Among blockchain ecosystems, Ethereum suffered the most losses in hacking incidents during the first half of 2024, according to a recent report by cybersecurity firm SlowMist.
The biggest reason for the security breaches was found to be vulnerabilities in blockchain contracts, which can include issues like bugs in the code. The second top reason was “rug pull,” a type of exit scam where a crypto team raises money from investors and the public by selling digital tokens only to disappear with the funds.
“In the first half of 2024, there were 158 DeFi security incidents, accounting for 70.85 percent of the total Incidents, with losses amounting to $659 Million. Compared to the First Half of 2023 (111 incidents with losses of approximately $480 Million), this represents a 37.29 percent year-on-year increase in losses.”
Security incidents on trading platforms alone accounted for $524 million in losses during the first half. The attack on Japanese crypto platform DMM Bitcoin on May 31 was the largest trading platform security incident during this period. More than 4,500 Bitcoins were illegally transferred from the company’s official wallet, leading to losses of around $305 million.
Hacking Incidents
In May, two brothers were arrested by law enforcement in the United States for attacking the Ethereum blockchain and stealing $25 million.The brothers, who studied math and computer at a prestigious university, were accused of tampering with and manipulating the processes and protocols by which transactions in the Ethereum blockchain are validated and added, according to a press release from the U.S. Department of Justice (DOJ).
“In doing so, they fraudulently gained access to pending private transactions and used that access to alter certain transactions and obtain their victims’ cryptocurrency. Once the defendants stole their victims’ cryptocurrency, they rejected requests to return the stolen cryptocurrency and took numerous steps to hide their ill-gotten gains,” the department said.
The Ethereum exploit carried out by the brothers was the “very first of its kind.”
On June 23, the foundation’s email account was used by criminals for a scam directed at its members. The hackers sent emails to 35,794 members, encouraging them to click on a link. Those who clicked the link were sent to a malicious website.
The website was running a “crypto drainer,” meaning that if someone were to initiate their crypto wallet and sign a transaction as requested by the website, the funds in their wallet would be drained.
The foundation said it took back control of the situation and prevented hackers from sending additional emails. It also shut down the access path threat actors used to access the mailing list provider.
The organization’s analyses “appear to show that no victims lost funds during this specific campaign sent by the threat actor,” the foundation said.
“As we continue working on this incident, we have taken additional measures such as migrating some mail services to other providers, to further help reduce the risk of this happening again.”
