Jack Kubinec

<div id="highlights-block_62dfaceef41b5" class="highlights">
 <ul>
 <li>Single lines of ill-conceived code gave hackers access to cryptoassets worth hundreds of millions of dollars</li>
 <li>Most of the hacked companies are continuing operations after undergoing audits or upgrading their security</li>
 </ul>
 
</div>



Hackers exploited a software bug in the Web3 music platform Audius to make off with $1.1 million on Saturday, but the funds are a drop in the nearly-$2 billion dollar bucket of <a href="https://cms.blockworks.co/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says/">funds lost to hacks</a> through the first half of 2022, according to <a href="https://static.footprint.network/report/Q2_2022_Web3_Security_Report.pdf">Blockchain security firm Beosin</a>.



The fiat value of hacked assets are on pace to top the $3.2 billion lost in 2021, <a href="https://blog.chainalysis.com/reports/2022-defi-hacks/">according to crypto security firm Chainalysis</a>, even amid a drastic slide in cryptocurrency valuations. Blockworks compiled some of the year’s largest crypto hacks to see what went wrong and how protocols fared after being hacked.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<div class="flourish-embed flourish-chart" data-src="visualisation/10742239"><script src="https://public.flourish.studio/resources/embed.js"></script></div>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<ul class="wp-block-list"><li>Crypto.com, January 17, $35 million<ul><li>In late January, a hacker managed to disable two-factor authentication on the crypto exchange Crypto.com and extract bitcoin and ether from customer accounts. CEO Kris Marszalek initially <a href="https://twitter.com/kris/status/1483277350683185155">denied customer funds were lost</a> before acknowledging the hack days later. The company said it is transitioning to “multi-factor authentication” in response to the exploit.</li></ul></li><li>Qubit QBridge Hack, January 27, $80 million<ul><li>A hacker <a href="https://cms.blockworks.co/defi-protocol-qubit-finance-loses-80m-in-hack/">manipulated a smart contract bug</a> on the Binance-based Qubit Finance’s QBridge to mint wrapped ether tokens without depositing funds. The lost assets <a href="https://pancakebunny.medium.com/the-next-chapter-dao-9630b2c087b">forced the developers behind Qubit</a> to trim the protocol’s staff and reclassify as a decentralized autonomous organization (DAO). </li></ul></li><li>Wormhole, February 2, $325 million<ul><li>A hacker exploited smart contracts on the Solana-to-Ethereum bridge to mint and cash out on wrapped ether without depositing collateral. Jump Crypto, the venture capital firm behind Wormhole, <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/">replenished the stolen funds</a> to keep Solana-based platforms affected by the hack solvent. Wormhole renamed its bridge Portal and currently holds over $480 million, <a href="https://defillama.com/protocols/Bridge">according to crypto data firm DeFi Llama.</a> </li></ul></li><li>IRA Financial Trust, February 8, $37 million<ul><li>The crypto-focused retirement and pension platform was pilfered when hackers accessed a “master key” that bypassed all security measures to customer accounts. IRA Financial Trust has since <a href="https://cointelegraph.com/news/ira-financial-trust-to-sue-gemini-over-36m-crypto-assets-exploit-back-in-february">sued</a> Gemini, the crypto exchange where customer funds were stored, for alleged negligence leading to the hack.</li></ul></li><li>Cashio, March 22, $52 million<ul><li>A string of fake accounts used an “infinite mint glitch” to put up worthless collateral for Cashio’s CASH stablecoin. The coin’s peg cratered to zero and has not recovered, <a href="https://www.coingecko.com/en/coins/cashio-dollar">according to data from CoinGecko</a>.</li></ul></li><li>Axie Infinity Ronin Bridge, March 28, $625 million<ul><li>The largest-ever crypto hack measured in fiat dollars came after hackers <a href="https://cms.blockworks.co/axie-infinity-developers-made-some-trade-offs-that-enabled-625m-ronin-breach/">gained control over a majority of the cryptographic keys</a> securing the play-to-earn game’s cross-chain bridge. Four of the nine keys were stolen when an Axie developer clicked on a fake job offer PDF, <a href="https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game">according to The Block</a>. The Ronin Bridge has since <a href="https://cms.blockworks.co/sky-mavis-reopening-ronin-bridge-with-enhanced-security/">reopened with more validators</a>, though the game is hemorrhaging users.</li></ul></li><li>Beanstalk, April 17, $182 million<ul><li>A hacker used a “flash loan,” where funds are borrowed and repaid in the same transaction, <a href="https://cms.blockworks.co/algo-stablecoin-protocol-beanstalk-cut-down-by-governance-hijack/">to accumulate enough assets</a> to control the stablecoin’s governance protocol. The hacker passed a proposal donating funds to Ukraine before making off with the collateral. Developers paused the protocol while undergoing audits and raising funds, but <a href="https://bean.money/blog/anticipated-replant-timeline">plan to reopen deposits</a> in early August.</li></ul></li><li>Fei Protocol, April 30, $80 million<ul><li>A “reentrancy” bug in the lending protocol’s code allowed a hacker <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/">to take out a loan</a> while also withdrawing the collateral put up on the loan. Fei users <a href="https://snapshot.fei.money/#/proposal/0x17f4d3b0f4d54296b4c36e79fa186d6379d0c0a1ac2b27a599780b5db853de43">passed a proposal</a> to make investors whole through “the DAO repaying the bad debt on behalf of the hacker.” The Fei stablecoin remains at its dollar peg, <a href="https://www.coingecko.com/en/coins/fei-usd">per CoinGecko</a>.</li></ul></li><li>Harmony Bridge, June 23, $100 million<ul><li>The North Korea-linked Lazarus group accessed two of the Binance and Ethereum bridge’s five security keys, <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/">approving transactions siphoning assets from the bridge</a>. Harmony now <a href="https://medium.com/harmony-one/harmonys-horizon-bridge-hack-1e8d283b6d66">requires four of five validator keys</a> to reach a consensus on transactions, and is yet to announce its plan to compensate users.</li></ul></li></ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

The Nine Largest Crypto Hacks in 2022

Morgan Chittum

<div id="highlights-block_61b88b9da0361" class="highlights">
 <ul>
 <li>The music industry generates roughly $42 billion in revenue and less than 12% of that goes to artists</li>
 <li>Daniel Allan, an artist who previously made hundreds of dollars per month from Spotify, is now making thousands after minting NFTs of his music</li>
 </ul>
 
</div>



World-renowned music producer Justin Blau sold his <a href="https://nft.3lau.com/#/auction" target="_blank" rel="noreferrer noopener">first tokenized album</a>, Ultraviolet, as a collection of NFTs for $11.7 million in February. A month later, Kings of Leon made north of $2 million through <a href="https://www.billboard.com/pro/kings-of-leon-nft-sale-2-million-sales-crew-nation/" target="_blank" rel="noreferrer noopener">NFT sales</a> of their album, When You See Yourself.&nbsp;



Along with a booming and speculative non-fungible token market for visual art, fashion and even <a href="https://cms.blockworks.co/why-investors-are-paying-millions-for-virtual-land-in-the-metaverse/" target="_blank" rel="noreferrer noopener">virtual real estate</a> this year, the demand for tokenized music is notching never-before-seen highs as well.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“There&#8217;s never been a way for [musicians] to mint their own work or provide value directly to the fans while simultaneously being able to pull value directly from their fans [until NFTs],” Austin Virts, head of crypto marketing at Audius, told Blockworks.</blockquote>



Historically, the music industry generates roughly $42 billion in annual revenue and less than 12% goes to artists, according to <a href="https://thedefiant.io/building-the-investable-layer-of-music-by-3lau/" target="_blank" rel="noreferrer noopener">a report</a> from Audius. Additional <a href="https://www.rollingstone.com/pro/news/top-1-percent-streaming-1055005/" target="_blank" rel="noreferrer noopener">data shows</a> that around 90% of streams on platforms such as Spotify and Apple Music are from the top 1% of artists. Therefore, most artists get paid fractions of pennies per stream.



Seeking to disrupt this system that has often failed artists, <a href="https://audius.co/" target="_blank" rel="noreferrer noopener">Audius</a> launched a peer-to-peer NFT music streaming service that allows users to upload their own music and monetize through tokens instead of royalties.



Audius allows creators and consumers to both upload and listen to content for free and without a third party. “We provide a UI and a UX, and then everything else on the back end is fully decentralized,” Virts said.&nbsp;



“There hasn’t really been anywhere [until] now for individuals who are not signed to a major record label to develop and grow an audience. Audius [is] utilizing blockchain technology to provide the platform for the 90% of artists who are being pushed around and not catered to by massive record labels.”



Currently, monetization for artists on Audius primarily comes from “trending tracks” on the platform via their token AUDIO. However, Virts said that a major focus moving forward for the platform is finding ways to increase monetization strategies.



“We&#8217;re not here to [just] make these artists millions of dollars,” he said.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“If you&#8217;ve never monetized your music before, and you upload to Audius and make $5,000 to $10,000 in one month, that can be life changing for a lot of people.”</blockquote>



Other startups such as OneOf are challenging the way musicians have historically interacted with their fans as well, co-founder and COO Josh James told Blockworks. The Quincy Jones-backed marketplace allows users to buy NFTs from certain musicians that gives them access to a “vault” where the artist can communicate with the NFT holders. OneOf has sold NFTs for big names such as rapper Pitbull, Doja Cat and Alesso.



“Artists are excited about a new way to connect with their fans, [one that] doesn&#8217;t involve a buffer or a middleman,” James said.



Additionally, the Grammy Awards <a href="https://www.grammy.com/recording-academy/news/music-nft-platform-oneof-announce-exclusive-grammys-awards-nfts-2022-64th-quincy-jones" target="_blank" rel="noreferrer noopener">announced</a> in November that next year’s show would be commemorated via a collection of NFTs in a partnership with OneOf, signalling further adoption of the digital assets in the multi-billion dollar industry.



Although it is unclear whether music NFTs will ever achieve mainstream status, it’s hard to deny that digital collectibles have changed the lives of many whom the traditional music industry has failed.&nbsp;



Independent artist Daniel Allan, who previously only made hundreds of dollars per month from Spotify despite racking up millions of streams, is now making thousands from minting NFTs of his electronic pop songs, <a href="https://time.com/6124814/music-industry-nft/">TIME</a> previously reported.



“I felt that a lot of my career was making a certain type of music that I had to make — and at times I didn’t really connect with,” Allan said to <a href="https://time.com/6124814/music-industry-nft/" target="_blank" rel="noreferrer noopener">TIME</a>. “From an artistic standpoint, I just feel like NFTs and Web3 in general can create a much brighter space for art.”



<hr class="wp-block-separator">
Get the day’s top crypto news and insights delivered to your inbox every evening.&nbsp;<a href="https://cms.blockworks.co/newsletter/?source=end" target="_blank" rel="noreferrer noopener">Subscribe to Blockworks’ free newsletter</a>&nbsp;now.
<hr class="wp-block-separator">