Off-chain Failures Drove Most Stablecoin Losses in 2024

Halborn’s 2024 analysis of decentralized finance incidents found that off-chain events accounted for 56.5% of attacks and 80.5% of stablecoin funds lost last year. The report attributes most losses to compromised private keys, manipulated payment instructions and administrative failures rather than flaws in smart contracts.

The report defines off-chain incidents as attacks that exploit the systems and people surrounding token holdings: private keys, administrative accounts, internal approval processes and devices used to sign transactions. In many cases the on-chain contracts behaved as written, so transfers executed by an authorized signer could not be reversed.

Payment-instruction fraud was the most common vector. Attackers gained access to email accounts or impersonated suppliers and sent routine-looking messages to change payment addresses. Organizations approved those changes through normal channels and on-chain transfers landed with attackers. The report recommends confirming any change to a payment address by voice on a number already on record and sending a small test payment before larger transfers.

Standing approvals represented a second major vector. Many wallet interfaces request unlimited token allowances by default. Those permissions persist after use, so a contract compromised later can still move funds from a wallet that granted access earlier. The report advises capping approvals to the required amount and scheduling regular reviews to revoke unused allowances.

Access that outlives the person who needed it was another frequent cause of loss. Wallet keys, custody logins and exchange credentials often remain active after employees change roles or leave. The report recommends tying access to employment status and performing access reviews during offboarding.

Single-signer operations concentrated risk where one device or person could move an entire treasury. Malware, malicious browser extensions or phishing pages that compromise a single laptop or phone can result in a total loss. Halborn describes multisignature or threshold-signature arrangements as ways to require multiple independent approvals to move funds.

Address poisoning exploited common verification habits. Attackers sent tiny transfers from addresses engineered to match the first and last characters of a target address so the malicious address appeared in transaction history. The report recommends copying addresses only from internal verified records and checking the full string for significant payments.

The report lists practical controls to reduce losses: separate a small hot wallet for routine payments from a cold or multisignature treasury, require out-of-band confirmation for any changed payment destination, perform scheduled reviews of approvals and access, and use test transactions before material transfers. After an incident, Halborn advises moving remaining funds to a wallet generated on a clean device, revoking approvals on the compromised address, preserving transaction hashes and screenshots as evidence, and reporting thefts to law enforcement when appropriate.

Halborn also notes that institutional custody, multisignature services with recovery options, commercial exchange accounts and some insurance products generally require a registered legal entity. Company funds held in personal wallets do not have access to those institutional controls.