Original author: Poopman

Original translation: Kxp, BlockBeats

Every year, the crypto space suffers more than 100 hacks, resulting in personal losses of more than $200 million. This number makes us deeply alarmed, but also teaches us valuable lessons. To better understand these incidents, I compiled a list called "The Five Biggest Attacks and Hacks of 2023", and let me introduce these victims one by one.

1. Euler Finance – $197 million

In March this year, Euler Finance was hacked, becoming the largest attack in 2023, with losses of up to $197 million. The attack was caused by defects in the donation and liquidation logic. The attacker borrowed a large amount of eDAI/dDAI from Euler using flash loans, and donated these borrowed eDAI to Euler for liquidation, which greatly affected the exchange rate, resulting in a hack. PeckShield Inc. made a detailed analysis of the attack process, please be sure to read his tweet.

2. Atomic Wallet — $35 million

Just 11 days ago, Atomic Wallet suffered a $35 million hack. The stolen funds were converted to Bitcoin and sent to a mixer called "Sinbad.io", a tool frequently used by the notorious North Korean hacker group "Lazarus Group". Although the exact method of the attack is still unclear, I still recommend everyone to investigate Tay.

3. Yearn Finance – $11.54 million

Two months ago, Yearn Finance also suffered a $11.54 million hack due to a flash loan misconfiguration vulnerability. The attacker used flash loans to change balances and monopolize the Curve pool, exchanging stablecoins at an obviously unbalanced price. If you want to know more details, you can check out OtterSec’s tweet for more detailed findings.

4. MyAlgo – $9.2 million

MyAlgo users lost over $9.2 million in crypto due to a compromised Cloudflare key. The root cause is unclear, but ZachXBT gave a good overview of the situation in his tweet.

5. Safemoon – $8.9 million

Over $8.9 million worth of cryptocurrency was hacked due to an apparent bug in a smart contract. The attacker exploited the destroy function in the Safemoon contract, destroying SFM tokens and increasing their price as supply decreased. The attacker then dumped all of the SFM into the WBNB-SFM LP pool at an inflated price, draining the entire WBNB pool. DeFi Mark has a great explanation of this.

To summarize, many of the $10 million+ attacks in 2023 were caused by oracle and smart contract vulnerabilities. Interestingly, zkSync had the most runaway incidents in 2023.

Original link