Crime & Security1 min readThe AssayerLook-back
Q3 2024 in crypto hacks: WazirX alone accounted for 55% of $427.3 million
The third quarter of 2024 was quieter than the two before it. The ledger records 44 incidents with a known loss and $427.3 million lost, down from $541.4 million in the second quarter. It was also below the $685.3 million lost in the third quarter of 2023.
WazirX
Most of the quarter’s losses came from one exchange. On July 18, Indian exchange WazirX lost about $234.9 million across more than 190 tokens. The attackers gained control of a multisig wallet held with the custody firm Liminal. They used a fake WazirX account and hot wallet access, then exploited the multisig’s smart contract without needing the original keys.
That one loss was 55% of the quarter’s total, and ranks 19th of 1,272 incidents with a known loss in the ledger.
Two more exchanges in September
On September 10, Indonesian exchange Indodax lost about $25.47 million from its hot wallet, including roughly 5,204 ETH. Its private keys were not compromised, which pointed to a breach of the withdrawal system itself. Ten days later, attackers got past access controls on BingX’s hot wallets and drained about $43 million in two transactions. BingX pledged to cover users from its reserves.
Together, three exchange incidents made up $303.4 million, 71% of the quarter’s losses.
DeFi
DeFi protocols had 35 of the 44 incidents and lost $114.4 million. Penpie lost about $27 million when an attacker created fake tokens posing as Pendle yield tokens and used a reentrancy flaw to claim real rewards. Ronin Bridge lost about $12 million in August after a contract upgrade skipped a required initialisation step, leaving its operator vote-weight checks broken.
Five incidents of $10 million or more accounted for 80.1% of losses. Nineteen were under $1 million.
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
More on Bridge hacks
