KEYTAKEAWAYS
- Centralized exchanges lost $1.59B, with Bybit's $1.45B hack as the largest.
- Phishing tactics now target user trust, not just code.
- Only 11.1% of stolen assets were recovered in H1 2025.
- KEY TAKEAWAYS
- LOSSES EXCEED HISTORICAL RECORDS: $2.29 BILLION VANISHED
- ATTACK STRATEGIES SHIFT: FROM CODE TO HUMAN NATURE
- THE MONEY TRAIL: MIXERS AND GEOPOLITICAL GREY ZONES
- A SHIFT TO PROACTIVE DEFENSE: AI, MECHANISMS, AND POLICY
- REBUILDING TRUST: THE NEW FORTRESS FOR WEB3
- DISCLAIMER
- WRITER’S INTRO
CONTENT
Web3 lost $2.29B to hacks, phishing, and Rug Pulls in H1 2025. But behind the chaos, a new generation of AI-driven, regulatory-backed defenses is taking shape.
LOSSES EXCEED HISTORICAL RECORDS: $2.29 BILLION VANISHED
While the market celebrates a bull run, a silent war is unfolding beneath the surface. In the first half of 2025, Web3 suffered $2.29 billion in losses due to hacks, phishing attacks, and Rug Pulls. This figure not only surpasses the total losses of 2024 but also sets a new historical record.
Centralized exchanges (CEXs) were the hardest hit. Six attacks accounted for $1.59 billion, or 74.4% of all reported losses. Among them, the Bybit cold wallet hack alone resulted in a $1.45 billion loss, sending shockwaves throughout the industry. Meanwhile, Iranian exchange Nobitex lost $90 million in a geopolitically motivated incident, demonstrating how state conflicts have now penetrated crypto infrastructure.
Even when excluding the extreme Bybit and Cetus cases, the average loss per incident still reached $3.5 million. This suggests that security failures are no longer rare anomalies—they are becoming a systemic feature of the ecosystem.
ATTACK STRATEGIES SHIFT: FROM CODE TO HUMAN NATURE
Hackers have evolved. They are no longer just exploiting code. Increasingly, they are targeting the intersection of human error and flawed system design.
Take the Bybit incident. On the surface, it appeared to be a smart contract permission flaw. In reality, it was a phishing attack executed through front-end manipulation. Hackers lured users into signing malicious transactions, then exploited weaknesses in the multisig process. The result: $1.45 billion vanished in plain sight.
This type of layered exploit is becoming more common. In the first half of 2025, over 200 phishing attacks resulted in $400 million in losses, accounting for 25% of all incidents. One case involved a DeFi project whose Discord community was phished, leading to a $2.3 million theft. This shows that user-side vulnerabilities are now harder to guard against than code bugs.
On the technical side, smart contract flaws remain a serious threat. On Sui, leading DEX protocol Cetus lost $223 million due to a bitwise shift bug, which triggered a 7% drop in SUI’s price. Other high-profile issues include zkLend’s integer overflow and UPCX’s unauthorized contract upgrade. These cases highlight a common weakness: newer blockchains still lack mature experience in designing and securing complex financial systems.
THE MONEY TRAIL: MIXERS AND GEOPOLITICAL GREY ZONES
Where did the money go? The answer is worrying. Only $238 million—or 11.1%—of stolen assets were frozen or recovered.
About 71.2% of the stolen funds remain active on-chain. Another 13%—around $278 million—passed through coin mixers. Tornado Cash received $19.5 million, while other new mixers absorbed even more, functioning like black holes for tracking efforts.
In the Cetus case, $162 million was frozen and a $6 million bounty was offered. Still, $60 million was laundered through cross-chain bridges and is now considered unrecoverable. When hackers use blockchain interoperability to move funds across networks, law enforcement can rarely keep up.
More troubling is the rise of geopolitical interference. In the Nobitex case, actors linked to Israeli interests reportedly stole private keys and transferred funds as part of a covert operation. Traditional blockchain analytics failed. Web3 has officially entered the era of state-sponsored cyber threats.
A SHIFT TO PROACTIVE DEFENSE: AI, MECHANISMS, AND POLICY
Despite the losses, the industry is adapting. There is a clear shift from reactive to proactive security. Three major trends are leading this change.
AI Monitoring
Machine learning now identifies 92% of abnormal transactions. AI-driven tools are becoming essential in stopping phishing attacks in real time. Zero-knowledge proofs (ZKPs) are also being used in identity verification, helping to balance privacy and transparency.
Mechanism Design
Protocols like XAI are introducing modular incentive structures that reduce the cost of collaboration in DeFi and GameFi. Meanwhile, the growth of liquid staking (LSTs) and restaking (LRTs) is expected to expand staking volume by 300% in 2025. These tools boost network participation while also enhancing security layers.
Regulatory Coverage
New regulations are raising the bar. The EU’s MiCA framework now requires stablecoin issuers to ensure redemption processes. Hong Kong has introduced a licensing system for stablecoins. Exchanges must now complete KYB (Know Your Business) procedures. Regulatory compliance is becoming a core defense layer, not just a legal burden.
REBUILDING TRUST: THE NEW FORTRESS FOR WEB3
“Security isn’t a cost—it’s the oxygen Web3 needs to function,” said one veteran auditor reflecting on the Bybit case.
The $2.29 billion lost in H1 2025 was not just a warning—it marked a shift. Attackers are no longer just coders. They include social engineers, nation-state actors, and increasingly sophisticated threat groups. As the threat landscape evolves, so must our defenses.
Three actions are now essential:
- Smart contract audits must identify at least 70% of known vulnerabilities. Formal verification and on-chain monitoring tools are key.
- User education must be practical. Wallet safety, phishing alerts, and clear security training are critical for real-world protection.
- Cross-border regulation must improve AML coordination. Shared anti-fraud databases and faster response networks are urgently needed.
This battle is far from over. But with each breach, the Web3 ecosystem gains clarity on what must be done.
Only by building resilient defenses can the industry rebuild trust—and guide Web3’s light through the fog of threats.
