The Worst Quarter in History: Crypto Lost $1.64 Billion to Hackers in Q1 2025
In the first three months of 2025, the crypto ecosystem lost a whopping $1,635,933,800 across 39 incidents, according to the blockchain security platform Immunefi.
Immunefi’s latest report notes that “Q1 2025 marks the worst quarter for hacks in the history of the crypto ecosystem.”
Hacks were behind the majority of the $1.64 amount. Most of that was the result of only two hacks of two centralized exchanges. Phemex suffered a $69.1 million loss in January, while Bybit lost $1.46 billion in February.
Subsequently, the total number of losses in the first quarter marks a 4.7x increase compared to Q1 2024. At that time, hackers and fraudsters stole $348,251,217.
Notably, experts assume that the infamous North Korean Lazarus Group is behind the two largest attacks. They stole $1.52 billion, or 94% of total losses. This “marks a historic moment in crypto security,” says Immunefi Founder Mitchell Amador.
“The sheer scale of the Bybit and Phemex attacks, totaling $1.5 billion, shows how state-backed actors are arguably the most pressing threat to our industry,” Amador adds. “Their success in breaching renowned, battle-tested platforms is a reminder of the need for security measures that protect the entire stack and help projects prevent catastrophic attacks before they happen.”
Given that exchanges manage large sums of money, “even a small breach can result in hundreds of millions in losses,” the report states.
Crypto Loss to Hacks Jumps 390%
Unsurprisingly, hacks were still the main cause of losses, accounting for 100% of the total losses compared to fraud. The total loss due to hacks amounts to nearly $1.64 billion, recorded across 39 specific incidents, representing a 390% increase compared to Q1 2024.
Given that the space saw no fraud incidents in this period, that represents “a significant decrease” compared to the same period in 2024. At that time, frauds, scams, and rug pulls caused a total loss of $14,665,817.
Meanwhile, BNB Chain surpassed Ethereum in Q1 2025, becoming the most targeted chain. These two chains together accounted for 76% of losses.
Interestingly, while centralized finance (CeFi) saw only two attacks in the year’s first quarter, it still became the primary target for exploits, given the massive amount lost. In comparison, there were no exploits of CeFi projects recorded in Q1 2024.
On the other hand, decentralized finance (DeFi) saw 38 incidents, yet recorded $106,833,800 in total losses. These numbers represent a 69% decrease compared to Q1 2024, when DeFi losses totaled $348,251,217, the report concludes.
Additionally, $6.5 million of the stolen funds was recovered in Q1 2025 – just 0.4% of the total losses. Meanwhile, Immunefi has so far paid out over $112 million in total bounties and saved over $25 billion in user funds, it says. It currently offers over $180 million in available bounty rewards.