Top Crypto Heist as of to Date, Are your Fund in peril?

[BitDane]

What is Crypto Heist:
Crypto Heist also known as Crypto robber where hackers have exploited vulnerabilities within these third parties, have targeted cryptocurrencies directly, and have utilized flash loans to their advantage. To date, this has seen them steal the equivalent of $4 billion.[1]

Here is the current statistics of the reported Crypto Heist



Heists are assigned to the country where the platform/website’s headquarters are located. Where a company’s location isn’t provided, the heist isn’t included in the map figures.[1]

Top Crypto Heist
According to the site[1] the following are the biggest crypto heist to date (based on the amount stolen at the time)

Ronin Network (Axie Infinity) – $620 million stolen

On 29 March 2022, Ronin Network (a gaming-based crypto network) announced it had been hacked and a whopping $620 million had been stolen in total. This was made up of 173,600 in ETH (worth just less than $595m USD) and $25.5m in USD, making it the biggest crypto heist to date. Ronin Network, which supports Sky Mavis’s Axie Infinity game, said its Ronin and Axie DAO validator nodes had been compromised with the funds being drained in two transactions. The US Treasury Department later attributed the theft to North Korea’s Lazarus group.

Poly Network – $610 million stolen

In August 2021, a hacker attacked Poly Network by exploiting a vulnerability in its system and managed to steal funds worth over $600 million. However, in a strange twist, they didn’t make off with their bounty. Instead, the hacker spoke to the platform and agreed to give back most of the money, except for $33 million of tether (USDT) which had been frozen by the issuers. But that wasn’t the end of the fiasco as $200 million of the stolen funds were trapped in an account that required a password from the hacker and Poly Network. For a while, the hacker refused to hand theirs over. That was until Poly Network begged for them to release it, coughed up $500,000 as a gesture for finding the system vulnerability, and even offered them a job! Poly Network later revealed that so-called “Mr. White Hat” had given them the private key.

Coincheck – $532 million stolen

In January 2018, Japan-based Coincheck had its NEM (XEM) tokens stolen to the tune of more than $530 million. Hackers exploited the fact that the currency was being kept in a “hot” wallet, meaning it was connected to the server and was effectively “online” (a cold wallet sees funds stored offline). NEM developers were able to identify the stolen coins and mark them as such, but there was speculation that the funds were available on dark markets. However, as the coins lost a lot of value after the attack, it’s unlikely many would have seen this as a good deal (even today the coins would be worth 83 percent less than they were–around $90 million).

MT Gox – $470 million stolen

This was the first large-scale hack on an exchange and is still the biggest theft of Bitcoins from an exchange. However, the MT Gox heist wasn’t down to a solitary event. Rather, the platform had been leaking funds since 2011, up until it was discovered in February 2014. Over a period of a few years, hackers stole 100,000 bitcoins from the exchange and 750,000 bitcoins from the exchange’s customers. At the time, these bitcoins were worth $470 million–but today, they’d be worth around ten times as much ($4.7 billion). MT Gox went into liquidation shortly after the hack with liquidators recovering approximately 200,000 of the stolen bitcoin.

Wormhole – $326 million stolen

In the first major crypto heist of 2022, Wormhole’s crypto platform was exploited to the tune of $326 million. The platform acts as a communication bridge between Solana (an ethereum rival that has recently gained traction) and other decentralized finance networks. On February 2, 2022, hackers were able to exploit a vulnerability, causing Wormhole to shut down its platform while it investigated. It later reported that 120k wrapped Ethereum (wETH) had been stolen.

KuCoin – $281 million stolen

In September 2020, KuCoin confirmed that hackers had managed to obtain private keys to their hot wallets before withdrawing large amounts of ethereum (ETH) and bitcoin (BTC), as well as Bitcoin SV (BSV), Litecoin (LTC), XRP (XRP), Stellar Lumens (XLM), Tron (TRX), and Tether (USDT). Since then, experts have suggested they have strong reason to believe that hackers in North Korea were responsible

PancakeBunny – $200 million stolen

In this flash loan attack in May 2021 where hackers were able to drain $200 million from the platform. To carry out the attack, the hacker loaned a large amount of Binance Coin (BNB) before manipulating its price and dumping it on PancakeBunny’s BUNNY/BNB market. This enabled the hacker to get a huge amount of BUNNY through a flash loan, dump all of the bunny in the market so the price dropped, before paying back the BNB through pancakeswap.

Bitmart – $196 million stolen

Almost $200 million was stolen in a compromise of Bitmart’s hot wallet in December 2021. Initially, $100 million was identified as having been stolen over the Ethereum blockchain, but a further investigation revealed another $96 million had been stolen over the Binance Smart Chain blockchains. A mix of more than 20 tokens were stolen, including altcoins like BSC-USD, Binance Coin (BNB), BNBBPay (BPay), and Safemoon, while large amounts of Moonshot, Floki, and BabyDoge were also compromised.

Beanstalk – $182 million stolen

In April 2022, Ethereum-based DeFi platform, Beanstalk, lost around $182m after a vulnerability allowed the hacker to carry out a flash loan attack. The hacker was able to make off with $80m in crypto but the platform’s losses extended far further than that to over $180m. Reports also suggest that the hacker deposited 250,000 USDC into the crypto donation wallet for Ukraine.

Bitgrail – $150 million stolen

Bitgrail was a small Italian exchange trading in lesser-known cryptos, such as Nano (XRB). In February 2018, just as the price of XRB skyrocketed from a few cents to $33, the exchange was hacked. Nano wallets had been targeted with at least 17 million coins stolen (the equivalent of around $150 million). Many users started to comment that they had noticed issues with the exchange before the attack (significantly lower withdrawal limits and transaction problems). Investigations also revealed that the coins had been stolen from cold wallets, not hot wallets, suggesting an inside job. Investigations have continued over the last few years with Italian police recently accusing the man who owned Bitgrail to be behind the attacks (either directly involved or was aware/took no action to prevent further theft once the first attack had been carried out).

Vulcan Forged – $135 million stolen

Hackers made off with $135 million from Vulcan Forged–a blockchain gaming company–in December 2021. They accessed 96 different wallets by stealing private keys, before draining 4.5 million PYR tokens from them.

Cream Finance – $130 million stolen

Not only did hackers make off with $130 million in this October 2021 attack, but this was the third attack Cream Finance had suffered in the year. in February, hackers stole $37 million and in August, $29 million. The latest attack saw hackers exploiting what was thought to be a vulnerability in the DeFi platform’s flash loan system. They were able to steal all of Cream Finance’s tokens and assets on the Ethereum blockchain, which amounted to $130 million.

BadgerDAO – $120.3 million stolen

In December 2021, a hacker managed to drain funds from across various cryptocurrency wallets on the DeFi platform, BadgerDAO. The platform confirmed that hackers had used a “maliciously injected snippet” via Cloudfare which allowed them to drain $130 million in funds, around $9 million of which was recovered as it hadn’t been withdrawn.

CoinBene – $105 million stolen

Initially, after huge outgoing transactions from CoinBene’s hot wallet to an unknown wallet in March 2019, the platform said it was undergoing maintenance. However, with every one of the platform’s ERC-20 tokens reportedly moving into an unknown wallet (which didn’t exist until the day of the transfer), rumors quickly circulated that this was an attack. Data scientists also found that the tokens were promptly moved to Etherdelta where they were sold for ethereum (ETH). This amounted to $105 million at the time.

Horizon (Harmony) – $100 million stolen

Horizon, Harmony’s cryptocurrency bridge that offers transfers between Ethereum and Binance and Bitcoin, was hacked for $100m across 11 transactions in June 2022. In a Twitter thread, Harmony announced it was working with authorities to try and identify the culprit and locate the stolen funds.

Liquid – $97 million stolen

In August 2021, Japanese cryptocurrency exchange, Liquid, detected that unauthorized persons had accessed its wallets before moving assets worth more than $97 million out of them. $16.13 million USDe of ERC-20 assets were frozen to prevent onward movement but 69 various cryptos were misappropriated and sent to other DeFi platforms or exchanges.

EasyFi – $81 million stolen

By stealing the private keys to EasyFi’s MetaMask admin account, hackers were able to extract $6 million in USD, DAI, and USDT, plus 2.98 million EASY tokens, all of which amounted to around $81 million. The machine that was compromised to gain the keys was offline most of the time, only being switched on to perform official transfers for the project. When the attack was carried out, the machine had been offline for more than a week. And because it wasn’t actively used when the attack was carried out, this delayed the platform’s resp

It is quite surprising how many promising exchanges, DeFi and crypto projects had suffered hacking.   Often time we wonder if it is an inside job or the cryptocurrency security system is so weak that it can't cope up with the advancement of hackers and hacking tools.  Regardless it is beyond the investors grasp.  Should the platform or project take responsibility for this incident?  Do you think the current DeFi security system isn't ready to protect the money of investors?  Or is it just an inside job disguise as crypto hacking incident?


[1] https://www.comparitech.com/crypto/biggest-cryptocurrency-heists/

[AmoreJaz]

the hard truth about any hacking incident is - even if we ask responsibility from the platform itself, it is not an assurance that you will get your funds back. it is still on your hands how you will secure your portfolio. this is why, if you are using a third party trading platform, better use them while you are actively trading. but if not, better transfer it to your own wallet where you have your own keys. some of these hacking incidents may be inside job in disguise. but would take years before someone will prove such connection to that employee. so why not just secure your own funds and not rely to these third party websites in storing your funds?

[hatshepsut93]

Do you think the current DeFi security system isn't ready to protect the money of investors?  Or is it just an inside job disguise as crypto hacking incident?

It's both. There's a ton of projects that put backdoors disguised as bugs so that they can scam people and have some deniability to protect them against law enforcement, in case they ever get caught. As for "security system" - DeFi is just a computer program, and computer programs have bugs, especially if these programs belong to a highly experimental paradigm and are written by small groups of amateurs. Bitcoin is much more secure than shitcoins because thousands of people are working on it, and these people are some of the best experts in the world, and everything gets checked, tested and reviewed many times over. Compare it with DeFi and other blockchain projects that release code asap just to make more money quickly and move on to the next project after the last one fails.

[The Sceptical Chymist]

There's been so much money lost because of all these hacks (with the exception of some customers who got their coins back from whatever exchange/platform was involved), and it's amazing to me that people still haven't lost their enthusiasm for crypto overall.  The entire crypto space has continued to grow and thrive in spite of the glaring problems of security with custodial ownership.

And then of course, this most recent catastrophe with UST, Voyager, and who knows what else has drawn the attention of regulators.  That's unfortunate IMO, because I think the level of regulation in the crypto industry is pretty good as is.  You just have to know that the freedom from banks carries with it the responsibility to secure your crypto yourself.  If you entrust anyone else with your coins, you're screwed if whoever has control over them goes bust, goes rogue or whatever. 

Big daddy government doesn't need to write a whole bunch of restrictive laws to protect us.

[2stout]

Unfortunately, I would have to say unequivocally yes if you don't have the keys.  But depending on goals and desires, some are ok with this and have done quite well for themselves; however, on the flipside, we have seen individuals as wells as entities totally wiped out as in everything lost.

[BitDane]

Do you think the current DeFi security system isn't ready to protect the money of investors?  Or is it just an inside job disguise as crypto hacking incident?

It's both. There's a ton of projects that put backdoors disguised as bugs so that they can scam people and have some deniability to protect them against law enforcement, in case they ever get caught.

The sad thing is that even with an idea that the perpetrator is inside the company, it fall short of evidence making the accusation only a rumor.  If we search list of possible inside job hacks, there are article that can be found about this but sadly they were never been proven true yet,

Like the recent UST fiasco, it was believed that the Wallet that caused UST attack are suspected to belong to the Terraform Labs[1]

The hack on Bithumb was also suspected as an inside job[2]

Here is another funny thing, CEO of Coinsecure Bitcoin Exchange Accussing his CSO of stealing 438 BTC.  The CSO declared a lost of fund while extracting Bitcoin Gold.[3]

"Our CSO, Dr. Amitabh Saxena, was extracting BTG and he claims that funds have been lost in the process during the extraction of the private keys," Coinsecure added.

And a rumor that BitMart Hack is an Inside Job since Twittterati  alleges the exchange to pay someone to hack their system.[4]

[1] Inside Job? Wallet That Caused the UST Attack Suspected to Belong to Terraform Labs (Report)
[2] Cypto Exchange Bithumb Hacked in Suspected Inside Job
[3] $3.3 Million Stolen From Coinsecure Bitcoin Exchange, Inside Job Suspected
[4] BitMart Hack an Inside Job? Twitterati Alleges the Exchange Firm Paid Scamsters to Hack Their own Network

[South Park]

Unfortunately, I would have to say unequivocally yes if you don't have the keys.  But depending on goals and desires, some are ok with this and have done quite well for themselves; however, on the flipside, we have seen individuals as wells as entities totally wiped out as in everything lost.

In my opinion people are too naive when it comes to how they manage their money, they just assume that since bitcoin is a secure coin then all the other coins which are based on it are as secure and this is not the case, many of those which are developing new coins do not really know what they are doing and they rushed the development of their coin to fulfill their goals, but they sacrificed the security of the coin in the process and since almost no one else is interested in the coin then there are not third parties checking if there are bugs somewhere and fix them, so hackers have huge chances of finding a coin which has a big enough security hole to exploit and then steal a fortune in the process.

[NotATether]

Most of the hacks on this list are against no-name exchanges. So the old lesson goes, "Don't use exchanges, and if you really have to, don't transfer what you can't afford to lose, and use only the well-known ones" as those have better security measures against hacks.

[Z-tight]

There's been so much money lost because of all these hacks (with the exception of some customers who got their coins back from whatever exchange/platform was involved), and it's amazing to me that people still haven't lost their enthusiasm for crypto overall.  The entire crypto space has continued to grow and thrive in spite of the glaring problems of security with custodial ownership.

That is because the people who have lost money to hacks and custodial services know they are guilty of failing in their responsibility, for example if a student fails in class and goes home with poor grades, they do not blame the school for that, it was their responsibilty to study and pass their exams, which they couldn't manage to do, even if they pull out of the school, the school goes on with other students willing to learn and study.

The crypto space will continue to thrive because even as many people that put their money in exchanges know they are not doing the right thing, but some do it because they find it to be more convenient for them, so needless to say that if something goes wrong and a hack happens, they have to blame only themselves, and the crypto space moves on, people learn from their lesson and use only non-custodial services, and the network goes on because the advantages outweigh every other thing.

[so98nn]

If it is actual stealing in terms of flash loans or re-routing money with another ways which belongs to the user then  I am pretty sure exchangers are responsible for the whole thing. I always knew that whenever there is hacks on exchanges its inside jobs. Giving away money or using peeps money for earning interest is nothing but stealing your money. The number one reason is, crypto ain’t meant for using the money of users in real world to lend our and earn interest. Secondly they are always publishing hacks when they are on their down turn so that the money need not to be returned and tangled up in the court sessions.

[Husires]

 Do you think the current DeFi security system isn't ready to protect the money of investors?  Or is it just an inside job disguise as crypto hacking incident?

What baffles me is how hack verification is done, I understand that large platforms will not take the risk of inventing a hack story but can we deal with the same credibility with smaller platforms?
how can verifying the accuracy of these total number of hacks, as many platforms fake trading volumes.

Stories like the CFO has passed away and there is no access to the private key, as QuadrigaCX case ( Mystery of crypto CEO who died, taking $250 million with him.


and Stablecoins that can freeze coins inside wallets Tether Froze $300K of Stablecoin Hacked After Victims Left

[zasad@]

https://bitcointalk.org/index.php?topic=5267124.msg57677686#msg57677686
Poly Network Hacker Returned the stolen money
Ronin did not return the stolen funds
https://decrypt.co/103999/axie-infinitys-ethereum-bridge-back-online-after-622m-hack
This market is still the Wild West, and small investors have no protection here.

[Lucius]

Most of the hacks on this list are against no-name exchanges. So the old lesson goes, "Don't use exchanges, and if you really have to, don't transfer what you can't afford to lose, and use only the well-known ones" as those have better security measures against hacks.

I can't say that I haven't heard of some of these companies, but 80% of all of them seem like classic exit scams where the owners robbed themselves and accused hackers from North Korea or some other country that is on someone's blacklist. I'm not surprised personally that some people have malicious ideas that they put into action, but when I see the amounts involved, I can't stop being surprised that there are so many naive people in the world who constantly finance such projects.

Should the platform or project take responsibility for this incident?  Do you think the current DeFi security system isn't ready to protect the money of investors?  Or is it just an inside job disguise as crypto hacking incident?

Of course, they should be held accountable for every incident, and not just morally like that South Korean hypocrite who is still laughing today as if nothing had happened - but they should be sentenced to long-term sentences, and then all their property should be confiscated, sold at auction and give to charity. Those who in any way participate in such projects did not even deserve to get their money back.

[The Sceptical Chymist]

The crypto space will continue to thrive because even as many people that put their money in exchanges know they are not doing the right thing, but some do it because they find it to be more convenient for them, so needless to say that if something goes wrong and a hack happens, they have to blame only themselves, and the crypto space moves on, people learn from their lesson and use only non-custodial services, and the network goes on because the advantages outweigh every other thing.

Yeah, but I wonder how many of those people were newcomers to crypto and got soured on it entirely after losing their funds.  I tend to think that the more dedicated crypto enthusiasts wouldn't entrust an exchange or defi platform or whatever with their coins, especially if it's a large amount. 

I don't think I looked at the infograms closely last time I checked this thread, so I just noticed that most of the hacks targeted US companies.  I don't know why that is, but I could probably hazard a number of guesses.  Also, it looks like though the number of hacks increased, the failure rate of the target company has decreased--so that's good.  Looks like these companies are becoming sufficiently capitalized such that they can withstand a decent-sized hit from a hacker.

[stompix]

Often time we wonder if it is an inside job or the cryptocurrency security system is so weak that it can't cope up with the advancement of hackers and hacking tools.

The security system of any company will get fucked up if your employee is applying from the company computers to a fake job interview, downloading a PDF from an unknown person who met online, and doing this on a computer that had zero protection against malware despite having access to all the systems in their company.
https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game

Imagine how secure was all this and how secure is all of it when your workers, while in your office are applying and conducting interviews on LinkedIn for other jobs?

One more thing,
PancakeBunny – $200 million stolen
This was no hack, it was just somebody exploring the loaning capabilities and the low liquidity in the market, manipulating the price but still paying back the loan.
So, he pulled a Soros, not a hack. 

[fiulpro]

-Get a good wallet, don't go for the online ones you are more or so going increase your chances of being scammed, an offline wallet doesn't cost anything and you always have options like : Samourai

-Make sure the device is secure there are so many things that can go wrong, make sure you are the only person who is using it, don't let anyone install anything in there

-Make sure you are not going on the dark side of the internet and downloding something that even you might not be aware of

-Make sure that the wallet or the exchange is ' Reputable ' check the reviews before going in and using it

There are so many things that you can do to make sure you don't get scammed, never to late to educate people about it.

[crwth]

The cryptocurrencies affected mean they were the ones being used to get the money right? But it doesn't mean they exploited that current currency to get it or something. I understand when it comes to other possible shitcoins or something, they would be able to exploit the underlying technology that it has or something. Because I know that's what happened to Terra and Luna or something like that right?

[tbterryboy]

the hard truth about any hacking incident is - even if we ask responsibility from the platform itself, it is not an assurance that you will get your funds back.

Yes, because they can lie when they say that they are going to be responsible for our funds but they have an intention to scam us later on. If we are lucky our funds can be returned once those scammers have been successfully caught out by the authorities.

it is still on your hands how you will secure your portfolio. this is why, if you are using a third party trading platform, better use them while you are actively trading. but if not, better transfer it to your own wallet where you have your own keys. some of these hacking incidents may be inside job in disguise. but would take years before someone will prove such connection to that employee. so why not just secure your own funds and not rely to these third party websites in storing your funds?

This is easy if you are not an active trader but what if you are one of them? Depositing and withdrawing every time you make a trade can be time consuming and can also be costly because you are paying fees left and right. There are some which aren't actively trading but stores their cryptos on some platform because they are earning a passive income thru it. The case can take years to find out the results, that is if the investigators are not good enough on doing their jobs.

[boris singer]

It's really difficult to eradicate things like this because thieves also keep trying to do things like this so that they can make profits without caring about others.
It's a shame that such a great ability is carried out in the wrong way, even though in this case there are still mistakes from people or institutions that were stolen because of recklessness.
In the end, things like this will still happen as time goes on, things are getting crazier.

[carlfebz2]

It's really difficult to eradicate things like this because thieves also keep trying to do things like this so that they can make profits without caring about others.
It's a shame that such a great ability is carried out in the wrong way, even though in this case there are still mistakes from people or institutions that were stolen because of recklessness.
In the end, things like this will still happen as time goes on, things are getting crazier.

Not all would be talking about being reckless or being irresponsible because some of them are just inside jobs which it cant really be avoided on people to be intruiged about the possibilities specially if there are some

loopholes that had been discovered where only part of the team or insider are the cause of those lost of funds which means that it wouldnt be taking all the blame into those hacking incidents.
It is really just sad to see that these things do still continue to exist which its not really that shocking because this crypto space is a sweet spot on taking up millions of dollars
and fooling people around.

Sorry for those people who had been affected thats why trusting up projects is really hard even on how reputable or known it is.