The year 2025 will be remembered as the moment mega-exploits returned to cryptocurrency. After a quieter 2024, DeFi hacks 2025 totaled an estimated $3.3 to $4 billion in stolen funds — and a single incident, the Bybit hack of February 21, accounted for roughly $1.46 billion of that. Strip Bybit out of the ledger and the industry would have seen a net decline in stolen value year-over-year. With Bybit included, 2025 became one of the most expensive years on record. This recap walks through the five largest crypto hacks 2025 produced, dissects the technical root causes behind each, and extracts the defensive lessons that the industry is still struggling to absorb.
The Shape of 2025: Fewer Big Hacks, Bigger Tails
Before diving into individual incidents, it helps to understand the macro picture. Three independent reporting bodies — CertiK, Hacken, and Beosin — published 2025 loss figures ranging from $3.35 billion to $4.0 billion, depending on methodology. The variance comes from what each counts: pure smart-contract exploits, exchange infrastructure breaches, rug pulls, and phishing are categorized differently across reports.
Two structural facts stand out across every dataset. First, the median loss per incident dropped sharply — Immunefi recorded a 75% decline, from roughly $6 million in 2024 to about $1.5 million in 2025. The typical hack got smaller. Second, the tail of the distribution fattened dramatically: only six hacks exceeded $50 million (down from eight in 2024), but the largest among them was the biggest crypto theft ever recorded. 2025 was not the year of a thousand small cuts. It was the year of a few catastrophic ruptures.
The dominant driver was North Korea. Hacken attributed approximately 52% of all 2025 stolen funds to DPRK actors, with the Lazarus Group's TraderTraitor subgroup linked to both the Bybit and Phemex breaches. The same operational cluster hit multiple exchanges, reusing tooling and infrastructure across attacks. Supply-chain compromise — attacking the infrastructure around smart contracts rather than the contracts themselves — was CertiK's most costly vector, at $1.45 billion across just two incidents.
The Bybit Hack: $1.46 Billion and a Supply-Chain Wake-Up Call
On February 21, 2025, attackers stole approximately $1.46 billion from Bybit's Ethereum cold wallet in a single transaction — the largest cryptocurrency theft in history. The hack did not break Ethereum's cryptography or exploit a flaw in Bybit's smart contracts. It compromised a developer at Safe{Wallet} (the industry-standard multisig custody provider), injected malicious JavaScript into the signing interface Bybit used, and tricked three hardware-wallet signers into approving what they believed was a routine internal transfer. The actual payload was a delegatecall that replaced the wallet's implementation contract with an attacker-controlled one, after which sweepETH() and sweepERC20() functions drained 401,346 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH in five transactions.
The FBI formally attributed the attack to TraderTraitor, a Lazarus Group subgroup. Bybit remained solvent — processing 580,000 withdrawal requests in the hours after the breach and covering the loss from reserves — which prevented the contagion many feared. But the incident exposed a structural weakness no multisig threshold can fix: when the signing interface itself is compromised, hardware wallets verify cryptography, not semantics. The Ledger screens displayed raw hex calldata the signers could not meaningfully interpret, and they pressed confirm.
This article is a recap, so we stop here. The full technical forensic walkthrough — AWS S3 injection timeline, EIP-712 payload analysis, fund-laundering paths through Thorchain and Wasabi Mixer, and the recovery effort — is documented in our dedicated deep-dive: Bybit Hack: How $1.46 Billion Vanished. For the purposes of 2025's threat landscape, the takeaway is that the attack surface moved from smart contracts to the Web2 infrastructure surrounding them.
Cetus Protocol: A $223 Million Integer Overflow on Sui
Three months after Bybit, on May 22, 2025, Cetus Protocol — the leading decentralized exchange on the Sui blockchain — lost approximately $223 million to an integer overflow in its concentrated liquidity AMM (CLMM). The bug lived in a single math function, get_delta_a inside clmm_math.move, and it exploited a mis-sized overflow check that had survived audits.
The Bug: A Mis-Sized Overflow Check
Concentrated liquidity AMMs let liquidity providers deposit funds within a specific price range defined by tick boundaries. The get_delta_a function computes how much of token A corresponds to a given amount of liquidity across a tick range. Inside it, checked_shlw(u256) was supposed to detect overflow when shifting a value left by 64 bits — the correct threshold is 1 << 192, but the check used a wrong bound, so certain inputs slipped through and produced a wrapped (overflowed) result.
The attacker did not need a normal market condition to trigger this. They engineered the precondition:
- Flash swap — borrowed 10 million haSUI from a Cetus pool.
- Extreme tick range — opened an LP position with tick range [300000, 300200], a narrow band at the upper bounds of the tick space that standard test suites never exercise.
- Minimal liquidity — added just 1 unit of token A as liquidity.
- Overflow fires — due to the mis-sized check, the function returned a massive liquidity value:
10,365,647,984,364,446,732,462,244,378,333,008. - Drain — removed liquidity across multiple transactions, extracting roughly 5.7 million SUI from the pool.
- Repay and profit — repaid the flash swap and kept the difference.
Why This Matters Beyond Sui
The Cetus overflow was not a novel bug class. It was functionally identical to the KyberSwap Elastic exploit of November 2023, which stole $48.8 million through a tick-boundary rounding error in the same kind of CLMM math. Cetus lost roughly five times more because Sui's TVL had grown substantially in the intervening 18 months. The pattern is clear: the industry knows that CLMM position-initialization at extreme tick boundaries is a blind spot, yet standard audit test suites — which cover normal market ranges — still do not systematically exercise those boundaries. Until fuzzing and property-based testing target the tick extremes specifically, this bug class will keep recurring and keep growing in cost.
After the attack, the attacker bridged about $62 million in USDC to Ethereum and converted it to roughly 23,000 ETH. Sui validators coordinated to freeze the remaining stolen funds on-chain — a controversial but effective response that limited total extractable value. SUI's price dropped 7%, the CETUS token fell 40%, and some smaller Sui ecosystem tokens lost up to 80% of their value.
Balancer v2: $120 Million from a Rounding Direction Error
On November 3, 2025, Balancer V2 lost approximately $120 million across six networks when a rounding error in its Composable Stable Pools (CSPv5) let an attacker underpay for token swaps and then arbitrage the resulting imbalance. What makes this incident notable is that the vulnerable code had passed multiple independent security audits and was considered battle-tested.
The Mechanism: Rounding the Wrong Way
The bug lived in the _upscale function, which scaled token amounts using rate providers before swap math. It used mulDown — which rounds down — when the correct behavior for an exact-out swap was to round up. In the _swapGivenOut path, this caused amountOut to be rounded down, and StableMath mechanics then propagated the imprecision so that amountIn was also rounded down. The net effect: the caller paid slightly less than they should have for the tokens they received.
A few wei of imprecision per swap is harmless in isolation. The attacker's genius was magnifying it. They deployed a contract whose constructor executed 65 or more micro-swaps in a single transaction (226 total within a batchSwap), deliberately pushing token pool balances down to the 8-9 wei range. At those tiny balances, each rounding error represented up to 10% precision loss. Repeated across hundreds of operations, the cumulative effect reduced the pool's invariant D, which lowered the BPT (Balancer Pool Token) price, which the attacker then arbitraged to extract real value: 6,587 WETH and 6,851 osETH from the osETH/wETH pool, plus 4,260 wstETH from the wstETH/WETH pool — roughly 19,239 ETH (~$71M) from two pools, and about $120 million total across Balancer forks.
Three Preconditions, All Required
The exploit required three conditions to align simultaneously, which is why it had gone undetected:
- A rounding error in exact-out swaps — the
mulDownbug. - Rate providers attached to the pool — rate providers introduce the scaling step where the rounding direction matters.
- A low-liquidity state — only at near-empty balances does a few-wei error become a 10% error.
Only Composable Stable Pools that had both BPT and rate providers satisfied all three. Balancer V3 was unaffected because it uses a completely different architecture and codebase. The V6 CSPs were within their pause windows, so Balancer's governance paused them within minutes, blocking further exploitation. The deeper lesson: composability creates emergent vulnerabilities. No single audit examining the rounding function in isolation would flag mulDown as dangerous, because the danger only manifests when rate providers, low liquidity, and exact-out swaps combine. Multi-audited, "battle-tested" code can still harbor inconsistencies that only specific composability conditions expose.
Nobitex: $90 Million Burned, Not Stolen
On June 18, 2025, Predatory Sparrow (Gonjeshke Darande) — a pro-Israel hacktivist group — breached Nobitex, Iran's largest cryptocurrency exchange, and destroyed approximately $90 million in assets. This was the first major crypto hack where the primary objective was destruction, not theft, and it redefines the threat model in a way every exchange should note.
Political Motivation, Not Financial Gain
Predatory Sparrow stated explicitly that Nobitex was targeted for being "a key regime tool for financing terrorism and violating sanctions." The attack followed days of violent Israel-Iran conflict, and the group had breached Bank Sepah, an Iranian state bank, the day before. Nobitex was not chosen for its treasury; it was chosen for its geopolitical role. The exchange had moved more than $11 billion in assets in recent years and reportedly served wallets tied to the Iranian government, Hamas-affiliated media, and sanctioned Russian exchanges.
Funds Burned via Vanity Addresses
The attackers drained hot wallets across multiple blockchains — $49.3 million on Tron, $24.3 million on EVM chains, $2 million in Bitcoin, and $6.7 million in Dogecoin, per Cyvers. Then they did something unprecedented: they sent the funds to vanity addresses embedded with political messages, such as TKFuckiRGCTerroristsNoBiTEXy2r7mNX on Tron. Vanity addresses are generated by brute-forcing key pairs until the public address contains a desired substring. The private keys for these specific vanity addresses are computationally infeasible to recover, so the funds are permanently unreachable — effectively burned.
This is the critical distinction from every other hack in this recap. Bybit, Cetus, Balancer, and Phemex were all financially motivated thefts where the attacker wanted to spend the money. Nobitex was a destruction operation. The funds were not laundered; they were annihilated, with the address strings themselves serving as a propaganda payload. The group also threatened to release Nobitex's source code and internal data within 24 hours.
The defensive implication is uncomfortable: access controls and hot-wallet key management protect against theft, but they also protect against destruction. An attacker who does not care about extracting value has no incentive to leave funds in place while negotiating, no need for laundering infrastructure, and no financial trail to follow. The threat surface expands from "who can steal from us" to "who can burn us."
Phemex: $73 Million Across 16 Chains
The fifth major incident of 2025 came early in the year. On January 23, 2025, at 11:30 UTC, Phemex — a Singapore-based centralized exchange — lost approximately $73 million when its hot wallet private keys were compromised. The funds were drained across 16 blockchains simultaneously: Ethereum, Bitcoin, Solana, XRP, BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, and others.
One Key, Sixteen Chains
The scale across chains is the telling detail. Initial estimates were $29 million, then climbed to $69 million (PeckShield), $73 million, and eventually $85 million (Taylor Monahan) as more affected chains were identified. The fact that 16 chains were drained at the same time indicates a single key compromise point, not 16 separate breaches. Phemex's hot wallet key material was likely co-located — stored or derived in a way that one compromise exposed the keys for every chain the exchange operated on.
On-chain analysis linked the attacker's cluster to the same operational group behind the Bybit hack two months later, pointing again to Lazarus Group / DPRK. Phemex suspended deposits and withdrawals, published a Proof of Reserves, and gradually restored operations. The systemic blind spot here is multi-chain hot wallet key management: as exchanges expand to more chains, the key-management surface grows linearly while the blast radius of a single compromise grows with the number of chains supported. Co-locating keys for operational convenience converts a contained incident into a simultaneous multi-chain drain.
The 2025 Attack Vector Taxonomy
Looking across the five incidents, 2025's hacks cluster into five distinct root-cause categories — and each category maps to a specific defensive gap.
| Hack | Loss | Root-Cause Vector | Key Failure |
|---|---|---|---|
| Bybit | $1.46B | Supply-chain attack | Signing UI compromised; hardware wallets can't decode semantics |
| Cetus | $223M | Integer overflow | Mis-sized overflow check; extreme tick ranges untested |
| Balancer v2 | $120M | Rounding error | mulDown vs round-up; composability + low liquidity magnifies |
| Nobitex | $90M | Access control | Internal systems infiltrated; attacker burned funds |
| Phemex | $73M | Hot-wallet key compromise | Co-located keys across 16 chains |
Two cross-cutting themes run through these incidents. Supply-chain attacks dominate the cost column: CertiK named supply chain the most expensive vector of 2025, and the attack surface has migrated from smart contracts to the infrastructure around them — signing UIs, developer machines, AWS endpoints. Arithmetic edge cases resurface: Cetus and Balancer both fell to math bugs (integer overflow and rounding direction, respectively) that lived in audited, mature code and only triggered under specific boundary conditions. The industry tests normal market ranges; attackers engineer the boundaries.
A third theme — political cyberwarfare — entered the picture with Nobitex. Not every attacker wants your money, and not every breach ends in a negotiable theft. The threat model now includes actors whose goal is destruction and signaling.
Defensive Lessons: What Would Have Stopped Each Attack
Each of the five hacks points to a concrete, implementable defensive control. None of these controls are exotic or theoretical — they are known best practices that were not applied or were applied incompletely.
Supply-Chain Defense (Bybit)
The Bybit hack survives any multisig threshold because it compromised the interface the signers used to construct and review transactions. The defense is transaction simulation and human-readable decoding on the signing device itself: the hardware wallet (or a dedicated verification layer) should simulate the effect of a delegatecall and display "this replaces the wallet implementation" rather than raw hex. Blind signing — approving calldata you cannot interpret — is the failure mode. Exchanges should also enforce out-of-band transaction construction that does not depend on a web UI loaded from a third-party CDN, and reproducible builds for any signing software so that a tampered binary can be detected.
Boundary-Condition Testing (Cetus)
The Cetus overflow is preventable with property-based and fuzz testing that specifically targets extreme tick boundaries. Standard unit tests covering normal market ranges will never hit tick [300000, 300200] with 1 unit of liquidity. Audit checklists should require explicit test coverage of the minimum and maximum tick values, zero-liquidity edge cases, and overflow-boundary inputs to every arithmetic function. The KyberSwap precedent existed for 18 months before Cetus repeated it — the industry's failure was not discovering the bug class, but failing to systematically test for it across new CLMM deployments.
Composability Auditing (Balancer)
Balancer's rounding error was invisible in isolation and catastrophic in combination. The defense is composability-aware auditing that tests rounding direction under the specific conditions where it matters: rate providers present, low liquidity, exact-out swaps. Auditors should run invariant-preservation property tests that assert "no sequence of swaps can reduce the invariant below its true value" across randomized liquidity levels and rate-provider configurations. A single function review will never catch this; only a system-level property test can.
Access Segmentation (Nobitex)
Nobitex's access control failure let attackers reach hot wallets across multiple chains from a single infiltration. The defense is strict network and credential segmentation: hot-wallet signing infrastructure should be isolated from general internal systems, with separate authentication, separate network zones, and no shared credentials. Privilege should be scoped per-chain so that compromising the Tron signing system does not grant access to the EVM or Bitcoin signing systems. For exchanges operating in geopolitically contested environments, the assumption must be that sophisticated state-aligned actors are targeting the internal network, not just the smart contracts.
Key Isolation Per Chain (Phemex)
Phemex's 16-chain drain is the case for per-chain key isolation. Hot wallet keys for each blockchain should be generated, stored, and operated independently, so that compromising one chain's key does not expose another's. This trades operational complexity for blast-radius containment. Where co-location is unavoidable for cost reasons, the compromise of one key should trigger automatic rotation and freeze across all related keys, not just the affected chain.
FAQ
How much was stolen in DeFi hacks 2025 in total?
Total Web3 losses in 2025 ranged from $3.35 billion (CertiK) to $4.0 billion (Hacken), depending on methodology. The Bybit hack alone accounted for approximately $1.46 billion — roughly 40-50% of the total. Without Bybit, 2025 would have seen a net decrease in stolen funds compared to 2024.
What was the biggest DeFi hack of 2025?
The Bybit hack of February 21, 2025, was both the biggest DeFi hack of 2025 and the largest cryptocurrency theft ever recorded, at approximately $1.46 billion. It was a supply-chain attack on Safe{Wallet}'s signing infrastructure, not a smart contract exploit.
How did the Cetus Protocol hack work?
The Cetus Protocol hack exploited an integer overflow in the get_delta_a function of its CLMM math library on Sui. A mis-sized overflow check (checked_shlw) let the attacker open an LP position at an extreme tick range with minimal liquidity, receive a massively overflowed liquidity value, and drain the pool for about $223 million.
Why did Balancer v2 get hacked if it was audited?
Balancer v2's Composable Stable Pools had a rounding error in the _upscale function that used mulDown (rounds down) instead of rounding up. The bug was harmless in isolation but became exploitable when combined with rate providers and low liquidity — a composability condition that individual function-level audits did not test. Multiple audits missed it because the danger only emerges from the interaction of three specific conditions.
What made the Nobitex hack different from other crypto hacks 2025?
Nobitex was the first major crypto hack where the attacker's goal was destruction, not theft. Predatory Sparrow, a pro-Israel hacktivist group, sent the stolen $90 million to vanity addresses with anti-IRGC messages whose private keys are computationally infeasible to recover — permanently burning the funds rather than laundering them.
Was the Phemex hack connected to the Bybit hack?
On-chain analysis linked the Phemex attacker's cluster to the same operational group behind the Bybit hack two months later, pointing to Lazarus Group / DPRK (TraderTraitor subgroup). Both incidents involved exchange infrastructure compromise rather than smart contract bugs.
Are DeFi protocols getting safer or more dangerous in 2025?
Both, simultaneously. The median loss per incident dropped 75% (from ~$6M to ~$1.5M), meaning the typical hack got smaller and protocols' day-to-day security improved. But the tail of the distribution fattened: the largest hacks got larger, with Bybit setting an all-time record. 2025 shows a bifurcation — better baseline security, but higher catastrophic-tail risk from sophisticated supply-chain and state-aligned actors.
Conclusion
The biggest defi hacks 2025 produced share a common thread: the vulnerabilities were not exotic zero-days in novel cryptography. They were known bug classes — supply-chain compromise, integer overflow, rounding errors, access control failures, key co-location — that survived in mature, audited systems because the testing and threat models did not cover the specific boundary conditions or composability interactions where they hide. Bybit proved that the attack surface has moved to the infrastructure around smart contracts. Cetus and Balancer proved that arithmetic edge cases in audited math libraries remain an unresolved blind spot. Nobitex proved that not every attacker wants to steal. Phemex proved that operational convenience in key management converts contained incidents into multi-chain catastrophes.
The defensive playbook is not mysterious. Transaction simulation on signing devices, property-based testing at tick and liquidity extremes, composability-aware invariant audits, strict access segmentation, and per-chain key isolation would have stopped or contained each of these attacks. The gap between knowing these controls and implementing them is where 2025's billions went.