Web3 Industry April Security Report: Losses of $364 million, Phishing Attacks as the Main Cause

Latest data shows that the Web3 industry lost as much as $364 million due to hacker attacks and scams in April 2025, with $337 million stemming from phishing attacks. This staggering figure mainly comes from a single incident: an elderly American citizen fell victim to a meticulously designed social engineering attack, resulting in the theft of 3,520 bitcoins.

On-chain analysis shows that these stolen assets were quickly transferred to multiple swap platforms and exchanged for Monero, causing a brief surge in XMR prices by 50%. The victim has been identified as an elderly individual who has held these Bitcoins since 2017.

In addition, several notable attacks occurred in April:

1. A decentralized trading platform was attacked for $7.5 million, with the attacker exploiting a price oracle vulnerability.
2. The project Loopscale was hacked, resulting in a loss of $5.8 million.
3. An airdrop contract of a certain Ethereum scaling protocol was hacked, resulting in the theft of over 5 million dollars.

Fortunately, the three platforms mentioned above were able to partially recover the stolen funds with the assistance of white hat hackers.

Compared to the loss of $28.8 million in March, the losses in April increased significantly. However, relative to the "historical highest month" of $1.5 billion set in February, the losses in April remain relatively limited. The massive losses in February were primarily due to a large-scale attack launched by a hacker organization against a well-known exchange.

Industry experts warn that although blockchain technology has gradually become an important part of the global financial infrastructure, security challenges remain severe. Data shows that in the first quarter of 2025, the industry suffered losses of up to $1.67 billion due to hacker attacks, an increase of 303% compared to the previous quarter, with the Ethereum ecosystem becoming a major target for attacks.

In response to the increasingly severe security situation, experts suggest:

1. When Web3 project parties and users are transferring assets, they must verify the authenticity of the website and smart contract.
2. Use cold wallets and other storage methods that are isolated from the internet to enhance asset security.
3. Avoid publicly sharing personal digital asset information on social media.

With the rapid development of the Web3 industry, security issues have become a key factor restricting its healthy development. The industry calls for the incorporation of advanced technologies such as formal verification into the security protection system and emphasizes that the industry should face the systemic risks exposed by every attack incident, working together to build a more secure and reliable Web3 ecosystem.