Median loss per hack fell from $6 million in 2022 to $1.5 million in 2025, a 75% drop, even as total value locked in DeFi grew significantly across the board. Bridge hacks also dropped sharply, from 73% of all losses in 2022 to only 3% in 2025.
Immunefi credits the lower losses to bigger bug bounties, regular smart contract audits, competitive security reviews, more skilled blockchain security researchers, and better monitoring as key factors. Instead of waiting for code to be hacked, more vulnerabilities are now being discovered by ethical hackers before they can be exploited.
Bug Bounty Programs are Proving Effective
During the first half of 2026, researchers reported 837 valid vulnerabilities through Immunefi. Approximately $13.45 million was paid in bug bounties, and lifetime researcher rewards surpassed $140 million.
Reportedly, the platform now safeguards over $180 billion in assets, partners with more than 650 protocols, has over 92,000 registered security researchers, and is estimated to have helped prevent more than $25 billion in potential losses from crypto hacks.
Despite shrinking losses, attacks continue to grow, fueled primarily by the growth of the entire Web3 industry.
Blockchain intelligence company TRM Labs says Q2 2026 saw 123 crypto hacks, contributing to the record total of 207 attacks during H1 2026. The bulk of those were smart contract exploits (125 out of 207), even though they made up only a small portion of the total value stolen.
According to TRM Labs, these attacks are getting more complex, often bundling several manipulations into one attack instead of just one coding bug. Most stolen money still comes from financial services and crypto‑focused platforms.
Related: Crypto Hacks Caused $75.87M in Total Losses During June 2026