A Grim Half-Year: Scams and Hacks Cost the Industry $3.1 Billion

In the first six months of 2025, Web3 projects suffered losses amounting to $3.1 billion due to hacks and fraud. This figure already surpasses the total for 2024, which stood at $2.85 billion, according to a report by Hacken.

The primary cause of these losses was access control vulnerabilities, accounting for $1.83 billion, or 59% of the total. Phishing and social engineering led to losses of $594 million (19%). Rug pulls and smart contract vulnerabilities accounted for $300 million and $273 million, respectively.

The largest incident was the hack of the Bybit exchange, resulting in a $1.46 billion loss due to a compromised signing interface. Analysts also highlighted the attack on Cetus involving $223 million and the theft of $330 million from a user in the United States through social engineering.

Shift in Attack Focus

Hacken analysts noted a shift in attackers’ focus from technical vulnerabilities to human factors and weak internal processes. Issues with key management and multisignatures have become the main reasons for breaches in both centralized and decentralized platforms.

Losses from phishing and social engineering reached a record $600 million. Hackers actively employed calls impersonating tech support and fake applications.

According to the report, artificial intelligence has emerged as a new serious security threat. The number of AI-related attacks increased by 1025% compared to 2023. Nearly 99% of these are linked to unsecured API.

Hacken recommended companies implement automated monitoring and conduct regular audits. 

Users were advised to store large sums in cold wallets, use hardware keys for two-factor authentication, and avoid clicking on suspicious links.

Back in May, the crypto industry’s losses from hacks reached $244 million.