftware:• $10 million for a vulnerability discovered in Wormhole, a generic cross-chain
messaging protocol.
• $6 million for a vulnerability discovered in Aurora, a bridge, and a scaling
solution for Ethereum.
• $2.2 million for a vulnerability discovered in Polygon, a decentralized
Ethereum scaling platform that enables developers to build scalable, userfriendly dApps.

Disclaimer:• Immunefi uses publicly available data and news reports in order to access and collect alleged frauds, scams, and rug pulls. Including such incidents
in this report does not constitute a determination from Immunefi that a fraud, scam, or rug pull event did occur.
• The full dataset can be found here.
Notes:• * Top 10 Losses in Q3 2023: *$38 million in stolen funds were later recovered from the Curve/Vyper exploit;• The Total Value Locked (USD) data has been extracted from DefiLlama.
• Immunefi assesses the volume of crypto funds lost by the community due to hacks and scams by reviewing, validating, and classifying publicly
available data. In this report, Immunefi considered only rug pulls for its fraud category. A rug pull is a project that creates an image of credibility
and attracts outside capital through token sales or other means with the sole purpose of stealing deposited user funds and disappearing.
• The report was updated on October 12, 2023, to specify certain figures.
More:• If you’re a developer thinking about a bug-hunting career in web3, we got you. Check out our Web3 Security Library, and start taking home someof the over $155M in rewards available on Immunefi — the leading bug bounty platform for web3.
For more information, please visit https://immunefi.com/