July’s Crypto Heist Spree: CoinDCX and GMX Lose Big as Hackers Nab $142M

Crypto's wild west strikes again—this time with a $142M bounty. July's hackathon saw exchanges and protocols scrambling as digital bandits made off with a fortune.

Who got hit hardest? CoinDCX and GMX led the casualty list, proving even the big players aren't bulletproof. Security audits? More like suggestions when the incentives are this juicy.

While TradFi bankers clutch their pearls, crypto's proving its resilience—funds vanish, but the ecosystem keeps building. Maybe next month's security budget won't get 'reallocated' to marketing.

Crypto hacks are getting worse, and fast.

July 2025 saw a sharp rise in crypto hacks as hackers pulled off 17 major attacks, resulting in total losses of $142 million. This marks a 27.2% increase compared to the $111.6 million lost in June, which reveals a growing threat to digital asset platforms and protocols. 

July’s Top Hacks: CoinDCX, GMX and More

#PeckShieldAlert In July 2025, ~17 major crypto hacks were recorded, resulting in total losses of $142M—a 27.2% increase (from $111.6M in June). Notably, the #GMX exploiter has returned ~$40.5M worth of cryptos, including 10K ETH and 10.5M $FRAX.#Top5 Hacks in July 2025:… pic.twitter.com/Y5VLUILq5Z

Notably, five major hacks were behind most of the crypto losses in July. 

The largest hit came from CoinDCX, which lost $44.2 million. An employee at CoinDCX was recently arrested after the hack. As per the local reports, Rahul Agarwal, a software engineer, was detained by Bengaluru police after hackers allegedly used his login credentials to access company servers and steal funds. 

CoinDCX CEO Sumit Gupta said that this appears to be a “sophisticated social engineering attack,” where employees are increasingly being targeted to gain access to the systems. 

GMX Hacker Returns Funds

Some media reports have surfaced referencing the FIR we filed with the Karnataka Police regarding the security incident that impacted our platform.

As this is an ongoing investigation, we unfortunately cannot engage with the media or public on this issue. We want to ensure the…

The next major hack was from GMX, which was initially valued at $42 million before the recovery. 

One of the surprising developments from the GMX exploit was, the attacker returned around $40.5 million worth of stolen assets. This included 10,000 ETH and 10.5 million FRAX.

While rare, this kind of reversal has sparked debate over hacker motives and negotiation strategies in the DeFi world.

Hot Wallet Attacks Hit BigONE and WOO X

On July 16, BigONE exchange was hit by a third-party attack on its hot wallets, leading to a loss of over $27 million. WOO X also lost $14 million on July 24. Hackers tricked a team member through a phishing scam, gaining access to their device and pulling off the attack.

WOO X, a Taiwanese crypto trading platform, was hit by a $14 million hack in July 2025

The attacker used a phishing attack on a team member to access the platform's development environment and make malicious withdrawal requests

Read more

Future Protocol also suffered an exploit during this period, with $4.2 million drained.

How Crypto Hacks Are Evolving in 2025

Security Experts say this is part of a new trend where hackers are going after off-chain systems (like backend tools), not just smart contracts. So, teams need to tighten internal security and not just rely on code audits. 

A report by Global Ledger reveals that in some cases, funds were laundered in just 3 minutes, with the fastest transfer taking only 4 seconds. In nearly 70% of cases, the money was already on the MOVE before the hack was even made public. Because of this speed, only 4.6% of stolen assets were recovered in the first half of 2025.

Over $3.1B Lost So Far as AI Threats Rise

According to a report from Hacken, crypto hacks have already cost over $3.1 billion in the first half of 2025, beating all of 2024’s total. 

Meanwhile, threats targeting AI-powered Web3 projects are rising fast. Attacks involving AI tools and infrastructure are up 1,025% this year, mostly due to insecure APIs that give hackers new entry points.