Crypto Hacks Persist with Concentrated Losses in Major Exploits

A recent security report by Immunefi reveals that while the frequency of crypto hacks remains steady, the financial losses are increasingly concentrated in a few large-scale exploits. According to Cointelegraph, the report analyzed 425 publicly known incidents from 2021 to 2025, estimating an average hack loss of approximately $25 million. In 2024 and 2025 alone, 191 hacks resulted in $4.67 billion in losses, with just five incidents accounting for 62% of the total. Centralized exchange breaches, though fewer in number, were responsible for the majority of these losses. Twenty exchange hacks contributed to around $2.55 billion, or about 55% of the total, highlighting the vulnerability of large pools of user funds concentrated in fewer points of failure. The report also noted that token markets are reacting more severely to breaches. Among 82 hacked tokens tracked, prices fell a median of 61% within six months, with 83.9% remaining below their hack-day price during that period. Immunefi CEO Mitchell Amador explained that the market's expectations have shifted, viewing breaches as indicators of deeper issues in engineering, governance, and operational resilience. Amador emphasized that the impact of exploits extends beyond the initial financial loss, affecting token prices, treasury capacity, leadership, development time, and user trust. The report also highlighted the interconnected nature of DeFi systems, where a single incident can have cascading effects across lending, collateral, and liquidity networks. An example is the collapse of Elixir’s deUSD stablecoin in November 2025, which was linked to a $93 million loss by Stream Finance, leading to a significant devaluation of deUSD. Despite a decrease in crypto-related hack losses to $26.5 million in February, the lowest monthly total in nearly a year, several security incidents have emerged in March. Google researchers identified a new exploit kit, Coruna, targeting Apple iPhone users to steal cryptocurrency wallet seed phrases. Additionally, the Bitcoin-based DeFi platform Solv Protocol reported a $2.7 million exploit affecting fewer than 10 users, with the project offering a bounty for the return of funds. Meanwhile, the domain of Bonk.fun was hijacked, leading to a wallet-draining scheme, and NFT lending platform Gondi disabled a faulty smart contract after an exploit resulted in the theft of approximately $230,000 worth of NFTs. The project is compensating affected users while investigating the vulnerability.