September 2024 Crypto Hacks Exceed $120M, Centralized Exchanges Hit Hard

September 2024 saw an uprise in crypto hacks, with total losses surpassing $120+ million. This figure marks the second-lowest monthly loss from hacks in 2024, following April. Centralized exchanges were the primary targets, continuing to show vulnerability to cyberattacks, with BingX and Indodax suffering the most significant losses.

Blockchain security firm Peckshield reported that the cumulative loss for the month amounted to $120.23 million, spread across more than 20 hacks. Centralized exchanges alone accounted for over half of this figure, with BingX losing $44 million and Indodax facing losses of $21 million.

#PeckShieldAlert September 2024 saw 20+ hacks in the crypto space, leading to ~$120.23 million in losses. (Note: The $32.4 million worth of $spWETH drained in a Permit signature #phishing is not included)#Top 10 Hacks in September 2024:#BingX: $44 million#Penpie: $27 million… pic.twitter.com/t2YuvIds6u

— PeckShieldAlert (@PeckShieldAlert) October 1, 2024

Compared to the previous month of August, which saw nearly $314 million stolen in crypto hacks, September recorded a 61.7% drop in losses. Despite the reduction, centralized exchanges continue to be prime targets, raising concerns about their security, with Certik Alert pegging their hack figures at $161.1 million.

#CertiKStatsAlert 🚨

Combining all the incidents in September we’ve confirmed ~$161.1m lost to exploits, hacks and scams after ~$2.1m was returned.

September has seen a 2x increase in incident numbers over August.

Exit scams: ~$0.7m
Flash loans: ~$4.7m
Exploits: ~$155.7m

More… pic.twitter.com/q8wX4WrBJ9

— CertiK Alert (@CertiKAlert) September 30, 2024

DeFi Protocols Also Hit

Decentralized finance (DeFi) platforms were not spared either. Penpie, a DeFi protocol, experienced one of the larger losses, falling victim to a $27 million exploit. Other notable DeFi platforms hacked in September include Delta Prime, which lost $6 million, inflation data provider Truflation ($5.6 million), and the liquid staking protocol Bedrock, which suffered a $2 million breach.

Crypto lender Shezmu also faced a $5 million attack but was able to partially recover the stolen funds through direct negotiations with the hacker. Meanwhile, Telegram bot Banana Gun announced it would refund affected users following a $3 million exploit.

WazirX Still Reeling from 2024’s Largest Hack

Indian exchange WazirX remains the biggest victim of cryptocurrency hacks in 2024, with losses amounting to $235 million after a breach in July. The exchange was compromised when one of its Safe Multisig wallets on Ethereum was hacked. As a result, WazirX suspended all withdrawals while conducting an internal investigation.

It's been over a month since WazirX, a major crypto exchange operating in India, claimed that a cyber attack on their platform led to the theft of $230 million (~ Rs 2000 cr) worth of funds.

We have attempted to be in regular touch with WazirX since the day of the incident but…

— CoinSwitch: India's Simplest Crypto App 🚀 (@CoinSwitch) August 28, 2024

Despite three months passing since the incident, WazirX has not yet outlined a compensation plan for affected users. Adding to its troubles, rival exchange CoinSwitch has taken legal action against WazirX to recover 2% of its assets, estimated at $6.2 million. WazirX has acknowledged that 43% of customer funds lost in the hack may never be recovered.

Despite being lower than in previous months, September’s hack toll highlights the persistent vulnerability of centralized exchanges and DeFi platforms to cyberattacks. As crypto markets expand, the pressure to tighten security measures and protect user funds becomes more urgent. WazirX’s prolonged recovery efforts are an immediate testimonial of the consequences such breaches can have on users and platforms.

⛑️Security Quarterly Report: Q3 2024
– Total network losses: $743 million
– 60+ phishing incidents: $340 million losses (58.08% increase)

On Aug 19, a victim lost 4,064 $BTC ($238 million) to a phishing attack. The stolen funds were swiftly moved through platforms like… pic.twitter.com/cSLosFgJMa

— OKLink (@OKLink) September 30, 2024

Meanwhile, per a Q3 security report by on-chain data hub OKLink, a total of over $740 million has been lost to network hacks, with a single victim suffering the loss of 4,064 BTC (worth $238 million) as of writing.