Crypto Hacks Fall 22% in September, but $127 Million Still Stolen in Web3 Exploits

Despite a modest decline in attack volumes, the crypto industry remains under siege. According to new data from blockchain security firm PeckShield, hackers stole approximately $127 million from Web3 projects and users in September 2025 — a 22% drop from the $163 million lost in August. While the decline suggests slight progress, analysts warn that this year remains one of the most destructive for crypto security on record.

PeckShield identified around 20 major exploits last month, with social Web3 platform UXLINK suffering the largest single attack. On September 22, bad actors compromised its multi-signature wallet, stripping admin controls and siphoning off $11.3 million. Soon after, the attackers minted billions of new UXLINK tokens on Arbitrum, nearly doubling the supply and causing the token’s price to crash by over 70%. Despite attempts by exchanges such as Upbit to freeze funds, most of the stolen assets remain untraced.

Another major hit came from SwissBorg, a Switzerland-based wealth management platform, which lost roughly $41.5 million after a supply-chain breach involving Kiln, its Solana staking partner. The attacker inserted malicious code into what appeared to be a standard unstaking request, gaining control of 193,000 SOL tokens. The exploit exposed the vulnerabilities of third-party integrations — a growing weak point across DeFi systems.

The Venus lending platform also made headlines on September 2 after a sophisticated phishing scam led to a $13 million loss. The victim was reportedly lured into a fake Zoom call, where attackers remotely accessed their device and altered wallet permissions. Venus quickly suspended operations and forcibly liquidated the attacker’s positions, managing to recover part of the stolen funds.

Smaller but still significant incidents hit Yala, which lost $7.6 million, and GriffAI, which suffered a $3 million breach. PeckShield’s report underscores that while total damages have dipped, the scale and complexity of attacks are escalating.

Even with September’s decline, 2025 is tracking as one of the worst years in crypto history for hacks and fraud. Data from cybersecurity firm Hacken shows that more than $3.1 billion was stolen during the first half of the year — already surpassing the $2.85 billion lost in all of 2024. Much of this stems from access control failures, such as the $1.5 billion Bybit hack earlier in the year, along with persistent social-engineering schemes targeting individuals.

Experts warn that unless platforms adopt stronger access control mechanisms, conduct independent security audits, and educate users on phishing and wallet safety, the temporary drop in exploits could prove deceptive. “September’s dip is a statistical blip, not a turnaround,” one analyst commented. “The sophistication of these attacks is increasing faster than most projects’ ability to defend against them.”