Crypto Users Lost $2B to Hacks, Scams and Exploits in 2023, De.Fi Says

The figure is roughly half the estimated $4.2 billion of 2022, a year that also included $40 billion lost through the collapse of Terra, Celsius and FTX.

AccessTimeIconDec 27, 2023 at 12:51 p.m. UTC
Updated Mar 8, 2024 at 7:10 p.m. UTC
  • Cryptocurrency users lost nearly $2 billion to scams, rug pulls and hacks in 2023, roughly half last year's amount.
  • While the reduction is largely attributed to improved security protocols, the industry remains susceptible to security risks.

Cryptocurrency users lost nearly $2 billion to scams, rug pulls and hacks in 2023, roughly half the amount of last year, but a sign that the industry remains susceptible to security risks, researchers at security app De.Fi said in their annual report on Wednesday.

The reduction, largely attributed to the implementation of improved security protocols, increased awareness within the community and the overall decreased activity in the market, is even greater when the $40 billion lost to the collapses of stablecoin issuer Terraform Labs, crypto lender Celsius and the FTX exchange are taken into account.

The drop coincides with a bear market in which some major alternative tokens slumped as much as 85% from their 2021 peaks before recovering in the past few months as conditions turned more bullish. Additionally, the recovery rate of funds improved significantly to around 10%, up from just 2% in 2022, De.Fi said.

Losses by blockchains

Ethereum, the biggest blockchain by active users and value locked, experienced the highest losses, with about $1.35 billion erased in an estimated 170 incidents. This figure is indicative of Ethereum's appeal to malicious actors due to its extensive ecosystem and high-profile projects. The largest exploit was July's $230 million attack on the cross-chain platform Multichain.

BNB Chain also proved an attractive target, with $110.12 million lost across 213 incidents. Emerging network zkSync Era lost $5.2 million in two incidents and Solana had a loss of $1 million in a single attack.

Losses on centralized platforms, such as exchanges and trading platforms, totaled some $256 million across seven cases. The largest, November's attack on Poloniex, netted $122 million.

Popular methods

Access control exploits were by far the most damaging, with attackers taking advantage of weaknesses in how permissions and access rights are managed within smart contracts or platforms. Such exploits often grant unauthorized access to funds or critical functionalities and resulted in losses of more than $852 million out of 29 instances.

Flash-loan attacks were the second-most cash-generative method, leading to $275 million lost over 36 cases. These attacks exploit the uncollateralized loan feature in decentralized finance (DeFi), allowing attackers to borrow large amounts of cryptocurrency without upfront capital. Attackers use these borrowed funds to manipulate market prices and exploit vulnerabilities in DeFi.

Exit scams accounted for $136 million over 263 cases. In such an exploit, a rogue developer simply drains all liquidity from a token they have issued or removes their online presence after raising money from unsuspecting market participants.

Edited by Sheldon Reback.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Read more about