Concerns surrounding vulnerabilities in crypto protocols are diminishing as sophisticated scamming tactics surface. According to blockchain security company CertiK’s recent analysis, hackers stole $3.3 billion in 2025; however, the number of attacks drastically decreased as losses became more concentrated in complex supply chain breaches.
Many breaches indicate that attackers are shifting focus from exploiting simple code flaws to phishing and infrastructure-targeting strategies. Supply chain attacks notably caused $1.45 billion in losses from just two significant incidents, including the notorious Bybit hack in February.
“The Bybit exploit signals that well-capitalized, well-coordinated threat actors are becoming more active across the ecosystem,” the report states. This raises expectations around the increasing number of sophisticated supply chain attacks aimed at infrastructure providers.
Crypto hacks by amount and incident, yearly chart. Source: CertiK
Related: Soulja Boy token sparks backlash after Base co-founder posts purchase receipt
Despite a higher overall financial impact, the total number of security incidents fell by 162 year-over-year, showcasing that blockchain cybersecurity strategies are advancing. Although the average amount lost per incident was $5.3 million (up 66% from last year), the median loss dipped to $103,966, reflecting a decrease of 35.75% in that timeframe.
Cryptop hacks by incident type and amount of losses, one-year chart. Source: CertiK
Related: Solana AI token Ava hit by launch sniping tied to deployer: Bubblemaps
Code Vulnerabilities Decrease, “Pig Butchering” Scams on the Rise
Phishing scams have reached a new level of intensity, becoming the second most common threat and costing investors around $722 million, spanning 248 incidents. A poignant case occurred recently when an investor lost their entire Bitcoin retirement fund to a romance scam employing the ‘pig butchering’ method, characterized by prolonged emotional coercion.
Pig butchering victim stats, grooming time. Source: Cyvers
Pig butchering scams are a form of phishing that led to $5.5 billion in losses throughout 2024, with 200,000 affected cases. The typical grooming phase for victims lasts one to two weeks and stretches up to three months in 10% of instances.
In June, the U.S. Department of Justice declared it seized over $225 million in crypto associated with pig butchering scams.
Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why
