Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<p>As we delve into the first quarter of 2024, the landscape of crypto security reveals both persistent challenges and emerging trends in the midst of a bull run. From substantial financial losses to innovative recovery efforts, the crypto space continues to evolve amidst an environment of heightened threat activity. Our report aims to uncover the key findings of the quarter, providing valuable insights and recommendations to fortify the security of Web3 businesses.</p>



<h2 class="wp-block-heading">Q1 2024 Security Highlights</h2>



<ul>
<li><strong>$824,405,224 Stolen</strong>: In Q1 2024, the crypto space witnessed 67 hacks totaling a staggering $824,405,224 stolen. This surge in malicious activity underscores the pressing need for enhanced security measures.</li>



<li><strong>$682,086,639</strong>: Access control breaches emerged as the most prevalent vulnerability, with $682,086,639 lost to such exploits. These incidents highlight the critical importance of robust access control mechanisms.</li>



<li><strong>$443,773,698 Recovered</strong>: Despite the onslaught of attacks, the sector demonstrated resilience, with $443,773,698 recovered or frozen post-incident. This represents a significant improvement in the industry's ability to respond to and mitigate the impact of hacks.</li>



<li><strong>56%</strong>: Share of <a href="https://hacken.io/discover/rug-pull-explained/">rug pulls</a> and <a href="https://hacken.io/discover/smart-contract-vulnerabilities/">smart contract vulnerabilities</a> in all incidents, signaling the persistent threat posed by such tactics.</li>
</ul>



<div id="lead-magnet-container"></div>



<h2 class="wp-block-heading">Key Observations</h2>



<h3 class="wp-block-heading">Evolution of Attack Vectors</h3>



<p><img src="https://lh7-us.googleusercontent.com/KdlPzQsyv6eIScIbMR1dumUdLEGIMR0QFb_vZTFHC4lLpn-zdt62Ncto9YniccYWC84nCl_JBg_eE4sj49oAupcN0REwfaArPlJo2UNGXjnIKEJEu7KhbyMreFHhY6N0zk3pVOAHdqPqRWFc2G63U8o" width="1452" height="436">While access control breaches remained prevalent, <a href="https://hacken.io/discover/flash-loan-attacks/">flash loans</a> and smart contract vulnerabilities also emerged as significant attack vectors. Hackers are continually adapting their tactics to exploit vulnerabilities across multiple fronts.</p>



<h3 class="wp-block-heading">Bull Market Drives Bad Actors<img src="https://lh7-us.googleusercontent.com/gfBW4aZnF5LDS-zqduxHmGPdlJ2enx4QqvqXB37r7aC6kees8cnazlWIcFAK0LDwAvkSx1SUfZ11PLfyO5KEJBTBkGea2jT9UrMxZeOnt81Y6d8tVmiu7olNW6R5l7juiNkHlCec31eLsbfF0KFJOtU" width="1430" height="380"></h3>



<p>In 2024, increased hacking activity and losses compared to 2023 can be attributed to the bullish market sentiment driving heightened activity and the emergence of vulnerable protocols in ‘’under-discovered” vectors like gaming, tokenization, and new dApps.&nbsp;</p>



<h3 class="wp-block-heading">Diverse Vulnerabilities Across Project Types</h3>



<p><img src="https://lh7-us.googleusercontent.com/FPSVojvX8hrXBkXUFsRl7sr8AWpuA2kKecRcltYetEfFYig88vja7tRtUH7x-sCQevaAlScW7tHRdx1AqSUrQT14Rc32nCF361PCi6fohZTtGRyr3xngEkezUbnJhATkgvIb3BRGZoScCGmDb9ZKXao" width="1424" height="722">Security incidents spanned a wide range of project types, from tokens to gaming platforms and decentralized exchanges. This diversity underscores the pervasive nature of security threats across the entire Web3 ecosystem.</p>



<h3 class="wp-block-heading">Recovery Efforts</h3>



<figure class="wp-block-image"><img src="https://wp.hacken.io/wp-content/uploads/2024/04/image-1.png" alt="" class="wp-image-22183"/></figure>



<p>In Q1, over $443 million was successfully recovered or frozen from crypto hacks, amounting to 54% of the stolen funds. This represents a significant improvement in the industry's responsiveness. Despite one standout incident involving PlayDapp, Web3 projects collectively managed to recover 23% of stolen funds, showcasing proactive measures from both teams and white hat hackers.</p>



<h3 class="wp-block-heading">Most Of Hacked Projects Didn’t Have Audit</h3>



<figure class="wp-block-image"><img src="https://wp.hacken.io/wp-content/uploads/2024/04/image.png" alt="" class="wp-image-22184"/></figure>



<p>During Q1, only 44% of Web3 projects underwent smart contract audits, leaving vulnerabilities unresolved in 56% of cases. Exploits often occurred post-audit due to new code deployments or upgrades, highlighting the need for continuous security monitoring and updated audit scopes. Audits are crucial, but they don't guarantee immunity; ongoing monitoring and security-first approaches are essential for risk mitigation.</p>



<p>Access these and other insights in the <a href="https://hacken.io/insights/q1-2024-security-report/#lead-magnet-container">full report.</a></p>



<h2 class="wp-block-heading">Exclusive Case Studies</h2>



<p>Our report showcases in-depth case studies of two significant incidents: Shido and ALI. Here’s a brief summary of the attacks.</p>



<h3 class="wp-block-heading">Shido Protocol Exploit</h3>



<p>The Shido Protocol suffered a major exploit due to an access control vulnerability, resulting in the loss of over $35 million. This incident underscores the critical importance of robust access controls and security restrictions.</p>



<h3 class="wp-block-heading">ALI Token Phishing Attack</h3>



<p>The ALI token incident exemplifies the swift response and collaboration within the Web3 community, highlighting the efficacy of proactive measures in mitigating the impact of security breaches.</p>



<p>For a detailed analysis, access the <a href="https://hacken.io/insights/q1-2024-security-report/#lead-magnet-container">full report</a>.&nbsp;</p>



<h2 class="wp-block-heading">Recommendations</h2>



<ul>
<li><strong>Comprehensive Auditing and Monitoring</strong>: Regular audits, combined with ongoing monitoring and assessment, are essential for identifying and mitigating security risks proactively.</li>



<li><strong>Proactive Security Culture</strong>: Fostering a security-conscious mindset among Web3 builders through education and awareness initiatives is paramount in mitigating risks beyond audits.</li>



<li><strong>Stringent Access Controls</strong>: Implementing robust access control mechanisms, such as multisig wallets, can significantly reduce the risk of unauthorized access and exploitation.</li>



<li><strong>Collaborative Security Efforts</strong>: Encouraging collaboration and information sharing within the Web3 community can enhance collective resilience against emerging security threats.</li>
</ul>



<h2 class="wp-block-heading">Conclusion</h2>



<p>As we navigate the evolving <a href="https://hacken.io/discover/web3-security-stack/">landscape of crypto security</a>, proactive measures and collaborative efforts are critical for safeguarding the integrity of the Web3 ecosystem. By prioritizing security, fostering a culture of vigilance, and embracing comprehensive security practices, businesses can mitigate risks and build a more resilient future in the crypto space.</p>



<p>[<a href="https://hacken.io/insights/q1-2024-security-report/#lead-magnet-container">Download Full Report</a>]</p>

Q1 2024 Web Security Report

<p>BREAKING: Hacken equity tokenization starts now! Claim your share <a href="https://hacken.io/rwa/">here</a>.</p>



<blockquote class="twitter-tweet"><p lang="en" dir="ltr">🔥 It&#39;s Official: <a href="https://twitter.com/search?q=%24HES&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$HES</a> Now Live!<br><br>Step into a new investment dimension with Hacken Equity Shares (HES)<br><br>Available on <a href="https://twitter.com/hashtag/Ethereum?src=hash&amp;ref_src=twsrc%5Etfw">#Ethereum</a>, <a href="https://twitter.com/hashtag/BSC?src=hash&amp;ref_src=twsrc%5Etfw">#BSC</a>, and <a href="https://twitter.com/hashtag/VeChain?src=hash&amp;ref_src=twsrc%5Etfw">#VeChain</a>, <a href="https://twitter.com/search?q=%24HES&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$HES</a> is your ticket to pioneering RWA tokenization<br><br>Each <a href="https://twitter.com/search?q=%24HES&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$HES</a> equals 0.1% of Hacken Entity, marking your direct stake in our growth <a href="https://t.co/DRSRWzuANj">pic.twitter.com/DRSRWzuANj</a></p>&mdash; Hacken🇺🇦 (@hackenclub) <a href="https://twitter.com/hackenclub/status/1767898899270754588?ref_src=twsrc%5Etfw">March 13, 2024</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>



<p>The wait is over. Hacken’s innovative equity tokenization has officially started. Existing and new $HAI holders can exchange their assets for Hacken Equity Share ($HES) in a one-time opportunity to become Hacken stakeholders.</p>



<p>With this move, Hacken becomes the first crypto company to enable its community to own part of the real business through a native token.</p>



<ul>
<li>10% company stake</li>



<li>100 equity shares</li>



<li>1M HAI for each share</li>
</ul>



<p>This is the most significant community offering in our history ever, and slots are limited. Invest now at <a href="https://hacken.io/rwa/">https://hacken.io/rwa/</a> </p>



<h2 class="wp-block-heading">How To Pass KYC (Guide Included)</h2>



<p>You need to complete the Know Your Customer (KYC) process to ensure compliance with regulatory requirements and verify your identity as an investor. To that end, you’ll be required to submit a Face Scan, ID, and Proof of Residence.</p>



<p>We've made things easy for you - our comprehensive KYC Guide will walk you through every step of the KYC verification process at Brickken.&nbsp;</p>



<p><a href="https://wp.hacken.io/wp-content/uploads/2024/03/KYC-Guide.pdf#zoom=25">Download KYC Guide</a></p>



<p>Why KYC? Completing the KYC process aligns with regulatory requirements and secures your participation in Hacken's tokenized equity – showcasing our commitment to transparency and security. If you encounter any issues, our support team is ready to assist you at every step.</p>



<h2 class="wp-block-heading">How To Buy HAI</h2>



<p>New to the Hacken ecosystem? No problem. You can buy $HAI from various exchanges, including <a href="http://gate.io">Gate.io</a>, <a href="https://www.kucoin.com/trade/HAI-USDT">KuCoin</a>, <a href="https://pancakeswap.finance/swap?outputCurrency=0xaa9e582e5751d703f85912903bacaddfed26484c&amp;chainId=56">PancakeSwap</a>, <a href="https://pancakeswap.finance/swap?outputCurrency=0xaa9e582e5751d703f85912903bacaddfed26484c&amp;chainId=56">LetsExchange</a>, or via fiat in Hacken’s wallet, <a href="https://apps.apple.com/us/app/hai-by-hacken/id1501384789">hAI</a>.</p>



<h2 class="wp-block-heading">RWA Era in Web3</h2>



<p>Discover the future of investment with fractional ownership, improved market access, enhanced liquidity, faster transaction settlements, programmable features, and transparency. Learn more about <a href="https://hacken.io/discover/rwa-tokenization/">real-world asset (RWA) tokenization on our blog</a>.</p>



<h2 class="wp-block-heading">Warning: Beware of scams</h2>



<p>Do not send $HAI to unknown addresses, and double-check the information on the official Hacken website.</p>

Hacken Equity Share Offering Is Finally Here!

<p>In celebration of International Women's Day, we're proud to present our 2024 Report on Gender Equality in Web3, which explores gender representation in the crypto space.</p>



<div id="lead-magnet-container"></div>



<p>At Hacken, we believe in diversity's power to shape a more inclusive industry culture. After all, crypto is about individual freedom, where everyone should have an equal footing to create and grow.</p>



<h2 class="wp-block-heading">Key Highlights</h2>



<p>1. Male founders and C-level executives outnumber their female counterparts by nearly <strong>9:1</strong>, revealing a significant imbalance</p>



<figure class="wp-block-image size-large"><img src="https://wp.hacken.io/wp-content/uploads/2024/03/Знімок-екрана-2024-03-08-о-12.37.07-1024x569.png" alt="" class="wp-image-21932"/></figure>



<p>2. <strong>Blockchain Protocols</strong> and <strong>DeFi</strong> host the highest number of women as founders and C-level executives, showcasing the potential of decentralization in promoting equal opportunity.</p>



<figure class="wp-block-image"><img src="https://wp.hacken.io/wp-content/uploads/2024/03/image.png" alt="" class="wp-image-21925"/></figure>



<p>3. Out of 1000 op-eds and articles across top media resources, women were mentioned <strong>127</strong> times as experts on the subject matter, compared to <strong>867</strong> mentions of men.</p>



<figure class="wp-block-image size-large"><img src="https://wp.hacken.io/wp-content/uploads/2024/03/Знімок-екрана-2024-03-08-о-12.38.08-1024x427.png" alt="" class="wp-image-21933"/></figure>



<p>4. Among the top 100 crypto influencers on Twitter, only <strong>5</strong> are women, indicating a need for greater gender diversity in public discourse.</p>



<p>5. There has been an <strong>increase in women-led communities</strong> fostering support networks within the crypto and fintech sectors: <a href="https://www.shefi.org">SheFi</a>, <a href="https://www.her-dao.xyz">H.E.R. Dao</a>, <a href="https://www.womenrise.art">Women Rise NFT</a>, <a href="https://www.cryptofemale.org/">CryptoFemale</a>, <a href="https://twitter.com/worldofwomennft">World of Women</a>, <a href="https://www.linkedin.com/showcase/rising-women-in-crypto-community/posts/?feedView=all&amp;viewAsMember=true">Rising Women in Crypto Community</a>, <a href="https://twitter.com/womenofweb3co">Women of Web3</a>, and many others.</p>



<h2 class="wp-block-heading">Decentralized But United</h2>



<p>Decentralized but united, let us recognize the importance of collective action in driving meaningful change. Together, we can build a crypto community that embraces diversity, empowers women, and fosters innovation for all.</p>



<p><strong>Download the Full Report</strong>: For a deeper dive into the details of these findings, we invite you to download Hacken's <a href="#lead-magnet-container">State of Gender Equality in Web3 Report 2024</a>.</p>

Hacken’s 2024 Report on Gender Equality in Web3

<p>With the alarming figure of <a href="https://hacken.io/insights/2023-security-report/">$1.9 billion</a> stolen from crypto projects in 2023, and a 14% increase in attack numbers over the previous year, the urgency for better security solutions has never been more critical. This surge underscores the essential need for comprehensive security measures throughout the entire lifecycle of smart contracts. While pre-deployment actions like smart contract audits have shown immense effectiveness (with 90% of incidents occurring in contracts without audits), the landscape of post-deployment security tells a different story, significantly lagging behind in both awareness and implementation.</p>



<p>Enter <a href="https://extractor.live/">Hacken Extractor, our post-deployment security solution</a>, now unveiling its latest major release with a spotlight on the integration of Forta's unparalleled Attack Detector capabilities to enhance its own Security Monitoring solution. This partnership marks a synergy moment between Web3 Threat Intelligence and Real-time security providers.</p>



<h2 class="wp-block-heading">New Features: Spotlight on Enhanced Detection Capabilities with Forta</h2>



<p>The integration of Extractor with <a href="https://forta.org/">Forta</a> brings top-notch, real-time detection of security threats without any additional setup needed by users. Forta's Attack Detector uses smart tech, like heuristics and advanced ML models, to spot dangers early—often before any money is lost. It keeps an eye on the whole process of an attack, from start to finish, including the early stages, where it can alert users about suspicious activity.</p>



<p>This system works non-stop, all year round, thanks to its deployment on the decentralized Forta Network. It makes sure teams get alerts fast and can act quickly, thanks to its high precision in spotting real threats. For example, it could have saved Euler Finance from a $197 million loss by catching the attack signs just minutes before they happened.</p>



<p>In 2023, Forta's Attack Detector detected 75% of major on-chain hacks, with 42% detected before exploitation – showcasing the power of predictive monitoring.</p>



<p>In simple terms, Forta's Attack Detector makes the Extractor platform even stronger, giving users peace of mind that their smart contracts are being watched over carefully against web3 hacks and vulnerabilities exploits.</p>



<h3 class="wp-block-heading">How Does It Strengthen Extractor?</h3>



<ul>
<li><strong>Most Comprehensive Threat Detection capabilities available on the market</strong>. From now on, Extractor’s own Security Monitoring works in parallel with Forta Attack Detector providing multi-layer real-time on-chain monitoring of your Smart Сontracts.&nbsp;</li>



<li><strong>No additional setup or configuration is needed.</strong> Just add your Smart Contracts addresses to the Extractor platform and get relevant Alerts.&nbsp;&nbsp;</li>
</ul>



<p>As a result of recent release, Extractor now provides:&nbsp;</p>



<ul>
<li><strong>Immediate Enhanced Attack Detection</strong>: Real-time alerts for potential attacks, by its own threat detection system and Forta’s Attack Detector, giving users a crucial lead time for response and best-in-class detection ratio. It is very important to be confident that the attack is indeed valid before taking any actions, and Extractor gives you that confidence.&nbsp;</li>



<li><strong>Smart Contracts Advanced Monitoring</strong>: Customizable triggers ensure comprehensive surveillance of your smart contracts.</li>



<li><strong>Team </strong><strong>Collaboration</strong><strong>: </strong>New authentication methods and team accounts make it easy to organize team members' collaborative work with different roles.</li>
</ul>



<p>&nbsp;Coming very soon:</p>



<ul>
<li><strong>Updated Protection Mechanisms</strong>: Proactive security mechanisms to safeguard assets on your smart contracts.</li>
</ul>



<p>The best thing is that you can try it all with no commitment – <a href="https://extractor.live/">a free 30-day trial is available</a>.&nbsp;</p>



<h2 class="wp-block-heading">Extractor’s Roadmap</h2>



<p>Over the past year, Extractor has grown its user base by 50% and achieved a 79% coverage across Web3 hack types. Looking ahead, our team is committed to continuous innovation and expansion across these key areas:</p>



<ol>
<li><strong>Enhanced Prevention Mechanisms</strong>: Leveraging Forta's insights to build more robust defense strategies.</li>



<li><strong>Broader Blockchain Coverage</strong>: Expanding support to include more blockchains, further widening our protective net.</li>



<li><strong>Client-Driven Security Solutions</strong>: Engaging with our users to co-create solutions that meet the evolving needs of the Web3 space.</li>
</ol>



<h2 class="wp-block-heading">Try Extractor Yourself</h2>



<p>At Hacken, we want to create the most secure, user-friendly, and advanced platform for real-time Web3 security. Extractor today offers best-in-class detection, and next-level protection is coming soon. It’s a one-stop solution for small and mid-sized businesses that doesn’t require any integrations and additional resources.&nbsp;<br><a href="https://extractor.live/">Experience the power and convenience of Extractor firsthand with our free 30-day trial</a>.</p>

Major Product Release: Extractor Integrates Forta Attack Detector

<p>2023 was a year of significant challenges and developments in the world of crypto security. From sophisticated attack techniques to substantial financial losses, the landscape of digital asset security has faced critical tests – and our report delves into the patterns and trends that shaped the turbulent year. Importantly, the 2023 Hacken Security Report gathers key expert insights, equipping Web3 businesses with evidence-based practices and strategic measures for navigating the evolving landscape of cyber threats.</p>



<h2 class="wp-block-heading">Some Key Takeaways</h2>



<ul>
<li>Total losses in 2023 reached a staggering $1.9B</li>



<li>Access control issues accounted for 50% of these losses</li>



<li>$275M drained from protocols in flash loan attacks</li>



<li>20% of the stolen funds were recovered</li>
</ul>



<div id="lead-magnet-container"></div>



<h2 class="wp-block-heading">Detailed Takeaways from the Report:</h2>



<h3 class="wp-block-heading">Total Value Lost</h3>



<p>$1.9 billion was the total yearly losses reached. Compared with the $52.3B loss of 2022, seems like a good dynamic. But a closer look paints a dimmer picture, with the number of attacks growing in numbers and complexity.</p>



<figure class="wp-block-image size-large"><img src="https://wp.hacken.io/wp-content/uploads/2024/02/img_rep2023_svg.svg" alt="" class="wp-image-21680"/></figure>



<p>The most affected sector was Lending and Borrowing, primarily smart contract-based money markets, followed by bridges and exchanges.</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/Af9z5RY-clp2b5iOdZSRpOss9-hV7RlCxkHGQR0eJf_k-0jXGQI82Kzhb0Blqmt5UURU6UogMeM43j2yv3beD3NWGC9__QGVexw-l5kmfHi9QFAktsIZjRtrtbc25YyLqzy9nG_qV0ARDcW5VgwXU3A" alt=""/></figure>



<h3 class="wp-block-heading">More (Sophisticated) Attacks</h3>



<p>2023 recorded a 14% increase in the number of attacks over 2023.<img width="1272" height="322" src="https://lh7-us.googleusercontent.com/HoGa5xWOd-K0RXvJS8eIv_5MctUDcFYZaGpZEnAYKjTOLvJWIelE5XefT01laRoZuT8C3CHlVJItyTyYpSWB8C-grC5tVejrEg3xBatQis8kd_Tea3cZnqshVYQyIpkfpABQ5XjTW-DxFeLO76JwyXI"></p>



<p>Access control issues were at the heart of 50% of all losses.</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/Pwoh8YPTuIVRsirChPzD8-jQyWHA4PJ9Mb2ZPBO4pIeEpvfOWMXfO0nng6KYtV8QSgxQPv_7kHpxjAA3lnSLo93wjHU3lUu3-OMgE-Dl8nJSxqELN8gIqOxum7zzoxf0clN6x2szu7a227cLvn3uS74" alt=""/></figure>



<h3 class="wp-block-heading">Hotspots For Hackers</h3>



<p>Singapore and the USA emerged as significant hotspots for cyber exploits, possibly due to the highest fintech activity there – a detailed analysis is included in the full report.</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/b9nuJcxBzrcs8ljzPpEB_010QseqsA6o6jt5LD5_7hwqgnvvcJxWQZJOxJ8l5FbuK_bE2CqO6xV-pzopmf3WzXxmEhjIz6G-6-Zk8s2IgoJveX0QkRkkSFzKIXLN_Lc_CjyzOeFUDOuw3AR4E8qWJl0" alt=""/></figure>



<h3 class="wp-block-heading">Rug Pulls</h3>



<p>The number of <a href="https://hacken.io/discover/rug-pull-explained/">rug pulls</a> was higher than all other registered exploits combined. It is expected to observe a surge of rug pulls on networks like Solana. An indicator of this trend is the creation of approximately 100,000 new tokens on Solana in just December. Investment in public security measures was a strong predictor of an exit scam risk, as notably, only 6% of all rug-pulled projects had any form of audit.&nbsp;</p>



<h3 class="wp-block-heading">Asset Recovery</h3>



<p>Protocols recovered 20% of stolen assets, or $400M, first in the industry.<img src="https://lh7-us.googleusercontent.com/ih7vzR6-BfurS5PHSaRhUkuqBww8lA_haBxLz-v-GUYGY99s__e7hRKnPrKLSFVrIbsRTXsq6-ShxpvnIYIqwPbdqR4Rg3PfUNtBBugjYPNaSP7rTYXYhYDpYx1FD7RZkLgbuPPAv-u8Vm9CeN3901k" width="626" height="300"></p>



<h3 class="wp-block-heading">Audits</h3>



<p>Only 10% of exploited contracts underwent any form of audit, and merely half of these were relevant, matching the deployed blockchain code.</p>



<figure class="wp-block-image"><img src="https://lh7-us.googleusercontent.com/jx3_hCpvHVWY7fKMPli610KwmVasDDKqcRFavnWASR6t71pYYt7pcKtVBZ2JmALnWnfgI83NcOwrO8jfIsKyYlg-UMwjeW97JgR77GfbmvqyJNuvEEbhxE4IfI4_w_bnTg6n-bfrduYT_qJwYkJU7fo" alt=""/></figure>



<h3 class="wp-block-heading">Bug Bounties</h3>



<p>Only 15% of hacked companies had any bug bounty program. Among these, just 7% had an ongoing bug bounty program covering the exploited smart contracts when the hack occurred.</p>



<h3 class="wp-block-heading"><img src="https://lh7-us.googleusercontent.com/OUgoKRDvqXys84KRVI4yvuI76vkt0A4X4CAoqc4cpUpqmCBInNOlHdYp_nvcYyov8UUfYbXeNHrUntGGd12cThANDtpJd2Pftz51k-hMMdZn0bdAnkjwYslnocY3Jk3juks3R_z4IPSC_kOXDhZOB_g" width="1166" height="598"></h3>



<h2 class="wp-block-heading">What to Expect in 2024 and Beyond?</h2>



<ul>
<li>Access control breaches and flash loan attacks will remain key concerns.</li>



<li>Rug pulls to continue as standard risk, with a surge on fast-rising networks like Solana.</li>



<li>Growth in token factories leading to rampant pump-and-dump schemes.</li>



<li>A potential rise in <a href="https://hacken.io/discover/smart-contract-vulnerabilities/">vulnerabilities</a> due to neglecting audits on new networks as risk-seeking liquidity and experimentation attention shifts from Ethereum to Layer 2 solutions.</li>
</ul>



<h3 class="wp-block-heading">Security Recommendations</h3>



<p>&nbsp;To improve security in 2024, businesses should invest in:</p>



<ul>
<li>Comprehensive <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">auditing</a> and ongoing <a href="https://extractor.hacken.io/">monitoring</a></li>



<li>Proactive security culture via <a href="https://hackenproof.com/">bug bounty</a> programs</li>



<li>Stringent access controls like multisig wallets</li>



<li>Security-rich features for wallets and extensions&nbsp;</li>



<li>Better scam <a href="https://dyor.hacken.ai/">education</a> for communities</li>
</ul>



<p>As the industry grows, proactive and resilient security measures will be essential to prevent incidents in the upcoming bull run.</p>



<h2 class="wp-block-heading">Download the Full Report</h2>



<p>For a deeper dive into the intricate details of these findings and to equip yourself with knowledge for a more secure future in the crypto space, we invite you to <a href="#lead-magnet-container">download our comprehensive 2023 Hacken Security Report</a>.</p>



<div id="lead-magnet-container"></div>

2023 In Review: Hacken Security Report 

<p>One of the biggest crypto exchanges in the world <a href="https://www.gate.io/">Gate.io</a> has recently upgraded its Proof of Reserves (PoR) to include zero-knowledge technology, marking an important step toward enhanced financial transparency. Hacken has conducted an independent third-party assessment to evaluate Gate.io’s Proof of Reserves newest implementation, scrutinizing it for vulnerabilities to known attacks or malicious code.</p>



<p>The move is particularly significant in the post-FTX landscape, where most exchanges don’t provide 100% capital reserve. With this initiative, Gate.io raises the bar for the transparency of digital assets among centrali<em>z</em>ed exchanges.</p>



<p class="has-black-color has-text-color has-background" style="background-color:#f6f6f6">“<strong>We’re grateful for Hacken’s thorough and diligent security review, leaving no stone unturned. Ensuring the integrity of our PoR is a commitment not only to user asset safety but also to the entire blockchain industry. Hacken plays an important role in fortifying this commitment and ensuring we continually set the bar high</strong>.”<br>- Dr. Lin Han, Founder and CEO of Gate.io, as reported on <a href="https://cryptonews.com/news/gate-ios-proof-of-reserves-implementation-passes-hackens-security-audit.htm">Cryptonews.com</a> </p>



<h2 class="wp-block-heading has-text-color" style="color:#222223">Technology &amp; Implementation</h2>



<p class="has-text-color" style="color:#222223">Gate.io’s original implementation of PoR, forked from Binance’s "zkmerkle-proof-of-solvency," underwent significant modifications in structure, dependency management, and cryptographic frameworks since 2020.</p>



<p>The most critical enhancement was the addition of <a href="https://hacken.io/discover/zk-snark-vs-zk-stark/">zk-SNARK</a> verification, which eliminated the weakness in the previous implementation that could have allowed the inclusion of fabricated accounts with negative balances, potentially altering data accuracy.</p>



<p>The project uses the following cryptographic frameworks and structures:&nbsp;</p>



<ul>
<li>A fork of GNARK – to construct cryptographic circuits.</li>



<li>Poseidon hash function with the BN254 curve – for hashing user data and the Sparse Merkle Tree (SMT) structure.</li>



<li>BSMT library – for implementing the SMT with a maximum depth of 28, enabling the Proof Of Solvency system to accommodate over 250 million users.</li>
</ul>



<p>See Gate.io’s Proof of Reserves implementation on <a href="https://github.com/gateio/proof-of-reserves">GitHub</a> or read more about it <a href="https://www.gate.io/proof-of-reserves/">here</a>.</p>



<h2 class="wp-block-heading">Findings &amp; Recommendations</h2>



<figure class="wp-block-image"><img src="https://wp.hacken.io/wp-content/uploads/2024/01/image.png" alt="" class="wp-image-21639"/><figcaption class="wp-element-caption"><em>Hacken’s assessment on Gate.io’s website</em></figcaption></figure>



<h3 class="wp-block-heading">Assessment Team</h3>



<p>The <a href="https://hacken.io/services/proof-of-reserves-audit/">Proof of Reserves Implementation Security Assessment</a> was led by Luciano Ciattaglia, Hacken's Director of Services and a renowned expert in cryptology, alongside lead auditors Sofiane Akermoun, Nino Lipartiia, and Bartosz Barwikowski.</p>



<h3 class="wp-block-heading">Method</h3>



<p>The team conducted a thorough analysis of Gate.io's documentation, repository codebase, code structure, and architectural quality, along with examining new release tags and functionalities. We performed extensive checks against known vulnerabilities, including verification through checksum validation for all 1157 dependencies. The primary objective of this assessment was to evaluate the code for vulnerabilities to known attacks or malicious code and to verify the absence of issues in build processes, deployment, and architectural design.</p>



<h3 class="wp-block-heading">Findings</h3>



<p>The Hacken team’s assessment revealed no critical-, high-, medium-, or low-severity vulnerabilities. We found several informative issues:</p>



<ul>
<li>Merkle root hash integrity: It was recommended that the Merkle root should be signed by a trusted third-party auditor or published on the blockchain for verifiability​​.</li>



<li>Outdated GNARK version: Updating to the latest GNARK version was strongly recommended to mitigate security risks and efficiency drawbacks​​.</li>
</ul>



<h3 class="wp-block-heading">Assessment</h3>



<p>Overall, the project is a testament to a strong foundation in cryptographic implementation and exceptional code organization. Its current state reflects a well-considered balance between functionality and complexity, offering a comprehensive setup for users with its detailed documentation and provided sample data. The project's existing framework and features already contribute significantly to the field, demonstrating a clear understanding and application of key principles in blockchain technology and cryptographic systems.</p>



<p>The full report is public and can be accessed at <a href="https://hacken.io/audits/gate.io">https://hacken.io/audits/gate.io</a>.&nbsp;</p>



<h2 class="wp-block-heading">Conclusions</h2>



<p>Gate.io’s PoR implementation sets a new benchmark in the blockchain and cryptocurrency industry. It exemplifies a commitment to transparency and trust for all of its 14M+ users. The 100% Proof of Reserves commitment, as well as a subsequent third-party security assessment of the implementation, offers a blueprint for other digital asset exchanges to enhance their security and integrity.</p>

Gate.io's Proof of Reserves Security Assessment: Elevating Crypto Standards and Trust

<p>In smart contract development, one of the key challenges is the lack of essential tools for secure coding on many platforms, particularly for WebAssembly (Wasm). Unlike Ethereum, which has tools like Istanbul.js, LLVM-cov, or Solidity-Coverage, Wasm lacks similar resources, leading to potential security gaps. To address this, we're proud to introduce Wasmcov, a specialized code coverage tool tailored for Wasm environments.</p>



<h2 class="wp-block-heading">Introducing Wasmcov</h2>



<p><a href="https://github.com/hknio/wasmcov">Wasmcov</a> is a Rust library and an associated binary that provides automated coverage analysis of Wasm executables. This tool leverages advanced LLVM functionality, offering a solution to the limitations in current Wasm compilation.</p>



<p>Wasmcov's primary goal is to provide developers with accurate and efficient code coverage data, essential for identifying untested code segments and potential vulnerabilities.</p>



<p>Code coverage is a fundamental aspect of software quality assurance. Without it, developers may overlook critical areas of their code, leaving potential security risks undetected. Wasmcov addresses this by enabling precise coverage measurement on the target system itself, eliminating discrepancies between host and target environments. It allows developers to automate test coverage, ensure code quality, and guarantee compatibility with specific target configurations.&nbsp;</p>



<h3 class="wp-block-heading">Team behind Wasmcov</h3>



<p>Wasmcov was developed by Hacken’s security researchers <a href="https://github.com/njelich-hacken">Noah Jelich</a> and <a href="https://github.com/bbarwikowski-hacken">Bartosz Barwikowski</a> during their audits of leading Wasm-based protocols Radix and NEAR.</p>



<p>Here's a detailed analysis of Wasmcov's capabilities and potential impact, as provided by Noah:<br>“In the current industry landscape, Wasm code coverage is limited to typical compilation targets, rather than encompassing the specific execution environments. You could run tests on the real runtime, but it took manual cumbersome work to check their coverage and could potentially lead to missing vulnerabilities. But now, things are shifting. We're introducing more robust tooling for Wasm, aiming to streamline and secure the process.”</p>



<h2 class="wp-block-heading">Conclusion</h2>



<p>This release marks a significant enhancement in the security and reliability of smart contracts on Wasm-based protocols. With its integration by leading protocols like Radix, which has already implemented it for all its projects, and the upcoming adoption by NEAR, Wasmcov is set to bolster the security landscape across various platforms.</p>



<p>Wasmcov, as an open-source library, is readily integrable into any Wasm application by simply adding it as a dependency. We warmly invite all developers to adopt this tool and join us in our mission to make Web3 a safer place.</p>



<p>To begin using Wasmcov and contribute to a more secure Web3 environment, visit our GitHub page for detailed instructions: <a href="https://github.com/hknio/wasmcov">https://github.com/hknio/wasmcov</a>.</p>

Introducing Wasmcov: Code Coverage Tool for Wasm Projects

<p>We are delighted to announce an allied partnership with Hacken and <a href="https://scrt.network/">Secret Network</a>, the trailblazer in privacy-preserving smart contracts. This collaboration marks a significant step towards fostering privacy and security in the Web3 landscape by spreading mutual values and connecting Hacken's security expertise with Secret's ecosystem.&nbsp;</p>



<h2 class="wp-block-heading">Why Privacy Matters in Web3</h2>



<p>The conventional approach of public blockchains, where all transactions and interactions are visible to anyone, poses challenges for applications dealing with sensitive data. Secret Network recognizes the crucial need for privacy in decentralized web applications, envisioning a future where blockchain technology empowers creators, business owners, and individuals like never before.</p>



<p>“Secret Network prioritizes the privacy aspect of a security angle in the layer-1 triangle (security-scalability-decentralization). Transaction payload, contract state, and computation itself are encrypted and encapsulated in SGX hardware enclaves. This gives end users a very high level of privacy, which is a challenge in most public blockchains.” — Andriy Kashcheyev, VP of Engineering at Hacken.</p>



<p>Sean Rad, Developer Relations at Secret Network, shares his excitement about the partnership,: "Secret Network’s confidential smart contracts allow developers to design dApps with true privacy — the ability to choose what you share and who you share it with! We are excited to partner with Hacken because of their commitment to blockchain security, as we work together to be stewards of Web3 innovation."&nbsp;</p>



<p>In line with its commitment to Web3 security, Hacken extends exclusive benefits to Secret Network projects:</p>



<p class="has-pale-cyan-blue-background-color has-background"><em>Note: To take advantage of these exclusive discounts and benefits, simply indicate that you are participating through the Secret Network partnership program by adding a comment in the request form on our website. Alternatively, DM Vlady on Telegram @vlady_hacken to instantly get connected to our team.&nbsp;</em></p>



<p><strong>- Audit Discounts</strong>: A welcome discount is offered for urgent audits and a more substantial discount for non-urgent audits, ensuring accessibility to robust security practices, including dApp, Wallet, Cross-chain Bridge, Tokenomics audits, Penetration Testing and Tokenomics Design.</p>



<p><strong>- Priority Queue:</strong> Secret Network projects enjoy a priority queue to address their urgent needs promptly.</p>



<p>- <strong>Bug Bounty and Triage</strong>: Secret Network projects benefit from a dedicated bug bounty program and free triage services, enhancing the overall security posture.</p>



<p>As we embark on this collaborative journey, Hacken and Secret Network are united in our commitment to privacy, security, and innovation in the Web3 space. By leveraging Hacken's expertise, Secret Network projects can implement rigorous security practices, ensuring a future where the decentralized web truly empowers users while preserving their privacy.</p>



<h2 class="wp-block-heading">About Secret Network</h2>



<p>Secret Network, launched in 2020, stands out as the first mainnet blockchain with privacy-preserving smart contracts. It empowers developers to create decentralized and permissionless applications while ensuring privacy through encrypted inputs, outputs, and state by default. The underlying ledger is transparent and completely auditable, striking a balance between privacy and transparency.</p>



<h2 class="wp-block-heading">About Hacken</h2>



<p>Hacken is a leading blockchain security auditor dedicated to making Web3 a safer space since 2017. Our services offer an extensive range of Web3 security solutions. This includes <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">Smart Contract Audit</a>, <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">Blockchain Protocol Audit</a>, dApp Audit, Penetration Testing, CCSS Audit, as well as <a href="https://hacken.io/services/tokenomics-audit/">Tokenomics Audit and Design</a>. Together, these services constitute a holistic security framework, ensuring all-around protection for Web3 projects.</p>

Get our latest updates and expert insights on Web3 security