CMC News

#Web3 Losses Hit $4B as North Korean Groups Take $2B in Thefts During 2025

Web3 platforms lost $$3.95 billion in 2025, with North Korean threat actors taking more than half that total. Hacken's yearly security report shows losses peaked above $2 billion in the first quarter before dropping to around $350 million by the fourth quarter.

Weak access controls and operational failures caused $2.12 billion in losses, representing 54% of the annual total. Smart contract bugs accounted for $512 million, a much smaller portion of the damage.

The Bybit incident alone reached $1.5 billion, setting a record for the largest single theft. North Korean groups were responsible for roughly 52% of all stolen funds across the year, according to Hacken's attribution analysis.

Yehor Rudystia, head of forensic at Hacken Extractor, said regulators in the U.S., European Union, and other jurisdictions now specify security standards including role-based access control, secure onboarding with ID verification, institutional custody using hardware security models or #multisig, cold storage, and continuous monitoring for anomalies.