The crypto universe has undergone a financial earthquake

In the first quarter of 2025, hackers siphoned off $1.63 billion, shattering all records. A deep dive into the crisis that shakes the foundations of decentralization.

The crypto universe is used to mind-boggling figures, but the first quarter of 2025 for web3 theft has reached astronomical proportions: $1.63 billion in crypto was stolen in Q1, shattering all previous records. To put this in perspective, the entire year of 2024 saw $1.1 billion in web3 theft.

This staggering sum is largely due to the titanic attack on Bybit, which alone accounts for 92% of the total losses. But beyond this brutal statistic lies a more nuanced reality: flaws are exploited, ecosystems are vulnerable, and resilience is fragile.

A Sledgehammer Blow

The attack on Bybit, which occurred in February 2025, is like a detonation in the tidy narrative of crypto winter. With $1.53 billion vanished, this feat is one of the boldest in crypto history. To understand its impact, we must return to the figures: in January, losses amounted to $87 million, already an alarming sum.

Then February arrived, transforming a worrying trend into a systemic catastrophe. Bybit wasn’t just hacked; it was dismantled, exposing structural vulnerabilities that many believed unlikely.

However, this carnage did not eclipse other attacks. Also in February, Infini suffered $50 million in theft, zkLend sustained $9.5 million in losses, and Ionic was hit for $8.5 million. These incidents, overshadowed by Bybit, showcase a resurgence of diverse targets: DeFi protocols, lending platforms, trading infrastructures.

Hackers are diversifying their strategies, shifting from exploiting smart contracts to manipulating institutional wallets. They are deploying increasingly sophisticated techniques to siphon funds from centralized exchanges and institutions.

March brought a semblance of respite, with a 97% drop in thefts, which reached a minimal $33 million. Some funds were even returned, like the $4.5 million recovered by 1inch after tough negotiations with hackers. But this relative calm should not deceive: it is less about protocols improving security than a tactical pause. Hackers digest their loot while protocols and institutions hastily strengthen their shields.

Coins used in scams

The report also provides a breakdown of the cryptocurrencies targeted by hackers in the first quarter of 2025. Of the $1.63 billion stolen, $1.5 billion was in stablecoins, mainly Tether (USDT) and USD Coin (USDC). This preference for stablecoins is likely due to the fact that they are easily liquidated on the open market.

Of the remaining $132 million, $117 million was in Bitcoin (BTC), and smaller amounts were stolen in other cryptocurrencies, including Ether (ETH), Solana (SOL), and Axie Infinity (AXS).

The report notes that the majority of the stolen cryptoassets were used in "plus token" and "HYIP" scams. Plus tokens are a type of cryptocurrency scam that promises investors high returns with low investment amounts, typically entices investors with the prospect of becoming an "early user" of a new cryptocurrency, and relies on a multi-level marketing scheme to recruit new investors. HYIPs, or High Yield Investment Programs, are investment scams that promise unrealistically high returns over short periods of time. They typically create a website or social media presence to promote their services and attract investors.

The report's findings highlight the ongoing threat of cryptocurrency scams and the importance of investors being aware of the risks. Investors are advised to be skeptical of investment opportunities that promise unusually high returns and to conduct thorough research before investing in any cryptocurrency project.