Losses from crypto hacks and exploits fell significantly in the third quarter of 2025, but a record number of million-dollar incidents underscored the evolving tactics of cybercriminals targeting wallets and centralized exchanges.

According to data from blockchain security firm CertiK shared with Cointelegraph, Q3 losses totaled $509 million — down 37% from the $803 million stolen in Q2 and more than 70% below Q1’s $1.7 billion.

The sharpest decline came from code vulnerabilities, which dropped from $272 million in Q2 to just $78 million in Q3. Phishing-related attacks also fell in value terms, even though the number of incidents remained consistent.

Total amount lost and total amount of security incidents in 2025. Source: CertiK

Despite the decline, analysts warned that hackers are adapting, moving away from mega-contract exploits to more targeted wallet and infrastructure breaches.

September Hits Record for Million-Dollar Hacks

September emerged as the most active month for high-value crypto thefts ever recorded, with 16 hacks surpassing the $1 million mark. This broke the previous record of 14 incidents set in March 2024.

So far in 2025, the average has been nearly six major incidents per month — fewer than the eight-plus monthly average seen in 2024 and 2023. Notably, the quarter did not include a single $100 million “mega-hack,” but attackers increasingly focused on mid-range targets that are harder to prevent and trace.

Security incidents with over $1 million in losses in 2025. Source: CertiK

Exchanges and DeFi Still Prime Targets

Centralized exchanges were the hardest hit in Q3, losing $182 million to sophisticated attacks. CertiK said exchanges and DeFi platforms remain the most lucrative targets for cybercriminals, particularly for state-sponsored groups.

Losses by project type in Q3 2025. Source: CertiK 

Decentralized finance (DeFi) protocols ranked second, with $86 million in Q3 losses. The largest incident was a $40 million exploit of GMX v1, though the attacker later returned funds after negotiating a $5 million bounty.

New ecosystems also showed vulnerabilities. Hacken flagged exploits on Hyperliquid’s ecosystem, including the HyperVault breach and HyperDrive rug pull, urging users to proceed with caution.

North Korea Remains the Biggest Threat

Hacken CEO Yevheniia Broshevan told Cointelegraph that North Korean cyber units were responsible for about half of the total funds stolen in Q3. She warned that hackers’ methods are evolving, shifting from phishing to complex, multi-step operational compromises.

Outlook: Signs of Progress Amid Persistent Threats

Despite the record number of million-dollar incidents, Q3’s overall 37% decline in losses and a 71% reduction in code-based exploits point to stronger defenses and more resilient codebases across the industry.

The data suggests that while hackers remain a major threat — particularly through wallet and infrastructure breaches — industry-wide security improvements may be reducing the scale of catastrophic losses.

“This is a wake-up call,” Broshevan said. “Centralized platforms and users exploring emerging chains like Hyperliquid must double down on operational security and due diligence.”