Watch the biggest digital robbery of 2025

In 2025, cryptocurrency hacking has risen surprisingly, with losses rising to billions. These attacks reflect the increasing sophistication of cybercrime targeting digital assets, ranging from massive exchange violations to decentralized financial (DEFI) exploits. In the first quarter alone, losses of over $1.6 billion were reported, showing an increase of 131% compared to the same period in 2024.

Q1 2025 Crypto Hack Statistics and Market Impact

Crypto totaled $1.63 billion in the first quarter of 2025, according to blockchain security company Peckshield. Bibit exchange violations accounted for $1.46 billion, accounting for 92% of total losses during this period.

Source: Peckshield

The loss in January was $87 million, and February witnessed the sharpest spikes, primarily due to the Bibit exploit. In March, stolen funds fell to $33 million, partially offset by recovery of some assets. The number of hacks rose by more than 60 in the first quarter compared to the previous year.

In particular, the decentralized financial sector has faced multiple attacks, including the $13 million exploitation of Abracadabra.Money and a $8.4 million breach on actual asset protocol Zoth. Despite the growing number of incidents, some platforms managed partial fund recovery, such as one inch, which regenerated 90% of the assets stolen after providing prizes.

Bybit: The biggest code robber in history

On February 21, 2025, Bybit suffered the largest single digital theft recorded, losing around $1.46 billion at Ethereum. The attacker exploited malware during the routine transfer from offline cold wallets to warm wallets, circumventing security controls. Bibit has quickly asserted its customers that its holdings were safe despite the violations.

Source: Elliptic

Bybit CEO Ben Zhou has committed to reimbursing all affected users and securing the platform’s solvency through internal funds and partner loans. The exchange has launched a prize program that provides 10% of the recovered funds with the aim of acquiring stolen assets. A study by blockchain analytics firm Elliptic linked the hack to North Korea’s Lazarus Group. It is a state-sponsored cybercrime organisation known for washing illegal funds to fund military programs.

North Korean hackers’ activities and global response

The role of the Lazarus Group in the Bybit Hack highlights the broader trend in state-sponsored crypto theft. Since 2017, North Korea-related hackers have been stolen over $6 billion in cryptocurrency. Their business often involves obscuring transaction trails through decentralized exchanges and mixers of stolen assets.

According to Bloomberg Report, Authorities will address the issue at a Seven Group (G7) meeting in Alberta, Canada in June 2025. The discussion will focus on the rise in North Korea’s cybercrime, particularly cryptocurrency theft. The US Department of Justice has confirmed that funds stolen by these hackers’ fiscal North Korea weapons programme have been stolen. These attacks show how geopolitical tensions intersect with the security of digital finance.

Other Hacks for Early 2025: ADSPOWER, PHEMEX, and MOBY: CCN Report

In January 2025, Adspower was found to have a $4.7 million violation. ADSpower is a company that offers anti-detection browser technology. The attacker replaced legitimate browser plugins with malicious browser plugins, breaching the user’s private key, allowing direct wallet access. Five wallets were damaged before the attack was identified.

Phemex, a cryptocurrency exchange, lost $85 million in the January 23 attack after exploiting vulnerabilities in its hot wallet system. The platform paused the drawers and began a security overhaul. The violation is suspected to involve state-linked hackers, but remains under investigation.

Moby, Arbitrum’s Defi optional platform, faced a $2.5 million theft after its private key leaked in early January. White Hat Hackers recovered $1.5 million and reduced their net losses. The incident highlighted Defi’s vulnerability to private key exposure and the important role of ethical hackers.

April 2025: Phishing controls losses amid multiple violations

April was a challenging month, with 18 major hacks totaling over $357 million in cryptocurrency losses. The phishing attacks have proven to be the dominant threat vector, accounting for $337 million of these losses. Famous cases included theft of 3,520 BTC from US-based victims through social engineering.

Despite these attacks, some platforms successfully recovered stolen funds. Loop Scale, a decentralized lending platform, reclaimed 90% of the $5.8 million breach two days after offering a 10% reward to hackers. Morpholab has been ranked among the top April incidents after a $2.6 million exploit. A surge in violations from a total of $28.8 million in March highlighted an increase in attacker activity despite increased defense.

Cetus Dex Exploit: Over $200 million in drainage

In May 2025, Cetus, a decentralized exchange of SUI blockchain, lost around $223 million on suspicion of exploitation. On-chain data showed rapid asset drainage and increased trading volumes of over $2.9 billion per day, up from the previous day’s $320 million. Cetus has frozen $162 million of stolen funds and suspended smart contracts to mitigate further losses.

https://x.com/extractor_web3/status/1925533008972423318

Blockchain cybersecurity company Hacken has confirmed that at least $63 million has been bridged to Ethereum and that 20,000 ETH has been largely transferred to new wallets. The attack compromised a pool and assets made up of all SUIs, including tokens such as Lombard Staked BTC and Axolcoin. Network Validators cooperate in ignoring transactions from identified attacker addresses, and further actions are pending.

Coinbase Data Breach: Insider Threat and Customer Data Break

Coinbase confirmed a significant data breaches in May 2025, including insider collusion with overseas employees. According to a post from ZACHXBT’s X, the attacker recruited a customer service agent to leak sensitive data, including name, address, ID image, phone number and masked bank details. Approximately 69,461 user accounts were affected.

https://x.com/zachxbt/status/1886411891213230114

Violation did not disclose login credentials, 2FA code, private key, or wallet. Coinbase refused to pay the $20 million ransom required and instead provided rewards for information that led to the arrest of the attacker. The company pledged to refund customers who were deceived by related scams and implemented enhanced safeguards such as stricter withdrawal verification and identity protection.

Measures and industry response to the rise in crypto crime

The affected platforms are increasingly combining technical fixes with incentives to recover stolen assets. Providing prize money to hackers returning funds has proven effective in cases like loop scales and 1 inch. The exchange has increased wallet security, added withdrawal permit lists, and added mandatory ID verification for large transactions.

Law enforcement cooperation is intensifying, businesses are submitting notifications of violations and sharing data with agencies. Blockchain analytics companies actively track stolen funds through public ledgers to identify washing routes. The first half of 2025 demonstrates the lasting threat landscape facing cryptocurrency platforms.

Famous violations from Bybit, Cetus, Coinbase and others reveal systemic weaknesses that attackers can quickly exploit. Some platforms have recovered funds and implemented stronger defenses, but the industry needs to remain vigilant. Collaboration between exchanges, security companies and regulatory authorities is important for tracking illegal activities and protecting users.