Web3 Projects Experience $685.5 Million in Losses in Q3
According to a report from web3 bug bounty platform Immunefi, web3 projects suffered losses totaling $685.5 million in Q3, with major exploits on Mixin Network and Multichain contributing to almost half of the total losses. This represents a 59.9% increase compared to the $428.7 million lost in Q2, with incidents up 153% year-over-year.
High-profile Attacks Drive Q3 Losses
The losses in Q3 reached $1.4 billion for the year, making it the worst quarter due to hacks and fraud. Mitchell Amador, CEO of Immunefi, stated that large-scale attacks like those on Mixin Network and Multichain played a significant role in driving these losses. State-backed actors were allegedly behind several cases this quarter, particularly focusing on CeFi platforms.
Lazarus Group Behind Major Attacks
Mixin Network’s $200 million exploit in September and Multichain’s $126 million funds stolen in July accounted for $326 million in losses alone, comprising 47.5% of the total losses in Q3. The North Korean regime-backed Lazarus Group was responsible for high-profile attacks on platforms such as CoinEx, Alphapo, Stake, and CoinsPaid, stealing a total of $208.6 million.
Ethereum Most Targeted Network
Ethereum was the most targeted network, with 35 out of 76 incidents (42.7% of losses). BNB Chain witnessed 25 incidents, accounting for 30.5% of the losses. Coinbase-incubated Layer 2 network Base suffered losses across four projects since its launch on Aug. 9, with Optimism being involved in three of the incidents.
DeFi Hacks Dominate Q3 Losses
Hacks accounted for $662.9 million of the total losses, with 49 exploits reported, representing a 66.1% increase year-over-year. Fraud, scams, and rug pulls resulted in $22.6 million lost across 27 incidents, totaling 3.3% of the combined losses.
DeFi platforms remained the primary targets for cybercriminals, experiencing $499.8 million (72.9%) of the losses. This marks an 18.5% increase compared to the previous year and adds to the approximately $3 billion stolen by DeFi attackers to date. Centralized platforms accounted for the remaining 27.1% ($185.7 million), reflecting a staggering 3,400% increase from Q3 last year.
A small silver lining is that $61.2 million in stolen funds from six cases have been recovered, representing just 8.9% of the total Q3 losses. The most significant recovery was made by Curve Finance, reclaiming $5.3 million out of $24 million stolen.
Immunefi’s Efforts and Future Plans
Immunefi has paid out over $80 million in bounties and protected over $25 billion in user funds across protocols like Chainlink, The Graph, Synthetix, and MakerDAO. In its first milestone towards decentralization, Immunefi recently launched on-chain vaults.
Hot Take: Web3 Projects Face Escalating Losses in Q3
The third quarter of 2023 proved to be the most challenging for web3 projects as they experienced a significant increase in losses due to hacks and fraud. State-backed actors and high-profile attacks played a crucial role in driving these losses, with Mixin Network and Multichain being the primary targets. DeFi platforms remain attractive to cybercriminals, while Ethereum remains the most targeted network. Despite some recovery efforts, the losses are a concerning trend for the industry. It is essential for project teams to prioritize security measures and for bug bounty platforms like Immunefi to continue their efforts in protecting user funds.
By
By
By
