鏈
開發人員
社群
In the process of compiling this report, we were fortunate to receive crucial contributions from AvengerDAO key members, Hashdit, CertiK, Ancilia, and Salus Security. Their expertise, insights, and dedication have immensely enriched the content and perspective of this report.
We eagerly anticipate further collaborations in the creation of more insightful reports in the future.
This report focuses on security events that happened on BSC in 2023, analyzing the type of projects targeted and sharing the common attack techniques used in 2023, with respect to the financial loss of the incidents.
The financial data provided here is accurate based on our own monitoring system and based on the $USD amount of the cryptocurrency involved at the time of the incident. Due to the fluctuating price nature of cryptocurrencies, the total amount loss might differ with the current token valuations.
Furthermore, the financial data might not fully reflect the true “exploited amount” of the incident. This is especially true for scams where the total scammed amount is usually mixed with an initial base amount injected by the scam project party.
Wallet Drainers are a form of Fraud technique that specifically targets users who are weak in security awareness. These drainers usually utilize a “Scam-as-a-Service” model, where people can purchase their malicious scripts to conduct their own scam campaigns. The underlying methodology is to trick the user into a phishing website and subsequently sign a scam transaction with their crypto wallet, resulting in their funds being stolen. This type of scam technique does not only target 1 chain, as it follows the money. As such, its attack scope is multichain, with the largest hitting chain being Ethereum. In 2023, AvengerDAO monitored more than a dozen Wallet Drainer groups, with new ones quickly replacing older ones.
Wallet Drainers are distributed in various forms, such as spreading phishing links through phishing emails, purchasing advertisements on multiple platforms like X and Google, and even compromising accounts on Discord and X usually by performing a Sim Swap attack. In terms of on-chain transactions, the phishing signature will usually require a user to approve their funds to a Scam address or transfer their funds to a Scam address. Once that is executed, the funds will be quickly transferred to the main operator’s wallet.
Supply chain attack vector is an emerging threat, where hackers infiltrate a system by exploiting vulnerabilities in a component of a trusted service or software.
Several cases include:
This section aims to describe the security incidents YoY from 2020 to 2023.
In 2023, AvengerDAO monitored $161,176,631 funds loss on BSC. The amounts lost to exploits have actually dropped significantly from 2022 to 2023, breaking the 3 years uptrend, with a YoY 85% decrease in damages, as seen from the figure below.
Figure 1: Total amount stolen funds (in dollars) on BSC over the last 4 years
In total, there were 414 security incidents on BSC, this is a 44% YoY increase from 2022. Figure 2 shows an increasing trend of security incidents on BSC over the last 4 years.
Figure 2: Number of incidents on BSC over the last 4 years
Analyzing the attack vectors trends based on Financial losses, both Hacks and Scams have dropped significantly from 2022, with Hacks accounting for $73.2m (91% decrease) and Scams accounting for $87.9m (54% decrease) in 2023.
Figure 3: Financial losses per attack vector over the last 4 years
In terms of incident count, both Hacks and Scams have increased from 2022, with 210 Hacks (96% increase) and 203 Scams (14% increase) in 2023.
Figure 4: Number of incidents per attack vector over the last 4 years
By comparing the increased percentages, it is evident that Hacks are growing at a concerning rate as well. This is likely supported by the fact that tracing the hacker’s real identity can be challenging with complicated use of money mixers and non-kyc exchanges.
This chart represents the type of projects that were exploited since 2020.
Figure 5: Security Incidents per type of project over the last 4 years
It is clear that DeFi projects are still the main targets for crypto hackers, with 352 in 2023, a 66% increase from 2022.
The figure below shows the comparison between the chains with the top funds losses to exploits over the last 4 years.
Ethereum (in green) has shown an increasing trend since 2021. At the same time, other chains like Tron (in purple), Fantom (in light blue) and Arbitrum (in yellow) have shown large increases from 2022.
Figure 6: Biggest financial losses across chains over the last 4 years
In total, roughly $161.17 million were lost to 414 security incidents on BSC.
Interestingly, when removing the top 3 outlier incidents, the total financial loss drops down to just $97m, slightly below $100m, a near 40% drop from the total amount loss of 2023.
Figure 7: Amount of stolen funds in dollars excluding the 3 largest incidents
By observing the quarterly and monthly trends below, there are some interesting observations to be made.
1. Q4 sees significant reduction in fiat losses compared to Q3
Fiat losses dropped by 64% from $43.7m in Q3 to $15.6m in Q4. This was largely due to the lesser number of hacks seen, with Q4 demonstrating 86 compared to 130 in Q3.
Figure 8: Financial losses across chains over the last 4 quarters in 2023
2. BSC ranks fourth in Q4 fiat losses when compared to other chains
Figure 9: Chain comparison fund losses in Q4
BSC saw 3.7% of the total fiat losses across all chains in Q4. It ranks fifth as compared to other chains. Fourth place goes to Bitcoin, representing 4.5%. Third place goes to Arbitrum, representing 5.3%. Second place goes to Tron, representing 13.6%. First place goes to Ethereum, representing 65% for the total fiat loss across all chains.
Figure 10: Amount of stolen funds in dollars per month in 2023
In those months, the main contributing incidents were (1) Fintoch Ponzi, (2) ipp Rugpull, and lastly the (3) Stake platform’s Hot Wallet Compromise.
Figure 11: Number of projects impacted by security exploits
Interestingly, even though October has the highest number of security incidents at 58, the financial loss only stands at $10m which is more than half of September’s data.
With a nearly similar count at 57, September’s financial loss is more than double, at $27m.
Such data reinforces AvengerDAO’s observation that we are seeing more incidents with lesser financial impact.
In the year 2023, various entities came to our aid in an extraordinary display of cooperation and coordination, aiding in the recovery and freezing of stolen funds. Among these entities, renowned organizations such as Tether and several Centralized Exchanges (CEXs) played pivotal roles.
Collectively, these entities assisted in rescuing approximately $55 million. Specific contributions came from Centralized Exchanges (CEXs) and Tether, demonstrating their commitment to safeguarding the digital assets ecosystem.
Diving deeper into the recovery statistics for 2023, our collective efforts, in conjunction with other entities, resulted in the successful recovery or freeze of funds summed up to a total of $7.3 million on the BNB Chain alone. This demonstrates the effectiveness and importance of robust and swiftly reactive security measures placed on the BNB Chain.
Out of the 414 security incidents, the type of the attack vectors are split almost equally with Hacks with a slight edge of 50.72% and Scams with 49.03%.
Figure 12: Proportion of different type of exploits
On the flip side, the total financial loss of scams ($87m) is more than that of hacks ($73m), as shown below in Figure 12.
Figure 13: Financial impact measured in dollars comparing different types of incidents
For further analysis of the specific attack vectors, this figure below displays this against the financial loss in 2023.
Figure 14: Proportion of the funds lost comparing the different type of vulnerabilities
35.18% attributed to Rugpulls where AvengerDAO monitored a change in rugpull techniques, scammers are adopting more complicated measures to obfuscate code and also funds flow . The 2nd largest contributor was Ponzi within smart contracts deployed on BSC, accounting for 22.53%. Ponzis are not a new form of scam technique, we have released an article on it previously which you can refer here: Ponzi Schemes in Web3.
The 3rd largest contributor was Hot wallet compromises within notable platforms like CEXs and other Entities. Web2 security is just as important as Web3 security as keys are often not secured properly and do not follow the proper security guidelines.
When focusing on the project type vs financial loss, without surprise, 60.38% of financial loss are attributed to Bridge projects. This is because cross-chain bridges generally lock large amounts of crypto assets on one chain to mint collateralized assets on the destination chain. Hackers took notice of this trend and targeted vulnerabilities within these cross-chain bridge smart contracts.
The 2nd most project type targeted was DeFi projects at 82.06%, followed by Gambling and CEX projects at 11.04% and 3.85% respectively.
Figure 15: Proportion of funds lost comparing the type of project
2023’s headline figure of a 85% decline in losses from 2022 on BNB Chain is worth investigating. Is it simply the result of declining asset valuations? To answer this question, we’ll examine the relationship between Total Value Locked (TVL) and losses to hacks, scams, and exploits in Web3.
TVL is one of the most important metrics in DeFi. It’s a measure of the value of assets deposited in decentralized financial protocols, and as such is representative of the demand for DeFi’s offerings.
While many tokens deposited in DeFi protocols are stablecoins, many are not, which means they are subject to market fluctuations. Thus, TVL is influenced by overall market conditions, as well as user demand. This makes it a useful metric for gauging the true active engagement and growth in the DeFi space, beyond just surface-level market capitalization. Unlike crypto's total market cap, which primarily reflects the valuation of assets, TVL offers insight into how much capital is actually being utilized within the DeFi ecosystem.
In late 2023, DeFi’s TVL (across all chains) stood at about $3.1 billion, down from a peak of $21.8 billion in November 2021, approximately a 85% decline.
Figure 16: Total Value Locked on BSC according to DeFiLlama
The decline in losses to security incidents from 2022 to 2023 mirrors the decline in time-weighted average TVL in 2023 compared to 2022.
As we cross reference the TVL values taken on the last day of each month from DeFiLlama’s dataset for 2023, we noticed there is a 19% correlation in 2023 with monthly losses.
There is a relatively low positive correlation between TVL and monthly losses, with an R2 value of 0.19. This suggests that approximately 19% of the variability in monthly losses can be statistically attributed to changes in DeFi’s TVL, which itself is a proxy for both asset valuations and user demand. This correlation, while statistically significant, leaves a significant 81% of the variability unexplained by TVL alone, suggesting other factors also play important roles in influencing the losses within the ecosystem such as new attack surfaces..
BSC continues to be a strong competitor, outperforming Ethereum in terms of daily active users and transactions. Even though 2023 has shown to be a better performing year in terms of the total funds lost to exploits, it is undeniable that scammers and hackers will continue to change their methods until there are stricter measures to hold them accountable.
In AvengerDAO, we will keep improving:
AvengerDAO is a community initiative to unite all ecosystem partners to protect our BNB chain users.
As part of our mission to secure the BNB Chain, AvengerDAO offers a range of instruments intended to assist projects and investors in adopting a holistic strategy towards security.
Additionally, our API covers accurate and timely detection for scam/exploit risks based on a domain url as well. This ensures that users requesting a specific domain are warned if there are any signs of a scam.
2023 highlights:
As part of our mission to secure the Web3 world, CertiK provides a number of tools designed to help projects and investors take an end-to-end approach to security.
2023 highlights:
Ancilia is a pioneering Web3 cybersecurity company that provides automated and real-time threat detection and prevention software-as-a-service (SaaS) products through a combination of on-chain + off-chain information.
The company's mission is to provide the most effective and easily adoptable Web3 security solutions. Ancilia has been a trusted security partner of Binance since 2022 providing Threat Monitoring and Alerting for a large number of Web3 projects deployed on BSC.It offers a Web3 threat intelligence API for Web3 Business that protects against hacks, phishing, scams, money laundering, and other malicious and/or risky activities.
Highlights:
Protect | Discover | Redefine.
Salus, a Binance Labs portfolio company, tackles the most complex security challenges through fundamental scientific research and pushing the boundaries of Web3 security.
Highlights: