CRYPTO LOSSES
Q3 2022

CRYPTO LOSSES IN Q3 2022
Prepared by Immune
The team at Immune , the leading bug bounty and security services platform
for web3 which protects over $60 billion in user funds, has assessed the volumeof crypto funds lost by the community due to hacks and scams in Q3 2022.

Overview
The global web3 space was valued at $3 trillion in 2021, and with billions locked
across di erent smart contracts, this capital represents an unparalleled andattractive opportunity for blackhat hackers.
We have reviewed all instances where blackhat hackers have exploited various
crypto protocols, as well as cases of alleged fraudulent protocols and founders
who have performed a rug pull in Q3 2022. We have located 39 such instances,including both successful and semi-successful hacking attempts, as well asfraud.
In total, we have seen a loss of $428,718,083 across the web3 ecosystem in Q3
2022. We have seen a loss of $398,912,483 to hacks across 30 speci c incidents,
and a loss of $29,805,600 to fraud across 9 speci c incidents in Q3 2022. Mostof that sum was lost by 2 speci c projects, Nomad Bridge, a cross-chaincommunication standard that enables transfers of tokens and data between
chains, and Wintermute, a global crypto market maker. Unlike in previousquarters, fraud was the cause of loss only for 9 projects, with the total gureamounting to $20,674,359.
These numbers represent a 62.9% decrease compared to Q3 2021, when
hackers and fraudsters stole $1,155,334,775.

If you’re a developer thinking about a bug-hunting career in Web3, we gotyou. Check out our ultimate blockchain hacking guide, and start taking
home some of the $132M in rewards available on Immune — the leading
bug bounty platform for Web3.

fifififififffiff

https://immune .com/

TOP 10 LOSSES IN Q3 2022
Nomad Bridge$190,000,000

Wintermute$160,000,000

Racoon Network andFreedom Protocol *$20,000,000

Impermax Finance$7,451,118

Audius$6,000,000

The Bribe Protocol$5,500,000

ZB$4,800,000

Teddy Doge *$4,500,000

Slope Mobile Wallet$4,500,000* the team behind Raccoon Network and Freedom
Protocol and Teddy Doge allegedly performed a rugpull.

Get the full dataset here

About Immunefififfifi

Immune is the leading bug bounty and security services platform for web3,
which features the world’s largest bounties. Immune guards over $60 billion inuser funds across projects like Synthetix, Chainlink, SushiSwap, PancakeSwap,Bancor, Cream Finance, Compound, Alchemix, Nexus Mutual, and others. Thecompany has paid out the most signi cant bug bounties in the software
industry, amounting to over $60 million, and has pioneered the scaling web3
bug bounties standard. For more information, please visit
https://immune .com/

Major Exploits in Q3 Analysis
Most of the Q3 loss sum was lost by 2 speci c projects, Nomad Bridge andWintermute, totaling $350,000,000. Together, these two projects represent
79,85% of Q3 losses alone.
Nomad Bridge$190 million
On August 2nd, 2022, Nomad Bridge, a cross-chain communication standard
that enables transfers of tokens and data between chains, su ered a major
exploit leading to $190 million being drained out of the protocol. Nomad’s hackquickly became referred to as a “chaotic” one, as in this particular case, there
wasn't a singular malicious actor exploiting the vulnerability. Rather, there weremany di erent people and MEV bots involved.
The hack was di erent from previous hacks that happened to the Ronin
Network and to the Horizon Bridge. The surprising aspect of the vulnerability
was that it was an easy-to-reproduce attack. All that was required to exploit itwas to copy the original hacker's transaction and change the original address toa custom one. Simple copy-paste. Many malicious users wanted a piece ofNomad’s pool. That's why the attack cannot be attributed to just one malicious
actor, as many people participated in it after they gured out they could easily
run the exploit as well.
Wintermute$160 million
On September 20th, 2022, Wintermute, a global crypto market maker, lost $160
million in a hack relating to its decentralized nance operation, in a hot wallet
compromise. Although su ering a major exploit, Wintermute's lending andover-the-counter (OTC) services were not a ected, and the company's CEO
Evgeny Gaevoy, said that the company remained solvent with "twice over" $160
million remaining in equity.
Wintermute provides liquidity on more than 50 exchanges and trading
platforms, including Binance, Coinbase, FTX, Kraken, and decentralized
platforms Dydx and Uniswap. It is also an active investor, having invested inprojects such as Nomad, HashFlow, and Ondo Finance.

ff

fi

fi

fi

ff

ff

ff

ff

3Hacks vs. Frauds Analysis
In the Q3 of 2022, hacks continue to be the predominant cause of losses ascompared to frauds, scams, and rug pulls. An analysis of the losses shows thatfraud accounts for only 7% of the total losses in the Q3 2022, while hacks
account for 93%.

OverviewHacks
In total, we have seen a loss of $398,912,483 to hacks in Q3 2022, across 30
speci c incidents. These numbers represent a 67.3% decrease compared to Q1
2022, when losses caused by hacks totaled $1,218,500,867, and a 38.7%
decrease compared to Q2 2022, when $650,269,602 was lost.
When compared to the losses of Q3 2021, where losses caused by hacks totaled$994,489,686, we’ve witnessed a 59.9% decrease.

Fraud
In total, we have seen a loss of $29,805,600 to fraud in Q3 2022, across 9
speci c incidents. These numbers represent a 170.9% increase compared to Q1
2022, when losses caused by frauds, scams, and rug pulls totaled $11,000,000
and a 838.9% increase compared to Q2 2022, when $3,174,359 was lost.
When compared to the losses of Q3 2021, where losses caused by frauds,scams, and rug pulls totaled $160,845,089, we’ve witnessed a 81.5% decrease.

fifi4

DeFi vs. CeFi Analysis
In the Q3 of 2022 DeFi continues to be the key target for exploits as compared
to CeFi. DeFi represents 98.8% of the total losses, while CeFi represents 1.2% ofthe total losses.

Overview
DeFi
DeFi has su ered $423,423,783 in total losses in the Q3 2022, across 36incidents.
In Q2 2022, DeFi su ered losses totaling $670,608,280 across 49 incidents,representing a 36.8% decrease in losses when compared with Q3 results.
CeFi
CeFi has su ered $5,294,300 in total losses in the Q3 2022, across 3 incidents.
In Q2 2022, CeFi su ered losses totaling $90,000 across 1 incident, representing
a 5782.6% increase when compared with Q3 results.
CeFi Safety
It’s harder to break into a centralized exchange like Binance and Coinbase, as
they’ve invested a lot of resources into security. Given their basic infrastructure
setups, pulling money out of a centralized exchange often requires hackers tojump through far more hoops than pulling money out of a vulnerable DeFi
protocol. In other words, vulnerable DeFi projects are much more low-hanging
fruit for malicious hackers, and the authorities are less likely to become
involved when a no-name protocol is hacked. There are also far more DeFi
protocols than centralized exchanges or CeFi projects, resulting in a muchgreater attack surface.

ff

ff

ff

ff

5

Losses by chain
The two most targeted chains in Q3 2022 were BNB Chain and Ethereum. BNB
Chain su ered the most individual attacks with 16 incidents, representing
28.6% of the total losses across targeted chains, and Ethereum witnessed 13incidents, representing 23.2% respectively.

Overview
BNB Chain and Ethereum represent more than half of the chain losses in Q3
2022 at 51.8%. Solana and Avalanche come in third both with 4 incidents, each
representing 6.8% of total losses across chains. Polygon follows with 3incidents, Fantom and Arbitrum with 2 incidents each.
Remaining chains like Optimism, Gnosis, Polkadot, Aurora, and others together
represent 21.4% of the total chain incidents, all with single incidents.

ff6

Losses by Chain
BNB Chain is still attracting a developer community that creates a lot of copies
of Ethereum protocols, and it also attracts a lot of users who want to earn quickmoney. Forked code can contain vulnerabilities, and we’ve seen cases before
where developers on BNB Chain will modify forked code without muchknowledge of the underlying program structure, which introduces novel
vulnerabilities that then get exploited.
Additionally, many of the security traditions and culture that exist within theEthereum developer community do not yet exist within the BNB Chain
community. Vulnerabilities that you see less and less in Ethereum protocols still
crop up on BNB Chain. Over time, if BNB Chain manages to attract more serious
developer talent, these security traditions will eventually grow.
Multiple Chain Incidents
It’s rare to nd a single smart contract-based attack method that equally a ects
all the di erent chains of a project, and these cases are no exception. WithImpermax Finance, the attack vector was a private key compromise, whicha ected team wallets on di erent chains. It was not a smart contract exploitthat allowed a hacker to pull funds out of contracts on di erent chains. WithCeler Network, the exploit was a DNS attack that allowed a malicious hacker toredirect users to a Celer frontend that that hacker-controlled. Once the users
interacted with that hacker-created frontend–regardless of the chain–their funds
were gone.
When a project has its smart contracts drained simultaneously across all chainsthat it operates on, the probability actually increases that it was a rugpull,although it is not a de nitive indicator.

Disclaimer: Immune uses publicly available data and news reports in order toaccess and collect alleged frauds, scams, and rug pulls. Including such incidents inthis report does not constitute a determination from Immune that a fraud, scam, orrug pull did occur.

ff

ff

fi

ff

fi

fi

fi

ff

ff

7

CRYPTO LOSSES YTD
The team at Immune , the leading bug bounty and security services platform
for web3 which protects over $60 billion in user funds, continuously assesses
the volume of crypto funds lost by the community due to hacks and scams
during the respective quarters of the year.
In total, we have seen a loss of $2,328,917,230 across the web3 ecosystem YTD.

Overview
Q1 2022
The total loss in Q1 2022 was $1,229,500,867. These numbers represented
almost a 7.9x growth compared to Q1 2021, when hackers and fraudsters stole$154,609,199. Most of that sum was lost by 2 speci c projects, Ronin Network,
known for the Axie In nity game, and the Wormhole bridge. The total loss ofthese two projects alone reached $951,000,000.

fifif8CRYPTO LOSSES YTD
Q2 2022
The total loss in Q2 2022 was $670,698,280. These numbers represented
almost a 1.5x growth compared to Q2 2021, when hackers and fraudsters stole$440,021,559. Most of that sum was lost by 2 speci c projects, Beanstalk andHarmony Horizon. The total amount of loss of these two projects alone reached$282,000,000.
Q3 2022
In total, we have seen a loss of $428,718,083 across the web3 ecosystem in Q32022. These numbers represent a 62.9% decrease compared to Q3 2021, when
hackers and fraudsters stole $1,155,334,775. Most of that sum was lost by 2speci c projects, Nomad Bridge, a cross-chain communication standard thatenables transfers of tokens and data between chains, and Wintermute, a global
crypto market maker. The total amount of loss of these two projects alone
reached $350,000,000.
Numbers Down
There are numerous reasons why the total value of losses has decreased.

• Developers are getting smarter over time and also more experienced.

Security has moved from a side concept to a main concept.
• Bug bounties and other security innovations have saved countless billions offunds from being hacked by blackhat hackers.
• More well-established protocols are standing the test of time and becomingsafer.
• Poorly managed projects, which often also have poor security, are being
weeded out by the bear market.
• The total value of losses is down because the total value of crypto is down asa result of economic trends.
It’s too early to tell which one of these reasons has played a decisive role inbringing down the total value of losses, so it’s too early to celebrate any
progress that has been made. Hacks are still happening, including someincredibly high-value ones. It’s important to stay vigilant and continue to invest
in security.

fifi9Funds Recovery
In total, $93,800,000 has been recovered from stolen funds, across 6 speci csituations. This number makes up 4% of the total losses YTD.

Multichain

Axie In nity

Optimism

Stolen$3 million
Recovered$2.6 million

Stolen$625 million
Recovered$30 million

Stolen$16 million
Recovered$15 million

XCarnival

Crema Fin.

Nomad

Stolen$3.8 million
Recovered$1.8 million

Stolen$9.6 million
Recovered$8 million

Stolen$190 million
Recovered$36.4 million

Some of the biggest hacks, such as the Axie In nity one, have come fromorganizations like the Lazarus Group, which is backed by North Korea. Thesegroups will never return any funds, as they have state support and are largely
immune from prosecution. Other malicious hackers are spread across theworld, and so even if law enforcement knows the identity of a hacker, it’s notalways easy to prosecute that person or a ect a return of funds. Furthermore,
hackers are becoming more and more professional in their DeFi hacking,leaving fewer traces for investigators to pick up on. It’s clear there is room for
improvement here.

fifi

fffi

10

Immune is the leading bug bounty and security services platform for web3
protecting over $60 billion in user funds. Immune boasts a massive communityof whitehat hackers who review projects’ blockchain and smart contract code,nd and responsibly disclose vulnerabilities, and get paid for making crypto
safer. With Immune , whitehat hackers are rewarded based on the severity ofthe vulnerability that they discover, creating incentives for as many experts as
possible to examine the code of particular projects for vulnerabilities.
Immune has pioneered the scaling web3 bug bounties standard, meaning thatrewards should be priced accordingly with the severity of an exploit and thevolume of funds at risk, which resulted in the company building the largest
community of security talent in the web3 space.

Total bounties paid
Immune has paid out $60 million in total bounties, while saving over $25
billion in user funds.

Total bounties available
Immune o ers over $132 million bounties available.

Supported projects
Trusted by established, multi-billion dollar projects like Chainlink, Wormhole,MakerDAO, Compound, Synthetix, and more, Immune now supports 302
projects across multiple crypto sectors.

Largest bug bounty payments in the history of software
Immune has facilitated the largest bug bounty payments in the history ofsoftware.
$10 million for a vulnerability discovered in Wormhole, a generic cross-chain
messaging protocol.
$6 million for a vulnerability discovered in Aurora, a bridge and a scaling
solution for Ethereum.
$2.2 million for a vulnerability discovered in Polygon, a decentralized Ethereumscaling platform that enables developers to build scalable user-friendly dApps.

fifi

fi

fi

ffffi

fi

fifi

If you’re a developer thinking about a bug-hunting career in Web3, we gotyou. Check out our ultimate blockchain hacking guide, and start taking
home some of the $132M in rewards available on Immune — the leading
bug bounty platform for Web3.
fifi

Immune12