  Over the past years, decentralized finance (DeFi) has been the target of
numerous profit-driven crimes. However, until now, the full prevalence and
cumulative impact of these crimes have not been assessed. This study provides a
first comprehensive assessment of profit-driven crimes targeting the DeFi
sector. To achieve this, we collected data on 1155 crime events from 2017 to
2022. Of these, 1050 were related to the DeFi industry and 105 to the
centralized finance (CeFi) industry. Focusing on the former, a taxonomy was
developed to clarify the similarities and differences among these crimes. All
events were mapped onto the DeFi stack to assess the impacted technical layers,
and the financial damages were quantified to gauge their scale. The findings
show that the entire cryptoasset industry has suffered a minimum loss of
US$30B, with two thirds related to centralized finance (CeFi) and one third to
DeFi. Focusing solely on the latter, the results highlight that during an
attack, a DeFi actor (an entity developing a DeFi technology) can serve as a
direct target, as a perpetrator, or as an intermediary. The findings show that
DeFi actors are the first victims of crimes targeting the DeFi industry: 52% of
crime events targeted them, primarily due to technical vulnerabilities at the
protocol layer, and these events accounted for 83% of all recorded financial
damages. On the other hand, in 40% of crime events, DeFi actors were themselves
malicious perpetrators, predominantly misusing contracts at the cryptoasset
layer (e.g., rug pull scams). However, these events accounted for only 17% of
all financial damages. The study's findings offer a preliminary assessment of
the size and scope of crime events within the DeFi sector and highlight the
vulnerable position of DeFi actors in the ecosystem.
