This year, global Web3 security attacks decreased, but losses increased by 37%. Phishing attacks have become the biggest threat | Lianhe Zaobao

In 2025, although the number of security incidents in the global cryptocurrency asset sector decreased to 630, the financial losses reached as high as $3.353 billion (approximately SGD 4.3 billion), a 37.06% increase from $2.446 billion in 2024. The 2025 Web3 Security Report released by the blockchain security company CertiK pointed out that this year the number of security incidents decreased by 137, but the average loss per attack reached $5.3219 million (approximately SGD 6.83 million), a year-on-year surge of 66.64%. This indicates that, despite the overall decrease in the number of incidents, the scale and impact of attacks have significantly increased, reminding the industry that investment in security protection remains crucial. The report noted that this trend shows attackers are gradually concentrating resources on fewer but more impactful high-value attacks, particularly in the area of supply chain attacks, where this phenomenon is particularly prominent. Although only two related incidents occurred in 2025, their cumulative losses amounted to $1.45 billion, accounting for nearly half of the total losses. Among them, the Bybit incident in February caused losses of approximately $1.4 billion, becoming one of the largest cryptocurrency thefts in history. In this incident, the attackers did not directly breach the exchange's system but instead infiltrated the developer environment of a third-party multi-signature wallet service provider, implanting malicious code in the signing process to bypass the multi-approval mechanism. Artificial Intelligence as a "Magnifier" for Phishing Attacks Excluding the Bybit incident, phishing attacks, wallet thefts, and code vulnerabilities are the three most severe security threats in terms of financial losses. Further Reading In the past five years, over $15 billion in cryptocurrency has been stolen by hackers Bybit attacked, $1.5 billion in cryptocurrency stolen, possibly the largest theft in the crypto space Phishing attacks are the most common attack method, with 248 incidents causing approximately $723 million in losses. Due to conservative statistics, the actual losses may be even more severe. Code vulnerability attacks follow closely behind, with 240 incidents resulting in losses of $555 million. The report emphasizes that the widespread adoption of artificial intelligence has significantly lowered the technical barriers for phishing attacks. Attackers use artificial intelligence to generate highly realistic phishing websites, wallet pop-ups, and multilingual scam messages, and combine on-chain data with social media content for precise targeting. Traditional defense methods that rely on grammatical errors or template features for identification are gradually becoming ineffective. Additionally, wallet intrusion attacks occurred 55 times throughout the year, but the financial losses reached $557 million, reflecting a high average loss per incident. From a platform perspective, Ethereum is the most frequently attacked blockchain platform, with 310 incidents of hacking, scams, and exploitations resulting in approximately $1.7 billion in losses. Hackers also focus on Bitcoin, with 22 incidents causing about $528 million in losses. CertiK predicts that by 2026, AI-driven impersonation attacks, complex supply chain intrusions, and social engineering attacks targeting individual users will continue to evolve. A more mature regulatory framework, strong real-time monitoring capabilities, and the widespread use of AI-assisted defense tools are expected to reduce the occurrence of preventable risks