Airdrop Army

In a fresh twist, cyber security firm CertiK dropped a bombshell on Tuesday: despite a dip in crypto hacks last quarter, the bad actors made off with way more crypto than before. The latest Web3 security report flagged a cool $750 million stolen across 155 attacks, raising eyebrows across the sector. That brings the year’s total losses close to $2 billion. And while hack incidents fell by 27, the lost value spiked nearly 10%. Yeah, fewer hits, but juicier rewards.

Phishing and private key compromises took center stage, siphoning off $668 million in value. Phishing alone accounted for $343 million in damages over 65 incidents—ouch. The report zeroes in on a particularly nasty case from August, when a Bitcoin whale lost a staggering $238 million. That phishing attack was the largest single hit for the quarter. Although the crypto community managed to salvage a chunk of the funds, most of it remains MIA.

Private key compromises weren’t any prettier. Ten incidents alone cost the space $317 million. The biggest mess? WazirX, one of India’s major exchanges, got smacked hard in July. A whopping $231 million in crypto, including SHIB, ETH, and MATIC, disappeared into the ether thanks to private key flaws. Not a great quarter for WazirX.

Ethereum, though, continued to be the top target. A whopping $387.8 million was swiped across 86 incidents, leaving other chains in the dust. And the multichain hacks? Those raked in $89.8 million, exposing the dangers of cross-chain action. Code vulnerabilities and reentrancy attacks added to the mayhem. Code flaws alone caused $39.6 million in losses across 44 incidents. Meanwhile, reentrancy exploits—where hackers can drain funds repeatedly before balances update—contributed another $30.3 million from just five incidents.

One particularly rough stat: only 4.1% of stolen funds got recovered this quarter, a steep drop from the 14.4% recovery rate seen in Q2. Even with fewer incidents, the hackers’ average haul ballooned to $5.93 million per hack. Immunefi, another security player, noted that despite all this, August crypto losses did drop to $15 million, the lowest month this year.