Crypto Losses Plunge 98% to $28.8M in March After February's $1.5B Spike

In March, the total losses from crypto exploits, scams, and hacks saw a significant decline, dropping to $28.8 million. This decrease came after a substantial spike in February, where losses reached $1.5 billion following the Bybit hack. The reduction in losses can be attributed to the successful recovery of a portion of stolen funds by the decentralized exchange aggregator 1inch. Initially, over $33 million was reported stolen for the month, but the recovery efforts by 1inch brought the total down to $28.8 million.

The primary cause of losses in March was code vulnerabilities, which accounted for over $14 million. Wallet compromises were another significant factor, resulting in the theft of over $8 million. The most notable incident was the $13 million smart contract exploit of the decentralized lending protocol Abracadabra.money on March 25. The exploit allowed the attacker to borrow funds, liquidate themselves, and then borrow additional funds without repaying the initial amount. This was due to a flaw in the liquidation process that did not overwrite records in RouterOrder, which counted as collateral, enabling the exploiter to falsely borrow more funds after liquidation. The protocol's team offered a 20% bounty, double the standard 10%, in exchange for the return of the funds, but there have been no public updates on whether any funds have been returned.

The second highest monthly loss was attributed to the restaking protocol Zoth, where the deployer wallet was compromised, and the attacker withdrew over $8.4 million in crypto assets. Additionally, some of the stolen funds in March were returned, further reducing the total losses. The decentralized exchange aggregator 1inch successfully recovered most of the $5 million stolen in a March 5 exploit after negotiating a bug bounty agreement with the attacker.

Despite these recoveries, there were other significant incidents reported. An unknown Coinbase user was claimed to have lost 400 Bitcoin (BTC), worth $34 million, although this figure is not included in the total losses. Furthermore, over $46 million could have been lost in March to phishing scams that spoofed crypto exchanges. These scams involved messages that mimicked legitimate crypto exchanges, tricking users into setting up new wallets with pre-generated recovery phrases controlled by fraudsters. The Australian federal police also alerted 130 people of a message scam aimed at crypto users, highlighting the ongoing threat of such deceptive tactics.