Web3 Industry April Security Report: Losses Reach $364 Million, Phishing Attacks as Main Cause

The latest data shows that the Web 3.0 industry suffered losses of up to $364 million due to security incidents in April 2025, with the vast majority stemming from phishing attacks. This staggering figure primarily comes from a single incident: a U.S. senior citizen fell victim to a meticulously designed social engineering attack, resulting in the theft of 3,520 bitcoins.

The investigation shows that the stolen assets were quickly transferred to multiple trading platforms and exchanged for Monero, causing a brief surge in XMR price by 50%. The victim was identified as an elderly individual who has held these bitcoins since 2017.

In addition, several notable attack incidents occurred in April. A decentralized exchange platform lost $7.5 million due to a price oracle vulnerability; a project team was hacked and lost $5.8 million; and an airdrop contract of an Ethereum scaling protocol was also attacked, resulting in over $5 million being stolen by the attackers. Fortunately, with the assistance of white hat hackers, all three platforms were able to partially recover the stolen funds.

Compared to the loss of $28.8 million in March, the figure in April saw a significant increase. However, it still pales in comparison to the $1.5 billion "historic highest month" set in February. At that time, a hacker group launched a large-scale attack on a well-known exchange, shocking the entire industry.

Industry experts warn that although blockchain technology has gradually become an important component of global financial infrastructure, security challenges remain severe. According to statistics, in the first quarter of 2025, the industry lost up to $1.67 billion due to hacker attacks, a quarter-on-quarter increase of 303%, with the Ethereum ecosystem becoming the main target of attacks.

Given the continuous growth of phishing attacks, security experts remind Web3.0 project teams and investors to verify the authenticity of URLs and smart contracts before making asset transfers. At the same time, users are advised to store assets in cold wallets and avoid publicly sharing information related to their digital assets on social media to enhance asset security.