This year, 1,200 Web3 security incidents occurred, with damages exceeding 5 trillion won.

Goplus Annual Security Report: "Simultaneous Increase in Large-Scale Hacks and Small-Scale Fraud"

The damage caused by major security incidents in the Web3 sector this year has exceeded $3.5 billion (KRW 5.027 trillion).

According to the Rekt Database from blockchain security platform GoPlus, there have been more than 1,200 serious security incidents targeting users and projects in the Web3 space this year, with a total damage exceeding $3.5 billion.

Bybit's $1.5 billion hack caused the largest damage, with the top three incidents all occurring at major exchanges.

By attack type, the most frequent attacks were private key theft (based on viruses, Trojans, and social engineering techniques), phishing attacks, and rugful tokens (fraudulent tokens).

Notably, the top three incidents in terms of damage were all reported to have targeted centralized exchanges. The Bybit hack (February 21, $1.5 billion), the Cetus hack (May 22, $223 million), and the Balancer hack (November 2, $128 million) were recorded as the largest damage incidents of 2025.

"Precision strikes and widespread fraud in parallel"… Polarization of attack strategies

Security experts analyzed that this year's security situation exhibited two distinct characteristics: an increase in mega-incidents and a significant decrease in the cost of micro-fraud targeting users. This indicates a shift in attacker strategies, with a trend toward simultaneously employing "precision attacks" targeting high-value assets and "wide-scale fraud" targeting large numbers of people.

It's noteworthy that a total of 12 large-scale attacks occurred, each resulting in losses exceeding $30 million, and seven of these targeted centralized finance (CeFi) platforms. Theft of administrator private keys and hot wallet private keys were identified as the primary causes, highlighting the serious security vulnerabilities of centralized exchanges.

There are growing voices in the industry calling for centralized exchanges to comprehensively review their private key management systems and take fundamental security enhancement measures, such as expanding the use of multi-signature wallets and cold wallets.

Joohoon Choi joohoon@blockstreet.co.kr