‘Billions’ lost through hacks of crypto lending platforms

New research by blockchain analytics firm Elliptic showed that fraud and theft at decentralized finance platforms have led to $10.5 billion in losses so far this year.

According to the report, published on Thursday, cash has been pouring into the so-called DeFi platforms, reflecting the explosive interest in cryptocurrencies. DeFi platforms allow users to lend, borrow and save (usually in crypto) while bypassing traditional gatekeepers of finance such as banks. The technology offers cheaper and more efficient access to financial services, supporters say.

Data by sector tracker DeFi Pulse shows that cryptocurrency worth $86 billion is currently stored on DeFi platforms, compared with some $12 billion a year ago.

Elliptic report hot off the press today, revealing #DeFi users and investors has suffered more than $12 billion in losses due to theft and fraud! ??

DeFi: Risk, Regulation, and the Rise of #DeCrime
Get your copy today ?https://t.co/QrLzPbR1qX#Crypto #AML #riskmanagement pic.twitter.com/9ilgCttiN7

— elliptic (@elliptic) November 18, 2021

However, the explosive DeFi growth came along with booming crime in the mostly unregulated sector, Elliptic said. Users have suffered over $12 billion in losses through crime at DeFi apps, lending platforms, and exchanges since 2020, with the majority of losses coming in 2021 alone.

Those losses were mainly attributed to bug and code flaws, as well as a hacking technique that involves exploiting loopholes in how the DeFi service operates.

“Decentralized apps are designed to be trustless in that they eliminate any third-party control of users’ funds,” said Tom Robinson, chief scientist at Elliptic. “But you must still trust that the creators of the protocol have not made a coding or design mistake that could lead to a loss of funds,” he added.

Major DeFi platforms say they take measures to bolster security that ranges from hiring external firms to audit code for vulnerabilities to maintaining keys and passwords needed to access user wallets in secure environments.