$2.1B in Crypto Stolen in 2025 as Hackers Target Users Over Code

So far in 2025, the crypto community has seen over $2.1 billion vanish into the hands of hackers—and it’s not coming from your typical smart contract bugs. According to blockchain security firm CertiK, the new frontier for cybercriminals isn’t faulty code… it’s you.

Yep, the biggest vulnerabilities now lie in user behavior—phishing emails, spoofed wallet interfaces, mismanaged keys, and all-too-convincing scams. And the bad guys? They’re getting more creative, more personal, and more effective.

Let’s unpack why this shift is happening, what types of attacks are on the rise, and what you can actually do to protect yourself in this increasingly tricky environment.

Why Hackers Are Targeting People Over Code

Ronghui Gu, co-founder of CertiK, said it clearly: “Attackers always target the weakest point.”

In the early days of DeFi, that weakest point was often poorly audited smart contracts. Think flash loan attacks, reentrancy bugs, or misconfigured oracles. But with better tooling, audits, and industry maturity, those technical weaknesses are harder to exploit now.

So hackers have moved on—to us.

CertiK’s Key Findings:

• $2.1 billion stolen so far in 2025
• Most of that came from wallet compromises and phishing attacks
• Social engineering has overtaken smart contract exploits as the leading threat
• Human error, not faulty code, now accounts for the majority of security lapses

Why This Shift Makes Sense:

• Smart contracts are improving thanks to better audits and open-source vetting
• Users remain untrained and are often unaware of basic safety practices
• Phishing is cheap, scalable, and often successful
• Wallet access is everything—steal a key, drain a wallet. No need for fancy exploits

How Social Engineering Attacks Work in Crypto

Social engineering doesn’t mean high-tech wizardry. It means tricking people with carefully designed deception. In crypto, these tricks are easier than ever.

Here are some common methods:

1. Phishing Links

Fake DApps, malicious airdrop offers, or wallet connection requests sent via email, Discord, or Telegram.

Example:
You click a link promising free tokens, connect your wallet, and boom—your assets are drained.

2. Address Poisoning

Hackers mimic your wallet address with a lookalike, hoping you copy-paste it during a transaction.

How It Works:
They send a small amount of tokens from a similar-looking address. When you go to send funds, you accidentally send it to them.

3. Fake Support Agents

Posing as MetaMask or Ledger support reps in chat groups.

The Trick:
They offer to help with “technical issues” and ask for your seed phrase.

4. Compromised Chrome Extensions or Wallet Interfaces

Even apps and extensions can be corrupted or spoofed to intercept keys or sign malicious transactions.

The Numbers Behind the Threat

According to CertiK’s data:

• $1.4 billion of 2025’s total losses came from a single event: the Bybit hack on February 21
• That attack was reportedly pulled off by North Korea’s Lazarus Group
• Phishing attacks alone accounted for $1B+ across 296 incidents in 2024
• 2025 is on track to match or exceed those numbers

This trend reflects a new normal: DeFi is becoming more secure, but the crypto user base? Still way too easy to trick.

Why DeFi Being “Secure” Isn’t Enough

Even if your favorite DEX is audited, your funds are still vulnerable. Here’s why:

• Users are the endpoint of every transaction. A safe protocol won’t save you if you sign a malicious transaction.
• Wallet keys = final authority. If someone steals them, they own your funds. Period.
• Tools are evolving, but so are scams. AI-generated phishing emails, deepfakes, and even cloned voice support calls are emerging.

As CertiK’s Gu said:

“The code used to be the weakest point—but now, it’s user behavior that hackers are exploiting.”

How to Protect Yourself in This New Era of Crypto Security

It’s not all doom and gloom. While the threats are real, so are the solutions—if you’re willing to use them.

Security Checklist for 2025 Crypto Users:

1. Never share your seed phrase.
Not with “support agents,” not with friends, not even with other wallets.

2. Use a hardware wallet.
Cold storage reduces exposure to browser-based attacks.

3. Double-check every transaction.
Especially wallet addresses. Use ENS or trusted address books when possible.

4. Beware of fake sites and links.
Always type URLs manually or use bookmarks for exchanges and DeFi apps.

5. Turn on multi-factor authentication (MFA)
Especially for exchanges and mobile wallets.

6. Stay updated on recent threats.
Follow security experts and trusted sources like CertiK, SlowMist, and DeFiSafety.

7. Use wallet simulation tools.
Some platforms now simulate transactions and flag suspicious contract behavior before you sign.

8. Watch for wallet drainage approvals.
Regularly revoke permissions on platforms like Revoke.cash or Etherscan Token Approvals.

The Silver Lining: DeFi Is Getting Stronger

Ironically, this surge in social engineering may mean something positive—smart contracts are getting harder to hack. The infrastructure is improving. Audits are more standard. Tools are better than ever.

Now, the final piece of the puzzle is user education.

As Gu puts it:

“The industry must now invest in better wallet security, access control, real-time transaction monitoring, and simulation tools.”

Only when you become your own first line of defense will the crypto industry finally become as secure as it needs to be.

Final Thoughts: Humans Are the New Attack Surface

In 2025, the battle for crypto security has moved from code to the click. Hackers aren’t looking for bugs—they’re looking for behavior.

Wallets aren’t being hacked. People are being tricked.

And while it’s easy to point fingers at protocols or exchanges, the truth is: security is personal now.

Stay cautious, stay updated, and most importantly—stay skeptical.

FAQs

Q: Why are hackers shifting from code exploits to social engineering?
A: Smart contracts are getting more secure, while users remain the most vulnerable part of the system.

Q: What was the biggest crypto hack of 2025 so far?
A: The $1.4 billion Bybit hack in February, reportedly carried out by North Korea’s Lazarus Group.

Q: What’s the most common type of attack now?
A: Phishing and wallet compromise through social engineering.

Q: How can I avoid getting phished?
A: Use cold wallets, double-check links, revoke permissions, and never give out your seed phrase.

Q: Where can I track these kinds of attacks?
A: Follow CertiK, PeckShield, or the Rekt Database for real-time reporting on DeFi exploits.