Social engineering drives 55% of crypto TVL exploits in 2025, report finds
Industry data shows crypto total value lost (TVL) to exploits in 2025 exceeded $2.53 billion, with social engineering now the dominant attack vector. Sentora attributes 55.3% (~$1.39 billion) of exploit-related losses to social engineering and human-centric attacks. Private key compromise accounted for 15% (~$0.37 billion), while infinite mint and smart-contract bugs made up the remainder. Chainalysis and other monitors estimate total crypto theft across all categories in 2025 at $2.7–$3.4 billion; DPRK-linked groups were the largest identifiable actors, tied to roughly $2.02 billion in theft including an estimated $1.4 billion Bybit breach. Analysts say improved automated auditing and formal verification have reduced large smart-contract vulnerabilities, shifting attacker focus to user-targeted and operational weaknesses. Traders should note the shift: losses are increasingly driven by social engineering, poor key management, and operational lapses rather than pure protocol code flaws.
Bearish
This news is bearish because the dominant rise of social engineering and operational failures increases systemic risk across exchanges, custodians, and retail wallets. Unlike a single smart-contract bug that can be patched and audited away, social engineering targets human and operational processes that are harder and slower to fix at scale. Large thefts — including a ~$1.4B Bybit exploit linked to DPRK actors — and Chainalysis’s $2.7–$3.4B annual theft range undermine market confidence, likely increasing risk premiums and prompting short-term sell pressure as traders de-risk. In the short term, expect heightened volatility in affected tokens and possible outflows from centralized venues and new listings, while security-focused assets or stablecoins may see relative demand. In the medium-to-long term, the market may adapt: improved custody practices, mandatory operational controls, insurance products, and tighter KYC/AML could restore confidence. However, until operational security materially improves, persistent theft risk will weigh on investor sentiment and capital allocation decisions.