CRYPTO LOSSESIN 2022

CRYPTO LOSSES IN 2022
Prepared by Immune
The team at Immune , the leading bug bounty and security services platform
for web3 which protects over $60 billion in user funds, has assessed the volumeof crypto funds lost by the community due to hacks and scams in 2022.

If you’re a developer thinking about a bug-hunting career in web3, we gotyou. Check out our Web3 Security Library, and start taking home some of
the $144M in rewards available on Immune — the leading bug bounty
platform for web3.

fifffihttps://immune .com/

Overview

The global web3 space was valued at over $934 billion in 2022. That capital
represents an unparalleled and attractive opportunity for blackhat hackers.
We have reviewed all instances where blackhat hackers have exploited various
crypto protocols, as well as cases of protocols that have allegedly performed arug pull in 2022. We have located 168 such instances, including both successful
and semi-successful hacking attempts, as well as alleged fraud.
In total, we have seen a loss of $3,948,856,037 across the web3 ecosystem in2022. $3,773,906,837 was lost to hacks in 2022 across 134 speci c incidents
and $174,949,200 was lost to fraud in 2022 across 34 speci c incidents. Most ofthat sum was lost by four speci c projects: Ronin Network, BNB Chain,Wormhole, and FTX.
This number represents a 51.2% decrease compared to 2021, when hackers
and fraudsters stole $8,088,338,239.

Key Takeaways in 2022

• The 5 major exploits of the year totaled $2,361,000,000 alone, accounting for59.8% of all losses in 2022.
• In 2022, hacks continued to be the predominant cause of losses at 95.6%, incomparison to frauds, scams, and rug pulls which comprised only 4.4% of thetotal losses.
• In 2022, DeFi continued to be the main target of successful exploits at 80.5%
as compared to CeFi at 19.5% of the total losses.
• The two most targeted chains in 2022 were BNB Chain and Ethereum. BNB
Chain surpassed Ethereum and became the most targeted chain in 2022, with65 incidents, while Ethereum witnessed 49 incidents.
• In total, $204,157,000 of stolen funds have been recovered across 12 speci cinstances. This number represents just 5.2% of the total losses in 2022.

fifififi2

TOP 10 LOSSES IN 2022
FTX

$650,000,000

Ronin Network$625,000,000

BNB Chain$570,000,000

Wormhole$326,000,000

Nomad Bridge$190,000,000

Beanstalk$182,000,000

Wintermute$160,000,000

Harmony$100,000,000

Mango Markets*$100,000,000

Mirror Protocol$90,000,000

Get the full dataset here
* Mango Markets later recovered $67 million of the stolen funds.

3TOP 10 LOSSES IN 2022 BY QUARTER
Q1 2022

Q2 2022

Ronin Bridge$625,000,000

Beanstalk$182,000,000

Wormhole$326,000,000

Harmony$100,000,000

Qubit$80,000,000

Mirror Protocol$90,000,000

Cashio$50,000,000

TribeDAO$80,340,000

IRA Financial$36,000,000

Fantom Scream$35,000,000

crypto.com$30,000,000

Optimism$35,000,000

Lympo$18,700,000

Akutars$33,000,000

Super uid

$13,000,000

Deus Finance$13,400,000

Arbix Finance$10,000,000

Elephant Money$11,200,000

Dego Finance$10,000,000

Venus Protocol$11,200,00

Q3 2022

Q4 2022

Nomad Bridge$190,000,000

FTX$650,000,000

Wintermute$160,000,000

BNB Chain$570,000,000

Racoon Network andFreedom Protocol *$20,000,000

Mango Markets**$100,000,000

Impermax Finance$7,451,118

mgnr*$52,000,000

Audius$6,000,000

DeFiAI$40,000,000

The Bribe Protocol$5,500,000

Transit Swap

$28,900,000

ZB$4,800,000

Deribit$28,000,000

Teddy Doge *$4,500,000

UXD Protocol**$20,000,000

Slope Mobile Wallet$4,500,000

Flare$18,500,000

Nirvana$3,500,000

Helio$15,000,000* The teams behind Raccoon Network and Freedom Protocol, Teddy Doge, and mgnr allegedly performed a rug pull.

** Mango Markets later recovered $67 million of the stolen funds. UXD Protocol later recovered over $19 million ofthe stolen funds.

fl4

Losses by quarter in 2022
In 2022, Q4 took the lead with $1,620,138,807 in total losses across 55
incidents, representing 41% of the total losses.

Overview
Q1 2022
The total losses in Q1 2022 were $1,229,500,867. This number represents
almost a 7.9x growth compared to Q1 2021, when hackers and fraudsters stole$154,609,199. Most of that sum was lost by two speci c projects: Ronin
Network, known for the Axie In nity game, and the Wormhole bridge. Theseprojects together amounted to a total loss of $951,000,000.
Q2 2022
The total losses in Q2 2022 were $670,698,280. This number represents almost
a 1.5x growth compared to Q2 2021, when hackers and fraudsters stole$440,021,559. Most of that sum was lost by two speci c projects: Beanstalk andHarmony Horizon. These projects together amounted to a total loss of$282,000,000.

fififi5

Losses by quarter in 2022
Q3 2022
The total losses in Q3 2022 were $438,324,902. This number represents a 62.9%
decrease compared to Q3 2021, when hackers and fraudsters stole$1,153,390,775. Most of that sum was lost by two speci c projects: NomadBridge, a cross-chain communication standard that enables transfers of tokens
and data between chains, and Wintermute, a global crypto market maker. Theseprojects together amounted to a total loss of $350,000,000.
Q4 2022
The total losses in Q4 2022 were $1,620,138,807. This number represents a
119.2% increase compared to Q4 2021 when hackers and fraudsters stole$739,243,793. Most of that sum was lost by two speci c projects: FTX, a
cryptocurrency exchange, and BNB Chain, a blockchain solution to build web3
dApps. These projects together amounted to a total loss of $1,220,000,000.

Losses by quarter 2021 vs. 2022
Overviewfifi6Major Exploits in 2022
The crypto industry has su ered some of the largest hacks in its history thisyear. The ve major exploits of the year totaled $2,361,000,000 alone,accounting for 59.8% of all losses in 2022.

Ronin Network Q1 2022
$625 million
Wormhole Q1 2022
$326 million
Nomad Q3 2022
$190 million
BNB Chain Q4 2022
$570 million
FTX Q4 2022
$650 million

fffi7

Hacks vs. Fraud Analysis
In 2022, hacks continued to be the predominant cause of losses as compared tofrauds, scams, and rug pulls. Fraud accounted for only 4.4% of the total losses
in 2022, while hacks accounted for 95.6%.

Overview
Hacks
In total, we have seen a loss of $3,773,906,837 to hacks in 2022, in 134 speci c
incidents. This number represents a 58.3% increase compared to 2021, whenlosses caused by hacks totaled $2,384,164,452, in 102 incidents.
Fraud
In total, we have seen a loss of $174,949,200 to fraud in 2022, in 34 speci cincidents. This number represents a 96.9% decrease compared to 2021, whenlosses caused by fraud totaled $5,704,173,787, in 14 incidents.

fi

fi

8

DeFi vs. CeFi Analysis
In 2022, DeFi continued to be the main target of successful exploits ascompared to CeFi. DeFi accounted for 80.5% of the total losses, while CeFi
accounted for 19.5%.

Overview
DeFi
DeFi has su ered $3,180,023,103 in total losses in 2022, across 155 incidents.
This number represents a 56.2% increase compared to 2021, when DeFi lost
$2,036,015,896, in 107 incidents.

CeFi
CeFi has su ered $768,832,934 in total losses in 2022, across 13 incidents. This
number represents a 87.3% decrease compared to 2021, when CeFi lost
$6,052,322,343, in 9 incidents.

ffff

9

Losses by Chain
BNB Chain and Ethereum were the two most targeted chains in 2022.
BNB Chain su ered the most individual attacks with 65 incidents, representing
36.1% of the total attacks across targeted chains. This number represents a
51.2% increase compared to 2021, when BNB Chain witnessed 43 attacks.
Ethereum witnessed 49 incidents, representing 27.2% of the total incidents
across targeted chains. This number represents a 8.9% increase whencompared to 2021, when Ethereum witnessed 45 attacks.

Overview

BNB Chain and Ethereum represented more than half of the chain attacks in
2022 at 63,3%. Solana came in third with 12 incidents, representing 6.7% of totalattacks across chains. Avalanche followed with 8 incidents, representing 4.4%.
Polygon with 4 incidents, representing 2.2%. NEAR with 2 incidents, representing
1.1%. Polkadot with 1 incident, representing 0.6%.
Remaining chains like Gnosis, Cronos, Arbitrum, Fantom, and others together
represented 21.7% of the total chain attacks.

ff10

Funds recovery
In total, $204,157,000 has been recovered from stolen funds in 12 speci csituations. This number makes up 5.2% of the total losses in 2022.

Overview of cases
Multichain

Axie In nity

Optimism

XCarnival

Stolen$3 million
Recovered$2.6 million

Stolen$625 million
Recovered$30 million

Stolen$16 million
Recovered$15 million

Stolen$3.8 million
Recovered$1.8 million

Crema Fin.

Nomad

OlympusDAO

Mango Mark.

Stolen$9.6 million
Recovered$8 million

Stolen$190 million
Recovered$36.4 million

Stolen$212,000
Recovered$212,000

Stolen$114 million
Recovered$67 million

Moola Mark.

Defrost Fin.

Tulip Protocol

UXD Protocol

Stolen$9.1 million
Recovered$8.6 million

Stolen$12 million
Recovered$12 million

Stolen$2.5 million
Recovered$2.5 million

Stolen$20 million
Recovered$19.9 million

fifi11CRYPTO LOSSES IN Q4 2022
In focus
Overview of the volume of crypto funds lost by the community due to hacks andscams in Q4 2022, as assessed by Immune .

Overview

In total, we have seen a loss of $1,620,138,807 across the web3 ecosystem inQ4 2022. $1,499,813,207 was lost to hacks, across 43 speci c incidents, and $$120,325,600 was lost to fraud, across 12 speci c incidents. Most of that sum
was lost by two speci c projects: FTX, a cryptocurrency exchange, and BNB
Chain, a blockchain solution to build web3 dApps.
This number represents a 119.2% increase compared to Q4 2021 when hackers
and fraudsters stole $739,243,793.

If you’re a developer thinking about a bug-hunting career in web3, we gotyou. Check out our Web3 Security Library, and start taking home some of
the $144M in rewards available on Immune — the leading bug bounty
platform for web3.

fi

fi

fi

ffifi

https://immune .com/

TOP 10 LOSSES IN Q4 2022
FTX

$650,000,000

BNB Chain$570,000,000

Mango**$100,000,000

mgnr*$52,000,000

DeFiAI$40,000,000

Transit Swap

$28,900,000

Deribit$28,000,000

UXD Protocol**$20,000,000

Flare$18,500,000

Helio$15,000,000

Get the full dataset here
* The team behind mgnr allegedly performed a rug pull. **Mango Market later
recovered $67 million of the stolen funds. UXD Protocol later recovered over $19
million of the stolen funds.

13

Hacks vs. Fraud Analysis
In Q4 of 2022, hacks continued to be the predominant cause of losses ascompared to fraud, scams, and rug pulls. Fraud accounted for only 7.4% of thetotal losses in Q4 2022, while hacks accounted for 92.6%.

Overview
Hacks
In total, we have seen a loss of $1,499,813,207 to hacks in Q4 2022, in 43
speci c incidents. This number represents a 106.3% increase compared to Q4
2021, when losses caused by hacks totaled $727,243,793, in 18 incidents.
Fraud
In total, we have seen a loss of $120,325,600 to fraud in Q4 2022, across 12
speci c incidents. This number represents a 902.7% increase compared to Q4
2021, when losses caused by fraud totaled $12,000,000, in 1 incident.

fifi

14

DeFi vs. CeFi Analysis
In Q4 of 2022, DeFi continued to be the main target of successful exploits ascompared to CeFi. DeFi accounted for 57.6% of the total losses, while CeFi
accounted for 42.4% of the total losses.

Overview
DeFi
DeFi has su ered $933,040,173 in total losses in 2022, across 50 incidents. This
number represents a 133.2% increase compared to 2021, when DeFi lost
$400,025,828, in 16 incidents.
CeFi
CeFi has su ered $687,098,634 in total losses in 2022, across 5 incidents. This
number represents a 102.6% increase compared to 2021, when CeFi lost
$339,217,965 in 3 incidents.

ff

ff

15

Losses by Chain
The two most targeted chains in Q4 2022 were BNB Chain and Ethereum.
BNB Chain su ered the most individual attacks with 18 incidents, representing
36% of the total attacks across targeted chains. This number represents a 260%
increase compared to Q4 2021, when BNB Chain witnessed 5 attacks.
Ethereum witnessed 14 incidents, representing 28% of the total attacks acrosstargeted chains. This number represents a 55.6% increase when compared toQ4 2021, when Ethereum witnessed 9 attacks.

Overview

BNB Chain and Ethereum represented more than half of the chain attacks in Q42022 at 64%. Solana comes in third with 6 incidents, representing 12% of total
losses across chains. Avalanche followed with 3 incidents, representing 6%.
NEAR with 2 incidents, representing 4%. Polygon with 1 incident, representing
2%.
Remaining chains like CELO, Optimism, and others together represented 13.6%of the total chain attacks.

ff

16

CRYPTO LOSSES IN 2021 vs. 2022
A visual comparisonfImmune has created a comprehensive visual comparison for its analysis oflosses by categories between 2021 and 2022. It contains the charts broken
down by category, year and quarter, as well as the corresponding datasets foreach chart.

Losses by quarter

Hacks vs. Fraud
Hacks

18

Hacks vs. Fraud
Fraud

DeFi vs. CeFi
DeFi

19

DeFi vs. CeFi
CeFi

20

Crypto Losses in 2021 vs. 2022
Losses by quarter

Hacks

20212022

20212022Q1$86,002,208$1,229,500,867

Q1$81,575,125$1,218,500,867

Q2$6,109,701,463$670,498,280

Q2$524,701,463$667,523,921

Q3$1,155,334,775$428,718,083

Q3$994,489,686$398,912,483

Q4$739,243,793$1,620,138,807

Q4$735,243,793$1,499,813,207

2021

2022

Frauds

DeFi
2021

2022

Q1

$4,927,083$11,000,000

Q1$85,957,208$1,153,060,867

Q2$5,585,000,00$3,174,359

Q2$609,701,463$670,498,280

Q3$160,845,089$29,805,60

Q3$940,331,397$423,423,783

Q4$13,400,000$120,325,600

Q4$400,025,828$933,040,173

2021

2022

Q1

$45,000$76,440,000

Q2$5,500,000,000$0Q3$213,059,378$5,294,300

Q4$339,217,965$687,098,634

CeFi

21

ImmuneImmune is the leading bug bounty and security services platform for web3
protecting over $60 billion in user funds. Immune features a massive
community of whitehat hackers who review projects’ blockchain and smart
contract code, nd and responsibly disclose vulnerabilities, and get paid formaking crypto safer. With Immune , whitehat hackers are rewarded based on
the severity of the vulnerability that they discover, creating incentives for as
many experts as possible to examine project code for vulnerabilities.
Immune has pioneered the scaling web3 bug bounties standard, meaning thatrewards should be priced accordingly with the severity of an exploit and thevolume of funds at risk, which resulted in the company building the largest
community of security talent in the web3 space.

Total bounties paid
Immune has paid out over $65 million in total bounties, while saving over $25
billion in user funds.

Total bounties availableImmune o ers over $144 million in available bounty rewards.

Supported projects
Trusted by established, multi-billion dollar projects like Chainlink, Wormhole,MakerDAO, Compound, Synthetix, and more, Immune now supports 301
projects across multiple crypto sectors.

Largest bug bounty payments in the history of software

fi

fi

fi

fi

ffffi

fi

fi

fi

fi

Immune has facilitated the largest bug bounty payments in the history ofsoftware.
$10 million for a vulnerability discovered in Wormhole, a generic cross-chain
messaging protocol.
$6 million for a vulnerability discovered in Aurora, a bridge and a scaling
solution for Ethereum.
$2.2 million for a vulnerability discovered in Polygon, a decentralised Ethereum
scaling platform that enables developers to build scalable user-friendly dApps.

Disclaimer: Immune uses publicly available data and news reports in order toaccess and collect alleged frauds, scams, and rug pulls. Including such incidents
in this report does not constitute a determination from Immune that a fraud,scam, or rug pull event did occur.

If you’re a developer thinking about a bug-hunting career in web3, we gotyou. Check out our Web3 Security Library, and start taking home some of
the $144M in rewards available on Immune — the leading bug bounty
platform for web3.

fifififi

https://immune .com/