During the first quarter of 2024, the cryptocurrency industry saw a 23% decline in losses due to hacking and scams compared to the same period in 2023, as per a research report by blockchain security firm Immunefi. The total amount lost to hacking and fraud incidents in Q1 of 2024 was approximately $336.3 million, down from $437.5 million in Q1 of 2023. The report identified 46 hacking incidents and 15 cases of fraudulent activities.
With nearly $100 billion of total value locked in Web3 protocols, decentralized finance (DeFi) platforms remained a significant target for hackers. They accounted for all of the exploits identified by Immunefi in Q1, compared to none for centralized finance platforms.
Two projects accounted for the bulk of the losses, totaling $144.5 million, or 43% of the overall amount. The largest attack, amounting to $81.7 million, targeted the cross-chain bridge protocol Orbit Bridge on New Year’s Eve. January saw the highest monthly losses in Q1, totaling $133 million.
Mitchell Amador, CEO of Immunefi, highlighted the susceptibility of DeFi platforms to private key breaches, stressing the need for enhanced security measures across code and protocol infrastructure. The second-largest attack involved a $62 million exploit on Blast-based nonfungible token game Munchables. However, the funds were recovered within 24 hours, as the hacker surrendered the private keys to the wallet containing Munchables’ assets.
In Q1, $73.9 million (22%) of the stolen funds from seven exploits were retrieved. The number of attacks decreased by 17.6%, from 74 in Q1 2023 to 61 in 2024. Hacks accounted for 95.6% ($321.6 million) of losses across 46 incidents, while fraud, scams and rug pulls accounted for 4.4% ($14.7 million) in 15 incidents.
Ethereum was the most targeted chain ahead of the BNB Chain, with both networks accounting for 73% of total losses combined. Ethereum had the highest number of attacks, with 33 incidents, accounting for 51% of the losses. BNB Chain experienced 12 attacks, representing 22% of the exploited funds. Other incidents were identified on Arbitrum, Solana, Optimism, Bitcoin, Blast, Polygon, Conflux Network and Base.
