DeFi Hacks: Token Value Loss & DAO Security Risks

Transactions within DeFi are publicly visible on the blockchain and are executed automatically through “smart contracts,” which are self-executing agreements. Users can trade, borrow and lend funds, and utilize derivatives and stablecoins – cryptocurrencies pegged to the value of the U.S. dollar. Many DeFi protocols are governed by Decentralized Autonomous Organizations, or DAOs, where voting rights are determined by token ownership. Well-known examples of DAOs include Uniswap and MakerDAO. However, anyone can establish a DAO, making them increasingly attractive targets for cybercriminals. Sometimes, the founders themselves are implicated, while in other cases, hackers exploit security vulnerabilities.

To date, the DeFi ecosystem has suffered over $10 billion in direct losses due to such criminal activity. Researchers Stefan Kitzler and Bernhard Haslhofer at the Complexity Science Hub (CSH) recently investigated the impact of these events in a study titled “The Economic Impact of DeFi Crime Events on Decentralized Autonomous Organizations.”

The damage often extends beyond direct financial losses. A decline in the value of affected tokens frequently occurs, representing an indirect cost. According to the study, which analyzed 22 criminal events, these losses stemming from diminished market confidence often exceed the initial, direct financial impact. (In rare instances, a hack can actually increase attention – and therefore the value – of a token, but this is the exception.) On average, losses associated with hacks are higher than those experienced by companies that have been breached.

So how do hackers operate? Kitzler explains that they often exploit flaws in the underlying programming code, which is frequently publicly accessible. While technical expertise isn’t always required to identify vulnerabilities, a DAO’s longevity and widespread use can offer a degree of security. Some DAOs also commission security audits conducted by external experts, providing an additional layer of protection, though not a foolproof one, according to Haslhofer.

While decentralization is often a desirable characteristic, centralized entities are generally more efficient when swift action is needed in the wake of a hack. DAOs, requiring a vote among their users to determine a course of action, can be slower to respond. This is contributing to a trend toward centralization even within the DeFi space. Traditional banks aren’t likely to be displaced anytime soon, but DeFi is proving to be a significant “innovation driver” for the broader financial system.