Gate Research Institute: Security Incident Summary for January 2025

According to the latest Web3 industry security report by gate Research, there were 40 security incidents in January, with losses of approximately $87.94 million. The types of incidents were diverse, with account hacking being the main threat, accounting for 52% of total losses. The report also provides detailed analysis of key security incidents, including Phemex exchange being attacked by hackers, NoOnes suffering a major security vulnerability, and Moby experiencing a Private Key leak. Account hacking and contract vulnerabilities have been identified as the main security risks this month, highlighting the need for the industry to continue to strengthen security measures.

Summary

• In January 2025, there were 40 security incidents in the Web3 industry, resulting in losses of approximately $87.94 million, a significant increase from the previous month.
• This month's security incidents mainly involve contract vulnerabilities, account theft, and other attack methods.
• Account hacking remains the main threat, accounting for 52% of total losses in the cryptocurrency industry's security incidents.
• Most of the losses occur on major public chains: BSC, Ethereum, Solana, etc.
• This month's major events include Phemex exchange being attacked by a Hacker (losing $70 million), NoOnes encountering a major security vulnerability (losing $7.2 million), and Moby encountering a Private Key leak (losing $2.5 million).

Overview of Security Incidents

According to Slowmist's data, there were 40 security incidents recorded in January 2025, with a total loss of 87.94 million USD. The attacks mainly involved contract vulnerabilities, account hacker attacks, and other methods. Compared to December 2024, the total loss amount increased by 20 times. Account hacking was the main cause of the attacks, with 21 related hacker attacks accounting for 52% of the total. Official X accounts and websites remain the primary targets for hackers. [1]

The distribution of security incidents in the public chain ecosystem this month shows that AST, BUIDL, FortuneWheel, HORS, IPC, and Mosca, the six projects that experienced security incidents, are all in the BSC ecosystem, with a total loss of over $600,000. Moonray, UniLend, SuperVerse, Sorra, and LAURA, the five projects that experienced security incidents, are in the ETH ecosystem, with a total loss of over $280,000. Holoworld AI and DAWN are the projects in the Solana ecosystem that experienced security incidents. This series of security incidents indicates the urgent need to enhance the security of public chain ecosystem projects. Faced with frequent attacks and vulnerabilities, BSC should pay more attention to smart contract audits, risk control mechanisms, and on-chain monitoring methods to improve overall security standards.

This month, several blockchain projects have encountered major security incidents, resulting in significant financial losses. Notable events include Phemex exchange being attacked by hackers and losing $70 million, NoOnes experiencing a major security vulnerability and losing $7.2 million, and Moby experiencing a private key leak and losing $2.5 million.

Significant Security Events in January

According to official disclosures, the losses suffered by the following projects in January exceeded $79.7 million. These events highlight that account hacking and contract vulnerabilities are the two main threats.

• In the event of a Hacker attack on Phemex, the attacker simultaneously extracted a large amount of assets from multiple chains, prioritizing the exchange of freezable stablecoins (such as USDC and USDT), and then liquidated other tokens in order of value. These operations were not scripted, but manually completed, with assets manually sent to new addresses for exchange, once completed, they would be transferred to another new address.
• NoOnes' hot wallet experienced several suspicious outbound transactions with amounts under $7,000. NoOnes' CEO Ray Youssef confirmed in a Telegram channel that the hacker attack occurred on January 1st due to a vulnerability in its Solana cross-chain bridge.
• Moby suspected Private Key leakage, Hacker modified the execution contract, and used the emergencyWithdrawERC20 function to withdraw 207 ETH, 3.7 BTC, and 1,470,191 USDC, with a total value of approximately 2.5 million dollars.

Phemex

Project Overview: Phemex is a cryptocurrency derivatives exchange. The exchange is based in Singapore and was founded in 2019 by former executives of Morgan Stanley. The exchange has low fees, high liquidity, and is growing rapidly, providing user-friendly charts and wallet interfaces.

Event Overview: Phemex was attacked on January 23, losing over $70 million worth of cryptocurrencies. This attack appears to be similar to the vulnerability attack pattern of other well-known cryptocurrency exchanges. Taylor Monahan, Chief Security Researcher at MetaMask, said, 'The attacker extracted a large amount of assets from multiple chains simultaneously, prioritizing the conversion of freezeable stablecoins such as USDC and USDT, and then liquidating other tokens in order of value. These operations were not scripted but manually executed, with assets being manually sent to new addresses for conversion. Once completed, they would be passed on to another new address. These assets will be kept until a real money laundering team takes them away next week or next month.'

Suggestions after the incident:

• Cross-chain monitoring and anomaly pattern recognition: Deploy real-time monitoring system supporting multi-chain asset flow, combined with AI behavior analysis, to identify non-scripted manual operation abnormal characteristics (such as large-scale transfer of multi-chain assets in a short period of time, high-frequency address changes, etc.), and set dynamic threshold alerts.
• Establish an industry-level risk warning network: Establish instant communication channels with mainstream stablecoin issuers such as USDT and USDC, sign pre-authorization agreements, and allow exchanges to trigger asset freeze requests with one click through API interfaces after confirming an attack, reducing response time.
• Distributed Cold Hot Wallet Hybrid Management: storing more than 90% of assets in multi-signature cold wallets, dynamically allocating quotas to hot wallets as needed, and dispersing keys through sharding technology to avoid global loss caused by single point breakthroughs.

( NoOnes

Project Overview: NoOnes is a financial communication super app that empowers people by connecting them to global conversations (chat) and the world financial system (payments). People in developing countries will now be able to send messages freely to anyone, trade approximately 250 payment methods in their markets, and make peer-to-peer payments - all using a Bitcoin wallet that can also serve as a store of value.

Incident overview: NoOnes was attacked on Ethereum, Tron, Solana, and BSC on January 1, 2025, resulting in a loss of approximately $7.2 million. The NoOnes hot wallet experienced hundreds of suspicious outbound transactions, each with a single amount below $7,000. NoOnes CEO Ray Youssef confirmed on the Telegram channel that the hacker attack occurred on January 1st due to a vulnerability in its Solana cross-chain bridge. Currently, the platform has closed the affected Solana cross-chain bridge and stated that it will not restore Solana support until comprehensive penetration testing is completed. [3]

Suggestions after the accident:

• Strengthen the security audit of cross-chain bridges: It is recommended to conduct a comprehensive security audit of all cross-chain bridges, especially focusing on vulnerabilities in smart contracts and cross-chain protocols. Hire a third-party security company to conduct penetration testing and code review to ensure the security of cross-chain bridges.
• Implement multi-signature and cold wallet storage mechanisms: To reduce the risk of hot wallet attacks, it is recommended to use a multi-signature mechanism, which requires multiple authorizations to complete large transfers. At the same time, store most of the funds in a cold wallet, keeping only a small amount of funds in the hot wallet for daily transactions.
• Introduce real-time monitoring and abnormal trading alert system: Deploy a real-time trading monitoring system to track and analyze the trading behavior of hot wallets. Set up abnormal trading alerts, such as automatically triggering alerts and suspending trading functions when a single transaction amount exceeds a certain threshold or a large number of small transfers occur within a short period of time.

) Moby

Project Overview: Moby is an on-chain options protocol driven by the SLE (Synchronous Liquidity Engine) model, offering the narrowest spreads, maximum liquidity, and Robinhood-level UI/UX in the market.

Event Overview: The on-chain options protocol Moby has a suspected Private Key leak, and Hackers have modified the execution contract to use the emergencyWithdrawERC20 function to withdraw 207 ETH, 3.7 BTC, and 1,470,191 USDC, with a total value of approximately 2.5 million USD. The on-chain options protocol Moby posted on platform X, suggesting the revocation of valid approved transactions related to the following addresses in order to further protect user asset security in the current situation: PositionManager, SettleManager, sRewardRouterV2, mRewardRouterV2. Moby stated that these measures are precautionary to ensure wallet security and efforts are currently being made to restore and maintain a stable and secure environment.

Recommendations after the accident:

• Establish a layered multi-signature permission management mechanism: upgrade the storage of the Private Key to a hardware-level cold wallet + multi-signature scheme, separating development permissions from fund control. Add time lock + DAO governance dual verification to key functions of core contracts (such as emergencyWithdrawERC20), set a 72-hour delay execution period, and require multi-signature confirmation from the community for major operations.
• Build a dynamic authorization monitoring system: Develop an on-chain authorization real-time tracking dashboard, integrate it into the user dashboard, display all contract interaction permissions and risk levels. Deploy an automatic authorization recovery robot, trigger smart contract-level automatic withdrawal when abnormal large transfers or contract exceptions are detected.
• Establish a secure event circuit breaker response system: deploy a machine learning-based abnormal trading detection module, set multi-dimensional risk control rules for sensitive functions such as emergencyWithdraw (time/frequency/amount three-dimensional thresholds). Develop an emergency pause switch, automatically freeze the contract and initiate a full node verification process when abnormal operations trigger an alert.

Summary

In January 2025, several DeFi projects encountered security vulnerabilities, resulting in a total loss of millions of dollars in assets. These events include Phemex exchange being attacked by a Hacker, NoOnes encountering a major security vulnerability, and Moby experiencing Private Key leakage. These events exposed critical risks in smart contract security, cross-chain protocol composability, and fund pool management. The industry urgently needs to strengthen smart contract audits, introduce real-time monitoring and multi-layer protection mechanisms, and enhance platform security and user trust. Gate.io reminds users to pay attention to security dynamics, choose reliable platforms, and strengthen personal asset protection.
Reference:

1. Slowmist, https://hacked.slowmist.io/zh/statistics
2. X, https://x.com/wublockchain12/status/1882605904761340362
3. X, https://x.com/wublockchain12/status/1883310710132035999
4. X, https://x.com/BeosinAlert/status/1877180521710596452

Click [link]###https://www.gate.io/learn/category/research### to go there immediately.

Disclaimer Cryptocurrency market investment involves high risks. Users are advised to conduct independent research and fully understand the nature of the assets and products before making any investment decisions. Gate.io does not assume any responsibility for any losses or damages caused by such investment decisions.