GoPlus Annual Security Report: 1200 Major Security Incidents Resulted in Over $3.5 Billion in Total Losses, with Attackers Employing a Dual Strategy of 'Targeted Attacks' and 'Widespread Phishing'

December 30, 2025 Data from GoPlus RektDatabase shows over 1,200 significant security incidents hit the Web3 space in 2025, totaling losses exceeding $3.5 billion. The most prevalent attack and fraud types included private key theft (via malware, trojans, and social engineering), phishing attacks, and rug pull tokens (fraudulent tokens). Top three loss events of the year: - Bybit hack (Feb 21, $1.5 billion) - Cetus hack (May 22, $223 million) - Balancer hack (Nov 2, $128 million) Key trends: - A rise in large-scale incidents - A sharp drop in the cost of minor user fraud This signals attackers are using both "precision targeting" and "broad net casting" strategies simultaneously. Notably: 12 incidents in 2025 had single losses over $30 million—7 tied to CeFi. The main causes? Theft of admin private keys and hot wallet private keys, exposing critical security risks.