Crypto hacks in 2025: the year in our verified database

2025 is the year with the most incidents in our hack database so far. This post looks back at it with the numbers as they stood in the database on 26 October 2026: how many incidents we verified, how much was lost where a dollar amount was stated, which attack types and chains came up, and how the year ended. Every amount is the one the primary source states; we do not convert token amounts into dollars.

For the current year, see Crypto hacks in 2026 so far. The full list, with a page and a primary source for every incident, is the hack database.

The year in numbers

We verified 25 incidents dated in 2025, out of 77 in the database since 2022. For comparison, the database holds 13 incidents for 2022, 14 for 2023 and 12 for 2024.

Only 9 of the 2025 incidents state a loss in US dollars. Together they add up to $1.6B. The other 16 report their losses in tokens, as bad debt, as a share of a pool, or not at all; they are counted but not summed. The total is therefore a floor, not the full damage of the year.

Stated losses by year, from the same snapshot (amounts only where an incident states one):

• 2022: $942M
• 2023: $824M
• 2024: $600M
• 2025: $1.6B
• 2026 so far: $1B from 13 incidents

By stated losses, 2025 was also the largest year in the database at that snapshot, but mostly because of one incident, as the next section shows. By count it is clearly ahead of every other year.

A higher count does not have to mean more attacks. It can also reflect which incidents we were able to verify from primary sources. The database is a verified list, not a complete census.

One incident dominates the total

The largest stated loss of 2025 was Bybit on 2025-02-21, at $1.5B, recorded as a key compromise (see the incident page for the primary source). It is so large that the two biggest incidents of the year made up 97% of all stated dollar losses.

Below it, the amounts drop sharply: GMX V1 (2025-07-09) at $42M, WOO X (2025-07-24) at $14M, Garden Finance (solver) (2025-10-30) at $11.4M and Trust Wallet (2025-12-24) at $8.5M.

That shape, one very large loss and a long tail of smaller ones, is why a yearly total says little on its own. Without the largest incident the year would look very different: still the year with the most verified incidents, but no longer the year with the largest stated losses. When you compare years, look at the count and the list of incidents, not only at the sum.

Attack types

By the type we recorded for each incident:

• Exploits: 9 incidents, $49.6M stated.
• Hacks: 5 incidents, $22.5M stated.
• Key compromises: 2 incidents, $1.5B stated.
• Bridge exploits: 1 incident, $4M stated.
• Market manipulation: 1 incident.
• Other: 7 incidents, for example the halted Hyperliquid bridge on Arbitrum listed below.

Exploits were the most frequent type, but key compromises carried almost all of the stated money: few incidents, very large losses. For the yearly total, how signing keys were protected mattered more than any single class of contract bug.

Chains

Counted by the chains each incident touched (one incident can involve several):

• Hyperliquid: 8
• Ethereum: 6
• Arbitrum: 5
• Solana: 3
• Base: 2
• BNB Chain: 2
• Other chains: 6

Hyperliquid leads this list, and that reflects what we track as much as where attacks happened: we follow Hyperliquid closely, and the database records events there, such as the halted bridge on Arbitrum, even when no theft was confirmed.

How the year ended

The last incidents of 2025 in the database were Flow on 2025-12-27 ($3.9M), Trust Wallet on 2025-12-24 ($8.5M), Yearn yETH on 2025-11-30, Hyperliquid (Arbitrum bridge lock) on 2025-11-12 and Moonwell on 2025-11-04 ($3.7M). Two of them state no dollar amount at all. That is common for incidents where funds were frozen or later recovered, or where the project reported its loss only in tokens, and it is one more reason why the dollar total of a year is a floor rather than a full account.

How we verify an incident

Facts come from primary sources: the project's post-mortem or official account, on-chain transactions, official exchange or Hyperliquid announcements and governance posts. Every entry is our own short text (who, what, when, amount, chain, status) with a link to the evidence, and amounts are copied as stated. We do not attribute fault beyond what the primary sources say. The methodology of the database describes the rules in full.

Limits of the data

• Verified, not complete. The database lists incidents we could confirm from primary sources, so yearly counts are not a census of every attack.
• Amounts as stated. We do not price token amounts, so totals cover only incidents that state a dollar figure.
• Frozen. All numbers here are fixed at the snapshot of the database and can change as entries are added or revised.

Alerts for new incidents are part of Alerts, under Security.