Blockchain security incidents resulted in losses totaling approximately $2.935 billion across 200 separate events in 2025, according to a new report from cybersecurity firm SlowMist.
The total represents a 46% increase in financial damage compared to the previous year, despite the number of incidents dropping from 410 in 2024.
The findings highlight growing sophistication among attackers, including professionalized hacker groups with alleged North Korean links and evolving money laundering techniques.
Ethereum recorded the highest losses among blockchain ecosystems, with incidents resulting in $254 million in damages throughout the year.
The figure positions the network significantly ahead of other platforms in terms of financial impact. BSC followed with $21.93 million in losses, while Solana experienced $17.45 million in damages.
SlowMist’s analysis also identified Arbitrum among the affected networks, reporting $17.10 million in losses.
The distribution suggests that established platforms with higher transaction volumes remain primary targets for malicious actors.
However, the report notes that actual losses likely exceed reported figures due to price fluctuations and unreported cases.
The data reflects token prices at the time each incident occurred. Individual user losses were excluded from the calculations, meaning the true scope of damages extends beyond the documented amounts.
SlowMist emphasized this limitation when releasing their 2025 Blockchain Security & AML Annual Report through their official account.
Decentralized finance protocols accounted for 126 incidents during 2025, representing 63% of all reported cases. These DeFi-related events resulted in combined losses of $649 million. The sector continues to face persistent threats from smart contract vulnerabilities and sophisticated exploit techniques.
Centralized exchanges experienced fewer incidents but suffered disproportionately higher losses. Only 22 incidents targeted centralized platforms, yet damages reached $1.809 billion.
The Bybit breach alone accounted for $1.46 billion of this total, demonstrating how single events can dominate annual loss statistics.
Attack vectors showed concentration in two primary categories, according to the SlowMist report. Smart contract exploits numbered 56 incidents, while account compromises totaled 50 cases.
The firm noted that attacks increasingly involve ransomware-as-a-service and malware-as-a-service operations. Global regulatory enforcement has accelerated in response to these evolving threats, though challenges persist in cross-border coordination and recovery efforts.
