According to data from SharkTeam's on-chain security analysis platform, ChainAegis, there were a total of over 228 security incidents in the Web3 sector during the second quarter of 2023, resulting in a cumulative loss of over $307 million. Despite a slight increase of approximately 8.05% compared to the previous quarter (211 incidents), Web3 security incidents continued to occur at a high frequency. However, the amount of funds lost decreased by 19.79% compared to the previous quarter ($383 million).

In this quarter, security incidents related to contract vulnerabilities have significantly increased, with a year-on-year increase of 64% and a quarter-on-quarter increase of 105%. SharkTeam hereby reminds project teams to prioritize contract audits to avoid unnecessary losses.

The number of Rug Pull incidents and other security incidents has remained relatively stable compared to the previous quarter. There is a wide variety of security incident types, and hackers continue to employ sophisticated attack methods, constantly coming up with new techniques. It is crucial for users to remain vigilant and not underestimate the risks when engaging with investment projects.

In the second quarter, the proportion of contract vulnerability incidents increased significantly compared to the previous quarter.

1. Contract Vulnerabilities

There were a total of 41 security incidents caused by contract vulnerabilities in the second quarter of 2023, resulting in a cumulative loss of over $74.1969 million.

On June 11th, Floating Point Group (FPG) was attacked, resulting in a loss of over $20 million. This incident was the most severe security event in terms of loss caused by contract vulnerabilities in this quarter.

On April 13th, Yearn Finance was targeted by a hacker attack, resulting in a loss of approximately $11.6 million. This event ranked second in terms of losses caused by contract vulnerabilities in this quarter. The attack was due to the attacker exploiting an incorrectly set fulcrum address in the yUSDT contract, enabling them to manipulate the stablecoin reserve balance within the yUSDT contract. By depositing USDT into yUSDT, they gained a significant amount of unexpected yUSDT tokens for profit.

Below are the specific losses incurred from other security incidents caused by contract vulnerabilities in this quarter:

In the second quarter of 2023, contract security vulnerabilities included permission vulnerabilities, logic vulnerabilities, reentrancy attacks, price manipulation, and others. Security incidents caused by logic vulnerabilities remained the highest, accounting for 54% and experiencing a significant increase of 175% compared to the previous quarter.

On May 6th, 2023, DEUS's stablecoin DEI contract had a burn logic vulnerability, resulting in an attacker profiting approximately $6.3 million. Logic vulnerabilities can be identified during the contract security audit phase, and project teams should opt for more professional third-party auditing firms to minimize losses caused by contract vulnerabilities.

Permission vulnerabilities refer to flaws in contract authorization checks that allow attackers to bypass permission checks and gain higher operational privileges after obtaining a low-privileged user account. Security incidents caused by permission vulnerabilities accounted for 7% of the total in the second quarter of 2023. On June 15th, Hashflow experienced an attack related to authorization, resulting in a loss of approximately $410,000.

Flash loan attacks continued to occur, with significant impact. Attack methods mainly included flash loan + governance attacks, flash loan + price manipulation attacks, and flash loan + reentrancy attacks. In this quarter, both price manipulation and reentrancy attacks accounted for 10% of contract vulnerability incidents.

On June 12th, the DeFi lending protocol Sturdy was attacked, resulting in a loss of approximately $770,000. The attacker utilized a flash loan + price manipulation attack. On May 20th, Tornado.Cash fell victim to a flash loan + governance attack, with the attacker profiting around $680,000.

2. Rug Pull

In the second quarter of 2023, there were a total of 31 Rug Pull incidents, resulting in a cumulative loss of over $15.1883 million. XIRTAM, a project built on the Arbitrum ecosystem, was a reputation-building platform that advocated for the anonymous and decentralized establishment of digital reputations. Users participating in activities on the XIRTAM system were rewarded. On May 3rd, the project behind XIRTAM executed a Rug Pull, where the deployer absconded with approximately 1,909 ETH of user funds. This incident was the most severe Rug Pull event in terms of loss in this quarter. Additionally, Swaprum, Merlin, and $KOKO experienced losses exceeding $1.5 million in this quarter.

The majority of fraudulent activities by project teams were concentrated on the Ethereum (ETH) blockchain, with some incidents occurring on the Binance Smart Chain (BSC). A few incidents also took place on the Arbitrum network and other platforms.

3. Other Risks

In the second quarter of 2023, there were a total of 156 security incidents classified under other types. Out of these, 78 incidents involved server attacks, accounting for the largest proportion at 50%, which represents a 12% increase compared to the previous quarter. Phishing attacks ranked second with a cumulative total of 50 incidents, accounting for 32% of the total, which saw a 16% decrease compared to the previous quarter.

There was a slight increase in other types of incidents compared to the previous quarter, such as theft of hot wallets, NFT theft, royalty vulnerabilities, and disruption of trading applications, among others. Hackers continuously update their fraudulent techniques, expanding their reach into various domains. When engaging in project investments, it is essential to remain cautious and vigilant to avoid potential losses that may arise from seemingly minor risks.

• On April 14th, the digital asset trading platform Bitrue tweeted that they discovered a vulnerability in a hot wallet, and attackers had stolen approximately $23 million worth of ETH, MATIC, and other assets.

• On April 20th, a fake account with the handle @aidogenft, claiming to be the official ArbDoge AI, started sharing phishing links at hxxps://aidoge.me/.

• On May 20th, the U.S. Department of Justice announced that a man from Nevada was charged for his alleged involvement in CoinDeal, an investment fraud scheme that defrauded over 10,000 victims of more than $45 million.

• On May 31st, one of the deployment private keys for the unshETH contract in the LSD protocol was leaked, prompting the official suspension of withdrawals for unshETHETH as a precautionary measure.

• On June 14th, users of the Atomic Wallet suffered losses exceeding $100 million in a hacking attack. This marked the first major cryptocurrency theft since the $100 million attack on Horizon Bridge one year ago.

• On June 12th, the Swiss government announced that federal administrative agencies were hit by a DDoS attack, causing certain websites and applications to become unavailable.

• On June 16th, the @ShellProtocol Discord server experienced a cyberattack.

The ever-changing and evolving attack methods reflect the constant evolution of fraud and intrusion techniques employed by hackers and scammers. Therefore, users should always maintain a respectful awareness of the risks, avoid greed and complacency, remain vigilant at all times, and take necessary precautions to prevent asset losses.

About us

SharkTeam’s vision is to comprehensively protect the security of the Web3 world. The team is composed of experienced security professionals and senior researchers from all over the world. They are proficient in the underlying theory of blockchain and smart contracts, and provide services including smart contract auditing, on-chain analysis, and emergency response. It has established long-term cooperative relationships with key players in various fields of the blockchain ecosystem, such as Polkadot, Moonbeam, polygon, OKC, Huobi Global, imToken, ChainIDE, etc.
Official website: https://www.sharkteam.org/
Twitter: https://twitter.com/sharkteamorg
Discord: https://discord.gg/jGH9xXCjDZ
Telegram: https://t.me/sharkteamorg