The Top 100 DeFi Hacks Report

Breaking Down the Top 100 DeFi Hacks

2016-2023

Comprehensive

Report

/ Scroll down to find out the surprising trends and data we uncovered /

//STATS & FINDINGS

5 KEY FINDINGS

$7.35 BILLION in total losses¹

2016-2023

TOTAL LOSSES
from top 100
$7.35
BILLION
Largest Hack
The $624 million Ronin Network hack in 2022
$624
MILLION
Most attacked chains
Ethereum, Binance Smart Chain, Polygon
ETH, BSC,
POLYGON
Common Exploits
- Direct contract exploitation: 33%
- Compromised private keys: 27%
- Price manipulation: 27%
33%
direct contract exploitation
Audited vs Unaudited
- Only 20% of hacked were audited
- Audited protocols accounted for 14.3% of the total value lost
39%
not audited

//Defi Hacks

A Growing Trend

NUMBER OF ATTACKS PER YEAR¹

The number of attacks peaked in 2021, with 38% of the top 100 hacks occurring in that year. The trend showed a slight decline in 2022 and 2023 but remained significant.

AMOUNT OF MONEY LOST PER YEAR¹

Losses peaked in 2021 and 2022, highlighting the increasing scale of DeFi and the high stakes involved.

//Ethereum and Binance Smart Chain

The Most Targeted Chains

Distribution of Attacks per Chain¹

Ethereum leads in both the number of attacks and total value lost, followed by Binance Smart Chain and Polygon.

Download the full report to learn more about the top 100 DeFi hacks and how to protect yourself from future attacks.

Rankings by Chain and Number of Attacks¹

This indicates a correlation between TVL and attack frequency, although some chains are disproportionately targeted relative to their size.

//The Achilles Heel of DeFi

Smart Contract Vulnerabilities

DeFi protocols face diverse vulnerabilities, with input validation flaws and logic errors being most frequent. Proof verification errors, while less common, lead to significant losses.

Robust auditing and validation processes are essential to mitigate these risks and protect against substantial financial damage. By focusing on comprehensive input validation, secure contract logic, and thorough proof verification, projects can enhance their security posture.

Investing in regular security audits, adopting industry best practices, and utilizing established libraries can further minimize the risk of exploits and ensure the integrity of DeFi systems.

Main Smart-Contract Related Vulnerability Types¹

Losses by Vulnerability Type¹

"Although hacks have seemed to decrease in both number and severity over the past year, they still present a significant threat to the Web3 space. This report shows that protocols need to secure not only their on-chain components but also their off-chain ones. Understanding which types of vulnerabilities are more likely to be attack vectors in specific protocols and chains can also help developers and auditors identify and mitigate potential threats in order to improve an organization’s security."

Mar Aguilar

Lead Security Architect and Researcher, Author of the Top 100 DeFi Hacks Report

//STAY AHEAD OF HACKERS

5 Best Practices for Preventing DeFi Breaches

Implement Comprehensive Security Audits: Regular and thorough audits of smart contracts and the entire ecosystem can identify and mitigate vulnerabilities before they are exploited.
Use Multi-Signature or Multi-Party Computation (MPC) Wallets: These wallets enhance security by requiring multiple signatures or computations for transactions, reducing the risk of single-point failures.
Regular Updates and Patches: Keeping smart contracts updated with the latest security patches can prevent known vulnerabilities from being exploited.
Robust Key Management Practices: Employing cold wallets for storing private keys and ensuring strong encryption and storage practices can protect against key compromises.
Monitor for Suspicious Activities: Implementing real-time monitoring and conducting regular security assessments can help detect and respond to potential threats swiftly.

Want to stay ahead?

Need Help? WE've GOT YOUR BACK!

Reach out to our experts for tailored advice and security solutions.

¹ It should be noted that 2018 and 2019 do not appear throughout the datasets. This is because none of the attacks during those years were big enough to make it to the top 100 list.