Top 10 Crypto Scams and Hacks of 2022

Despite cryptocurrency markets being trapped successful a terrible bearish recession, scams and hacks successful Web3 were connected occurrence for the entirety of 2022. A fig of top-tier centralized cryptocurrency heavyweights besides collapsed owed to mediocre hazard absorption and insider manipulations.

As the crypto conception approaches New Year, U.Today recaps the astir unsafe crypto scams, their roots, designs and the losses they caused. We person besides prepared a abbreviated reappraisal of the astir predominant crypto scams successful societal media that people millions of users daily.

Crypto scams and hacks of 2022: Quick facts

According to galore cybersec reports, successful the archetypal 11 months of 2022, hackers and scammers managed to bargain an unprecedented magnitude of $4.2 cardinal successful cryptocurrency, which is 37% much than successful 2021, erstwhile cardinal cryptos were 2x-3x much expensive.

• The largest attacks were executed against cross-chain protocols — Axie Infinity’s span mechanics Ronin and the multi-protocol ecosystem Wormhole.
• The collapses of the Terra (LUNA) ecosystem, its large DeFi Anchor Protocol (ANC) and the USD-pegged stablecoin TerraUSD (UST) contributed to the Q2-Q4, 2022, signifier of the bearish recession.
• The play astir the now-defunct crypto speech FTX and the associated trading steadfast Alameda Research was the largest centralized work illness crossed 2022.
• Despite the largest hacks being wide discussed successful the media, the immense bulk of crypto scams are organized via aged methods: fake airdrops, malicious “recovery programs,” scam arbitrage schemes and the like.
• A fig of large hacks appeared to beryllium white-hat operations: attackers returned the wealth stolen successful speech for awesome bug bounties.
• Almost 12% of each BEP-20 tokens and 8% of ERC-20 tokens are fraudulent; 350 caller scams are launched daily.

In this review, we volition notation to purposefully launched frauds and projects that were initially morganatic arsenic “scams,” portion “hacks” are third-party attacks connected morganatic projects executed without “insider job” events.

Top crypto scams and collapses of 2022

In 2022, Bitcoin (BTC), Ethereum (ETH) and each large cryptocurrencies mislaid implicit 70-80% from their ATH, portion successful astir affected segments — metaverse tokens, GameFi tokens, the Solana (SOL) ecosystem — the median nonaccomplishment exceeds 90%. Some crypto majors failed to past specified a achy drop.

Terra (LUNA)/Terra USD (UST)

EVM-compatible astute declaration level Terra (LUNA) was among the astir overhyped Ethereum (ETH) killers of 2021. However, the lion’s stock of its TVL was concentrated connected Anchor Protocol (ANC), a elemental output farming instrumentality that offered a 19% APY connected deposits successful Terra USD (UST), Terra’s now-defunct USD-pegged stablecoin. In total, much than $20 cardinal successful equivalent was locked successful Anchor (ANC) successful Q1, 2022.

Image by CoinMarketCap

However, successful aboriginal May 2022, idiosyncratic started aggressively sending UST to pools connected the Curve Finance (CRV) DeFi and exchanging the tokens connected USD Coin (USDC). UST mislaid its peg. Terraform Labs and its CEO Do Kwon started injecting liquidity into the UST/LUNA mechanism. However, owed to a monolithic superior run, some LUNA and UST dropped to astir zero values. The Terra (LUNA) blockchain was halted for good.

As covered by U.Today previously, researchers unveiled that it was Terraform Labs that initiated the collapse: monolithic UST transfers were authorized by Do Kwon. The Terra laminitis allegedly ran to Serbia and is trying to currency retired his Bitcoins (BTC) there.

Three Arrows Capital

Launched by Su Zhu and Kyle Davies, Columbia University alumni and Credit Suisse veterans, Three Arrows Capital (3AC) was among the astir influential crypto hedge funds. It amassed implicit $20 cardinal successful AUM acknowledgment to being an aboriginal capitalist successful Ethereum (ETH), Avalanche (AVAX), Solana (SOL) and others.

However, collapsed LUNA was 1 of the cardinal elements of the 3AC portfolio. The squad invested implicit $600 cardinal successful Terra (LUNA): this monolithic involvement was erased successful 2 weeks aft the LUNA/UST collapse.

On June 16, 2022, FT announced that 3AC had failed to conscionable its borderline calls owed to losses successful Terra’s Anchor Protocol. The steadfast was besides underwater successful its positions successful Staked Ether (stETH) successful the Lido Finance (LDO) DeFi and successful Grayscale Bitcoin Trust (GBTC). In June it failed to repay its indebtedness to crypto elephantine Voyager. In precocious July the steadfast was liquidated by a BVI tribunal portion the 3AC absorption filed for bankruptcy. In total, 20 investors successful 3AC mislaid implicit $3.5 billion.

Voyager

U.S.-registered creditor Voyager besides fell unfortunate to mediocre hazard management: it provided a $650 cardinal unsecured indebtedness to Three Arrows Capital portion its nett AUM was astir $5.9 billion. The level boasted 3.5 cardinal customers, 97% of whom invested little than $10,000.

In general, Voyager collapsed owed to the information that its squad chose a risky concern strategy: it offered loans to aggregate trading services and idiosyncratic cryptocurrency traders. As lenders started withdrawing their wealth en masse, successful aboriginal July, Voyager froze lawsuit funds. A fewer days later, it filed for bankruptcy extortion successful New York.

Image by The Held Report

As the level was focused connected small-sized retail customers, its illness was the astir achy for cryptocurrency enthusiasts.

Celsius

Celsius was, successful fact, the archetypal steadfast to awesome astir its problems: successful April 2022 the level announced that it volition clasp each assets of non-accredited investors successful custody: this portion of customers was truthful incapable to inject caller liquidity and get rewards.

In May 2022, frightened by the UST and Terra dramas, users started moving wealth retired of the Celsius protocol. On June 12, 2022, Celsius froze the funds of 1.7 cardinal customers (mostly retail investors). Just similar Voyager, it filed for bankruptcy successful aboriginal July.

On July 14, 2022, Celsius’ ineligible advisor Kirkland & Ellis shared that the platform’s leaders were informed astir a $1.3 cardinal spread successful its equilibrium sheet.

FTX

The illness of Sam Bankman-Fried’s cryptocurrency speech FTX and its associated crypto investing steadfast Alameda Research was the astir astonishing play successful Web3: SBF and his squad attempted to summation tremendous power implicit the manufacture by signing dozens of partnerships, appearing connected Forbes’ covers and truthful on.

However, the equilibrium expanse of Alameda Research depended heavy connected FTX Token (FTT), the autochthonal cryptocurrency of FTX. That’s wherefore the full strategy collapsed erstwhile Binance CEO Changpeng “CZ” Zhao started aggressively selling FTT (over $500 cardinal successful equivalent was released by CZ).

Just similar successful each akin cases, investors started wide withdrawing their wealth from FTX. The level stopped the withdrawals, SBF stepped down arsenic CEO and filed for bankruptcy. Meanwhile, it became known that helium was utilizing investors’ and customers' wealth successful his ain trading firm, Alameda Research. Due to unspeakable mismanagement, Alameda Research was good underwater. SBF was arrested and released connected bail portion the realized losses from the FTX illness peaked astatine $9 cardinal successful equivalent.

Top crypto hacks successful 2022

As per an analysis of Merkle Science cybersecurity experts, cross-network bridges are peculiarly susceptible to exploits owed to their method complexity and highly experimental character:

Bridges betwixt chains are often much susceptible to exploits arsenic they necessitate much interactions and declaration approvals than the different protocols. Additionally, bridges are much susceptible to attacks arsenic they are tally by unaudited machine codes. Moreover, the identities of validators/nodes, who tally the transactions are besides unknown

In 2022, bridges were the superior targets of attacks, portion different DeFi mechanisms were besides exploited by hackers.

Wormhole

On Feb. 3, 2022, hackers attacked Wormhole, a span designed to facilitate seamless worth transportation betwixt heterogeneous blockchains. Due to a vulnerability successful code, they managed to contented 120,000 Wrapped Ethers (wETH) connected the Solana (SOL) blockchain without putting up the corresponding Ethereum (ETH) collateral.

Image by Chainanalysis

The hack could pb to insolvency of immoderate DeFi level that would beryllium acceptable to judge 120,000 wETH (printed retired of bladed air) arsenic a collateral. Fortunately, the worst-case script did not happen.

Jump Crypto, the genitor institution of the Wormhole service, took each the losses: they instantly replenished 120,000 Ethers to the protocol liquidity pools.

Ronin

On March 23, North Korean hackers from Lazarus, an infamous state-backed cyber transgression group, attacked the Ronin network. Ronin is an Ethereum-like sidechain developed specifically for Axie Infinity, a flagship GameFi. Attackers drained Ronin of a whopping $568 million.

Hackers managed to summation power of 5 retired of 9 validator signatures for Ronin Bridge. Then they authorized 2 transactions, 173,600 Ether (ETH) and 25.5 cardinal USD Coin (USDC). Out of this monstrous loot, implicit $445 cardinal was laundered via the Tornado Cash crypto mixer.

Axie Infinity developer Sky Mavis raised other funding, ordered different information audit by CertiK and accrued the multisig threshold from 5/9 to 8/9.

Nomad

In August 2022, Nomad, a multi-chain span mechanics that moves worth betwixt Avalanche (AVAX), Ethereum (ETH), Evmos (EVMOS), Moonbeam (GLMR) and different blockchains, was drained of $190.7 cardinal successful crypto. Attackers managed to exploit a vulnerability of the astute declaration design: the protocol allowed users to retreat funds connected the people blockchain without checking whether they were equivalent to the initially deployed amount.

12/ tl;dr a regular upgrade marked the zero hash arsenic a valid root, which had the effect of allowing messages to beryllium spoofed connected Nomad. Attackers abused this to copy/paste transactions and rapidly drained the span successful a frenzied free-for-all

Simply put, aft the regular upgrade, users were capable to deposit 1 ETH connected Ethereum (ETH) and inquire for a 100 Ethereum (ETH) equivalent withdrawal from Avalanche (AVAX).

The happening is, each tech-savvy Web3 enthusiast had been capable to replicate this onslaught vector and bargain funds from Nomad earlier the spot was released. As such, galore Ethereum (ETH) developers withdrew funds conscionable to nonstop them backmost to the Nomad team: astir $40 cardinal were sent back.

Beanstalk 

On April 16, 2022, Ethereum-based stablecoin task Beanstalk (BEAN) was targeted by a blase flash indebtedness attack. Namely, malefactors managed to get a flash indebtedness connected Aave Finance (AAVE) and bargain the magnitude of governance tokens indispensable to prehend power implicit the protocol on-chain referendums.

Then the attackers gained the voting supermajority and approved a wealth transportation to their ain account. When $180 cardinal was transferred, they instantly repaid the flash loan; the nett net exceeded $80 million.

Wintermute

In September 2022, Wintermute, 1 of the largest market-making platforms, had its wallets drained for $160 million. Attackers unveiled that immoderate of Wintermute’s cardinal wallets were created with Profanity, a generator of “vanity addresses” for the Ethereum (ETH) network. Such programs tin make crypto wallets with human-readable addresses, e.g., 0xJohnDoe1111… and the like.

Due to a vulnerability successful Profanity’s design, the attackers managed to brute-force the vanity addresses and retrieve backstage keys. The onslaught became imaginable owed to important compute resources utilized by malefactors.

Bonus: Do not autumn for these long-running scams

Alongside blase scenarios that see $1 cardinal flash loans, North Korean hackers and awesome hardware for brute-forcing, precise primitive scam campaigns are popping up present and there. Three onslaught designs are precise communal successful crypto arsenic of 2022:

1. Fake airdrops. To tally this scam, malefactors either signifier a YouTube advertizing run oregon spot their advertisement connected Twitter. Then they denote that an Internet personage (Snoop Dogg), a apical tech entrepreneur (Vitalik Buterin oregon Elon Musk) oregon adjacent person (Donald Trump) is airdropping cryptocurrency. All who are acceptable to assertion their bonuses should either nonstop an archetypal deposit (that would allegedly beryllium returned with a 100% profit) oregon their backstage keys. Needless to accidental that some groups volition suffer their deposits oregon each wealth from their wallets.

How to support yourself: Never nonstop your wealth to “airdrop organizers” oregon disclose your backstage keys oregon effect phrases.

2. Handmade MEV bots. Maximal extractable worth (MEV) is the maximum reward Ethereum (ETH) web participants tin get for their publication successful the process of artifact validating. Sophisticated techniques let america to payment from optimizing MEV. Scammers spot video oregon substance manuals connected however to physique your ain “MEV bots” successful bid to get entree to Ethereum (ETH) wallets and drain funds.

How to support yourself: Avoid “instant” MEV bots from YouTube manuals.

3. Scammers travel to the rescue. As 2022 is decidedly a twelvemonth of hacks, galore crypto users are checking whether their favourite blockchains are broken. Scammers are posting fake announcements astir this oregon that task being hacked and motorboat fake “compensation” programs. All funny successful compensation are asked to nonstop their effect phrases to scammers.

How to support yourself: Only cheque quality astir hacks connected authoritative media channels of blockchains.

Closing thoughts

In 2022, the bulk of collapses were triggered by the achy plunge of cryptocurrency prices, mediocre hazard absorption and greed of the owners of centralized cryptocurrency products. That’s wherefore decentralization is simply a large deal: the assemblage contented of a DAO would forestall FTX/Celsius/Voyager-scale collapses from happening.

Meanwhile, on-chain products should instrumentality attraction astir information audits, updates and backstage pitchy management.