Immunefi: crypto industry lost a record $1.64B in Q1 2025 across 40 incidents, including $1.46B from the Bybit hack, vs. $348.3M across 63 incidents in Q1 2024
James Hunt / The Block :
Context & Ripple Effects
The quarter reverses the apparent improvement reported for 2023, when Immunefi counted $1.8B in losses but a year-over-year decline. It also extends a 2024 pattern in which a handful of large attacks made up most stolen crypto, rather than losses being spread evenly across incidents.
The key change is concentration: Q1 2025 recorded fewer incidents than Q1 2024, yet far higher losses because the Bybit breach dominated the total. That makes aggregate loss figures especially sensitive to the security posture of major venues.
First-order effects
- Bybit's breach accounts for nearly all reported Q1 losses, immediately making it the central driver of the quarter's record loss total rather than a broad-based increase in incident frequency.
- The comparison with Q1 2024 shifts attention from the number of attacks to their severity: 40 incidents produced substantially more damage than 63 incidents a year earlier.
Second-order effects
- Large exchanges and custodial platforms face stronger pressure to demonstrate controls against high-impact compromises, since one failure can overwhelm sector-wide security progress elsewhere.
- Security reporting and risk assessment will place greater weight on loss concentration and exposure to major platforms, a pattern already visible when five attacks accounted for 70% of H1 2024 thefts.
Third-order effects
- If outsized breaches continue to dominate loss totals, crypto's security challenge becomes increasingly tied to a small set of critical intermediaries rather than the average resilience of the broader ecosystem.
- That concentration could deepen the recurring gap between lower annual loss totals and severe single incidents, keeping trust and legitimacy contingent on whether major platforms can limit catastrophic failures.
The trend: Crypto security risk is becoming more concentrated, with a small number of major-platform breaches capable of defining industry-wide loss totals.