Crypto Hacks
Top 10 crypto hacks of 2025
In 2025, attackers took $2.8B in 252 crypto hacks and thefts. The biggest was Bybit on Feb 21, 2025, at $1.4B. The 10 largest account for 80% of the year's losses.
Last updated · Data last changed · Checked daily
The 10 biggest crypto hacks of 2025, ranked
1
Bybit
Feb 21, 2025CEXEthereum$1.4B returned$1.4BAttackers tricked Bybit signers into approving a masked transaction that changed the hot wallet’s security rules, using a spoofed Safe interface. This enabled the theft of over $1.4 billion in ETH and other assets.
2
Cetus
May 22, 2025DeFi ProtocolSui$223MA math error in Cetus’s liquidity calculations let attackers create positions showing large amounts of fake liquidity with minimal deposits, then withdraw real pool assets. Sui validators froze some of the funds, while others escaped.
3
Balancer V2
Nov 3, 2025DeFi ProtocolEthereumArbitrumBase+3 chains$128MA rounding flaw in Balancer V2’s stable-pool swap calculations let attackers manipulate pool values and withdraw assets for far less than they were worth. The exploit affected pools across several chains; mitigation efforts protected or recovered some funds.
4
Bitget
Apr 20, 2025CEX$100MBitget’s market-making bot entered a predictable trading loop on the VOXEL/USDT futures pair. Traders used high leverage to extract about $100 million before Bitget froze accounts and rolled back trades.
5
Phemex
Jan 23, 2025CEXEthereumSolanaXRP+10 chains$85MAttackers compromised Phemex’s hot-wallet private keys and signing systems, draining wallets across multiple blockchains. Reported losses ranged from about $69 million to $85 million.
6
Nobitex
Jun 18, 2025CEXTronEthereumBSC+4 chains$82MCompromised hot-wallet keys let attackers steal roughly $82–90 million from Nobitex across multiple blockchains. The attackers sent the stolen assets to inaccessible addresses, destroying rather than keeping them.
7
UPCX
Apr 1, 2025DeFi ProtocolEthereum$70MUsing a compromised private key, an attacker upgraded UPCX’s ProxyAdmin contract and used an admin withdrawal function to move 18.4 million UPC from three management accounts. UPCX later said it still controlled the tokens while it investigated.
8
Infini
Feb 24, 2025DeFi ProtocolEthereum$49.5MA former Infini developer who retained vault-draining privileges used admin access to drain the contract. The stolen USDC was converted into ETH.
9
BtcTurk
Aug 14, 2025CEXEthereumAvalancheArbitrum+4 chains$48MBtcTurk’s hot wallets were hit across seven blockchains after private keys were compromised, with reports estimating losses in the tens of millions of dollars. The exchange acknowledged unusual wallet activity and suspended deposits and withdrawals.
10
CoinDCX
Jul 19, 2025CEX$44.2MA server breach exposed the private key for CoinDCX’s operational hot wallet, and the attacker stole about $44 million in corporate funds, moving assets from Solana to Ethereum. Customer funds in cold storage were unaffected.
