Crypto investors lost more than $2.2 billion to hacks, scams, and security breaches in the first half of 2025, according to a new report by blockchain security firm CertiK.
The firm’s “Hack3d: Web3 Security Report for Q2 + H1 2025” outlines a shifting threat environment, with wallet compromises and phishing attacks leading the pack.
According to the report, between January and June, a total of $2.47 billion was lost across 344 incidents. Wallet-related breaches alone accounted for $1.7 billion across just 34 attacks.
Phishing followed as the second most expensive threat, with over $410 million stolen in 132 incidents.
While the raw numbers suggest rising risk, CertiK says two incidents, Bybit and Cetus Protocol, skew the data.
Combined, those attacks made up about $1.78 billion of the total, pushing the year’s figures above all of 2024’s losses.
Removing those two cases brings the total to $690 million, which aligns more closely with previous years.
Ethereum remained the most targeted blockchain, experiencing 175 security events and over $1.6 billion in losses.
In a statement, CertiK noted that the trend in wallet breaches is “alarming,” but added that private key compromises, a top concern in 2024, have shown signs of decline.
The largest hack of the year so far came in February, when crypto exchange Bybit suffered a breach that led to the theft of more than $1.5 billion in liquid-staked ETH and MegaETH. It remains the single largest exploit of 2025.
Cetus Protocol, a decentralized exchange on Sui, was next. On May 22, the protocol lost about $225 million due to a smart contract flaw. The attacker used spoof tokens and price manipulation to drain liquidity. Sui validators later froze and returned $162 million.
The average amount lost per incident stood at over $7.1 million, while the median loss was just under $90,000.
Phishing attacks have grown more deceptive, especially in Q2, where they topped all other attack vectors. The report urges users to be cautious, double-check URLs, avoid suspicious links, and use hardware wallets for storage.
Social engineering attacks also remain a serious threat. In April, a BTC whale fell victim to a phishing scam that resulted in a $330 million loss. The attacker used multiple instant exchanges and eventually swapped the funds for the privacy coin Monero.
Despite the scale of attacks, some funds were recovered.
CertiK reports that $187 million was returned to victims through law enforcement action, whitehat efforts, and exchange cooperation.
This brings the net loss for the first half of the year to around $2.29 billion.
Looking closer at May 2025, CertiK noted a rise in losses due to code vulnerabilities.
In that month alone, flawed smart contracts caused $229 million in damages, a massive jump from just $5 million in April.
“As the tokenization of financial systems accelerates, so too do the methods of attack,” the report said.
“While it’s encouraging to see private key breaches drop, phishing and smart contract risks continue to evolve rapidly.”
With the pace of incidents showing no sign of slowing, the second half of 2025 may test whether recovery efforts can keep up with the rising tide of exploits.
As crypto scams and hacks rise, so do violent crimes targeting private holders.
According to Bitcoin security advocate Jameson Lopp, at least 32 physical attacks, known as “wrench attacks,” have been reported globally this year, putting 2025 on pace to surpass 2021’s record of 36.
Nearly a third of these incidents occurred in France.
The attacks have grown more brutal. In January, Ledger co-founder David Balland was kidnapped and mutilated in a failed ransom attempt.
In another case, the father of a young trader was abducted by men posing as couriers; his captors severed a finger and demanded €7 million before police intervened.
Criminals have also begun targeting families. In May, Pierre Noizat, CEO of Paymium, narrowly avoided tragedy when attackers tried to kidnap his daughter and grandson.
That same month, authorities arrested 25 suspects in a Paris-based kidnapping ring.
Outside France, cases have emerged in the U.S., including a kidnapping in Las Vegas where the victim was driven into the Arizona desert.
Experts say crypto-related violence is entering a darker, more personal phase, prompting increased demand for private protection services.
