The first half of 2025 has already proven more destructive for crypto than all of 2024, with blockchain security firm Hacken reporting over $3.1 billion in losses tied to exploits, scams, and protocol failures.
The sharp rise underscores how attackers are evolving alongside the industry.
Unlike in previous years, losses now stem less from code flaws and more from weak access controls — responsible for nearly 60% of the damage so far. Smart contract bugs, while less dominant, still accounted for $263 million in stolen funds. The worst single incident? February’s $1.5 billion Bybit hack, which may have skewed the numbers but highlights the sector’s fragility.
DeFi was hit hard in Q2, particularly with the $223 million Cetus exploit — one of the most damaging attacks since early 2023. It halted a five-quarter decline in protocol-related losses and exposed critical oversight in real-time monitoring systems.
Hacken also flagged older codebases as a rising risk. Legacy systems like GMX v1, left active and unpatched, were exploited aggressively this year. According to head of forensics Yehor Rudytsia, projects must shut down or secure obsolete contracts to avoid becoming easy targets.
The threat landscape isn’t limited to tech anymore. As crypto matures, social engineering tactics like blind signing, phishing, and insider leaks have taken center stage. And with AI deeply embedded in many projects, a new set of vulnerabilities is surfacing.
AI-related attacks have skyrocketed — up 1,025% since last year — mostly through exposed APIs. Existing security standards don’t yet cover risks like prompt injection or model poisoning, leaving a blind spot for the fast-expanding Web3 + AI frontier.
