Cryptocurrency hacking has become a significant threat

“This post has been pulled the outstanding Chainalysis 2024 Cryptocrime Report. In recent years, cryptocurrency hacking has become a significant threat, resulting in billions of dollars stolen from crypto platforms and exposing vulnerabilities across the ecosystem. Attack vectors affecting DeFi are sophisticated and diverse. Therefore, it is important to classify them in order to understand how hacks occur and how protocols can reduce their likelihood in the future. On-chain attack vectors do not arise from vulnerabilities inherent in blockchains themselves, but rather from vulnerabilities in the on-chain components of a DeFi protocol, such as their smart contracts. This is not a point of concern for centralized services, as centralized services do not function as decentralized applications with publicly visible code as DeFi protocols do.

The classification of attacks are summarized below:

Protocol Exploitation – When an attacker exploits vulnerabilities in a blockchain component of a protocol, such as those across validator nodes, the protocol’s virtual machine, or in the mining layer. On-chain Insider Attack: When an attacker operating within a protocol, such as a rogue developer, uses privileged keys or other private information to directly steal funds. Off-chain Phishing occurs when an attacker tricks users into signing permissions, often by replacing a legitimate protocol, which allows the attacker to spend tokens on behalf of users. Phishing can also happen when attackers trick users into directly sending funds to malicious smart contracts. Off-chain contamination – When an attacker exploits a protocol because of vulnerabilities created by a hack in another protocol. Contamination also includes hacks that are closely related to hacks in other protocols. On-Chain Compromised Server: When an attacker compromises a server owned by a protocol, they disrupt the protocol’s standard workflow or gain knowledge to further exploit the protocol in the future. Off-Chain Wallet Hack – When an attacker exploits a protocol that provides custody/wallet services and then obtains information about the wallet’s operation. Off-chain Price manipulation hack – When an attacker exploits a smart contract vulnerability or uses a flawed oracle that does not reflect accurate asset prices, facilitating the manipulation of a digital token’s price. On-chain smart contract exploitation – When an attacker exploits a vulnerability in a smart contract code, which typically grants direct access to various control mechanisms of a protocol and token transfers. On-chain compromised private key – When an attacker gains access to a user’s private key, which can occur for example through a leak or a failure in off-chain software. Off-chain Governance attacks – When an attacker manipulates a blockchain project with a decentralized governance structure by gaining enough influence or voting rights to execute a malicious proposal. On-chain Third Party Compromised – When an attacker gains access to an off-chain third-party program that uses a protocol, providing information that can later be used for an exploit.

Off-chain attack vectors arise from vulnerabilities outside the blockchain. One example could be the off-chain storage of private keys in a faulty cloud storage solution, which applies to both DeFi protocols and centralized services. In March 2023, Euler Finance, a borrowing and lending protocol on Ethereum, experienced a flash loan attack, resulting in approximately $197 million in losses. July 2023 saw 33 hacks, the most of any month, which included $73.5 million stolen from Curve Finance. Similarly, several major exploits took place in September and November 2023 on both DeFi and CeFi platforms. On-chain attack vectors do not arise from vulnerabilities inherent in blockchains themselves, but rather from vulnerabilities in the on-chain components of a DeFi protocol, such as their smart contracts. Hacking remains a significant threat. Protecting your digital assets from hacking is of utmost importance, especially in the current scenario where cyber threats continue to increase.

Measures to protect your digital assets include:

1. Use strong passwords: Create strong and unique passwords for all your accounts and avoid using the same password for multiple accounts. Use a mix of upper and lower case letters, numbers and symbols. 2. Two-factor authentication: Enable two-factor authentication for all your accounts whenever possible. This adds an extra layer of security to your accounts. 3. Keep your software up-to-date: Keep all your software, including anti-virus and anti-malware software, up-to-date to ensure it has the latest security patches. 4. Use a hardware wallet: Consider using a hardware wallet to store your digital assets offline. This will ensure that your assets are safe even if your computer or mobile device is hacked. 5. Be careful with phishing emails: Be wary of phishing emails that appear to be from legitimate sources. Do not click on any links or download any attachments from such emails. 6. Use trusted exchanges: Use only trusted exchanges to buy, sell and store digital assets. Research the exchange thoroughly before using it. 7. Back up your data: Back up your data regularly to ensure you maintain access to your digital assets in the event of a hack or a hardware failure”.