Crypto Hacks Swipe Nearly $3 Billion In 2025 Despite Fewer Attacks – Report

As we approach the final day of a massive year for the crypto industry, a recent report revealed that the sector has lost nearly $3 billion amid the emergence of new trends from malicious actors and growing security complexities.

On Tuesday, blockchain security firm SlowMist shared its 2025 Blockchain Security & AML Annual Report, highlighting the severe security challenges the crypto industry faced throughout the year.

According to SlowMist, the total value stolen from crypto hacks increased by 46% in 2025 compared to 2024, a trend previously noticed by earlier reports. Notably, crypto theft had been more devastating by the first half of this year than the entirety of 2024.

A Mid-Year report by Chainalysis showed that 2025’s activity by the end of June revealed a significantly steeper trajectory into the end of the first half than any previous year, with an alarming velocity and consistency.

Now that the year is near its end, security incidents have cost approximately $2.935 billion, according to SlowMist data, significantly surpassing the $2.013 billion in losses from the previous year.

However, the number of incidents dropped year-over-year (YoY) despite the total amount of losses increasing, signaling a trend of fewer but larger-scale crypto heists. The number of incidents declined by 51%, with 200 cases in 2025. In comparison, 2024 saw 410 reported hacks.

The report shared that DeFi remained the most frequently targeted sector this year, with 126 security incidents, accounting for approximately 63% of all hacks and total losses of around $649 million. This represents a 37% and 62% YoY decrease from 2024’s 339 incidents and $1.029 billion in losses, respectively.

Meanwhile, Centralized exchange (CEX) platforms reported 22 incidents, which accounted for $1.809 billion in losses, led by Bybit’s hack. The February attack resulted in approximately $1.46 billion being stolen in a single incident, becoming the most serious and largest security event of the year.

Although phishing remained one of the most active schemes, scams and intrusive attacks continued to evolve in 2025, noted SlowMist. Therefore, scams have become more deceptive and difficult to detect, with malicious actors no longer relying on a single method of attack to deceive victims:

Traditional phishing has gradually expanded into permission hijacking, malicious code execution, and supply-chain poisoning. Attacks are no longer reliant on a single method; instead, they increasingly combine social engineering, browser exploitation, new protocol mechanics, and hybrid lure strategies to form stealthy and destructive attack chains.

However, the report highlighted that crypto enforcement and sanction actions worldwide displayed a “clear trend of escalation” this year, as regulatory and law enforcement agencies directly intervened “in key areas of crypto-related money laundering, fraud, sanctions evasion, and illicit financing.”

Notably, there were 18 incidents this year in which lost funds were recovered or frozen. In these cases, the total stolen funds totaled to $1.95 billion, of which nearly $387 million was successfully returned or frozen.

SlowMist concluded that “the development of the Web3 industry will no longer rely solely on technical innovation. (…) Organizations that can build stronger internal security controls, more transparent fund governance models, and more comprehensive KYT/AML review capabilities will gain longer-term resilience in the next cycle.”