Crypto Hacks 2025: Full List of Scams, Exchange Exploits & DeFi Vulnerabilities [Updated October]

As 2025 unfolds, the cryptocurrency world continues to be a dynamic battlefield where evolving technologies are met with equally sophisticated threats. This year, the crypto world is already witnessing a new wave of hacks and scams that reflect emerging vulnerabilities in blockchain protocols, smart contracts, and decentralized finance platforms. 

With cybercriminals adapting to advanced security measures, every breach serves as an important reminder of the need for ongoing innovation in cybersecurity.

In 2025, the stakes are higher than ever as both established and emerging entities navigate these risks. 

In this article, learn about the latest security breaches and exploits, ensuring that you remain well-informed in an ever-changing digital landscape.

Hacks & Scams Targeting DeFi Protocols in 2025

The decentralized finance (DeFi) sector remains one of the most vulnerable areas in the crypto ecosystem, with hackers continually exploiting its open architecture and complex smart contract systems. 

In previous years, DeFi platforms witnessed a series of high-profile hacks and scams that highlighted weaknesses in protocol design, private key management, and governance models. From flash loan attacks to phishing schemes targeting liquidity providers, the landscape of DeFi crime is evolving rapidly. .

2025 has seen a surge in major crypto hacks, with over $2.3B lost across platforms like Bybit, Coinbase, and Cetus. The table below summarizes these significant incidents:

Abracadabra Exploit ($1.8 Million)

On Oct. 1, 2025, the Abracadabra DeFi protocol, known for its Magic Internet Money (MIM) stablecoin, suffered a flash-loan exploit that drained roughly $1.8 million. Attackers manipulated collateral values to over-borrow MIM and exit with profit. The exploit targeted an overlooked rounding vulnerability in the lending contract. 

Within hours, developers halted the affected pools, froze the exploit address, and began patching the bug. The project coordinated with exchanges and on-chain analysts to track stolen funds. 

Roughly one-third of the loss was later blacklisted or recovered through front-end restrictions, while the team implemented upgraded oracle and liquidation protections.

HyperVault (Hyperliquid Ecosystem) ($3.6 Million)

On Sept. 24, 2025, the HyperVault yield-farming protocol within the Hyperliquid ecosystem executed what analysts described as a rug-pull, removing around $3.6 million in user deposits. The project’s developers drained liquidity pools and deleted their social channels. 

SlowMist and on-chain data confirmed the funds were converted to stablecoins and routed through Tornado Cash. No code exploit occurred, the team itself orchestrated the theft. 

Hyperliquid’s core team distanced itself from the project, warning users to verify integrations. Law-enforcement reports were filed in Singapore and Korea, but as of October 2025, no recovery was confirmed and investor compensation remains unlikely.

Shibarium Bridge Exploit  ($2.4 Million)

On Sept. 9, 2025, a Shibarium bridge component was exploited, resulting in losses of roughly $2.4 million in SHIB, ETH, and BONE tokens. Attackers used a flash-loan and validator-signature manipulation method to withdraw bridged assets without proper collateralization.

Developers paused bridge operations within hours and coordinated with the Shiba Inu ecosystem team to trace stolen funds. Some tokens were blacklisted on partner exchanges.

A post-mortem revealed poor validation logic and outdated multisig authorization parameters. Patches were deployed and new audits commissioned. Roughly $300,000 worth of stolen tokens were later frozen on centralized exchanges.

Individual Bitcoiner Phishing Scam ($91 Million – 783 BTC)

On Aug. 19, 2025, an individual Bitcoin investor lost 783 BTC ($91 million) to a social-engineering and phishing attack. The scammers impersonated customer support staff from a major hardware wallet company, convincing the victim to share recovery phrases over an encrypted chat. Funds were immediately transferred to multiple addresses and laundered through Wasabi Wallet mixers.

On-chain analysts like ZachXBT traced partial flows but found minimal recovery potential due to privacy mixing. Law enforcement and exchanges were notified, but no arrests were made. The case became a cautionary example of human-targeted compromises, prompting renewed education campaigns on wallet-seed security.

BtcTurk Exchange Hot-Wallet Exploit ($48–50 Million)

Turkish crypto exchange BtcTurk detected unauthorized outflows on Aug. 14, 2025, amounting to roughly $48–50 million in multi-chain assets (ETH, AVAX, ARB, MATIC, and more). The breach was traced to compromised private keys controlling the exchange’s hot wallets.

Trading and withdrawals were suspended while cold-wallet reserves remained safe. Security firm investigations suggested credential theft rather than a contract exploit. BtcTurk quickly replenished user balances from insurance and corporate funds, resumed operations within five days, and strengthened its wallet-segregation model.

No public disclosure identified the attackers, but forensic data was shared with Interpol and blockchain-intelligence agencies.

GMX V1 ($40–42 Million)

On July 9, GMX V1, a decentralized perpetual trading protocol, was hit by a major exploit involving a re-entrancy vulnerability within its GLP (liquidity provider) pools deployed on Arbitrum and Avalanche. 

The attacker repeatedly entered and exited mint and burn functions in a single transaction, manipulating pricing mechanisms and draining approximately $40–42 million in crypto assets. GMX responded by pausing V1 minting and disabling its legacy contracts. A 10% whitehat bounty, worth roughly $4 million, was publicly offered to incentivize the return of stolen funds. 

Importantly, GMX V2 remained unaffected, and the protocol has since urged users to fully migrate away from V1 while investigating the full scope of the breach.

Resupply ($9.5 Million)

On June 26, Resupply, a DeFi lending platform focused on tokenized donations, was exploited for roughly $9.5 million. The attacker manipulated the valuation logic of a newly deployed vault that accepted crvUSD collateral. 

By donating and inflating collateral values, they were able to mint ReUSD at highly favorable rates and immediately extract the overvalued assets. This vulnerability stemmed from an unprotected exchange-rate function and reliance on poor oracle data. 

Resupply paused affected contracts, alerted users, and is now working with whitehat auditors to deploy a patched version of the ERC-4626 vault.

Nobitex ($90 Million)

Iran’s largest cryptocurrency exchange, Nobitex, was the target of a politically motivated cyberattack on June 18, 2025. Hacktivist group “Predatory Sparrow” claimed responsibility, stating the attack was retaliation against the Iranian regime. 

Using stolen private keys and administrative credentials, the attackers drained nearly $90 million from Nobitex’s hot wallets across Ethereum, TRON, and Bitcoin. Some funds were sent to burn addresses containing anti-government messages. 

Nobitex confirmed the breach shortly after a partial service outage and subsequent internet disruptions across Iran. In response, the exchange has transitioned to cold storage for critical assets and is cooperating with local authorities and blockchain analytics firms to trace any recoverable funds.

ALEX Protocol ($8.3 Million)

On June 6, 2025, ALEX Protocol, built on the Stacks blockchain, lost approximately $8.3 million in an exploit that targeted its vault permissions system. The attacker created a malicious token with smart contract properties that mimicked legitimate assets and used it to bypass internal access controls. 

This flaw in the protocol’s vault verification logic allowed unauthorized withdrawals from ALEX’s DeFi vaults. Upon detection, ALEX halted the vaults, collaborated with security firms, and launched an internal investigation. 

Force Bridge ($3.6 Million)

Between May 31 and June 1, 2025, Force Bridge, a cross-chain asset transfer bridge connecting Ethereum and Binance Smart Chain, suffered a $3.6 million exploit. The breach stemmed from a compromised private key that gave the attacker unauthorized control over the bridge’s validator functions, enabling them to drain funds from the bridge contract. 

The attacker quickly obfuscated the trail using Tornado Cash, making traceability difficult. In response, Force Bridge halted operations and announced an emergency audit.

Cetus on Sui (Estimated $220 Million Loss)

Cetus, a decentralized exchange on the Sui blockchain, experienced a massive exploit when attackers used fake token contracts to manipulate pool balances and drain assets. 

By spoofing token metadata and tricking smart contracts, they bypassed security checks and withdrew roughly $220 million. The Cetus team paused protocol operations, coordinated with the Sui Foundation, and began forensic investigations with blockchain security partners. On May 25, Cetus announced a fund recovery and reimbursement plan.

Coinbase Support Exploit (Estimated $400 Million Loss)

In May, Coinbase was hit by a social engineering attack in which overseas support contractors were bribed by attackers. These insiders provided unauthorized access to user account data, affecting under 1% of users. 

The exploit allowed attackers to initiate transfers and breach sensitive information, with estimated damages approaching $400 million. Coinbase confirmed the incident and terminated relationships with the implicated support firm.

zkSync ($5 Million Loss)

ZKsync, an Ethereum layer-2 scaling solution, suffered a security breach in April 2025 involving an exploited admin wallet. The attacker minted 111 million unclaimed ZK tokens worth $5 million from airdrop contracts, increasing the circulating supply by 0.45%. 

UPCX ($70 Million Loss)

In April 2025, UPCX, a crypto payment platform, was hacked for 18.4 million UPC tokens worth $70 million. The attacker exploited a compromised private key to perform a malicious smart contract upgrade and drained funds using an admin function. UPCX froze activity and secured remaining tokens. 

The incident highlights the rising threat of private key theft in DeFi and the need for better key management practices, like cold storage and multi-signature wallets, as traditional smart contract audits can’t prevent such off-chain exploits.

Zoth ($8.4 Million Loss)

Zoth, a real-world asset (RWA) restaking layer, was hacked for $8.4 million after its proxy contract was tampered with. A suspicious address exploited the “USD0PPSubVaultUpgradeable” contract, allowing the attacker to withdraw $8.45 million in USD0++. 

The stolen funds were then swapped for DAI and converted into 4,223 ETH, now worth around $8.29 million. Blockchain security analyst Cyvers and X user @0xtroll were among the first to identify the breach.

Wemix ($6.1 Million Loss)

In February 2025, blockchain gaming platform WEMIX was hacked, resulting in the theft of 8.65 million WEMIX tokens worth $6.1 million. Hackers used stolen authentication keys from WEMIX’s NFT platform, NILE, to infiltrate the system and execute 13 successful withdrawals. CEO Kim Seok-Hwan delayed the public disclosure to prevent market panic and further risks.

A criminal complaint was filed immediately, and WEMIX began migrating to a more secure infrastructure. Digital Asset Exchange Alliance (DAXA) has labeled WEMIX a cautionary asset and suspended deposits.

ByBit Crypto Exchange

On February 21, 2025, hackers stole approximately $1.46 billion in cryptoassets from Bybit, a Dubai-based exchange. Investigators believe malware tricked the platform into approving unauthorized transactions, sending funds to the attacker.

The Largest Crypto Heist in History

• This breach surpasses the $611 million stolen from Poly Network in 2021, most of which was later returned.
• It may be the largest theft of any kind, eclipsing Saddam Hussein’s $1 billion heist from Iraq’s Central Bank in 2003.

Lazarus Group’s Involvement

• Elliptic has attributed the attack to North Korea’s Lazarus Group, based on the laundering patterns of the stolen funds.
• Since 2017, North Korea-linked cybercriminals have stolen over $6 billion in cryptoassets, financing the country’s ballistic missile program.
• Lazarus Group employs sophisticated techniques to breach organizations, steal crypto, and obscure the transaction trail.

How the Stolen Funds Are Being Laundered

• The laundering process follows a distinct pattern:
  • Swapping stolen tokens for blockchain-native assets like Ether to avoid asset freezes.
  • Dispersing funds across multiple wallets—within two hours, the hackers sent funds to 50 wallets, each holding 10,000 ETH.
  • Using decentralized exchanges (DEXs), cross-chain bridges, and mixers like Tornado Cash to complicate tracing efforts.
• As of February 23, 10% of the stolen assets (valued at $140 million) had already been moved.
• eXch, a crypto exchange known for anonymous swaps, has facilitated tens of millions of dollars in laundering despite Bybit’s requests to block these transactions.

Elliptic continues working with Bybit, crypto service providers, and investigators to track the funds and prevent North Korea from profiting.

AdsPower ($4.7 Million)

In January 2025, specifically between January 21st and 24th, AdsPower, a company specializing in anti-detect browser technology, suffered a cyberattack resulting in the theft of $4.7 million in cryptocurrency. 

The attackers compromised AdsPower’s distribution system, replacing a legitimate browser plugin used for managing crypto wallets with a malicious version. 

For those three days, users who downloaded or updated the plugin unknowingly installed malware. This malware allowed the attackers to steal mnemonic phrases and private keys, giving them full access to users’ crypto wallets. 

Five wallets were ultimately compromised. This attack highlights the danger of off-chain vulnerabilities, even when software is downloaded from seemingly legitimate sources. It reinforces the importance of robust private key security practices such as cold storage and multi-signature wallets for protecting substantial crypto holdings.

Phemex ($85 Million)

On Jan. 23, 2025, the Phemex cryptocurrency exchange was the victim of a significant security breach. Attackers exploited a vulnerability in Phemex’s hot wallet system, resulting in the theft of over $85 million in cryptocurrency. 

Phemex immediately responded by suspending deposits and withdrawals, and initiated an investigation with third-party security experts and law enforcement. 

While initially estimated to be lower, the scale of the theft was progressively revised upwards by security firms and analysts. Phemex CEO Federico Variola described the attack as “sophisticated” but refrained from naming any specific threat actors. 

Although the investigation is ongoing, large-scale crypto thefts are often attributed to North Korean hacking groups. Phemex has since implemented a more secure system and is gradually restoring withdrawal functionality for various cryptocurrencies and networks. They have also cautioned users to avoid using old deposit addresses.

Moby ($2.5 Million)

The DeFi space experienced its first major hack of 2025 when attackers exploited Moby (on 8 Jan), an options platform on the Arbitrum network, stealing $2.5 million in USDC, WETH, and WBTC. The breach was caused by a leaked private key, allowing hackers to activate an emergency withdrawal function. 

However, in a dramatic twist, whitehat hacker Tony Ke from Solayer Labs/Fuzzland recovered $1.5 million in USDC by exploiting a flaw left in the attacker’s replacement contract. This helped decrease total losses by 60%.

Moby assured users that it would reimburse affected traders and liquidity providers, while $1 million of stolen funds in WETH and WBTC remains unrecovered. 

This incident underscores the ongoing risks within DeFi and highlights the critical role of whitehat hackers in mitigating damage. 

Key Trends and Insights from the Chainalysis 2025 Crypto Crime Report

The Chainalysis 2025 Crypto Crime Report highlights critical trends shaping the evolving landscape of illicit activity in the digital asset space. As cybercriminals adopt increasingly sophisticated methods, the insights below reveal the strategies, challenges, and opportunities for combating crypto crime. These findings emphasize the importance of vigilance and advanced blockchain intelligence in safeguarding the cryptocurrency ecosystem.

• Increased sophistication: Criminals are employing more advanced techniques—from leveraging zero-day vulnerabilities to using artificial intelligence for personalized scams—making detection and prevention increasingly challenging.
• Diversification of targets: While centralized exchanges and high-profile wallets continue to be primary targets, decentralized finance (DeFi) platforms and emerging token projects are also in the crosshairs. Attackers are broadening their scope by exploiting weaknesses in smart contracts and novel blockchain protocols.
• Shifting asset use: Traditional cryptocurrencies like Bitcoin are slowly giving way to the increased use of stablecoins and alternative tokens in illicit transactions. This shift reflects both the adaptability of cybercriminals and the changing dynamics of on-chain value movements.
• Regulatory and compliance pressures: As regulatory oversight intensifies globally, the need for robust compliance measures becomes clear. New reporting standards and enhanced due diligence procedures are emerging to counteract the sophisticated methods of crypto criminals.
• Real-Time Intelligence: The rapid pace at which crime is evolving necessitates real-time blockchain analysis and intelligence. Businesses, law enforcement, and regulatory bodies are increasingly turning to advanced tools to trace illicit funds, mitigate risk, and enforce compliance.

Top Crypto Hacks & Scams Of 2024

In 2024, the cryptocurrency landscape continued to face significant security challenges despite advancements in blockchain technologies. 

The table below summarizes the major hacks and scams of 2024, highlighting the targets, dates, and estimated losses. These incidents underscore the persistent vulnerabilities within the space and the critical need for robust security measures.

Top Crypto Hacks & Scams Of 2023

Reflecting on the year 2023, it was marked by several high-profile security breaches in the cryptocurrency space. 

The following table presents an overview of the major incidents from 2023. These events not only had substantial financial consequences but also served as important lessons for enhancing cybersecurity within the industry.

Conclusion

The ever-evolving nature of cryptocurrency technology continues to push boundaries, but it also invites sophisticated threats. Hacks and scams targeting centralized exchanges, DeFi protocols, and individual users highlight vulnerabilities that require constant vigilance.

As seen in 2025 so far, cybercriminals are becoming more innovative, exploiting smart contracts, private keys, and user errors. At the same time, whitehat hackers and blockchain intelligence providers play a crucial role in recovering stolen funds and mitigating damage.

Protecting the crypto ecosystem demands proactive security measures, collaboration across sectors, and ongoing user education. Whether you are a platform operator, trader, or casual investor, staying informed and adopting robust security practices is vital.

This article will continue to be updated as new incidents unfold. Stay tuned for the latest developments and insights into how the cryptocurrency industry is tackling these challenges and working toward a more secure future.

FAQs

About the Author

Dr. Guneet Kaur

Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.

Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.

[email protected] LinkedIn