# Web3 Hack Report 2025 (Explained)

By [Untitled](https://paragraph.com/@0x5496063325debeb245c4b0114418aec4b7946ee4) · 2026-01-07

web3, hackreport, smartcontract, blockchain

---

2025 was a reminder that Web3 security risks are evolving faster than many protocols expect.

While the **number of hacks actually went down**, the **financial damage reached new highs**. According to our latest analysis, attackers focused on fewer but much more severe exploits — causing massive losses in single events.

Here’s a clear breakdown of what really happened in Web3 security during 2025.

### Web3 Lost $2.54 Billion Across 89 Confirmed Incidents

In total, **89 confirmed security incidents** were recorded in 2025, leading to **$2.54 billion in losses**. This is a sharp increase in financial impact compared to previous years, even though the total number of attacks was lower.

What this shows is a shift in attacker strategy. Instead of many small hacks, we’re seeing **fewer but far more destructive incidents**.

### Phishing &Private Key Compromises Caused the Most Damage

Phishing emerged as the **most financially devastating attack vector** of the year. Just **three phishing-related incidents alone accounted for over $1.4 billion in losses**. 

These attacks didn’t rely on complex smart contract bugs — instead, they exploited human trust, leaked credentials, and compromised private keys.

### Ethereum Was the Most Affected Network

Ethereum remained the **most targeted blockchain in 2025**.

*   **30 incidents**
    
*   **$1.9 billion in total losses**
    

No other network came close to Ethereum in terms of both **frequency** and **financial damage**. Its large ecosystem, deep liquidity, and complex infrastructure continue to make it a high-value target for attackers.

> **Want the Full Breakdown?**
> 
> If you want incident-by-incident analysis, attack patterns &lessons learned, you can explore the complete report here: [**Web3 Hack Report 2025**](https://www.quillaudits.com/reports/exploited-ledgers-web3-2025-hack-report?utm_source=paragraph&utm_medium=content_distribution&utm_campaign=web3_hack_report_2025)

### Major Incidents That Defined the Year

Some single events had an outsized impact on total losses:

*   **Bybit multisig breach** ~$1.4B
    
*   **Cetus CLMM exploit** ~$223M
    
*   **Balancer V2 exploit** ~$128M
    
*   Multiple compromises involving **centralized infrastructure and access control failures**
    

These incidents reinforced a key lesson. Security failures are no longer limited to smart contracts alone.

Security can no longer be treated as a one-time audit — it needs to cover **code, access controls, key management and operational processes** together.

---

*Originally published on [Untitled](https://paragraph.com/@0x5496063325debeb245c4b0114418aec4b7946ee4/web3-hack-report-2025-explained)*