Crypto hacks are just as old as the crypto ecosystem itself, but hackers are becoming increasingly active and effective as the years go by. Cybercriminals have cost crypto companies, DeFi protocols and their users over $1.36 billion across 92 hacks last year, according to data collected by DefiLlama. 

2024 has been a rather poor showing in this regard, although it is on course to be a better year than 2023, where hackers stole over $1.51 billion through 97 hacks. As we have entered 2025, I thought I would look into the five biggest crypto hacks from the year we have just waved bye to, what we know about them, and possibly what we can learn from them.

1. DMM Bitcoin Exchange - $305 Million 

DMM Bitcoin hack was one of the biggest hacks in crypto history. In May 2024, DMM Bitcoin, a prominent Japanese cryptocurrency exchange, experienced the largest hack, resulting in a loss of approximately 4,502.9 Bitcoins, valued at around $305 million at the time.

This cyber attack was attributed to North Korean hackers, possibly linked to the Lazarus Group, which is known for its sophisticated cybercrime operations. After the theft, the stolen Bitcoin was laundered using a CoinJoin mixing service, which obscures the origin of funds by mixing them with others. 

The hackers exploited vulnerabilities related to private key management, which is critical for securing access to users’ funds. Reports suggest that the breach may have stemmed from poor security practices, such as inadequate encryption or improper storage of private keys. 

In response, to the attack, the exchange suspended its various services and restricted account activities. However, the actions were not enough to save the exchange as the repercussions of the crypto hack were severe. DMM Bitcoin struggled to recover from the incident and ultimately decided to shut down operations in December 2024. 

The exchange announced plans to transfer its assets and customer accounts to SBI VC Trade, a subsidiary of SBI Group, with this transition expected to be completed by March 2025.

2. WazirX - $235 Million 

The WazirX hack was the second biggest hack the crypto community witnessed this year. On July 18, 2024, WazirX, an Indian cryptocurrency exchange, witnessed a $235 million crypto hack (around 35,000 ETH and significant amounts of other tokens were stolen) from a multi-signature wallet.

The hackers exploited the vulnerability in the WazirX’s multi-signature wallet, which was designed to require multiple approvals for transactions. This wallet uses a Gnosis Safe multisig configuration in which 4 out of 6 keys are required for any transaction.

To break this security hackers deployed a malicious smart contract eight days before the attack which allowed them to change the wallet’s configuration, and bypass security. After the hack, the exchange suspended its various services and restricted trading activities. WazirX faces backlash from creditors for holding their remaining funds. 

In November 2024, reports emerged that law enforcement had arrested an individual from West Bengal who allegedly sold his WazirX account details to the hackers. The investigation continues as authorities work to trace and recover stolen assets.

On December 2024 the exchange announced that the crypto withdrawals are expected to resume by mid-April 2025.

3. Munchables - $63 Million

Munchables, a crypto-focused Web3 game, was exploited in March this year, losing $63 million in assets. What’s the common factor here? You guessed it right: The North Koreans again.

The platform fell prey to another elaborate social engineering method, where Munchables hired four developers believed to be the same person—and suspected to be from North Korea—to create its smart contracts.

As a result, the hacker who created the smart contract used an upgradeable proxy contract, which the deployer’s address could modify. The developer owned this deployer address, not the Munchables contract.

The deployer then assigned themselves a balance of 1 million ETH within the smart contract and got away with $62.8 million worth of ETH, once the smart contract received enough ETH deposits.

4. BtcTurk - $54 Million

Turkish crypto exchange BtcTurk became another centralised exchange to be exploited in 2024. In a June hack, the exchange lost $55 million due to compromised private keys.

After getting access to enough private keys to bypass the multi-sig wallets, they exploited 10 hot wallets.

The attackers later dumped the stolen crypto asset from the exchange on the market. Thankfully, all the stolen assets belonged to the exchange, so its customers suffered no loss.

BtcTurk also received aid from Binance in investigating the incident, and Binance froze over $5.3 million on its exchange.

5. Radiant Capital - $53 Million

Radiant Capital, a prominent DeFi project, witnessed a $58 million hack in October 2024. The attackers got access to three of the platform’s private keys which allowed them to steal assets over various networks such as Arbitrum, Binance Smart Chain, Base, and Ethereum.

The attackers employed sophisticated malware to compromise the devices of three trusted developers. This malware allowed them to manipulate transaction data displayed in the Gnosis Safe wallet interface same as the wazirX hack.

Subsequent investigations linked this attack to North Korean hackers, specifically a group known as Citrine Sleet (UNC4736). Radiant Capital has since collaborated with cybersecurity experts and law enforcement agencies to recover stolen funds and enhance their security protocols. 

Changing Trends

The most notable shift is the focus on centralised exchanges over decentralised exchange platforms.

Until last year, DeFi protocols were the primary target of hackers over centralised exchanges, but that changed in 2024, with centralised exchanges accounting for the majority of the exploits. Although DeFi still accounted for the largest share of stolen assets in the first quarter of 2024, centralised services were the most targeted in Q2 and Q3.

The increased target on centralised exchange highlights the growing sophistication of hacking methods, as more rigorous methods are required to compromise cold wallet keys than exploit the vulnerability of a protocol.

Staying Safe

As there is an increase of centralised exchanges being exploited there are a simple things to boost your safety -

• Hold your funds in a self-custody wallets, such as a hardware wallet or web wallet — being sure to securely back up your private keys / recovery phrases. Remember the infamous line not your keys, not your crypto. 

• If you insist on storing your crypto on a centralised exchange, try to pick one that has a proof of reserves. Following the fallout of the FTX meltdown in 2022, many exchanges began maintaining proof of reserves to demonstrate that they hold 100% of user deposits in reserve. This means that if there is a hack they are able to restore stolen crypto (in theory). 

• In addition to strong passwords, where available, use two-factor authentication (2FA). 

• Hackers posing as support — Never give out your passwords, 2FA codes, PIN numbers or for remote access to your computer. 

• Scammers create fake sites that look like real exchanges but are designed to steal account information. Double check the web address before you login into your account or input any of your credentials.

• And last but no means least, use common sense. If something sounds too good to be true it probably is. 

What do you think about the hacks from last year? What do you thin will be the trend for 2025?

If you like this sort of content, please give it an upvote / tip so I know that you want to see more stuff like this. Also, if you want to chat add me on X. I'm always happy to connect with fellow crypto lovers!

Until next time!