Security

The Hacken 2025 Yearly Security Report puts total Web3 losses at about $3.95 billion, up $1.1 billion from 2024, with just over half of that attributed to North Korean threat actors.
The <a href="https://hacken.io/insights/2025-security-report/" rel="noopener noreferrer nofollow" target="_blank">report</a>, shared with Cointelegraph, shows losses peaked at more than $2 billion in the first quarter of the year before falling to about $350 million by Q4, but Hacken warned that the pattern still points to systemic operational risk rather than isolated coding bugs.
The report frames 2025 as a year where the numbers worsened, but the underlying story became clear. <a href="https://cointelegraph.com/news/5-smart-contract-vulnerabilities" rel="noopener noreferrer nofollow" target="_self">Smart contract bugs</a> matter, but the biggest, least recoverable losses are still coming from weak keys, compromised signers and sloppy off‑boarding.
<h2 id="access-control-not-code-drives-losses">​Access control, not code, drives losses</h2>
According to Hacken, access control failures and broader operational security breakdowns accounted for about $2.12 billion, or nearly 54% of all 2025 losses, compared with around $512 million from smart contract vulnerabilities.
<figure>
 <img alt="North Korea-linked theft and poor key security dominate Web3 losses: Hacken" src="https://s3.cointelegraph.com/uploads/2025-12/019b6a46-6d24-7e5f-a2c8-d23c912ce468.png" title="">
 <figcaption style="text-align: center;">
 Crypto losses by attack type. Source: Hacken 2025 Security Report
 </figcaption>
</figure>
The <a href="https://cointelegraph.com/news/bybit-hack-safe-rearchitects-systems" rel="noopener noreferrer nofollow" target="_self">Bybit breach alone, at nearly $1.5 billion</a>, is described by Hacken as the largest single theft on record and a key reason North Korea-linked clusters account for 52% of total stolen funds.
Related: <a href="https://cointelegraph.com/news/crypto-3-4-billion-losses-2025-wallet-hacks" rel="noopener noreferrer nofollow" target="_self">Crypto losses near $3.4B as hackers went ‘big game hunting’</a>
<h2 id="regulators-spell-out-controls-industry-lags">​Regulators spell out controls, industry lags</h2>
Yehor Rudystia, head of forensic at Hacken Extractor, told Cointelegraph that regulators across the US, European Union and other major jurisdictions’ licensing regimes increasingly spell out what “good” looks like on paper, such as role‑based access control, logging, secure onboarding and ID verification, <a href="https://cointelegraph.com/news/institutional-crypto-custody-how-banks-are-housing-digital-assets" rel="noopener noreferrer nofollow" target="_self">institutional‑grade custody</a> (hardware security models, multi-party computation, or <a href="https://cointelegraph.com/learn/articles/what-is-multisignature-wallet" rel="noopener noreferrer nofollow" target="_self">multi‑sig</a>, and cold storage), as well as continuous monitoring and anomaly detection.
​However, “as regulatory requirements are only becoming mandatory principles, a lot of Web3 companies continued to follow insecure practices throughout 2025,” Rudystia said.
He pointed to practices such as not revoking developers’ access during off‑boarding, using a single private key for managing a protocol, and not having Endpoint Detection and Response systems.
“Among the most important are regular pen tests, incident simulations, custody control reviews, and independent financial and controls audits,” Rudystia said, adding that large exchanges and custodians should treat these as non‑negotiable in 2026.
Related: <a href="https://cointelegraph.com/news/crypto-security-human-layer-threats-2026-expert-tips" rel="noopener noreferrer nofollow" target="_self">Social engineering cost crypto billions in 2025: How to protect yourself</a>
<h2 id="from-soft-guidance-to-hard-requirements">​From soft guidance to hard requirements</h2>
Hacken expects the bar to rise further as supervisors move from guidance to hard requirements.
Yevheniia Broshevan, Hacken’s co-founder and CEO, told Cointelegraph, “We see a significant opportunity for the industry to raise its security baseline, particularly in adopting clear protocols for using dedicated signing hardware and implementing essential monitoring tools.”
She expects overall security to improve in 2026 with regulatory requirements and “the most secure standards” imposed to protect users’ funds.
Given that North Korea-linked clusters drove roughly half of the losses in Hacken’s report, Rudystia said regulators and law enforcement also needed to treat the country’s playbooks as a specific supervisory concern.
He said authorities should mandate real‑time threat intelligence sharing on North Korean indicators, require threat‑specific risk assessments focused on phishing‑led access attacks and pair that with “graduated penalties for non‑compliance” and safe‑harbor protections for platforms that fully participate and maintain North Korea‑specific defenses.

North Korea-linked theft and poor key security dominate Web3 losses: Hacken

Table of Contents

Cointelegraph

Other articles published on Dec 29, 2025

Join our free newsletter for daily crypto updates!