Web3 Scams & Security Incidents Report: March 2024

TL;DR March 2024 was a pretty quiet month with a relatively low amount of stolen funds ($124M vs. $398M in February), even more so when considering that $62 million from the Munchables hack was returned by the attacker, lowering the total losses for March to $62 million.

The Munchables attack was particularly interesting due to its use of social engineering. The project, which runs on Blast, had a team of anonymous developers, one of whom appears to have impersonated the other three and controlled the keys for the main contract. This individual stole the funds and
demanded $1M. After negotiations, all of the funds were returned to the project.

Attack Vectors

Regarding attack vectors, March has had seen mostly smart contract attacks, followed by rug pulls. The following is a summary of security incidents by categories, that took place this month:

• 8 Smart contract vulnerabilities
• 6 Rug puls
• 3 Flash Loan Attacks
• 3 Social Engineering attacks
• 3 X accounts compromised
• 2 Compromised private keys
• 1 DNS Hijacking Attack
• 1 Newsletter compromised
• 1 Phishing attack

Attack Vectors Behind Major Funds Lost

From the lost funds’ point of view, social engineering is the number one attack vector for this month, followed by smart contracts’ vulnerability:
• Social Engineering: $65M
• Contract vulnerability: $36M
• Flash Loan Attack: $9M
• Phishing attack: $4.3M
• Rug pull: $2.9M
• Compromised private keys: $2.7M
• DNS Hijacking Attack: $100K
• Newsletter compromised: $3K

Security Incidents Classified by Attack Vectors

We have classified the most relevant security incidents by attack vectors:
– Smart contract vulnerability: Unizen, BLASTOFF, MOBOX, ParaSwap, Dolomite, Super Sushi Samurai, Curio Ecosystem, Prisma Finance.
– Rug pull: OrdiZK, ClosedAI (ClosedAI), HumanizedAi (HMZ), FLOKIAI (FLOKIAI), Fake ETHFI, Lucky Star Currency.
– X Account compromised: Sherlock, beoble, Pendle Finance.
– Compromised private keys: Polyhedra Network, Mozaic.
– Social engineering: Ansem, AirDAO, Munchables.
– Flash loan attack: WOOFi, ZongZiFa, Lava

Funds Lost by Network

Blast is the network that suffered the most, but 95% of those funds account to the Munchables attack, which were later returned by the rogue developer.

– Blast: $66.360.000
– Ethereum: $39.293.000
– Arbitrum: $9.090.000
– Solana: $3.600.000
– Other: $1.810.000
– Base: $900.000
– BSC: $808.000
– Optimism: $750.000

Attack Incidents per Network

Regarding the most attacked network by the number of incidents, not surprisingly, we have Ethereum at the top of the list due to having the biggest TVL of all:

– Ethereum: 12
– BSC: 4
– Other: 3
– Arbitrum: 2
– Blast: 2
– Solana: 2
– Base: 1
– Optimism: 1
– Unknown: 1

Most Prominent Attacks of the Month

The biggest attacks during March 2024, were:

• Munchables (Blast): Social Engineering > $62.300.000
• Curio Ecosystem (Ethereum): Smart contract vulnerability > $16.000.000
• Prisma Finance (Ethereum): Smart contract vulnerability > $11.600.000
• WOOFi (Arbitrum): Flash Loan Attack > $8.750.000
• $ALI, $PUSH (Ethereum): Phishing attack > $4.390.000
• Super Sushi Samurai (Blast): Smart contract vulnerability > $4.060.000

Most Prominent Rug Pulls

• OrdiZK (Ethereum): $1.400.000
• HumanizedAi (HMZ) (Ethereum): $665.000
• Fake ETHFI (Ethereum): $354.000
• Lucky Star Currency (BSC): $300.000
• FLOKIAI (FLOKIAI) (BSC): $148.000
• ClosedAI (ClosedAI) (BSC): $131.000

Most Prominent Smart Contract Attacks

• Curio Ecosystem (Ethereum): Smart contract vulnerability > $16.000.000
• Prisma Finance (Ethereum): Smart contract vulnerability > $11.600.000
• WOOFi (Arbitrum) Flash Loan Attack > $8.750.000
• Super Sushi Samurai (Blast): Smart contract vulnerability > $4.060.000
• Unizen (Ethereum): Smart contract vulnerability > $2.100.000
• Dolomite (Ethereum): Smart contract vulnerability > $1.800.000

The Bottom Line: $124M stolen

March stolen funds were $124M, 60% less than previous month (February 2024). Over the past twelve months (April 2023 – March 2024), the total amount of stolen funds amounts to USD 2.5 billion, indicating a declining trend compared to the USD 3.5 billion stolen during 2022.

$2.9 billion lost since February 2023

Over the past fourteen months (February 2023 – March 2024), the stolen funds amount to USD 2.9 billion.

82% detected by Blockfence

Our engine detected $16.5M out of $20.3M total relevant compromised funds. This does not include compromised private keys and centralized exchanges, which can not be detected in advance.

Download the Full Report (PDF)

Download a full copy of our report in PDF here

Monthly Security Report by Eyal Mor & Pablo Sabbatella.