DeFi exploits and access control hacks cost crypto investors billions in 2022: Report

Cyber criminals used a variety of novel ways to carry out hacks and exploits in 2022, with over $2.8 billion of cryptocurrency stolen last year.

According to a report from CoinGecko using data sourced from DeFiYield’s REKT Database, nearly half of the total crypto stolen in 2022 was fleeced using diverse methods. This includes bypassing verification processes, market manipulation, ‘crowd looting’ as well as smart contract and bridge exploits.

The biggest hack of 2022 was carried out through an access control hack. Sky Mavis, the developer behind popular game Axie Infinity, saw its Ronin bridge hacked in March 2022, leading to $625 million being drained from the bridge between the Ronin chain and Ethereum network.

It was later revealed that North Korean hacking group Lazarus gained access to five private keys which were used to sign transactions from five Ronon Network validator nodes. This was how the hackers drained 173,600 ETH and 25.5 million USDC from the bridge.

According to CoinGecko, access control exploit is carried out by attackers that have gained access to wallets or accounts through compromised private keys, networks or security systems. As Cointelegraph explored last year, cross-chain bridge hacks were prevalent in 2022 with 65% of funds stolen from these types of attacks alone.

Related: Crypto exploit losses in January see nearly 93% year-on-year decline

The second largest exploit of 2022 took place in Feb. 2022, as attackers bypassed verification with a forged signature on the Wormhole token bridge before minting $326 million worth of crypto. Wormhole’s failure to validate ‘guardian’ accounts allowed hackers to mint tokens without needing the required collateral.

‘Crowd looting’ came to the fore in August 2022, as an insecure smart contract configuration on Decentralized Finance (DeFi) token bridge Nomad allowed users to withdraw an unlimited amount of funds. Hundreds of wallets took advantage of the exploit, seeing over $190 million drained.

Mango Markets suffered a market manipulation exploit in October 2022, as a hacker purchased and artificially inflated Mango (MNGO) tokens before taking out under-collateralized loans from the project’s treasury. $116 million was stolen in the flash loan attack.

Reentrancy attacks, in which attackers make use of a malicious smart contract that drains funds from a target with repeated withdrawal orders, amounted to $81 million stolen last year.

Oracle issue hacks led to $54 million of funds stolen. This method sees hackers gain access to an oracle service and manipulate its price feed data service to enforce smart contract failure or carry out flash loan attacks.

Phishing attacks only amounted to $17 million of cryptocurrency stolen in 2022. This method was prevalent between 2017 and 2020, as attackers preyed on unwitting victims through social engineering methods to steal login credentials and private keys.

An oracle attack in February 2023 is the largest hacking incident to date of the new year. Hackers managed to manipulate the price of the AllianceBlock token through an oracle hack, leading to an estimated $120 million being stolen from the protocol.