Web3 Industry Security Situation in April: Losses of $364 million, Phishing Attacks as the Main Cause

A recent security analysis report revealed that the Web3 industry will suffer losses of up to $364 million due to security incidents in April 2025, with phishing attacks accounting for the largest share of losses at $337 million. This data has sparked widespread concern within the industry regarding blockchain security issues.

It is worth noting that the massive losses in April were mainly due to a major phishing incident. A senior citizen in the United States fell victim to a carefully designed social engineering attack, resulting in the theft of 3,520 bitcoins. According to investigations, the stolen assets were quickly transferred to multiple trading platforms and exchanged for anonymous cryptocurrencies, causing significant short-term fluctuations in the prices of the relevant coins.

In addition, several notable security incidents occurred in April. A decentralized exchange platform suffered a $7.5 million attack due to an oracle vulnerability; a project team was hacked and lost $5.8 million; an airdrop contract of an Ethereum scaling protocol was also attacked, with over $5 million stolen. Fortunately, with the assistance of white hat hackers, these platforms have partially recovered the stolen funds.

Compared to the loss of $28.8 million in March, the loss amount in April shows a significant upward trend. However, compared to the record monthly loss of $1.5 billion set in February, the data for April is still relatively small. The massive loss in February was mainly caused by a large-scale attack on a well-known exchange by a hacker organization.

Industry experts point out that although blockchain technology is gradually becoming an important part of global financial infrastructure, security challenges remain severe. Data shows that in the first quarter of 2025, the industry suffered losses of up to $1.67 billion due to hacker attacks, a year-on-year increase of 303%, with the Ethereum ecosystem becoming a primary target for attacks.

In response to the growing security threats, experts recommend that Web3 project parties and users verify the authenticity of URLs and smart contracts when transferring assets. At the same time, it is advised to use cold wallets and other internet-isolated methods to store assets, and to avoid disclosing information related to digital assets on social media to reduce the risk of theft.

With the rapid development of the Web3 industry, how to effectively respond to increasingly complex security challenges has become a key issue that the entire industry urgently needs to address. There is a call within the industry to incorporate advanced technologies such as formal verification into the security protection system, and it is emphasized that lessons should be learned from every attack incident to continuously improve systemic risk prevention measures.