Can a CSRF CAPTCHA be defeated?
Is it to possible break captcha? If yes, how? If no, why websites use difficult captcha systems?
Yes. CAPTCHA is broken and I have actually used software that breaks it.
I forget the toolkit. Its on my laptop and I'm at work right now but I just googled and found this one http://code.google.com/p/captcha-breaker/
There have been some successful attacks against reCAPTCHA as well but I think they have been mitigated.
Yes. The most foolproof method is using humans for low wages, who will break ~1000 CAPTCHAs for ~$2. Certain CAPTCHAs have been broken at various times (though they often get upgraded to become more difficult), but still present a difficult barrier for spammers (who often will go to easier targets instead).