Mapping the DeFi crime landscape: an evidence-based picture

TL;DR

This paper provides a comprehensive, evidence-based analysis of profit-driven crimes in DeFi from 2017 to 2022, quantifying damages, categorizing crime types, and highlighting vulnerabilities of DeFi actors within the ecosystem.

Contribution

It offers the first detailed taxonomy and mapping of DeFi crimes across technical layers, quantifies financial damages, and analyzes the roles of DeFi actors as victims, perpetrators, and intermediaries.

Findings

DeFi crimes caused at least US$10 billion in damages.

52% of crimes targeted DeFi actors, mainly due to protocol vulnerabilities.

DeFi actors are both primary victims and perpetrators of crimes.

Abstract

Decentralized finance (DeFi) has been the target of numerous profit-driven crimes, but the prevalence and cumulative impact of these crimes have not yet been assessed. This study provides a comprehensive assessment of profit-driven crimes targeting the DeFi sector. We collected data on 1141 crime events from 2017 to 2022. Of these, 1036 were related to DeFi (the main focus of this study) and 105 to centralized finance (CeFi). The findings show that the entire cryptoasset industry has suffered a minimum loss of US$30B, with two-thirds related to CeFi and one-third to DeFi. Focusing on DeFi, a taxonomy was developed to clarify the similarities and differences among these crimes. All events were mapped onto the DeFi stack to assess the impacted technical layers, and the financial damages were quantified to gauge their scale. The results highlight that during an attack, a DeFi actor (an entity developing a DeFi technology) can serve as a direct target (due to technical vulnerabilities or exploitation of human risks), as a perpetrator (through malicious uses of contracts or market manipulations), or as an intermediary (by being imitated through, for example, phishing scams). The findings also show that DeFi actors are the first victims of crimes targeting the DeFi industry: 52% of events targeted them, primarily due to technical vulnerabilities at the protocol layer, and these events accounted for 83% of all financial damages. Alternatively, in 41% of events, DeFi actors were themselves malicious perpetrators, predominantly misusing contracts at the cryptoasset layer (e.g. rug pull scams). However, these events accounted for only 17% of all financial damages. The study offers a preliminary assessment of the size and scope of crime events within the DeFi sector and highlights the vulnerable position of DeFi actors in the ecosystem.