Q2 2023 in crypto hacks: Atomic Wallet users lost $100 million to poisoned software

Crypto losses in the second quarter of 2023 came to $240.6 million across 51 incidents, slightly below the $270.1 million of the first quarter and well below the $631.5 million of the second quarter of 2022.

Atomic Wallet

On June 3, attackers compromised the Atomic Wallet application through its software supply chain. Malicious code stole users’ private keys, and over $100 million was taken from roughly 5,500 wallets on several chains. It was 41.6% of the quarter’s losses.

Unlike most large incidents, the losses fell on individual users rather than a company’s treasury.

Exchanges

Centralised exchanges had five incidents and lost $53.9 million. On April 14, attackers compromised a Bitrue hot wallet and withdrew about $23 million, from a wallet that held under 5% of the exchange’s funds. South Korean exchange GDAC lost about $13.9 million from its hot wallet days earlier. In June, Floating Point Group, a prime broker for institutions, lost an estimated $15 million to $20 million from custody accounts.

A validator turns on the bots

In April, a malicious Ethereum validator abused a flaw in the mev-boost-relay software to see block contents early. It front-ran trading bots that profit from transaction ordering and took about $20 million across 24 transactions.

Six incidents of $10 million or more made up 76.3% of losses, and 29 incidents were under $1 million.

Sources

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.