Q1 2025 in crypto hacks: Bybit’s $1.40 billion made up 86.8% of the quarter

Crypto losses in the first quarter of 2025 came to $1.61 billion across 37 incidents, according to the Bitminer.io failures ledger. In the fourth quarter of 2024 they had been $178.3 million. The first quarter of 2024 had lost $522.7 million across 58 incidents.

Fewer incidents and nine times the losses had one cause.

Bybit

On February 21, Bybit lost roughly $1.4 billion to $1.5 billion in ETH and other assets. Lazarus Group, the North Korean hacking group, phished a Bybit DevOps engineer and spoofed the Safe interface used to approve transfers. Bybit’s signers blind-signed a disguised transaction that installed a rogue hot-wallet policy, and the funds were drained.

The ledger records the loss at $1.40 billion, 86.8% of the quarter. It is the third-largest of the 1,272 incidents with a known loss. The ledger also records $1.40 billion as returned or repaid, which counts the exchange replacing customer funds itself.

It was the Radiant attack of October 2024 at a far larger scale: signers approving what they couldn’t properly see.

The rest of the quarter

A month earlier, Singapore-based exchange Phemex had its hot wallets drained across more than a dozen chains, with reported losses between $69.1 million and $85 million. Together, the two exchange incidents made up $1.49 billion, 92% of losses.

Infini lost $49.5 million on February 24 when a former developer who still held privileges over its vault emptied the contract. Abracadabra.Money lost about $13 million in March when an attacker used a flash loan to abuse its liquidation logic. DogWifTools, a Solana token-launch tool, had its software update hijacked to ship malware that stole about $10 million from users.

Key compromises and social engineering made up 96.7% of the quarter’s losses. DeFi protocols had 31 of the 37 incidents but only $117.6 million, or 7.3%, of the losses. Of the 37 incidents, 24 were under $1 million.

Sources

1. DefiLlama hacks data
2. Bitminer.io failures ledger: 2025

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.

More on North Korea, Bybit