Crypto projects lose $278 million to July hacks, second-highest in 2024

Crypto projects lose $278 million to July hacks, second-highest in 2024 Oluwapelumi Adejumo · 2 weeks ago · 2 min read

CertiK stated that $7.8 million of the stolen assets were recovered in July.

2 min read

Updated: Aug. 1, 2024 at 11:05 am UTC

Crypto projects lose $278 million to July hacks, second-highest in 2024

Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.

Crypto projects lost $278.8 million to exploits and hacks in July—the second-highest monthly loss this year—according to blockchain security firm CertiK.

CertiK pointed out that the losses were primarily due to exit scams, flash loans, and other exploits. However, $7.8 million of these stolen assets were recovered, reducing the net loss to $270.9 million.

The exploits

Project exploits were the most significant contributors, amounting to approximately $265 million. The top five exploits, including incidents involving WazirX, Li.Fi, Bittensor PyPi, and Terra IBC were responsible for about $253 million.

On July 18, Indian crypto exchange WazirX suffered an exploit totaling $235 million, triggered by suspicious transactions in its Ethereum network multi-sig wallet. Market observers said the attack was linked to North Korea-backed Lazarus Group, which has begun laundering the funds via crypto mixing tools like Tornado Cash.

Meanwhile, the exchange has paused operations and introduced a $23 million bounty to incentivize the attackers to refund the stolen funds. WazirX has also proposed “implementing a socialized loss strategy to distribute the impact equitably among all users.”

Another major exploit last month was the $10 million smart contract exploit of the LiFi protocol. Reports revealed that the platform had suffered a similar attack in March 2022.

Crypto Exploits in July (Source: CertiK)

Flash loan attacks also saw notable incidents. On July 19, Rho Markets, a lending protocol on the Scroll layer-2 network, experienced a $7.6 million exploit on its USDC and USDT pools. The platform later confirmed that the entire amount was recovered from the MEV address.

Dough Finance, a liquidity provider, suffered a $2.1 million loss through multiple flash loan transactions. While some funds were returned, a significant portion was sent to the crypto-mixing tool Tornado Cash.

Furthermore, exit scams contributed roughly $3 million in losses last month.