DeFi Exploits Plunge 40% In 2024, But Centralized Exchange Losses Soar

Este artículo también está disponible en español.

According to a report published today by blockchain security firm Hacken, decentralized finance (DeFi) protocols witnessed a steep decline in exploits in 2024, while centralized finance (CeFi) platforms more than doubled their losses due to security breaches.

DeFi Platforms Show Better Security Mechanisms

In its annual “Web3 Security Report,” Hacken outlined the general trends in the cryptocurrency industry with regard to scams and security infrastructure. The report notes that total losses arising from security failure in 2024 stood at $2.91 billion.

Related Reading

DeFi protocols accounted for $474 million in losses this year, a 40% decline from $787 million in 2023. This sharp drop reflects the growing adoption of advanced security techniques, such as zero-knowledge cryptography and multi-party computation, across the DeFi ecosystem.

One key factor contributing to the reduction in DeFi exploits was the sharp decline in cross-chain bridge hacks. Losses from these attacks have consistently fallen – from $1.89 billion in 2022 to $338 million in 2023, and finally to $114 million in 2024.

In contrast, CeFi platforms, including cryptocurrency exchanges, reported $694 million in losses in 2024, more than double the $339 million recorded in 2023. CeFi accounted for nearly one-third of all crypto-related incidents, highlighting persistent vulnerabilities in centralized systems.

Gaming and metaverse projects were another major target in 2024, responsible for nearly 20% of all crypto-related hacks, with $389 million in losses. The largest gaming/metaverse breach of the year was the PlayDapp exploit in Q1 2024, which resulted in a $290 million loss.

Phishing scams also remained a significant concern, causing more than $600 million in losses this year. These scams highlight increasingly sophisticated social engineering tactics in the Web3 space.

In November, the sector faced a $129 million address poisoning attack. For context, address poisoning phishing involves attackers sending small transactions from an address that closely resembles one the victim has interacted with, tricking them into mistakenly sending funds to the fraudulent address in future transactions.

Memecoins And Rugpulls Continue To Prey On Users

While memecoins were all the rage for the majority of 2024 – particularly on the Solana (SOL) blockchain due to its low transaction costs – a significant proportion of them preyed on investors through presale scams and celebrity-endorsed rug pulls.