September Crypto Hacks Drain $127M, Highlighting DeFi and RWA Vulnerabilities

02.10.2025 14:09

In September 2025, the cryptocurrency industry suffered approximately $127.06 million in losses from around 20 major security incidents, as reported by PeckShield. This marks a 22% decrease from August's $163 million in damages, but the number of attacks actually increased, indicating evolving hacker methods and persistent risks.

Key exploits included the UXLINK hack at $44.14 million, which involved unauthorized token minting through a multi-signature wallet vulnerability, leading to a dramatic token value drop; SwissBorg at $41.5 million, due to an API manipulation in its Solana Earn program integration with Kiln; Venus Protocol at $13.5 million from a phishing attack, with partial recovery later; Yala at $7.64 million; and GriffAI at $3 million. These top five incidents accounted for the majority of stolen funds.

A growing trend targeted Real World Asset (RWA) projects, with around $14.6 million in damages recorded in the first half of 2025. Despite the RWA segment booming—on-chain value reached $32.32 billion, an 11.76% increase over 30 days—its complexity in bridging on-chain and off-chain assets creates new vulnerabilities. If unchecked, this could shake confidence in a key growth driver for the crypto market.

Quarterly data for Q3 2025 revealed over $432 million lost from 53 hacks, building on a turbulent year that included the February Bybit $1.46 billion exploit and July's Nobitex $90 million breach. PeckShield emphasized the need for independent security audits, multi-layer protections like multisig and timelocks, and continuous on-chain monitoring to safeguard institutional trust.