Crime & Security2 min readThe AssayerLook-back
Q1 2024 in crypto hacks: one stolen key made up 55.5% of $522.7 million in losses
Crypto projects lost $522.7 million across 58 incidents with a known loss in the first quarter of 2024, according to the Bitminer.io failures ledger. That was close to double the $270.1 million lost in the first quarter of 2023, across 43 incidents.
One incident made up most of it. PlayDapp, a blockchain gaming platform, lost $290 million, 55.5% of everything lost in the quarter. It ranks 16th of the 1,272 incidents with a known loss in the ledger.
A stolen key, not a code flaw
PlayDapp’s loss didn’t come from a bug in its smart contracts. Its deployer key was compromised through spear-phishing. The attacker used it to make itself a minter on the PLA token contract and created 1.79 billion tokens in two transactions, on February 9 and February 12.
That pattern ran through the quarter. Key compromises and social engineering accounted for 13 incidents and $322 million, or 61.6% of losses. In February, FixedFloat lost about $26.1 million after attackers obtained the private keys to its Bitcoin and Ether hot wallets.
The insider at Munchables
The second-largest loss came from inside. Munchables, a gaming NFT project on the Blast layer-2 network, lost $62.5 million on March 26. A developer hired to write its smart contracts had planted vulnerabilities, then used control of the upgradeable proxy to credit themselves 1 million ETH and drain the protocol.
Late March brought two more eight-figure losses. Curio lost roughly $16 million when an attacker abused an access control flaw in its voting power system to mint about 1 billion CGT tokens. Three days later, Prisma Finance lost about $11.6 million in collateral to a flash loan attack on a contract that didn’t check who was calling it.
Most incidents were small
Six incidents of $10 million or more made up $417.8 million, 79.9% of the quarter’s losses. At the other end, 24 incidents involved less than $1 million each. DeFi protocols took 45 of the 58 hits and $423.7 million of the losses. Centralised exchanges lost $15.1 million across three incidents, a share that would change sharply in the next quarter.
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
More on NFTs
