Table of Contents
TL;DR,
- PeckShield reveals 2023 crypto hacks totaled $2.61 billion in losses, but uniquely, victims successfully recovered $674.9 million—a 25% recovery rate achieved through active negotiations and bug bounties.
- While overall incidents declined, DeFi protocols remained the primary target, accounting for two-thirds of losses. Flash loan attacks and compromised private keys were the dominant methods used to drain funds from smart contracts.
- Security firms warn that despite improved recovery tactics and centralized exchange cooperation, rising token valuations in a bull market will likely motivate smarter, more frequent cyberattacks in the coming year.
PeckShield, a blockchain security and data analytics firm founded in 2018, released its comprehensive analysis of 2023 crypto hacks in late January 2024. Their findings? While blockchain claims to be inherently “safer,” the reality is far from it.
There are more than 600 “documented” major incidents that collectively resulted in $2.61 billion in losses (excluding the disputed Multichain protocol withdrawals). A 27.78% year-over-year decline from 2022’s record $3.6 billion; however, this year the theme focused on recovery.
PeckShield has confirmed over $674.9 million has been recovered in 2023, representing a 25% recovery rate and a fivefold increase over the roughly $133 million recovered in 2022.
So maybe Web3 security might not be where we want it to be, but it’s far better as safety analysts up their game, maturing beyond detection and post-mortems into active incident response, negotiation, and fund retrieval—capabilities that were almost non-existent two years ago.
What PeckShield’s 2023 Dataset Reveals
PeckShield’s methodology tallies “major hacks and scams” across both decentralized finance (DeFi) protocols and centralized platforms, valued at incident-time prices. The firm explicitly excludes the July 2023 Multichain cross-chain protocol incident ($126 million in unauthorized withdrawals).
They opted to treat it as a possible inside job or rug-pull rather than an external hack. This does place a clear distinction on how blockchain security firms are refining their classifications to separate criminal breaches from potential fraud or mismanagement.
Of the $2.61 billion lost in 2023:
- $1.51 billion came from hacks and $1.1 billion from scams, a roughly 58%-to-42% split.
- 67% of total losses occurred in DeFi environments, with the remaining 33% on centralized finance (CeFi) platforms.
- 40% of hacks involved flash-loan attacks, a reminder that with new tech comes new exploits such as DeFi’s unique exposure to liquidity manipulation or collateral in a single transaction block.
PeckShield also documented that $342 million in stolen crypto was laundered in 2023, down 25% from $460 million in 2022. Exchanges, stablecoin issuers like Tether, and law enforcement have learned a valuable lesson about how digital assets can effectively “clean” illicit funds.
The Recovery Breakthrough: How $674 Million Was Clawed Back
Recovering any digital asset funds has been historically on a flat zero, until now. The 2023 crypto hacks cycle broke that pattern. PeckShield’s team effectively gave us the blueprint:
- Active negotiations with attackers, often framed as retroactive bug bounties. The March 2023 Euler Finance exploit—a $196 million flash-loan attack exploiting a logic flaw in the protocol’s function (donateToReserves)—became the poster case. After public pressure, on-chain tracking, and a $1 million bounty offer, the attacker returned essentially all recoverable funds over 23 days, one of the largest-ever reversals.
- Bug bounty platforms and on-chain sleuthing. Platforms like Immunefi, which PeckShield and others coordinate with, have made it economically rational for some attackers to negotiate rather than launder, especially when their wallets are publicly flagged.
- Collaboration with centralized exchanges and stablecoin issuers. In an interview, PeckShield stated:
“Engaging in active negotiations with hackers can lead to the return of stolen funds. […] Implementing bug bounty programs or on-chain sleuthing to identify hackers and vulnerabilities in the system can enhance security.”
Partners like Tether can freeze USDT when they detect suspicious flows, and exchanges can blacklist addresses. This immediately reduces the liquidity and usability of stolen assets.
Centralized exchange security infrastructure (KYC rails, chain-analysis tools, and compliance teams) also played a substantial role in safeguarding the DeFi ecosystem. To some extent it provided a hybrid public-private incident-response capability.
Attack Vectors: Flash Loans, Private Keys, and the DeFi-CeFi Divide
PeckShield’s finding that 40% of 2023 crypto hacks used flash loans. This was backed up by other well-known sources like CertiK’s Hack3d 2023 report and Chainalysis data showing that smart-contract vulnerabilities in DeFi dropped sharply, even as the total number of incidents rose. Halborn’s lead security architect, Mar Gimenez-Aguilar, working with Chainalysis, noted:
“I do think that the increase of security measures in DeFi protocols is a key factor in the reduction in the quantity of hacks related to smart-contract vulnerabilities.“
She pointed out that losses from the top 50 DeFi hacks fell from 47% of all 2023 thefts to 18.2%, but she warned that compromised private keys now represent 47.8% of losses, up from 22% previously.
This trend was showcased in PeckShield’s data, with the ecosystem suffering the majority of incidents by count (Immunefi separately tracked 306 DeFi incidents versus only 13 CeFi breaches in 2023).
Additionally, centralized platforms experienced far larger per-incident losses due to hot-wallet key compromises. Poloniex ($100–125 million), Mixin Network ($200 million from a cloud database breach), CoinEx ($70 million), and Stake.com ($41 million, which the FBI says was done by North Korea’s Lazarus Group) are some of the best examples.
PeckShield’s approach differs from that of other firms in several key ways.
Several blockchain security firms put out reports in 2023 with different totals:
- Chainalysis said that hackers stole $1.7 billion from DeFi and CEX platforms (not counting most scams).
- CertiK recorded 751 on-chain security incidents that cost $1.84 billion.
- Immunefi counted $1.803 billion in Web3 hacks and scams.
PeckShield has a higher total because it looks at both hacks (58%) and scams (42%), while Chainalysis only looks at platform breaches. But all the companies agree on the general story: 2023 crypto hacks and exploits fell by about 27% to 54% from one year to the next, and DeFi losses fell the most. Chainalysis says that the DeFi drop is 63.7%, from $3.1 billion in 2022 to $1.1 billion in 2023.
PeckShield security audits cover everything from smart contracts and DeFi protocols to Layer-1 blockchains and real-time threat monitoring and incident alerts. PeckShield can see a lot of DeFi transaction volume because it works with clients like Polygon, BNB Chain, Bancor, 1inch, OKChain, and dYdX.
What This Situation Means for Web3 Users and Stakeholders
The Web3 vulnerability assessment was clear: DeFi remains with the largest losses at 67%, with audited protocols like Euler harboring latent bugs.
Centralized exchange security has improved over the years due to multisig wallets, hardware security modules, geographically distributed cold storage, and insider-threat controls. As per CertiK co-founder Ronghui Gu’s words, it’s a positive development, but phishing and key-management failures have reached “alarming levels.”
There is some good news with the 2023 crypto hacks; the endless war has provided the means for recovery. The growing number of CEXs, bug bounty programs, and law enforcement cooperation has made recovering an “anonymous” asset practical.
However, these gains may not hold if token prices surge in a bull market; TRM Labs’ Ari Redbord warned in mid-2024 that rising valuations will “motivate cybercriminals” and increase per-incident hauls, independent of any security improvements.
Ronghui Gu captured the long-term reality:
“As long as there’s a weak point or some vulnerabilities out there, sooner or later they will be discovered by these attackers… So it’s an endless war.”
A Milestone Report, Not a Victory Lap
PeckShield’s 2023 crypto hacks documents the first year in which the Web3 ecosystem recovered a substantial share—one quarter—of stolen funds, driven by negotiation, surveillance, and cross-platform cooperation. The 27.78% drop in losses and the $674 million clawed back are genuine milestones.
But the reality remains that with DeFi still accounting for two-thirds of losses, private-key attacks rising, and a potential bull market on the horizon, the 2023 crypto hacks report is best read as a progress checkpoint in an ongoing conflict, not a declaration of security maturity.
