CertiK: Training and Security Audits Curtail Fraud
Blockchain security firm CertiK has released its Q2 2023 report, where it assesses the financial damages incurred by the crypto industry and examines recent exploits.
On this page
Overall, a total of $313.5 million was pilfered from decentralized protocols. The average loss per incident stands at $1.479 million, a figure consistent with the preceding quarter, but a significant 58% drop compared to last year's numbers. This decline might suggest a temporary decrease in the crypto market's liquidity and allure. CertiK points to user education and routine security checks of projects as key factors behind the reduced number of stolen funds. Moreover, the company has observed a shift in fraudulent tactics; instead of sophisticated exploits involving oracle manipulation, criminals are now more commonly opting for traditional exit scams and similar strategies.
Atomic Wallet
The unforeseen breach of the well-known cryptocurrency wallet, Atomic Wallet, turned heads last quarter. Nearly 5,000 users suffered a loss exceeding $100 million, with the greatest single loss pegged at $7.95 million. The developers were at a loss themselves, unable to pinpoint the vulnerability that enabled miscreants to access private keys and transfer funds to their wallets. CertiK attributes this transgression to the Lazarus Group, a band of Korean hackers since the asset laundering process involved the Sinbad mixer and the Russian crypto exchange Garantex, both regularly connected with this group.
The Deceitful Validator
Early in April, a deceitful validator launched a successful attack on MEV bots, culminating in a theft of $25 million. This figure represents a whopping 92% of all hacks aimed at automated trading bots in the last year. The malefactor leveraged a loophole in the MEV-boost-relay that let him receive and rearrange transactions post block-signing, including fund withdrawals. After transmitting an invalid block, he received an error message from the relay, which came with transaction data. Using this data, the validator crafted a new block and managed to withdraw the assets before the MEV bot could carry out the remaining operations. The developers sprung into action and remedied the problem swiftly once it came to light.
Final Words
Despite a dip in malicious activities, criminals continue to exploit weak spots in prominent applications, leading to asset thefts. Security measures often struggle to keep up with the pace of new developments. For example, CertiK identified critical vulnerabilities in two separate projects just in the last quarter. The first issue was tied to SUI validators, with the potential to completely paralyze the network, while the second vulnerability allowed access to the user funds of the ZenGo crypto wallet. This underscores the company's insistence on the need for developers to devote more time to educating individuals and frequently conducting third-party security audits.
The content on The Coinomist is for informational purposes only and should not be interpreted as financial advice. While we strive to provide accurate and up-to-date information, we do not guarantee the accuracy, completeness, or reliability of any content. Neither we accept liability for any errors or omissions in the information provided or for any financial losses incurred as a result of relying on this information. Actions based on this content are at your own risk. Always do your own research and consult a professional. See our Terms, Privacy Policy, and Disclaimers for more details.
Articles by this author
