‘This is the jungle’: Law enforcement slowly waking up to the threat of DeFi exploits

The warning did nothing to deter cybercriminals, who launched flash loan attacks—where someone borrows funds and then manipulates the price of the asset before quickly reselling it—on the Avalanche blockchain and the New Free DAO protocol the following week that totaled nearly $2 million. According to data from investment platform DeFiYield, $211 million was lost in decentralized finance hacks just in August.

Cybersecurity experts say the timing of the FBI warning—several years after DeFi exploits began—illustrates how slow governmental agencies and technological solutions have been to catch up to the vulnerabilities of the ecosystem.  

“Law enforcement is reactionary to what’s happening out there,” said Chris Tarbell, the co-founder of the cybersecurity firm NAXO and a former FBI special agent who was instrumental in taking down the notorious Silk Road marketplace. “It takes time because it’s such an advanced technology.”

‘Logical target’ 

As the apocryphal story goes, a reporter once asked Willie Sutton why he robbed banks. “Because that’s where the money is,” he replied.  

Michael Rosmer, cofounder of DeFiYield, said the same logic attracts cybercriminals to the world of decentralized finance, where transactions are irreversible—unlike in traditional banking—and law enforcement is still figuring out how the platforms work.  

“Where else can you go where you can steal really large amounts of money with no recourse?” Rosmer told Fortune. “That makes crypto a logical target until we can somehow turn around and come up with better systems for addressing this.” 

According to DeFiYield’s data, the $211 million lost last month still pales in comparison to August 2021, when cybercriminals stole an estimated $827 million. Rosmer clarified that the decrease does not mean there is any less of a threat, attributing the figure to the cryptocurrency industry’s vastly lower market cap, as well as the shifting nature of DeFi hacks.

Previous exploits targeted lending protocols—like Binance Smart Chain–based protocol Meerkat Finance, which lost $31 million in user funds the day after it launched in 2021—as well as other complex DeFi tools like liquidity pools and automated market makers.  

Rosmer said that the main target in 2022 has been bridges, a type of technology that connects different blockchains, allowing users to move cryptocurrencies among chains. The biggest example from 2022 was the attack on popular play-to-earn game Axie Infinity, which lost an estimated $620 million in March when cybercriminals targeted the bridge to its…