2025 Web3 Blockchain Security Status Report

Foreword

This research report, initiated by the Blockchain Security Alliance and co-authored by alliance members Beosin and Footprint Analytics, aims to comprehensively explore the global blockchain security landscape in 2025. Through analysis and assessment of the current state of global blockchain security, the report will reveal the current security challenges and threats, and provide solutions and best practices. Blockchain security and regulation are key issues in the development of the Web3 era. Through in-depth research and discussion in this report, we can better understand and address these challenges to promote the security and sustainable development of blockchain technology.

1. Overview of Web3 Blockchain Security Situation in 2025

According to monitoring by Alert platform under Beosin, a blockchain security and compliance technology company, the total losses in the Web3 field caused by hacking attacks, phishing scams, and project Rug Pulls reached US$3.375 billion in 2025. There were a total of 313 major blockchain security incidents, including 191 hacking attacks with a total loss of approximately US$3.187 billion; project Rug Pull incidents with a total loss of approximately US$11.5 million; and 113 phishing scams with a total loss of approximately US$177 million.

In 2025, the types of projects attacked included DeFi, CEX, public chains, cross-chain bridges, NFTs, Memecoin trading platforms, wallets, browsers, third-party code packages, infrastructure, MEV bots, and many others. DeFi remained the most frequently attacked project type, with 91 attacks targeting DeFi resulting in losses of approximately $621 million.

4. Losses by Chain

Ethereum suffered the highest losses and had the most security incidents.

As in previous years, Ethereum remains the public chain with the highest losses and the most security incidents.

170 security incidents on Ethereum resulted in losses of approximately $2.254 billion, accounting for 66.79% of the total losses for the year. The second most affected public blockchain was BNB Chain, with 64 security incidents causing losses of approximately $89.83 million. While BNB Chain experienced more on-chain attacks, the total losses were relatively smaller. However, compared to 2024, both the number of security incidents and the amount of losses increased significantly, with the amount of losses increasing by 110.87%. Base was the third most affected blockchain, with a total of 20 security incidents. Solana followed closely with 19 security incidents. 5. Attack Method Analysis Contract vulnerability exploitation was the most frequent attack method. Of the 191 attack incidents, 62 were due to contract vulnerability exploitation, accounting for 32.46%, resulting in total losses of $556 million. This was the largest loss-making attack method besides Bybit's supply chain attack. According to the breakdown of contract vulnerabilities, the vulnerability causing the most losses was the business logic vulnerability, with a total loss of $464 million. The top three contract vulnerabilities by frequency were business logic vulnerabilities (53 times), access control vulnerabilities (7 times), and algorithm defects (5 times). This year, there were a total of 20 private key breaches, resulting in a total loss of approximately $180 million. The number of breaches and the resulting losses are significantly lower than last year. Exchanges, project teams, and users have shown increased awareness of private key protection.

6. Typical Security Incident Attack Analysis

6.1 Analysis of the $224 Million Cetus Protocol Security Incident

Event Summary

On May 22, 2025, the DEX Cetus Protocol on the Sui ecosystem was attacked. Its vulnerability stemmed from an implementation error in the left shift operation in the open-source library code. Taking one of the attacked transactions (https://suivision.xyz/txblock/DVMG3B2kocLEnVMDuQzTYRgjwuuFSfciawPvXXheB3x?tab=Overview) as an example, the simplified attack steps are as follows:

1. Enable Flash Loan: The attacker borrowed 10 million haSUI through a flash loan.

Vulnerability Analysis

The root cause of this attack lies in the implementation error of `checked_shlw` in the `get_delta_a` function, which causes the overflow check to fail. Attackers only need a small number of tokens to exchange for a large amount of assets in the liquidity pool, thus enabling the attack.

Furthermore, in Move, integer arithmetic is designed to prevent overflow and underflow, as these can lead to unexpected behavior or vulnerabilities. Specifically: if the result of addition and multiplication is too large for an integer type, the program will terminate. If the divisor is zero, division will terminate.

The unique feature of left shift (<<) is that it does not terminate when an overflow occurs. This means that even if the number of bits shifted exceeds the storage capacity of the integer type, the program will not terminate, potentially leading to erroneous values ​​or unpredictable behavior.

6.2 Analysis of the Balancer $116 Million Security Incident