<h2 id="header-0">Overview</h2>In November 2024, the total losses from Web3 security incidents amounted to approximately $86.24 million. According to the<a href="https://hacked.slowmist.io/" rel="noopener noreferrer nofollow"> SlowMist Hacked Database</a>, 21 hacking incidents were recorded, resulting in losses of approximately $76.86 million, of which $25.5 million was recovered. The primary causes of these incidents included smart contract vulnerabilities, account compromises, and price manipulation.Additionally, data from the Web3 anti-phishing platform Scam Sniffer revealed that 9,208 victims fell prey to phishing attacks in November, incurring a total loss of $9.38 million.<img src="https://miro.medium.com/v2/resize:fit:700/0*_tcS_eTcgboSzBCS" /><a href="https://dune.com/scam-sniffer/november-scam-sniffer-2024-phishing-report" rel="noopener noreferrer nofollow">https://dune.com/scam-sniffer/november-scam-sniffer-2024-phishing-report</a><h2 id="header-1">Key Incidents</h2><img src="https://miro.medium.com/v2/resize:fit:700/0*hld0qAuz_T35hq_j" /><h3 id="strong-metawin-strong">MetaWin</h3><ul><li>Date: November 4, 2024</li><li>Loss: Over $4 million</li><li>Details: Blockchain detective ZachXBT reported that the crypto gambling platform MetaWin was compromised on both Ethereum and Solana. The attackers exploited MetaWin’s frictionless withdrawal system, gaining unauthorized access to the platform’s hot wallets.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/0*2MRnFNuuj3t85ogC" /><h3 id="deltaprime">DeltaPrime</h3><ul><li>Date: November 11, 2024</li><li>Loss: $4.75 million</li><li>Details: The DeFi protocol DeltaPrime was exploited on Avalanche and Arbitrum due to insufficient input validation in its reward claiming mechanism.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/1*kTSBB30Lx7Oi9elAAfzo5g.png" /><a href="https://x.com/DeltaPrimeDefi/status/1855899502944903195" rel="noopener noreferrer nofollow">https://x.com/DeltaPrimeDefi/status/1855899502944903195</a>Thala<ul><li>Date: November 15, 2024</li><li>Loss: $25.5 million (partial recovery)</li><li>Details: The Aptos-based DeFi project Thala was attacked via a smart contract vulnerability, leading to significant losses. The project team froze $11.5 million in assets and, after negotiations, recovered the funds, allowing the attacker to retain $300,000 as a bounty.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/0*elhB2DThoZRMx8JL" /><a href="https://x.com/thalalabs/status/1857703541089120541?s&#61;46&amp;t&#61;bcMyidYO0QkS5ajIW9CBdg" rel="noopener noreferrer nofollow">https://x.com/thalalabs/status/1857703541089120541?s&#61;46&amp;t&#61;bcMyidYO0QkS5ajIW9CBdg</a><h3 id="strong-dexx-strong">DEXX</h3><ul><li>Date: November 16, 2024</li><li>Loss: $21 million</li><li>Details: Several users of the on-chain trading terminal DEXX suffered losses due to an ongoing attack. The SlowMist security team identified 8,612 attacker addresses on Solana, with EVM-based addresses to follow.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/1*lMQlKz2k3mSxbUilwN8MxA.png" /><a href="https://x.com/MistTrack_io/status/1862134946090881368" rel="noopener noreferrer nofollow">https://x.com/MistTrack_io/status/1862134946090881368</a><h3 id="strong-polter-finance-strong">Polter Finance</h3><ul><li>Date: November 17, 2024</li><li>Loss: $12 million</li><li>Details: The Fantom-based DeFi project Polter Finance fell victim to a flash loan attack that drained BOO token reserves and manipulated token pricing. Efforts to negotiate fund recovery via on-chain messaging and reports to Singaporean authorities remain unresolved.</li></ul><img src="https://miro.medium.com/v2/resize:fit:700/1*W-MvQ1adGmWaabsnyrzgsQ.png" /><a href="https://x.com/polterfinance/status/1857971122043551898" rel="noopener noreferrer nofollow">https://x.com/polterfinance/status/1857971122043551898</a><h2 id="header-2">Analysis and Recommendations</h2><img src="https://miro.medium.com/v2/resize:fit:700/0*GKPhEx5bM9Y_TWO_" /><h3 id="strong-incident-trends-strong">Incident Trends</h3><ul><li>The number and scale of incidents decreased compared to the previous month, indicating progress in industry security measures.</li><li>Smart contract vulnerabilities remained the leading cause, accounting for 39% of total losses ($30 million across 7 incidents). Regular security audits and proactive threat monitoring are essential for protecting assets.</li></ul><h3 id="strong-emerging-threats-ai-supply-chain-attacks-strong">Emerging Threats: AI Supply Chain Attacks</h3><ul><li>A new trend observed this month involved AI poisoning attacks, where compromised AI-generated code was leveraged in the crypto industry. Developers relying on AI tools should ensure rigorous code review, and all implementations must undergo comprehensive testing before deployment.</li><li>Strengthening supply chain security, including evaluating third-party tools and services, is critical to mitigating risks.</li></ul>For further details on blockchain security incidents, visit the<a href="https://hacked.slowmist.io/" rel="noopener noreferrer nofollow"> SlowMist Hacked Database</a>.<h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.We offers a variety of services that include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

SlowMist Monthly Security Report: November Estimated Losses at $86.24 Million

Table of Contents

SlowMist

Other articles published on Dec 17, 2024

Coinjay.com Unveils Next-Generation Cryptocurrency Exchange Platform

Don’t miss the holiday rally – discover 5 altcoins to watch for explosive x250 growth

Technical Analyst Predicts 2x Gains On Ethereum With Momentum Rising On FXGuys ($FXG)

io.net Powers Zerebro’s New Ethereum Validator Service with Decentralized GPU Compute

MINGO, Hedera Based Wallet, Sets Sights on the Global Ticketing Industry

Plus Wallet Gains Popularity with New Arbitrum and Base Features as Xverse and Backpack Enhance F...

Join our free newsletter for daily crypto updates!