Plunge

DeFi

Notable

Hyperliquid

<p>Crypto hack losses fell sharply in the third quarter of 2025, signaling progress in curbing large-scale exploits. Still, September offered a stark reminder of ongoing risks, logging a record number of million-dollar hacks. While attackers stole less overall, their tactics continued to evolve, with wallets and centralized platforms increasingly targeted over smart contracts.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span> <span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Q3 2025 saw $509M stolen in hacks, down 37% from Q2 and over 70% lower than Q1’s nearly $1.7B losses.</li>
   <li>Losses from smart contract exploits dropped to $78M, signaling stronger code defenses across DeFi projects.</li>
   <li>September logged 16 million-dollar hacks, the most ever in one month, raising concerns over attacker strategies.</li>
   <li>Centralized exchanges were hit hardest, losing $182M, with North Korean groups behind nearly half of Q3’s thefts.</li>
  </ul>
 </div>
</div>
<h2 id="h-crypto-industry-sees-relief-in-q3-losses-yet-faces-september-surge">Crypto Industry Sees Relief in Q3 Losses, Yet Faces September Surge</h2>
<p>Losses from hacks and exploits decreased significantly in Q3, despite September setting a new high for million-dollar incidents. According to blockchain security firm CertiK, <a href="https://www.cointribune.com/en/massive-npm-supply-chain-hack-targets-crypto-wallets-but-nets-just-50/" target="_blank" rel="noopener noreferrer nofollow">hackers</a> stole $509 million during the quarter—a 37% decline from $803 million in Q2. Compared with Q1’s nearly $1.7 billion, losses have plunged by more than 70%.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<p>A decrease in large-scale code exploits primarily drove the downturn. CertiK reported that losses from smart contract vulnerabilities sank from $272 million in Q2 to just $78 million in Q3. Phishing-related losses also decreased, although the number of phishing incidents remained stable.</p>
<p>Analysts suggest this shift shows hackers are moving away from direct contract exploits toward wallet compromises and operational breaches.</p>
<figure class="wp-block-image size-full"><img width="1017" height="546" src="https://www.cointribune.com/app/uploads/2025/10/image-9.png" alt="Amount Lost Through Crypto Hacks">
</figure>
<p>Despite the broader decline, September proved an outlier. The month saw 16 hacks worth over $1 million each—the highest ever for a single month—<a href="https://x.com/CertiKAlert/status/1972994839873794062" target="_blank" rel="noopener noreferrer nofollow">surpassing the previous record of 14 in March 2024</a>. This surge pushed the 2025 year-to-date average to nearly six million-dollar hacks per month.</p>
<p>While still below the eight-plus monthly average seen in 2023 and 2024, September’s spike raised fresh concerns about attackers’ tactics.</p>
<div class="affiliate-button"><a href="https://join.swissborg.com/r/frederEZU5" target="_blank" rel="noopener noreferrer nofollow">Your 1st cryptos with Swissborg</a> <a href="https://www.cointribune.com/en/sponsored-content/" target="_blank" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>Notable incidents included the compromise of widely used NPM packages with over a billion downloads, which introduced malware targeting major cryptocurrency wallets. Another major hit came from the SwissBorg exchange, where <a href="https://www.cointribune.com/en/swissborg-confirms-hack-blames-third-party-provider/" target="_blank" rel="noopener noreferrer nofollow">hackers stole 193,000 SOL</a>, valued at approximately $41 million.</p>
<h2 id="h-hackers-shift-to-mid-sized-exploits-as-centralized-exchanges-suffer-most">Hackers Shift to Mid-Sized Exploits as Centralized Exchanges Suffer Most</h2>
<p>Q3 also saw a shift in attack patterns adopted by malicious actors preying on decentralized assets. No “mega-hacks” of $100 million or more were reported, with <a href="https://x.com/CertiKAlert/status/1974074394235580592" target="_blank" rel="noopener noreferrer nofollow">criminals instead focusing on mid-sized crypto exploits</a>.&nbsp;</p>
<figure class="wp-block-image size-large"><img width="1024" height="516" src="https://www.cointribune.com/app/uploads/2025/10/image-8-1024x516.png" alt="Crypto Hacks Over $1 Million">
</figure>
<p>Centralized exchanges were hardest hit, losing $182 million, followed by DeFi platforms with $86 million stolen. One of the largest cases was the $40 million GMX v1 exploit, though the hacker later returned funds after accepting a $5 million bounty.</p>
<p>A CertiK spokesperson stated that exchanges and DeFi projects remain prime targets, noting that state-sponsored groups, in particular, view them as attractive.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<p>Blockchain security firm Hacken echoed that view, citing phishing and social engineering campaigns against centralized exchanges to access multisig and hot wallets. Hacken also warned of new threats on the Hyperliquid chain, including the HyperVault exploit and HyperDrive rug pull.</p>
<h2 id="h-north-korean-hackers-dominate-q3-crypto-threats-despite-overall-decline">North Korean Hackers Dominate Q3 Crypto Threats Despite Overall Decline</h2>
<p>Hacken CEO Yevheniia Broshevan stressed that North Korean hacking units remain the single biggest threat to the crypto ecosystem. She estimated that about half of all Q3 losses could be traced back to North Korean groups, which now deploy <a href="https://cointelegraph.com/news/q3-2025-crypto-hacks-losses-drop-37-percent" target="_blank" rel="noopener noreferrer nofollow">multi-layered approaches beyond traditional phishing</a>.</p>
<p>Broshevan warned that both centralized crypto exchanges and emerging ecosystems like Hyperliquid must strengthen operational security.</p>
<blockquote class="wp-block-quote">
 <p><em>This is a wake-up call. Centralized platforms and users exploring emerging chains like Hyperliquid must double down on operational security and due diligence, or they will remain the easiest entry points for attackers.</em></p> <cite>Yevheniia Broshevan</cite>
</blockquote>
<p>While September’s record-setting crypto hacks raised alarms, the broader decline in total losses—especially the steep drop in code-related exploits—gave some cause for optimism. CertiK suggested industry efforts to harden codebases may be paying off, even as attackers adapt. The ongoing challenge, analysts say, will be keeping pace with the evolving strategies of <a href="https://www.cointribune.com/en/crypto-com-a-hack-kept-secret-for-two-years/" target="_blank" rel="noopener noreferrer nofollow">well-resourced hacking groups</a>.</p>

Crypto Hack Losses Plunge in Q3 2025, But September Records Surge in Million-Dollar Attacks

Table of Contents

Cointribune EN

Other articles published on Oct 4, 2025

Join our free newsletter for daily crypto updates!