Immunefi Crypto Losses Q1 2025 Report
The team at Immunefi, the leading onchain crowdsourced security platform, has assessed the volume of crypto funds lost by the community due to hacks and scams in Q1 2025.
Overview
As of March 2025, nearly $100 billion in capital was locked across Web3 protocols. That capital represents an unparalleled and attractive opportunity for blackhat hackers.
We have reviewed all instances in Q1 2025 where blackhat hackers exploited various crypto protocols. We have located 40 such instances, including successful and semi-successful hacking attempts and alleged fraud*.
Q1 2025 marks the worst quarter for hacks in the history of the crypto ecosystem. In total, we have seen a loss of $1,635,933,800 across the ecosystem in Q1 2025. The majority of the funds were lost to hacks. Most of that sum was lost by two specific CeFi crypto exchanges: Bybit suffered an attack that resulted in $1.46 billion in losses, and Phemex incurred a loss of $69.1 million.
The total number of losses in Q1 2025 represents an 4.7x increase compared to Q1 2024, when hackers and fraudsters stole $348,251,217.
Crypto Losses in Q1 2025
Key Takeaways in Q1 2025
- The 2 major exploits of the quarter totaled $1.52 billion alone, accounting for 94% of all losses in Q1 2025.
- In Q1 2025, hacks continued to be the main cause of losses.
- CeFi became the primary target of successful exploits, comprising 94% of cases, while DeFi accounts for 6% of total losses.
- The two most targeted chains in Q1 2025 were BNB Chain and Ethereum. BNB Chain suffered the most individual attacks with 19 incidents, followed by Ethereum with 15 incidents, and Base with 3 incidents.
- In total, $6,500,000 has been recovered from stolen funds in 2 specific situations. This number makes up 0.4% of the total losses in Q1 2025.
Key Insights in Q1 2025
- Q1 2025 is marked by a considerable increase in the total number of losses, up by 4.7x compared to Q1 2024, amounting to $348,251,217.
- Overall, February witnessed the highest loss in Q1 2025, primarily due to the Bybit hack.
- The number of attacks decreased by 36% from 63 in Q1 2024 to 40 in Q1 2025.
- In Q1 2025, BNB Chain surpassed Ethereum and became the most targeted chain compared to the previous period.
- In Q1 2025, funds recovery has proven less effective than in the previous period. To date, only 0.4% of stolen funds have been recovered, compared to the 21.2% recovered in Q1 2024.
Top 10 Losses in Q1 2025*
| Project | Loss |
|---|---|
| Bybit | $1,460,000,000 |
| Phemex | $69,100,000 |
| Infini | $49,500,000 |
| MIM Spell | $12,800,000 |
| zkLend | $9,500,000 |
| Zoth | $8,850,000 |
| Ionic Money | $8,600,000 |
| Wemix | $6,000,000 |
| 1inch | $5,000,000 |
| Moby Trade | $2,500,000 |
North Korean Hackers
In Focus
- In Q1 2025, the North Korean Lazarus Group is suspected to be behind two major crypto attacks, causing 94% of total losses. They hacked Bybit and Phemex, stealing a total of $1.52 billion. Industry investigations found a direct link between the two attacks by analyzing test transactions, connected wallets, and the subsequent movement of funds.
- These incidents highlight once again the growing trend of state-backed hackers targeting centralized exchanges and project infrastructure to carry out massive exploits. Such compromises are among the most devastating in crypto, as a leaked private key can give attackers full control over all associated funds. Since exchanges manage large sums of capital, even a small breach can result in hundreds of millions in losses, making them prime targets for malicious actors. In contrast, vulnerabilities in smart contracts may only allow partial or conditional access to funds.
| Category | Amount |
|---|---|
| Total Losses | $1,623,133,800 |
| North Korea-linked Attacks | $1,529,100,000 |
Major Exploits in Q1 Analysis
Most of that sum was lost by two specific centralized crypto exchanges: Bybit suffered an attack that resulted in $1.46 billion lost, and Phemex incurred a loss of $69.1 million.
Bybit, $1.46 Billion
- On February 21, 2025, Bybit, the Singapore-based centralized crypto exchange, was hacked for $1.46 billion. In the largest crypto hack ever, the attackers gained control of an Ethereum cold wallet.
- Total Losses: $1.6B
- Bybit: $1.46B
Phemex, $69.1 Million
- On January 23, 2025, the Singapore-based cryptocurrency exchange Phemex suffered an exploit, resulting in over $69 million in losses drained from its hot wallets.
- Total Losses: $1.6B
- Phemex: $69.1M
Hacks vs. Fraud Analysis
In Q1 2025, hacks continue to be the predominant cause of losses far surpassing fraud. An analysis reveals that hacks accounted for 100% of the total losses during this period, with no notable fraud incidents reported.
Overview
- Hacks In total, we saw a loss of $1,635,933,800 due to hacks in Q1 2025 across 39 specific incidents. These numbers represent an 390% increase compared to Q1 2024, when losses caused by hacks totaled $333,585,400.
- Fraud The ecosystem hasn't seen specific fraud accidents in Q1 2025. This represents a significant decrease compared to Q1 2024, when losses caused by frauds, scams, and rug pulls totaled $14,665,817.
Hacks vs. Fraud
- Hacks: 100.0%
DeFi vs. CeFi Analysis
In Q1 2025, CeFi became the primary target for exploits, despite only two major attacks being recorded. This contrasts sharply with DeFi, which experienced a significantly higher incidence rate, with 38 documented attacks.
Overview
- DeFi DeFi has suffered $106,833,800 in total losses in Q1 2025 across 38 incidents. These numbers represent a 69% decrease compared to Q1 2024, when DeFi losses totaled $348,251,217.
- CeFi CeFi has suffered from 2 major attacks in Q1 2025, totalling in $1,529,100,000. In Q1 2024, no incidents were recorded on CeFi projects.
DeFi vs. CeFi
- DeFi: 5.8%
- CeFi: 94.2%
Losses by Chain
The two most targeted chains in Q1 2025 were Ethereum and BNB Chain. BNB Chain suffered the most individual attacks with 19 incidents, representing 44% of the total losses across targeted chains. Ethereum witnessed 15 incidents, representing 32% respectively.
Overview
- In Q1 2025, Ethereum and BNB Chain accounted for over half of the chain losses, totaling 76%.
- Base followed with 3 incidents, comprising 7%. Optimism and Arbitrum had 2 incidents, each representing 4.7%. Other chains, including Abstract, Wemix and Mode, suffered 1 attack each, representing 2.3% each.
Insights
- In Q1 2025, BNB Chain surpassed Ethereum and became the most targeted chain compared to the previous period.
Losses by Chain
| Chain | Incidents |
|---|---|
| BNB Chain | 19 |
| Ethereum | 15 |
| Base | 3 |
| Optimism | 2 |
| Arbitrum | 2 |
| Other | 6 |
Funds Recovery
Overview
In total, $6.5 million was recovered from stolen funds in 2 specific situations. This number makes up 0.4% of the total losses in Q1 2025.
| Project | Stolen | Recovered |
|---|---|---|
| 1inch | $5,000,000 | $5,000,000 |
| Moby Trade | $2,500,000 | $1,500,000 |
In Focus: Crypto Losses YTD
Monthly Overview
In total, the ecosystem has witnessed $1.62 billion in losses year-to-date (YTD) across 40 specific incidents. The majority of these losses came from over $1.5 billion lost in February alone.
| Month | Losses |
|---|---|
| January | $73,915,700 |
| February | $1,534,342,400 |
| March | $27,675,700 |
In Focus: Crypto Losses YTD
Total Losses YTD: Hacks vs. Fraud
| Month | Hacks | Fraud |
|---|---|---|
| January | $73,915,700 | $0 |
| February | $1,534,342,400 | $0 |
| March | $27,675,700 | $0 |
In Focus: Q1 2024 vs. Q1 2025
TVL (USD) All Protocols
- Total Value Locked across Q1 2024 vs. Q1 2025 (January 1 – March 1), ranging from $0 to $200B.
TVL (USD) Ethereum
- Total Value Locked across Q1 2024 vs. Q1 2025 (January 1 – March 1), ranging from $0 to $100B.
In Focus: Q1 2024 vs. Q1 2025
DeFi vs. CeFi
DeFi: 69% ↓ Losses are down 69% when compared to the previous period.
CeFi: ↑ Losses are up $1.5 billion when compared to the previous period.
*CeFi has suffered $1,529,100,000 in total losses in Q1 2025 across 2 incidents. In Q1 2024, there was no recorded incident on a CeFi project.
In Focus: Q1 2024 vs. Q1 2025
Hacks vs. Fraud
Hacks: 390% ↑ Losses are up 383% when compared to the previous period.
Fraud: 100% ↓ Losses are down 100% when compared to the previous period.
"The Q1 2025 breaches mark a historic moment in crypto security, with CeFi accounting for 94% of total losses, all caused by North Korean hackers. The sheer scale of the Bybit and Phemex attacks, totaling $1.5 billion, shows how state-backed actors are arguably the most pressing threat to our industry. Their success in breaching renowned, battle-tested platforms is a reminder of the need for security measures that protect the entire stack and help projects prevent catastrophic attacks before they happen."
Mitchell Amador Founder and CEO at Immunefi
Crypto Losses Q1 2025
Total Losses in Q1
$1,635,933,800
Major Losses
| Project | Loss |
|---|---|
| Bybit | $1.46B |
| Phemex | $69.10M |
| Infini | $49.50M |
| MIM Spell | $12.80M |
| zkLend | $9.50M |
Hacks vs. Fraud
| Type | Amount |
|---|---|
| Hacks | $1,635,933,800 |
| Fraud | $0 |
DeFi vs. CeFi
| Category | Amount |
|---|---|
| DeFi | $106,833,800 |
| CeFi | $1,529,100,000 |
Top Losses by Chain
| Chain | Incidents |
|---|---|
| BNB Chain | 19 |
| Ethereum | 15 |
| Base | 3 |
Download the full report here.
Get the full dataset here.
For questions about this study or Immunefi itself, reach out at press@immunefi.com
About Immunefi
Immunefi is the leading security platform for crypto, protecting more than $180 billion in user funds, and securing protocols across the full development lifecycle, from pre-deployment through production.
