What Happens After the Hack? A Deep Dive Into DeFi Exploits and Recoveries
Note: This article is the first output of YaaS Analytics comprehensive credit and yield analytics platform. Please visit www.yaasdigital.com to sign up for our waitlist and get a free trial of the platform.
Transparency is a double-edged sword in Decentralized Finance (DeFi). Open-source code allows the community to access and review the code, building trust and accountability in the technology. However, the same reason that attracts people to DeFi can also leave the ecosystem vulnerable to exploitation if not constructed to meet security best practices and constantly maintained. Take the Wormhole exploit in February 2022 for example. An attacker exploited the use of a deprecated, insecure function to bypass signature verification and stole 120,000 ETH ($326 million USD). In 2022, YaaS Analytics estimates $2,638,605,490 bn USD was impacted by exploits on DeFi protocols, accounting for about 2.8% of average TVL (remember that number!). This is where the story usually stops though in the public consciousness. There is an incident, there is a headline number and then there is grumbling that “DeFi isn’t ready for primetime”. However just like when a traditional company goes bankrupt when a platform gets exploited, often the story is just getting started.
In the immediate aftermath of the Wormhole exploit, Jump Crypto, who had acquired the developer of Wormhole (Certus One) in August 2021, repaid participants all of their lost funds out of their own equity. Effectively a “parental guarantee” if we were to look at TradFi equivalents. That’s all well and good, but what if a platform doesn’t have a parent or foundation with a spare $320 million kicking around? In February 2023, Jump Crypto partnered up with Oasis, a multi-sig wallet developer, and “exploited” all 120,000 of the stolen ETH ($140 million USD) back from the original attacker, which any sophisticated “white hat” hacker could have theoretically undertaken themselves. As we said, the story is just getting started when the exploit happens. White hat hackers, protocol reimbursement, protocol intervention, recovered collateral, and good old fashioned “hacker gave it back”; the list goes on and on of how funds are recovered after attacks. In all, YaaS Analytics estimates about 28.7% of the funds lost are ultimately recovered (remember that number too!).
Coincidentally what was Moody’s default rate for speculative corporate debt in January 2023? 2.8%, the same as the exploits as a percentage of TVL in 2022 above. And what was Moody’s 5-year trailing recovery rate for unsecured high-yield bonds in 2020? You guessed it, just a shade under 30%. Default Rate and Recovery Rate are the holy grails of credit risk in traditional finance, yet when we start looking at DeFi it is more about “headline panic” and “no further questions please”. Clearly, defaults and exploits are not truly apples to apples nor are TradFi and DeFi, BUT it’s time to get past the hysteria and look at the real numbers when evaluating risk in the DeFi space.
Let’s dig in.
Methodology
We extracted our data from a number of existing exploit databases, namely DeFi Yield’s Rekt Database, DeFi Llama Hacks, Slowmist Hacked, and Halborn Blogs just to name a few, with data correct as of 13 March 2023.
Thereafter, we reclassified exploits into Centralized Finance (CeFi) for platforms such as FTX and Binance, and DeFi for platforms such as Uniswap and Compound. For CeFi platforms, we have excluded these events as even if the losses were related to an exploit (ie. Wintermute), those assets were still corporate assets, not direct user funds. We therefore consider these events as Credit Loss events and will analyze these separately in a crypto credit-focused article (also fascinating!).
Next, we further classified the exploited platforms into more specific categories, such as Dexes, NFT Marketplaces, Lending, and Bridges; utilizing DeFi Llama’s protocol categories. Additionally, we came up with our own rubric for classifying each Issue Type to help us get a better understanding of how a protocol was exploited.
We also identified exploits that had funds recovered and included how these funds were recovered to determine what were the predominant recovery methods employed by protocols.
Additionally, we excluded edge cases like Terra Luna / Anchor, which did not seem truly to be an “exploit” in the sense that we were looking to explore in this paper. Please see our multi-part series on algorithmic stablecoins and the Terra Luna event for more details. Overall, this filtering process allowed us to paint a clearer picture of how the funds were lost from each exploit.
The History of DeFi Exploits and Recovery
In total, since 2011 the DeFi industry had an estimated $5,973,900,547 USD of funds impacted across 763 recorded exploits, leading to an average of $7.82mm lost for each exploit. As mentioned previously, the percentage of funds recovered stands at $ 1,712,265,702 USD (28.7%).
Though only accounting for 2.1% of the exploits, the 16 exploits totaled up to $ 3,264,070,257 USD, accounting for 54.6% of the total amount of DeFi exploits. Less the Parity Multi-Sig exploit that happened in 2017, the massive exploits started happening during the meteoric rise of DeFi’s Total Value Locked(TVL) in the second half of 2021, where it reached a peak of $180.08bn USD total TVL on 2nd December 2021, starting with the Poly Network exploit on 8th August that same year.
Let us look at the top 5 exploits, which account for 32.5% of the total funds lost in DeFi, and how they affected the DeFi economy.
- Ronin Bridge — $625,000,000 USD
- Category: Bridge
- Cause of exploit: Access Control — Backdoor through Axie Infinity
- Date: March 29, 2022
- Audited: Only audited after exploit.
2. Poly Network — $602,189,570 USD
- Category: Bridge
- Cause of exploit: Access Control
- Date: 10 August 2021
- Audited: Claimed to be audited by NCC Group, Certik according to Twitter user @WuBlockchain.
3. Wormhole — $326,000,000 USD
- Category: Bridge
- Cause of exploit: Smart Contract Vulnerability
- Date: 2 February 2022
- Audited: January 2022 by Neodyme
4. Euler Finance — $197,000,000 USD
- Category: Lending
- Cause of exploit: Smart Contract Vulnerability
- Date: 13 March 2023
- Audited: 9 audits by 6 unique auditors (Omniscia, Sherlock, Certora, Halborn, Solidified, Zk Labs)
5. Nomad — $190,000,000 USD
- Category: Bridge
- Cause of exploit: Smart Contract Vulnerability
- Date: 1 August 2022
- Audited: 9th June 2022 by Quantstamp, but reported that vulnerability was outside the scope of the audit firm.
Exploit Categories and Statistics
We wanted to identify which category of protocols was the most prone to exploits. Bridges have suffered some of the largest losses in DeFi exploits, accounting for 33.3% of all exploits. According to Chainalysis, Bridges often rely on a central storage point for the funds backing bridged assets on the receiving blockchain, creating an attractive target for bad actors seeking to exploit vulnerabilities in the protocol. The concentration of liquidity in a single point also exacerbates the impact of any successful exploit. We also observe that Access Control and Smart Contract Vulnerabilities are the 2 main causes of exploits, accounting for 65.1% of total exploit losses at $3,891,712,303 USD.
Despite boasting the highest TVL of any DeFi sector, standing at 18.09 billion USD across 741 protocols as of March 20th, 2022, according to DeFiLlama, Decentralized Exchanges (Dexes) only ranked third in total funds lost, with 102 exploit incidents. While the number of exploits was the third highest across all DeFi categories, it is possible that the sheer volume of Dexes on the market played a role in limiting the damage caused by any one exploit. With so many options available to users, funds are distributed across multiple platforms, reducing the impact of a single exploit.
Now that we understand where all these exploits are occurring, let us dive deeper into the history of these exploits.
Despite increased awareness, rugpulls continue to plague the DeFi space, with the most recent notable incident being the rugpull of Dictum Exchange. On December 31st, 2022, Dictum Exchange, a protocol built on the Arbitrum network executed a hard rug on its liquidity providers (LPs) shortly after airdropping its $DIC token. The LP contracts were constructed using a proxy upgradeability pattern, which enabled the deployment of new implementations with malicious code, including a burn() function that allowed its creator to drain liquidity from the contracts. Rugpulls are often hard to keep track of, as the creators usually delete their social media accounts and website after they pull all the funds. Thankfully, some members of the community such as DeDotFi help to warn users of these exploits and recover any funds if possible.
It is crucial for users to perform their own due diligence when with new DeFi protocols. Some of the simplest measures include conducting thorough research before providing liquidity and using non-custodial wallets so that you are the owner of your private keys. It is also recommended to stay up to date with the latest news and developments in the DeFi space, as well as to avoid sharing personal information or private keys with anyone.
Recovery of Funds
Almost 30% of funds lost in DeFi hacks to date have been recovered. Great! But how? In TradFi, generally when a company goes bankrupt a court liquidates all of its assets and those assets are used to pay back creditors pro rata. In DeFi……. it’s a bit more complicated.
The most common recovery method for stolen funds was when the hacker voluntarily returned the funds, accounting for $815,851,258 USD in recovered funds, or 47.6% of the total recovered funds. Some of the common reasons for Hacker Returned was because the hacker received a bounty, as in the case of the Crema Finance exploit, where the hacker negotiated a bounty of 45455 SOL (~$ 1.4 million USD) in exchange for returning all $ 8 million in stolen funds. Another reason for fund recovery was when the hacker turned out to be a White Hat, an ethical security hacker, which was seen in the Poly Network exploit, where the hacker decided to return the funds and send a message to the creators of the protocols. There are various other recovery vectors as well for funds lost to exploits, such as collaborating with blockchain security firms to identify and restrict wallet transactions, or stopping the blockchain altogether (remember the inaugural DAO hack? The good ole days).
In all, YaaS Analytics has identified recovered funds on 59 out of the 763 exploits in the ecosystem. Interestingly, when there was a recovery the size of the recovery was generally a pretty high proportion of assets, with the average recovery rate when there were funds recovered being approximately 76%. In 25 of those 59 scenarios, 100% of the funds were recovered.
Another interesting data point, while not exactly apples to apples, is based on a report published by Sophos on mid-sized businesses affected by data breaches. In about 46% of these cases, these more traditional tech companies turned to paying a ransom to recover data not that dissimilar to negotiating a Bounty with a hacker. That 46% is coincidentally the exact same proportion of exploit recoveries where the Hacker Returned the funds. Thankfully, hackers for DeFi protocols seem to be more generous than hackers in traditional businesses, returning approximately 70% of the exploited funds as compared to a 61% recovery rate of encrypted data.
How Can I Protect Myself?
One of the easiest ways to protect yourself in the DeFi space is to verify that the protocol you’re interested in has undergone a security audit by a reputable blockchain security firm such as Certik, Peckshield Inc, and Consensys Diligence. Out of the 763 exploits that occurred, only 52 of them were audited protocols, which is only about 7%! You can usually find audit reports for major protocols on their official websites or in their GitHub repositories. By doing so, you can be confident that the protocol’s codebase has undergone professional scrutiny and that any potential vulnerabilities have been identified and addressed. While audited protocols are not completely immune to exploits and the biggest hacks listed above were all on audited protocols, they do provide an additional layer of verification for users not well-versed in analyzing smart contracts.
In addition to audits, purchasing DeFi insurance is another way to protect yourself. DeFi insurance can cover a variety of risks, such as smart contract vulnerabilities, stablecoin de-peg risks, contract bugs, and economic attacks. By purchasing insurance, you can mitigate potential losses in the event of an exploit. It is important to research and choose a reputable insurance provider with a proven track record of payouts.
DeFi insurance is gaining popularity as more people seek protection in the unpredictable and volatile market, with around $322.83mm currently locked into insurance protocols according to DeFiLlama in 2023. To learn more about the various options available for protecting yourself with DeFi insurance, you can refer to a Twitter thread we shared in July about DeFi Insurance.
You can also learn more about protecting yourself with DeFi insurance by checking out our CEO Alex McDougall’s presentation on “DeFi: How to earn passive income with Crypto” at Coindesk Consensus 2022. In his talk, Alex discusses how to use DeFi insurance to safeguard your investments. You can find the video of the presentation on Yahoo Finance here and here.
There are also evolving new models such as Tranching as a Service platforms like Idle Finance, which offer junior and senior tiers of exposure on underlying DeFi and CeDeFi platforms that can provide another tier of first-loss capital.
You can also use some of the data from this report and our YaaS Analytics database to make better data-driven decisions about where risk is accumulating in the space and take extra precautions when using the riskiest types of platforms like bridges.
Finally, always think about who stands to benefit or is incentivized to protect these platforms if there is an attack. It is a pre-known piece of information that Jump Crypto was backing Wormhole and has sufficient resources to support fund recoveries. Similarly, if it is a platform on a newer protocol or one of the leaders on a protocol then that protocol has a strong incentive to step in and make people whole as well. There are no guarantees in this role, but it is similar to an implied parental guarantee for the subsidiaries of larger financial institutions when evaluating credit risk.
What’s Next For DeFi?
The transparent nature of DeFi no doubt exposes the vulnerabilities of a protocol to the public, however, with more blockchain security firms popping up in recent years, as well as the joy of open-source software where innovations can be shared instantly, exploits are becoming difficult. Furthermore, there have been success stories of exploit prevention and recovery of stolen funds through counter-exploits, such as BlockSec’s article on rescuing stolen funds as well as the previously mentioned Wormhole recovery by Jump Crypto and Oasis. The success stories of recovery innovations suggest that there is hope for blockchain security, and ongoing efforts to improve security measures are likely to yield positive results in the future.
Nonetheless, it is important to perform your own due diligence to ensure that you understand the risks involved in DeFi and take measures to protect yourself, such as hedging your assets with insurance and investing in professionally audited protocols. At YaaS Analytics, we are constantly monitoring DeFi Exploits and Recovery to generate a fully transparent risk-adjusted portfolio to help protect our assets as well as deliver the best data and research in the industry.
If you are interested in finding out more about YaaS Analytics, you can follow us on Twitter and sign up on our website for a free trial of our data streams!
By Alex McDougall and Ryan Tan
