The Crypto Ecosystem Saw Most Heists in 2022
In back-to-back attacks, hackers drained billions of dollars from exchanges, NFTs, DAOs and decentralized credit based stablecoin protocols. This marked a record year for hacks, according to blockchain analytics platform Chainalysis.
Cross-chain bridges, which allow users to move tokens between different chains, were a major target for hackers this year. This is because they have to temporarily hold the value of each transaction in each token.
Nomad – $190 million
Cross-chain messaging protocol Nomad is the latest crypto bridge to fall victim to a heist. A hacker exploited a security flaw in Nomad that allowed them to drain $190 million worth of tokens from the platform in August.
Nomad is a project that aims to provide a bridge for users to move their tokens across blockchain networks such as Ethereum, Moonbeam and Polkadot’s Evmos. It is currently working with blockchain analysis firm TRM labs to trace stolen funds in an effort to return them to users.
Nomad is also planning to relaunch its bridge and offer partial refunds to affected users. The company plans to upgrade smart contracts and open Know Your Customer checks in an attempt to prevent similar incidents in the future.
Beanstalk – $182 million
A recent hack of the Beanstalk stablecoin protocol has netted the project a $182 million loss. The attack, which is believed to be the second nine-figure DeFi hack in a month, involves the theft of project assets through a flash loan exploit.
A ‘flash loan’ is a decentralized liquidity market protocol which allows users to borrow large amounts of crypto without providing any collateral. It also requires that the borrowed asset is returned to the system within a single block.
In this case, the crook essentially took out a flash loan to acquire a 67 percent voting interest in Beanstalk Farms. The attacker then used the funds to become a supermajority voter, which enabled them to create governance proposals and accept them in seconds.
Once the crook had enough of Beanstalk’s native governance token, stalk, they were able to pass a malicious proposal that drained all of the protocol’s funds into a private ETH wallet. The attacker then laundered a portion of the stolen assets through Tornado Cash, a coin-mixing platform which was used to obfuscate the transfer.
Ronin Network – $625 million
The Ronin Network, a blockchain network for the popular Axie Infinity video game, has experienced one of the largest crypto hacks to date. It saw threat actors steal 173,600 ether and 25.5 million USDC tokens, which totaled $625 million.
The attack on the Ronin bridge, which allows users to withdraw or deposit funds from the platform’s chain, occurred last week. According to Sky Mavis, the company that runs the Ronin platform, the hackers exploited a security flaw that was introduced in November 2021.
To move money out of the Ronin network, five validator nodes must approve the transaction. The attacker was able to hack these nodes, taking control of Sky Mavis’s four Ronin validators and a third-party validator run by Axie DAO.
After the hack, the Ronin team froze all transactions on the bridge, as well as Katana DEX, which enables transfers between the Ronin chain and other Ethereum-linked blockchains. They’ve also increased the minimum number of validator nodes to eight and have partnered with a reputable security firm to improve the network’s security.
Tornado Cash – $625 million
The United States Treasury on Monday sanctioned the Tornado Cash, a cryptocurrency mixer service that launders illicit funds, for the first time ever. It accuses the company of providing “material support” to North Korea-backed hackers.
A blockchain-based platform, Tornado Cash is designed to indiscriminately process anonymous transactions and mix them without trying to determine their origin or destination. It enables cryptocurrencies to be mixed on the Ethereum blockchain and improves privacy by obfuscating their origins and destinations, thus making them harder for authorities to trace back to a specific person.
This week, the Netherlands’ Fiscal Information and Investigation Service arrested a 29-year-old Amsterdam resident suspected of concealing criminal financial flows and facilitating money laundering through Tornado Cash. The agency added the person to its Specially Designated Nationals (SDN) list, which effectively blacklists individuals from all economic activity within the country.
The news comes as a blow to the crypto industry, which has been under increasing pressure from regulators and other authorities for its unregulated nature. The crypto community is attempting to counter this by organizing a campaign to release Pertsev from sanctions, which has already gained over 750 members.