There were 48 major attacks in Web3 Space, with total losses of approximately $718.34 million. These attacks were far from equal. Beanstalk Farms, Elrond, and Harmony, with the three alone, accounted for over $182 million, $113 million, and $100 million in losses, respectively.  In spite of losses occurring throughout the Web3 industry, this sector became the most interesting for VCs in Q2 2022. 

Key Takeaway: 

• April was the most active month for exploits in Q2. 
• 79.2% of exploits occurred in the DeFi space.
• Ethereum saw the greatest loss; BNB Chain saw the most attacks. 
• Social media platforms were the most vulnerable to hackers, accounting for 290 phishing attacks in Q2. 
• Flashloan attacks are maintained to be the major pain point for Web3 projects. 
• Rugpulls and exit scams continued to be the most common types of hacking activity.
• Web3 dominated almost every metric in Q2, garnered around 42% of all the individual deals, leaving DeFi, the all-time interest for VCs, far behind. 

Q2 2022 Web 3 Security Report

Last quarter’s losses were technically a 43% drop from the nearly $1.2 million lost in Q1, 2022. However, there was a 2.42 times increase from the $296.56 million lost in Q1 2021. In the total of the first half of 2022, Web3 projects lost more than $2 billion to hacks, scams, and phishing schemes… meaning that 2022 has already lost more to hacks and exploits than the entirety of 2021, and has been recorded as the most expensive year for Web3 by far.

Breaking it down into a monthly timeline, April was the most active month for hacking, with 19 major security incidents and over $374 million lost. Losses significantly decreased in May alongside Bitcoin winter but saw an increase in June despite the market volatility.

Moving to Q2, DeFi continued to be the most common type of rekt projects, with around 79.2% of attacks occurring in the DeFi space and a total loss of approximately $454.74 million, 63.3%. There were two more cross-chain bridge attacks that occurred this quarter, which accounted for $100 million loss. adding with the other four cross-chain bridge attacks in Q1-2022, the total accumulative loss reached above $1 billion in the first half of 2022. 

For those projects under attack in May, almost all of them experienced a decrease in total value locked (TVL). For some projects such as Beanstalk and Blizz Finance, the TVL immediately bounced to zero after the attack. As recorded, there were less than 30% of the TVL reported after the attack. However, especially, Beanstalk and Blizz Finance witnessed TVL losses of 100% and 500% respectively.

Analyzing the loss amount by chains in Q1 and Q2 of 2022, we have pointed out that there are chains with attacks in two consecutive quarters. Those are Ethereum, BNB Chain, Fantom, and Cronos. Ethereum saw the greatest loss, which was recorded as $381.35 million, in this quarter. BNB Chain was the most frequently attacked chain, with 26 times being exploited. On the other hand, whilst Solana suffered from attacks in the first quarter, with a total loss of $374 million, this chain remained safe, without any major security incidents this quarter.

Web3 hacking tendencies:

Analyzing the trend of Web3 hacking types, social media is the most vulnerable to hackers, in which there were 290 attacks throughout Q2, according to CertiK. Phishing attacks were increasing by over 170% when compared with the 106% recorded in Q1 of 2022. This has raised a big problem regarding the decentralization of Web3 platforms, since the security of user data was at risk, including login credentials and credit card numbers.

On the other hand, flashloan attacks continued to be a major pain point for Web3 projects, which accounted for a total of $308,002,694 lost across 27 attacks. Beenstalk Farms had been recorded, suffering the highest damage from the attack. Compared to the last quarter, this is far much greater than the amount of $14 million in damage. 

Maintaining to be one of the most popular forms of attack, rugpulls and exit scams caused $37,687,648 lost across 89 attacks, which is 16% higher than the last 3-month period. However, the amount of money lost by rugpulls and exit scams had sharply declined, in comparison with the same period last year, which was recorded as over $2 billion of losses.

In addition to the above form of attacks, Q2 saw over $520 million lost to exploits over 39 attacks. Compared with Q1 2022, the amount considerably went down by 57%, from $1.2 billion, with an increase in the number of attacks, slightly from 33 to 39. 

Despite the loss, Web3 Sector became the most interesting for VCs.

Web3 dominated almost every metric in Q2. Surpassing all other sectors in the blockchain industry, including DeFi, CeFi (centralized finance), blockchain infrastructure, and Non-fungible Tokens (NFT), Web3 garnered around 42% of all the individual deals, leaving DeFi, the all-time interest for VCs, far behind. 

Early-stage investment in Seed rounds saw the most activity as usual and total capital inflows of $2.18billion. There were 155 individual companies in the Web3 sector receiving capital during the startup rounds. Compared to only 60 in the DeFi sector, and 53 in the NFT space, we noticed that the trend toward Web3 was upward, even though there were hundreds of millions of losses in Q2. In addition, there were 40 individual deals focusing on the growing sector of Web3 in the Series A rounds in the second quarter.  

There were seven out of the ten most active VCs chose Web3 as the ideal investment. Among them, Animoca Brands was the most active one this quarter. The firm’s evenly split investment (between NFTs and Web3) was heavily changed in the favor of the Web3 sector. In the total of 42 deals this quarter, which was six more than last quarter’s 34 deals, there was 72% of the individual investments into the third generation of web technologies. 

Why Web3?

We all witnessed the flurry of investments in Web3, since 2021. According to a report by Galaxy Digital, companies that focused on digital asset trading or building in Web3 raised the most capital overall in 2021. 

Web3 development and integration have been key for any big business. Twitter was looking at ways to embed Web3 applications into its platforms. For instance, after logging onto Web3 you could send a tweet from a crypto account instead of a Twitter account. 

Meta’s metaverse play was a big bet on Web3. There was a special team at Google for blockchain and Web3 development, as the biggest search platform was interested in contributing to the Web3 space. Spotify was hiring Web3 experts, to develop a new streaming platform on the third generation of web technologies.

Realizing the undoubted potential of the Web3 sector, VCs rerouted funding to Web3, the next generation of the Internet. Remarkably, the California-based investment firm Andreesen Horowitz (A16Z) announced a massive $4.5 billion fund for blockchain companies, which also included exponentially growing Web3 startups. Believing that we have entered the “Golden Era of Web3”, the fund was to help hasten Web3 adoption and growth.

We all agree that Web3 is vulnerable, but it is also potential. In the next generation of the Internet, where everything is decentralized, many opportunities for business are opened. Despite the challenge of security, VCs are taking the risk that they all know, somedays, it will pay off, and so does Satom, we believe in the future of Web3 and its potential applications. Hit us up at hello@satom.vc if you have a creative idea or an expected business model for the Web3 sector. We’re more than welcome to you and your team for our support and resources. Let us accompany you to the future.