According to PeckShield, over 20 hacks occurred during September, resulting in approximately $120.23 million being stolen.
This figure doesn’t include an additional $32.4 million lost in a phishing attack involving Spark Wrapped Ethereum on September 27.
Major targets
Among the most affected platforms were BingX, Penpie, and Indodax, which collectively lost about $92 million.
The BingX hack took place on September 20, when PeckShield first reported a suspicious outflow of $13.5 million, but then experts estimated the losses to be between $44 million and $52 million.
#PeckShieldAlert September 2024 saw 20+ hacks in the crypto space, leading to ~$120.23 million in losses. (Note: The $32.4 million worth of $spWETH drained in a Permit signature #phishing is not included)#Top 10 Hacks in September 2024:#BingX: $44 million#Penpie: $27 million… pic.twitter.com/t2YuvIds6u
— PeckShieldAlert (@PeckShieldAlert) October 1, 2024
In response to the incident, the Singapore-based exchange assured its users that it would cover these losses, calling them minor.
Vulnerabilities in the system
The Penpie incident occurred earlier in the month on September 3. A detailed investigation revealed that hackers exploited a vulnerability in the platform’s reentrancy protection, allowing them to create a fake Pendle market.
This manipulation enabled them to steal 11,113.6 ETH.
Indodax, an Indonesian crypto exchange, also suffered painful losses due to hacking activities last month.
The attackers reportedly breached the withdrawal system and stole large amounts of Bitcoin, Tron, Polygon, and Shiba Inu.
Fruitful month for the hackers
Other platforms experienced smaller breaches as well. DeltaPrime lost $5.98 million, while Truflation was hit for $5.6 million.
Onyx, a fork of Compound Finance, lost $3.8 million last month and had previously been robbed of another $2.1 million in October 2023 due to a known, but unpatched vulnerability in its code.
This same flaw had also been used to steal funds from Midas Capital and Hundred Finance.
The top ten biggest hacks of September included BananaGun with a loss of $3 million, Bedrock suffering a breach of $1.75 million, and Caterpillar Coin, where $1.4 million vanished in a flash loan attack.
