In August 2024, the total losses from Web3 security incidents were estimated to be around $316 million. According to the SlowMist Hacked Archives, 28 hacking incidents were recorded, resulting in approximately $253 million in losses, with $13.58 million being recovered.
The incidents were caused by various factors, “including contract vulnerabilities, account compromises, and frontend attacks.”
Additionally, data from the Web3 anti-fraud platform Scam Sniffer “indicates that there were 9,145 phishing victims this month, with total losses amounting to $62.93 million.”
Major Incidents
Convergence Finance
On August 1, 2024, Convergence Finance was attacked, with “the attacker minting and selling 58 million CVG tokens, worth approximately $210,000 (equivalent to the entire token allocation designated for staking rewards). An additional $2,000 in unclaimed rewards from Convex was also stolen. According to the incident analysis report released by Convergence Finance, the root cause of the attack was the `claimMultipleStaking` function in the reward distribution contract, which lacked proper validation of user inputs.”
Ronin
On August 6, 2024, the gaming blockchain Ronin “was attacked, with abnormal withdrawals of cross-chain assets occurring on the Ronin Bridge project. The SlowMist Security Team’s analysis revealed that the attack was due to a change in the weight settings, allowing funds to be extracted without passing any multisignature threshold checks. The attacker extracted approximately 4,000 ETH and 2 million USDC, valued at around $12 million. By August 7, a white hat hacker returned $12 million worth of assets and received a $500,000 bounty for identifying the vulnerability.”
Nexera
On August 7, 2024, an external attacker gained “access to the credentials managing the smart contracts on the Nexera Fundrs platform. Using these credentials, the attacker transferred NXRA tokens from the Fundrs staking contract on Ethereum, resulting in a loss of approximately $1.83 million. Out of the 47.24 million NXRA tokens stolen, the attacker sold only 14.75 million tokens (about $449,000). Nexera successfully removed the remaining 32.5 million NXRA tokens from the attacker’s wallet, preventing further losses.”
For a breakdown of other incidents, check here.
At SlowMist, they pride themselves on “being a frontrunner in blockchain security, dedicating years to mastering threat intelligence.”
Their expertise is grounded in “providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele.”
They’ve established a robust network “for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape.”
They offer tailor-made security solutions that “span from identifying threats to implementing effective defense mechanisms.”
This holistic approach has garnered “the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.”
They offer a variety of services that “include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products.”
They have partnerships with domestic and international firms “such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.”
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.”
