Analysis by Bonanza Factory's Blackpaper service

353 security incidents this year, surpassing 2024's record

Cumulative hack losses reach $27.5 billion; recovery rate limited to 4.8%

Stolen funds used as DeFi loan collateral, diversifying laundering methods

[123rf]
[123rf]

A record-breaking hack at digital asset exchange Binance has sent shockwaves through the industry, as global digital asset hacking and security incidents this year have surged to roughly three times the level seen in the same period last year. With large exchanges squarely in attackers' sights, total losses have reached an all-time high, while increasingly sophisticated methods of dispersing stolen funds — including their use as collateral in decentralized finance loans — are making tracking and recovery ever harder.

According to Blackpaper, a real-time fund-tracking service operated by Bonanza Factory, digital asset hacking and security incidents worldwide totaled 353 through Monday, approximately 2.9 times the 121 cases recorded in the same period last year. Cumulative losses this year reached $8.87 billion, an all-time high. Of that total, approximately $6.3 billion — or 70 percent — was stolen from Binance.

From June 2011 through this month, a total of 1,353 incidents have been recorded, with cumulative losses reaching approximately $27.53 billion. Of that, only about $1.33 billion has been recovered — just 4.8 percent of the total.

The sectors bearing the brunt of hacking losses were also clearly defined. Some 81 percent of this year's total hack losses stemmed from key and infrastructure breaches targeting private keys and related systems. By victim type, exchanges accounted for 76 percent of total losses.

The recent Binance hack illustrates how a breach of an exchange's internal systems can lead to massive asset outflows. Assets stolen from Binance's hot wallet in the incident are estimated at approximately $6.34 billion, of which about $2.85 billion has been frozen or had its movement blocked.

However, not all frozen assets have been returned to Binance. Replenishing lost assets from the exchange's own reserves is a separate matter from actually recovering the stolen funds. As of Sunday, assets linked to the attackers confirmed by Bonanza Factory included approximately 522,409 ether and about 18,270 bitcoin.

"We believe the funds stolen in the Binance hack have not yet been cashed out in earnest," said Heo Se-hyeon, a senior researcher at Bonanza Factory's blockchain technology project division. "A significant amount of ether and bitcoin remains at associated addresses, and the major flows confirmed so far have been asset swaps and transfers on-chain."

A defining feature of this incident was the use of DeFi lending services to move funds. The hackers deposited $60 million in stolen Tether (USDT) as collateral on the DeFi lending protocol Aave and borrowed 19,762 wrapped ether (WETH). Aave responded immediately after the incident by temporarily restricting new deposits and loans to prevent further inflows of criminal funds.

"The attacker can move the borrowed assets elsewhere while the stolen assets remain locked as collateral," Heo said. "If that collateral is subsequently frozen and rendered unusable, it creates problems for recovering the loan — meaning the risk from stolen assets can spread to the lending protocol itself." Heo added that tracking such transactions requires examining not only the assets the attacker took away but also the collateral left in the protocol and the associated debt relationships.

Even when transaction timestamps, amounts and fees are recorded on the blockchain, identifying the ultimate destination of stolen funds or their true owner remains difficult. "The fact that transaction records are public is a different matter from being able to confirm where the money came from, who actually controls the wallet, and who received the cash," Heo said.

The use of mixers and privacy technology raises the difficulty of tracing funds even further. Tornado Cash obscures the link between deposit and withdrawal addresses, while CoinJoin combines transactions from multiple users into one, muddying the flow of funds.

Converting assets into Monero (XMR), which conceals transaction parties and amounts, reduces the information available in public records. Similarly, when digital assets are exchanged for fiat currency through over-the-counter trades, blockchain records alone are generally insufficient to identify who ultimately received the funds.

A gap therefore exists between tracing funds and actually recovering them. "Bitcoin and ether cannot be frozen by requesting it from an issuer the way stablecoins can," Heo said. "You have to catch the moment the funds are converted into stablecoins, or the moment they enter a centralized exchange or custodial service provider."

Beyond tracking and recovering stolen funds, the importance of robust internal security systems at exchanges to prevent hacks in the first place is also growing. In the Binance incident particularly, analysts found that hackers exploited the exchange's internal wallet signing system to siphon large amounts of assets externally — even though the hot wallet keys themselves were not compromised.

"Exchanges need to expand the scope of security beyond safely storing signing keys to also judging whether a signing request itself is legitimate," said Kim Young-seok, chief executive of Bonanza Factory. "Even if keys are stored securely, a breach of internal systems can turn a normal signing service into a vehicle for attack."

Kim recommended that exchanges verify, immediately before signing, whether the recipient address, amount and execution details of a withdrawal request match pre-approved records — and that the system be designed to refuse signing if any discrepancy is found. Kim also said such verification should apply not only to customer withdrawals but also to internal asset movements such as rebalancing and settlement.

Kim also proposed separating withdrawal request authority from signing authority. "Standards are needed, such as separating the department that creates withdrawal obligations from the department that actually signs," Kim said. "Even if an attacker takes control of the signing system, the risk of asset outflows can be reduced if they cannot bypass a separately operated verification system."

Regulatory improvements were also cited as an outstanding challenge. "The Digital Asset Basic Act should establish a basis for swift asset freezing and recovery, as well as cooperation between domestic and international agencies," Kim added. "The obligation to monitor abnormal transactions should also be expanded beyond customer transactions to cover internal withdrawal and signing processes."


kyoung@heraldcorp.com