Hacking Epidemic in Crypto: Social Engineering Targets DeFi Protocols

Recent reports indicate that cybercriminals are focusing on decentralized finance (DeFi) protocols, often utilizing social engineering tactics as their primary attack vector. For example, suspicious encounters with attendees at crypto conferences have been reported, suggesting a trend where individuals are manipulated into compromising their security.

Social engineering employs psychological tricks to encourage users to engage with malicious links or software. This was evident in the $1.5 billion hack of crypto exchange Bybit and the $282 million theft from a single crypto holder earlier this year, both cases having roots in social manipulation tactics.

Particularly notable is the Drift Protocol attack, where hackers built supposed relationships with the project’s team, ultimately leading to the loss of nearly $300 million in assets. This incident emphasizes a shift in hacker strategy, focusing more on exploiting human vulnerabilities than on solely penetrating technical systems.

According to security analysts at Elliptic, the rise in social engineering attacks reflects a broader increase in cybercrime targeting the crypto sector, as hackers recognize the relative security weaknesses in DeFi compared to more traditional central systems. “Right now, DeFi seems to be the primary target,” notes Michael Pearl, a vice president at Cyvers.

The statistics are alarming: hackers have already stolen $786 million from crypto projects in 2023 alone, echoing concerns from previous years where total theft exceeded $2.5 billion.

What’s Driving the Surge?

Experts point to the advent of affordable and advanced artificial intelligence (AI) tools, which allow hackers to enhance their social engineering techniques. AI can aid in identifying vulnerabilities in DeFi protocols that auditors may overlook, resulting in more effective attacks. The consensus at a recent congressional cybersecurity hearing highlighted that while AI may bolster hacker efficiency, the root of many exploits remains poorly designed systems and processes within DeFi. Matt Price of Elliptic stated that human error often serves as the initial point of vulnerability.

Critics argue that framing AI as the main driver behind increased hacking risks can be misleading. David Schwed, chief operating officer at SVRN, asserted that while hackers using sophisticated tools can operate more effectively, many vulnerabilities result from a lack of secure coding practices within DeFi projects. He argues that without prioritizing security like traditional financial institutions, DeFi will remain a target for opportunistic hackers.

Looking Ahead

The surge in attacks, particularly against DeFi protocols, indicates a need for improved security measures and awareness among crypto users. As social engineering tactics become more prevalent, the protection of human elements in the security apparatus of these protocols is essential. Ongoing education and the implementation of robust security protocols may help mitigate this growing threat. As the landscape evolves, observing how DeFi projects adapt to these challenges will be crucial.