CertiK Reports $302M Lost to Web3 Security Breaches in May

Blockchain security firm CertiK’s May 2025 Security Report reveals $302 million was siphoned from Web3 projects through hacks, scams, and exploits. While total losses dipped 16.94% from April’s $364 million, code vulnerability exploits surged 4,483% to $229.6 million—now the dominant attack vector.

CertiK Senior Researcher Natalie Newson warns this reversal of prior annual declines ($1.35B in 2021 to $173M in 2024) demands urgent adoption of advanced auditing. "Even mature protocols require layered security combining AI and human expertise," she noted. Approximately $140.1M represented irreversible losses, with $162M frozen and $8.5M attributed to phishing.

The DeFi sector remains particularly vulnerable, though phishing incidents declined sharply from April’s peak. The report underscores an industry paradox: as infrastructure matures, attackers increasingly target sophisticated protocol-layer weaknesses rather than surface-level social engineering.