Beosin Report: Analysis of the Web3 Blockchain Security Situation in the First Half of 2023
Original Authors: Mario, Donny, Beosin Research Team
Original Source: Beosin
This report is jointly produced by Beosin, SUSS NiFT, LegalDAO, Footprint Analytics, Biteye, and ShellBoxes
Introduction
With the continuous acceleration of the global digitization process, blockchain technology, as an emerging decentralized transaction method, is gradually becoming one of the core infrastructures of the digital economy. However, as the application scenarios of blockchain continue to expand, the security risks it faces are also increasing. In such a context, understanding the Web3 blockchain security situation and regulatory policies in the encryption industry becomes one of the necessary measures to ensure the security and stability of blockchain applications. This research report is jointly initiated by Beosin, a blockchain security company, and SUSS NiFT, focusing on the global blockchain security situation, Web3 hot events, and key regulatory policies in the encryption industry for the first half of 2023. It provides in-depth analysis and summary, aiming to provide valuable references and insights to readers and help the secure and healthy development of blockchain technology.
Data charts can be foundhere (data as of June 25th)
1. Overview of Web3 Security Situation in the First Quarter of 2023
According to Beosin's security risk monitoring, early warning, and blocking platform Beosin EagleEye, in the first half of 2023, the total loss caused by hacker attacks, phishing scams, and project rug pulls in the Web3 field reached $655.61 million. There were 108 attack incidents with a total loss of approximately $471.43 million; phishing scams resulted in a total loss of approximately $108 million; there were 110 project rug pull incidents with a total loss of approximately $75.87 million.
Web3 domain hacker attack incidents have seen a significant decrease in total losses compared to last year. The total loss in the first half of 2022 was about 1.91 billion USD, in the second half of 2022 it was about 1.69 billion USD, and in the first half of 2023, this number dropped to 470 million USD.
In terms of the attacked project types, DeFi remains the most frequently attacked and highest loss type. The total loss from 85 DeFi security incidents reached 292 million USD, accounting for 62% of the total loss.
In terms of chain platform types, 75.6% of the loss amount came from Ethereum, around 356 million USD, ranking first among all chain platforms.
In terms of attack methods (based on the root cause), the most frequent and highest loss-causing attack method is contract vulnerability exploitation. 60 contract vulnerability incidents caused losses of 264 million USD, accounting for 56% of all loss amounts.
In terms of fund flow, about 215 million USD of stolen assets have been recovered, accounting for 45.5% of all stolen assets. In addition, approximately 113 million USD of stolen assets have been transferred to Tornado Cash and other mixer services.
In terms of auditing status, about 49% of attacked projects have not undergone audits.
Contrary to the trend of decreased hacker attacks compared to 2022, for ordinary users, phishing scams and Rug Pull incidents by project teams have increased in the first half of 2023. According to incomplete statistics, the total amount involved in these two types of incidents reached at least 184 million USD. Due to the lowered entry barrier for phishing techniques (such as being able to purchase malicious toolkits from phishing groups through certain channels and share profits), phishing scams have increased significantly in the first half of 2023, becoming a major threat to the security of Web3 users.
II. Overview of Attack Incidents
A total of 108 attack incidents resulted in losses of 471.43 million USD
During the first half of 2023, Beosin EagleEye Security Risk Monitoring, Early Warning, and Blocking Platform detected a total of 108 major attack incidents in the Web3 field, resulting in a total loss of $471.43 million. Among them, there was 1 security incident with a loss exceeding $100 million, 7 incidents with losses between $10 million and $100 million, and 23 incidents with losses between $1 million and $10 million.
Attacks with losses exceeding $10 million (sorted by amount):
● Euler Finance - $197 million
On March 13th, DeFi protocol Euler Finance was attacked, resulting in a loss of $197 million. On April 4th, Euler Labs announced on Twitter that, after successful negotiation, the attacker had returned all stolen funds.
● Atomic Wallet - $67 million
On June 3rd, several Atomic Wallet users reported on social media that their wallet assets had been stolen, with the stolen amount reaching at least $67 million. The hacker has laundered the stolen funds through the mixing platform Sinbad, and the reason for the attack is still under investigation.
● MEV attack - $25 million
On April 3rd, multiple MEV robots were subjected to a malicious sandwich attack, resulting in a total loss of approximately $25 million.
● Bitrue - $24 million
On April 14th, the hot wallet of the cryptocurrency exchange Bitrue was attacked, resulting in a loss of $24 million.
● Floating Point Group (FPG) - $20 million
On June 11th, the cryptocurrency brokerage firm Floating Point Group (FPG) was hit by a cyber attack, resulting in a loss of approximately $20 million in cryptocurrency.
● GDAC - $13 million
On April 9th, the South Korean cryptocurrency exchange GDAC was targeted by hackers, resulting in a loss of nearly $13 million.
● Yearn Finance - $11.5 million
On April 13th, Yearn Finance's yusdt contract was hacked, with hackers making a profit of over $10 million.
● MyAlgo Wallet - $11.2 million
In February, MyAlgo Wallet was attacked by an intermediary, resulting in a loss of $11.2 million.
3. Types of Attacked Projects
85 DeFi Security Incidents Resulting in $292 million Loss
In the first half of 2023, there were a total of 85 security incidents in DeFi projects, accounting for 78.7% of the total incidents. The total amount of losses in DeFi reached $292 million, accounting for 62% of the total losses. DeFi is the most frequently attacked and highest loss-generating type of project.
Out of the 85 DeFi security incidents, 51 were due to contract vulnerabilities, resulting in a loss of $249 million, accounting for 85% of the total DeFi losses.
Wallet attacks caused approximately $78.2 million in losses, ranking as the second highest among all project types. The Atomic Wallet attack alone resulted in a loss of at least $67 million, while the MyAlgo Wallet attack resulted in a loss of $11.2 million.
The third-ranked type of project is exchanges, with losses of approximately $50.14 million. Exchange attack incidents were also ranked third in terms of losses in the full-year data for 2022, and this year continues the trend of frequent attacks.
The cross-chain bridge project had the highest loss amount in 2022 (1.89 billion USD), but the loss decreased significantly to 1.38 million USD in the first half of 2023.
IV. Loss Amounts on Various Chain Platforms
75.6% of the loss amount came from Ethereum
In the first half of 2023, there were a total of 27 major attack incidents on the Ethereum chain, with a loss amount of approximately 356 million USD. The loss amount on the Ethereum chain ranked first among all chain platforms, accounting for approximately 75.6%.
The BNB Chain experienced the highest number of attack incidents, reaching 58, accounting for 53.7% of all incidents. Among the 58 attack incidents on BNB Chain, 40 projects that were attacked had not undergone audits.
There were a total of 7 attack incidents on the Arbitrum chain, resulting in a loss of approximately 16.71 million USD. The amount and number of security incidents on Arbitrum increased compared to 2022 (Arbitrum only had two major security incidents throughout 2022).
In 2022, Solana ranked third in terms of loss amount among all public chains, but no major attack incidents were monitored in the first half of 2023.
V. Attack Methods Analysis
Contract vulnerabilities exploited most frequently with the highest loss amount
* Note: When multiple attack methods coexist, classification is based on the root cause. Attack incidents with insufficient information or undisclosed reasons are classified as "Unclear for now".
In the first half of 2023, the most common cause of attacks and the most damaging attack technique was contract vulnerability exploitation. 60 instances of contract vulnerability incidents caused a loss of $264 million, accounting for 56% of all losses.
Approximately $100 million worth of security incidents have unclear attack techniques, including the theft of $67 million from the Atomic Wallet, $20 million attack on the cryptocurrency brokerage company FPG, and other similar events. These incidents involve large amounts of money and have a significant impact on users. It is recommended that project teams actively cooperate with third-party security companies, promptly disclose investigation results, and take necessary remedial measures to ensure user asset security.
In addition, there were 7 incidents of private key leakage resulting in a loss of approximately $27.67 million. In 2022, private key leakage losses ranked third among all types of attacks. Private key leakage continues to pose a threat to project security. Strengthening the professional ethics and security awareness management of core members is particularly important, as evidenced by some disclosed incidents.
When categorized by vulnerability type, the top three causing the most losses are business logic defects, permission issues, and reentrancy. 36 instances of business logic vulnerabilities caused a loss of approximately $239 million, accounting for 90% of all losses caused by contract vulnerability attacks. These types of vulnerabilities are the most easily overlooked issues by developers, and the resulting losses after an attack are often significant. In 9 cases, the loss amount exceeded $1 million. It is recommended that project teams seek professional auditing companies with experience for audits.
Six. Analysis of Typical Case Attack Techniques
6.1 Euler Finance Security Incident
On March 13, Euler Finance, a lending project on the Ethereum chain, fell victim to a flash loan attack, resulting in a loss of $197 million.
On March 16, the Euler Foundation offered a $1 million reward to gather information helpful for the arrest of the hacker and the return of stolen funds.
On March 17th, CEO Michael Bentley of Euler Labs tweeted that Euler has always been a project with a strong security awareness. From May 2021 to September 2022, Euler Finance underwent 10 audits by 6 blockchain security companies including Halborn, Solidified, ZK Labs, Certora, Sherlock, and Omnisica.
From March 18th to April 4th, attackers started returning funds gradually. During this period, the attackers apologized through on-chain messages, admitting that they "disturbed other people's money, work, and lives" and asking for forgiveness.
On April 4th, Euler Labs announced on Twitter that, after successful negotiation, the attackers have returned all stolen funds.
Vulnerability analysis: Replaying the origin and development of the $200 million theft case of Euler Finance, what inspirations does this incident bring us?
6.2 BonqDAO Security Incident
On February 1st, the crypto protocol BonqDAO fell victim to a price manipulation attack. The attacker minted 100 million BEUR tokens and then swapped them for other tokens on Uniswap, causing the price of ALBT to plummet close to zero, which further resulted in the liquidation of the ALBT treasury. With the token price during the hack, the losses amounted to as much as $88 million, but due to liquidity depletion, the actual losses were around $1.85 million.
Vulnerability Analysis: The biggest hacker event at the beginning of the year, with a loss of 88 million US dollars, the attack event analysis of the encryption protocol BonqDAO
6.3 Platypus Finance security incident
On February 17th, Platypus Finance, a platform on Avalanche, was attacked due to a function check mechanism issue, resulting in a loss of approximately 8.5 million US dollars. However, the attacker did not implement the withdrawal function in the contract, resulting in the attack proceeds being locked in the attack contract and unable to be withdrawn.
On February 23rd, Platypus stated that they have contacted Binance and confirmed the identity of the hacker, and they will refund at least 63% of the funds to the users.
On February 26th, the French National Police have arrested and summoned two suspects who attacked Platypus.
Vulnerability Analysis: How to prevent flash loan attacks? Analysis of the attack event that caused a loss of 8.5 million US dollars on the Avalanche-based Platypus project
6.4 Yearn Finance security incident
On April 13, 2023, Yearn Finance's yusdt contract was attacked by a flash loan attack, and the hacker made a profit of over 10 million US dollars. It is suspected that yUSDT was incorrectly configured when deployed over 1000 days ago, using Fulcrum iUSDC instead of Fulcrum iUSDT.
On May 26th, the Yearn attacker transferred 4134 ETH to Tornado Cash.
Vulnerability analysis: How did Yearn Finance get targeted by hackers and lose over 10 million US dollars?
7. Review of typical anti-money laundering cases
According to Beosin EagleEye, a security risk monitoring, warning, and interception platform developed by Beosin, a blockchain security audit company, Atomic Wallet was attacked in early June this year. According to Beosin's team statistics and comprehensive on-chain victim reports, the attack resulted in losses of at least approximately 67 million US dollars.
We will thoroughly discuss the money laundering details of this hacking and use Beosin KYT, a virtual asset anti-money laundering compliance and analysis platform, to track and analyze the money laundering techniques used by hackers.
Event summary
According to Beosin's team analysis, the chains involved in the theft so far include BTC, ETH, and TRX, totaling 21 chains. The stolen funds are mainly concentrated in the Ethereum chain. Specifically:
Ethereum chain:
The stolen funds amount to 16,262 ETH, equivalent to approximately 30 million US dollars.
TRON chain:
The stolen funds on the TRON chain amount to 251,335,387.3208 TRX, equivalent to approximately 17 million US dollars.
BTC chain:
The stolen funds on the BTC chain amount to 420.882 BTC, equivalent to approximately 12.6 million US dollars.
BSC chain:
The stolen funds on the BSC chain amount to 40.206266 BNB, worth virtual currency.
Other chains
XRP: 1676015 XRP, about $840,000
LTC: 2839.873689 LTC, about $220,000
DOGE: 800575.67369797 DOGE, about $50,000
Ethereum
In the hacker's operation on the stolen funds, Ethereum has two main ways of attack:
1. Divergence through contracts and utilizing Avalanche for cross-chain laundering
According to the analysis of the Beosin team, the hacker first converts valuable coins in the wallet into the main coin of the public chain, and then collects them through two contracts.
The contract address will package ETH into WETH through two-layer transfers, and then transfer WETH to the contract used to diverge ETH. Through up to 5 layers of transfers, it will be transferred to the wallet address for cross-chain operations using Avalanche. This cross-chain operation does not involve contracts and belongs to Avalanche's internal accounting transaction type.
The Ethereum chain is shown in the diagram below:
8. Analysis of the flow of stolen assets
45.5% of stolen assets have been recovered
During the first half of 2023, the Beosin KYT Virtual Asset Anti-Money Laundering Compliance and Analysis Platform showed that approximately $215 million of stolen assets have been recovered, accounting for 45.5% of all stolen assets. In 2022, only 8% of stolen assets were recovered. The opportunity for fund recovery in 2023 has greatly increased. In addition to negotiating with hackers for recovery, there are also increasing cases of recovery through collaboration between security companies, law enforcement agencies, and community. Furthermore, the improvement of global regulatory systems and increased law enforcement efforts have also served as a deterrent to hacker activities.
Approximately $113 million of stolen assets have been transferred to mixer services. Among them, around $45.38 million has been transferred to Tornado Cash, and about $68.14 million to other mixing platforms. Since Tornado Cash was sanctioned by the US Office of Foreign Assets Control (OFAC) in August 2022, the total amount of funds mixed using Tornado Cash has significantly decreased, while the usage of other mixing platforms like FixedFloat and Sinbad has noticeably increased.
9. Project Auditing Analysis
The ratio of audited to unaudited projects is roughly equal. Out of the 108 attacked projects, 51 projects have been audited, while 53 projects have not. This ratio is roughly consistent with the situation in 2022.
Among the 51 audited projects, 31 projects (60%) were attacked due to contract vulnerabilities exploitation. This ratio is higher than last year's 45%, indicating that the overall quality of the auditing market is still not optimistic. It is recommended for project teams to seek professional security companies for auditing.
10. Rug Pull Analysis
There have been 110 Rug Pull incidents, resulting in a loss of $75.87 million.
During the first half of 2023, a total of 110 major Rug Pull incidents were detected in the Web3 field, involving approximately $75.87 million.
In terms of the amount, there were 14 incidents (12.7%) with Rug Pull amounts exceeding $1 million, 41 incidents (37.3%) with amounts between $100,000 and $1 million, and 55 incidents (50%) with amounts below $100,000.
The largest Rug Pull incident in terms of amount was the Fintoch project, which took away approximately $31.6 million in assets.
In terms of chain platforms, there were 80 Rug Pull incidents on BNB Chain, involving $53.37 million, far surpassing other public chains.
Summary of Security Situation in the First Half of 2023
Overall, the total amount of losses from hacker attacks in the Web3 field has significantly decreased compared to 2022. In the first half of 2022, the total loss from attacks was approximately $1.91 billion, and in the second half of 2022, it was about $1.69 billion. In the first half of 2023, this value decreased to $470 million, and about $215 million of stolen assets were recovered. Hacker attacks have shown a significant slowdown, and the main reasons for this phenomenon include the gradual improvement of global regulatory systems, increased law enforcement efforts, improved security awareness among project teams, the sanctioning of mixer Tornado Cash, and the improvement of AML (Anti-Money Laundering) technologies and procedures. In addition, there have been cases where the hacker's identity was identified through off-chain intelligence by the community and forced the hacker to return the stolen assets.
Even though hacker attacks have significantly slowed down, contract security issues cannot be ignored. In the first half of 2023, the most frequent and damaging attack method was the exploitation of contract vulnerabilities. 60 incidents of contract vulnerabilities resulted in a loss of $264 million, with the majority of vulnerabilities being related to business logic issues. Some more complex business logic vulnerabilities require experienced professional auditing companies to discover. Beosin's auditing team conducts in-depth analysis of every hacker attack incident (Twitter: @BeosinAlert) to ensure that the experience and technology summarized from these incidents are applied to the project auditing process to address potential hacker attacks.
Contrary to the trend of declining hacking incidents, phishing scams targeting ordinary users are becoming more frequent. In the first half of the year, a series of wallet drainer groups, represented by Venom Drainer, emerged. They developed malicious toolkits for sale and shared profits with buyers who successfully phished. Such phishing scams have affected a wide range of users, with Venom Drainer alone victimizing at least 15,000 people. For ordinary users, it is best to regularly pay attention to security company alerts and systematically learn about phishing prevention and theft prevention. Installing phishing protection plugins, transaction pre-execution tools, and other reminder tools can be helpful (but not solely relied upon, as strengthening one's own security awareness should always come first).
