The report by crypto research firm Chainalysis analysed different types of attack and their origins.

March and October 2022 saw the worst losses, with $732.4m and $775.7m wiped off the market.

A total of $3.8bn was lost over the course of the year. DeFi protocols accounted for 82.1% ($3.2bn) of this loss, continuing a trend that first emerged in 2021.

North Korean-linked attacks were highlighted, having surged in 2022, accounting for $1.7bn in losses compared with $429m in 2021. DeFi protocol-related attacks amounted to $1.1bn. Much of this money is used to fund the country’s nuclear weapons programs.

The report says DeFi code auditing conducted by third-party providers is a possible remedy to hacks.

Blockchain security firm experts say regulators have a role to play, making DeFi safer by setting minimum security standards protocol developers must follow.

Blockchain cybersecurity firm Halborn COO David Schwed said DeFi developers should look to traditional financial institutions for examples of how to make their platforms more secure. You don’t need to move as slow as a bank, but you can borrow from what banks do. “A big protocol should have 10 to 15 people on the security team, each with a specific area of expertise.”

To mitigate future risk, experts suggest:

• developers simulating hacking scenarios on testnets;
• closely monitoring the mempool (where transactions are stored) for suspicious activity on smart contracts;
• circuit breakers to pause protocols and halt suspicious transactions.

But law enforcement and security agencies are continuing to build capabilities to investigate hacks and to retrieve stolen funds. For example, last year $30m was recovered from the Axie Infinity Ronin Bridge hack.

More such stories of funds being recovered are expected in the coming years, largely due to the transparency of the blockchain. When every transaction is recorded in a public ledger, it means that law enforcement always has a trail to follow, even years after the fact, which is invaluable as investigative techniques improve over time. Their growing capabilities, combined with the efforts of agencies like OFAC to cut off hackers’ preferred money laundering services from the rest of the crypto ecosystem, means that these hacks will get harder and less fruitful with each passing year.