Source: Chainalysis
Compiled by: Tao Zhu, Golden Finance
Cryptocurrency hacks remain a persistent threat, with more than $1 billion worth of cryptocurrency stolen in four of the past decade (2018, 2021, 2022, and 2023). 2024 marks the fifth year that this troubling milestone has been reached, highlighting that as cryptocurrency adoption and prices rise, so too does the amount of money that can be stolen.
In 2024, stolen funds increased by approximately 21.07% year-over-year to $2.2 billion, and the number of individual hacking incidents increased from 282 in 2023 to 303 in 2024.
Interestingly, the intensity of cryptocurrency hacking attacks changed around the first half of this year. In our mid-year crime update, we noted that the cumulative value stolen from January 2024 to July 2024 had reached $1.58 billion, approximately 84.4% higher than the value stolen during the same period in 2023. As we see in the chart below, by the end of July, the ecosystem was easily on track to potentially rival the more than $3 billion seen in 2021 and 2022. However, the upward trend in stolen cryptocurrency in 2024 noticeably slowed after July, maintaining relative stability thereafter. Later, we will explore the potential geopolitical reasons for this change.
In terms of the stolen amounts classified by the type of victim platform, an interesting pattern also emerged in 2024. In most quarters from 2021 to 2023, decentralized finance (DeFi) platforms were the primary targets for cryptocurrency hackers. DeFi platforms may be more vulnerable to attacks because their developers tend to prioritize rapid growth and market release over implementing security measures, making them prime targets for hackers.
Although DeFi still accounted for the largest share of stolen assets in the first quarter of 2024, centralized services were the most targeted in the second and third quarters. Some of the most notable centralized service hacks include DMM Bitcoin (May 2024; $305 million) and WazirX (July 2024; $234.9 million).
This shift of focus from DeFi to centralized services underscores the growing importance of security mechanisms commonly used by hackers (such as private keys). In 2024, private key leaks accounted for the largest proportion of stolen cryptocurrency, reaching 43.8%. For centralized services, ensuring the security of private keys is crucial as they control access to user assets. Given that centralized exchanges manage significant amounts of user funds, the impact of private key leaks can be devastating; we need only look at the DMM Bitcoin hack, worth $305 million, which is one of the largest cryptocurrency breaches to date and may have occurred due to poor private key management or insufficient security.
After the leak of private keys, malicious actors often launder stolen funds through decentralized exchanges (DEX), mining services, or mixing services, obscuring transaction trails and complicating tracking. By 2024, we can see significant differences in the laundering activities of private key hackers compared to those utilizing other attack vectors. For instance, after stealing private keys, these hackers often turn to bridging and mixing services. In contrast, decentralized exchanges are more commonly used for laundering activities by hackers using other attack vectors.
In 2024, the amount stolen by North Korean hackers from cryptocurrency platforms will be greater than ever before.
North Korean hackers are notorious for their sophisticated and ruthless methods, often leveraging advanced malware, social engineering, and cryptocurrency theft to fund state-sponsored operations and evade international sanctions. U.S. and international officials assess that Pyongyang uses stolen cryptocurrency to fund its weapons of mass destruction and ballistic missile programs, posing a threat to international security. By 2023, North Korean hackers had stolen approximately $660.5 million through 20 incidents; by 2024, this figure increased to $1.34 billion across 47 incidents, a 102.88% increase in the value stolen. These figures represent 61% of the total amount stolen that year and 20% of the total incidents.
Please note that in last year's report, we reported that North Korea had stolen $1 billion through 20 hacking attacks. After further investigation, we determined that some of the previously attributed large-scale hacking attacks to North Korea may no longer be relevant, reducing the amount to $660.5 million. However, the number of incidents remained unchanged because we identified other smaller hacking attacks attributed to North Korea. Our goal is to continuously reassess our evaluation of North Korean-related hacking incidents as we obtain new on-chain and off-chain evidence.
Unfortunately, North Korea's cryptocurrency attacks appear to be becoming increasingly frequent. In the diagram below, we examine the average time between successful DPRK attacks based on the scale of the exploits, finding that the frequency of attacks of various scales has decreased year-on-year. Notably, attacks valued between $50 million and $100 million and those exceeding $100 million occurred significantly more frequently than in 2023, indicating that North Korea is improving and accelerating its capacity for large-scale attacks. This starkly contrasts with the previous two years, where their profits per incident often fell below $50 million.
When comparing North Korea's activities to all other hacking activities we monitor, it is clear that North Korea has been responsible for most large-scale attacks over the past three years. Interestingly, the amounts involved in North Korean hacking attacks are lower, and the density of attacks valued around $10,000 has also been steadily increasing.
Some of these events appear to be related to North Korean IT professionals, who are increasingly infiltrating cryptocurrency and Web3 companies, compromising their networks, operations, and integrity. These employees often employ sophisticated strategies, techniques, and procedures (TTPs), such as false identities, hiring third-party recruitment intermediaries, and manipulating remote work opportunities to gain access. In a recent case, the U.S. Department of Justice (DOJ) charged 14 North Korean nationals working remotely in the U.S. The company earned over $88 million by stealing proprietary information and extorting employers.
To mitigate these risks, companies should prioritize thorough hiring due diligence — including background checks and identity verification — while maintaining strong private key security to protect critical assets (if applicable).
Despite all these trends indicating that North Korea was very active this year, most of its attacks occurred early in the year, with overall hacking activities stagnating in the third and fourth quarters, as shown in earlier charts.
In late June 2024, Russian President Vladimir Putin and North Korean leader Kim Jong-un will also hold a summit in Pyongyang to sign a joint defense agreement. So far this year, Russia has released previously frozen North Korean assets worth millions of dollars in accordance with United Nations Security Council sanctions, marking the ongoing development of the alliance between the two countries. Meanwhile, North Korea has deployed troops to Ukraine, providing Russia with ballistic missiles and reportedly seeking advanced space, missile, and submarine technology from Moscow.
If we compare the daily losses from DPRK vulnerabilities before and after July 1, 2024, we can see a significant decrease in the stolen value. Specifically, as shown in the diagram below, the amount stolen by North Korea decreased by approximately 53.73%, while the amount stolen by non-North Koreans increased by about 5%. Therefore, in addition to redirecting military resources to the Ukraine conflict, North Korea, which has significantly strengthened its cooperation with Russia in recent years, may also have altered its cybercrime activities.
The decline in North Korea's theft of funds after July 1, 2024, is evident, and the timing is also clear. However, it is worth noting that this decline does not necessarily correlate with Putin's visit to Pyongyang. Furthermore, some events that occurred in December may change this pattern by the end of the year, and attackers often launch attacks during holiday periods.
Case Study: North Korea's Attack on DMM Bitcoin
A notable example of a North Korean-related hacking attack in 2024 involved the Japanese cryptocurrency exchange DMM Bitcoin, which was hacked, resulting in a loss of approximately 4,502.9 bitcoins, worth $305 million at the time. The attackers exploited vulnerabilities in the infrastructure used by DMM, leading to unauthorized withdrawals. In response, DMM, with the support of its group companies, committed to fully reimbursing customer deposits by seeking equivalent funds.
We were able to analyze the flow of funds on-chain following the initial attack. In the first phase, we see the attackers transferring cryptocurrency worth millions of dollars from DMM Bitcoin to several intermediary addresses before finally reaching the Bitcoin CoinJoin mixing servers.
After successfully mixing the stolen funds using the Bitcoin CoinJoin mixing service, the attackers transferred part of the funds to Huioneguarantee, an online marketplace associated with the Cambodian conglomerate Huione Group, which is a significant player in facilitating cybercrime.
DMM Bitcoin has transferred its assets and customer accounts to SBI VC Trade, a subsidiary of Japan's financial group SBI, with the transition scheduled to be completed by March 2025. Fortunately, emerging tools and predictive technologies are on the rise, which we will explore in the next section, preparing for the prevention of such destructive hacking incidents.
Utilize predictive models to prevent hacker attacks
Advanced predictive technologies are transforming cybersecurity by providing proactive approaches to protect digital ecosystems through real-time detection of potential risks and threats. Let's take a look at the example below, involving the decentralized liquidity provider UwU Lend.
On June 10, 2024, the attackers manipulated the price oracle system of UwU Lend to obtain approximately $20 million in funds. The attackers initiated a flash loan attack to alter the price of Ethena Staked USDe (sUSDe) across multiple oracles, leading to misvaluations. Consequently, the attackers could borrow millions of dollars within seven minutes. Hexagate detected the attack contract and its similar deployments about two days before the exploit.
Despite the attack contract being accurately detected in real-time two days before the exploit, its connection to the exploited contract did not immediately become apparent due to its design. Other tools, such as Hexagate's security oracle, could further leverage this early detection to mitigate threats. Notably, the first attack, which resulted in an $8.2 million loss, occurred just minutes before subsequent attacks, providing another critical signal.
Alerts issued before significant on-chain attacks have the potential to change the security of industry participants, enabling them to prevent costly hacker attacks rather than merely respond to them.
In the diagram below, we see that the attackers transferred the stolen funds through two intermediary addresses before reaching the OFAC-approved Ethereum smart contract mixer Tornado Cash.
However, it is worth noting that simply accessing these predictive models does not ensure the prevention of hacker attacks, as the protocols may not always possess the appropriate tools to take effective action.
Stronger encryption security is needed
The increase in stolen cryptocurrency in 2024 underscores the industry's need to address a growing and evolving threat landscape. While the scale of cryptocurrency theft has not yet returned to the levels seen in 2021 and 2022, the resurgence highlighted above underscores the gaps in existing security measures and the importance of adapting to new exploitation methods. Effective collaboration between the public and private sectors is crucial to address these challenges. Data sharing programs, real-time security solutions, advanced tracking tools, and targeted training can empower stakeholders to quickly identify and eliminate malicious actors while building the resilience needed to protect crypto assets.
Additionally, as the regulatory framework for cryptocurrencies continues to evolve, scrutiny of platform security and customer asset protection may strengthen. Industry best practices must keep pace with these changes to ensure prevention and accountability. By establishing stronger partnerships with law enforcement and providing teams with rapid response resources and expertise, the cryptocurrency industry can bolster its theft prevention capabilities. These efforts are crucial not only for protecting individual assets but also for building long-term trust and stability within the digital ecosystem.