The Nine Largest Crypto Hacks in 2022

Already nearly $2 billion, the value of cryptoassets lost to software exploits this year is likely to exceed 2021

article-image

Blockworks exclusive art by axel Rangel

share

key takeaways

  • Single lines of ill-conceived code gave hackers access to cryptoassets worth hundreds of millions of dollars
  • Most of the hacked companies are continuing operations after undergoing audits or upgrading their security

Hackers exploited a software bug in the Web3 music platform Audius to make off with $1.1 million on Saturday, but the funds are a drop in the nearly-$2 billion dollar bucket of funds lost to hacks through the first half of 2022, according to Blockchain security firm Beosin.

The fiat value of hacked assets are on pace to top the $3.2 billion lost in 2021, according to crypto security firm Chainalysis, even amid a drastic slide in cryptocurrency valuations. Blockworks compiled some of the year’s largest crypto hacks to see what went wrong and how protocols fared after being hacked.



  • Crypto.com, January 17, $35 million
    • In late January, a hacker managed to disable two-factor authentication on the crypto exchange Crypto.com and extract bitcoin and ether from customer accounts. CEO Kris Marszalek initially denied customer funds were lost before acknowledging the hack days later. The company said it is transitioning to “multi-factor authentication” in response to the exploit.
  • Qubit QBridge Hack, January 27, $80 million
  • Wormhole, February 2, $325 million
    • A hacker exploited smart contracts on the Solana-to-Ethereum bridge to mint and cash out on wrapped ether without depositing collateral. Jump Crypto, the venture capital firm behind Wormhole, replenished the stolen funds to keep Solana-based platforms affected by the hack solvent. Wormhole renamed its bridge Portal and currently holds over $480 million, according to crypto data firm DeFi Llama. 
  • IRA Financial Trust, February 8, $37 million
    • The crypto-focused retirement and pension platform was pilfered when hackers accessed a “master key” that bypassed all security measures to customer accounts. IRA Financial Trust has since sued Gemini, the crypto exchange where customer funds were stored, for alleged negligence leading to the hack.
  • Cashio, March 22, $52 million
    • A string of fake accounts used an “infinite mint glitch” to put up worthless collateral for Cashio’s CASH stablecoin. The coin’s peg cratered to zero and has not recovered, according to data from CoinGecko.
  • Axie Infinity Ronin Bridge, March 28, $625 million
  • Beanstalk, April 17, $182 million
    • A hacker used a “flash loan,” where funds are borrowed and repaid in the same transaction, to accumulate enough assets to control the stablecoin’s governance protocol. The hacker passed a proposal donating funds to Ukraine before making off with the collateral. Developers paused the protocol while undergoing audits and raising funds, but plan to reopen deposits in early August.
  • Fei Protocol, April 30, $80 million
    • A “reentrancy” bug in the lending protocol’s code allowed a hacker to take out a loan while also withdrawing the collateral put up on the loan. Fei users passed a proposal to make investors whole through “the DAO repaying the bad debt on behalf of the hacker.” The Fei stablecoin remains at its dollar peg, per CoinGecko.
  • Harmony Bridge, June 23, $100 million

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Permissionless is a conference for founders, application developers, and users. Come meet the next generation of people building and using crypto.

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

4.png

Research

This months PPGC covered four main areas. Firstly, debriefing the progress and status of the mainnet implementation of the Ahmedabad hard fork. Secondly, a retrospective on the testnet phase of the Ahemdabad Hard Fork. Thirdly, an update on PIP-36 which involves replaying failed state syncs. Lastly, PIP-47 which pushes upgrades to the Polygon Protocol Council.

article-image

Gurbir Grewal, who has been at the agency almost as long as Gensler has been chair, will depart on Oct. 11, 2024

article-image

The stablecoin’s supply has declined about 50% in the last month, from $660 million to $320 million

article-image

Plus, Sky’s soaring stablecoin and simpler bitcoin staking

article-image

Bitwise took the initial steps for an XRP ETF Wednesday

article-image

Plus, enrollment for the Donald Trump-backed crypto project is underway