Q3 2022 in crypto hacks: Nomad and Wintermute made up 85.6% of $408.7 million

The third quarter of 2022 was the quietest of the year. The ledger records 31 incidents with a known loss and $408.7 million lost, down from $631.5 million in the second quarter and $1.04 billion in the third quarter of 2021.

Only two incidents passed $10 million, and together they made up $350 million, 85.6% of the total.

Nomad

On August 1, the Nomad bridge was drained of about $190 million. A setup error had marked an empty value as trusted, so its contract accepted any message as valid. Once the first withdrawal showed how, more than 300 copycats copied the transaction and took funds for themselves.

It was 46.5% of the quarter’s losses and ranks 24th of the 1,272 incidents with a known loss.

Wintermute

On September 20, trading firm Wintermute lost about $160 million from its DeFi hot wallet. The wallet’s address had been made with Profanity, a tool for generating custom-looking addresses, which used a weak 32-bit seed. The attacker worked out the private key from it. Only Wintermute’s DeFi operations were affected. It was the firm’s second loss of the year, after the Optimism tokens in June.

The rest

The other 29 incidents shared $58.7 million between them, and 17 were under $1 million. Centralised exchanges lost $4.8 million in one incident.

Sources

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.