TL;DR

Median hack size falls: Security stats show the median loss per crypto hack dropped sharply to ~$2.2M in 2024–25 (vs ~$4.5M earlier). Daily fixes and bounties catch small bugs before they turn into disasters.
Average still huge: A few mega-breaches keep the average loss near $25M. The top five hacks of 2024–25 made up ~62% of stolen funds, for example, the $1.5B Bybit breach was 44% of 2025’s losses.
Hygiene matters: Routine security work is paying off. Proactive bug bounties and audits are finding logic flaws and patching them. Wormhole fixed a critical proxy bug on the same day via a bounty; Silo Finance plugged a $3M logic hole before funds were lost. Regular audits and code scans are now standard practice.
Big risks remain: Yet the “long tail” of giant hacks lingers. As Chainalysis notes, in 2025 the largest exploit was ~1000× the median, and the top 3 hacks drove 69% of all losses. Centralized exchanges (only ~10–20% of incidents) still account for ~50% of money stolen. In short, basic hygiene lowers the bottom-end hacks, but a single critical bug or key compromise can still trigger billion-dollar failures.

Crypto Hacks: Median vs. Average Losses

Immunefi’s latest State of Onchain Security report confirms a changing landscape. Hacks are not more frequent in 2024–25, but their distribution has shifted. There were ~95 hacks per year in 2024 and 2025 (roughly flat from 2023). However, the median loss per hack has halved, down to about $2.2M for 2024–25. In plain terms, more hacks are being contained at the multi-million-dollar level rather than ballooning out of control. Crypto news outlets echo this: average losses hit ~$24.5M per hack, but typical victims lose ~$2–3M.

This split comes from the concentration of value in a few outliers.

In 2024–25, the top 5 breaches accounted for 62% of stolen funds. For example, the 2025 Bybit CEX hack alone was ~$1.5B, 44% of that year’s total. On the flip side, nearly half of the hacks in those years involved losses under $2.2M (the new median). Chainalysis highlights the skew: in 2025, the largest hack was 1000× larger than a median incident.

In short, a handful of protocol/CEX failures are driving the enormous average, while the bulk of incidents are comparatively small.

This trend suggests that day-to-day security measures are working. Smaller bugs, the ones that used to slip through code reviews, are being caught earlier. In effect, the “we got lucky” exploits of the past are turning into “we found it in time” stories. As one report puts it,

“despite increased Total Value Locked, hack losses remained suppressed in 2024–2025, suggesting improved security practices are making a meaningful difference”.

In practice, this means projects that stay on top of ordinary security hygiene see far fewer $$$ drained by common flaws.

Meanwhile, why does the average stay near $25M? Because when a critical vulnerability or key compromise does occur, especially in a major chain or exchange, it still allows an attacker to take hundreds of millions. 2024–25’s average loss was ~$24.5M (over 11× the median). Centralized platforms, though few in number, were responsible for over half the total value stolen. DeFi composability means one logic bug or oracle error can cascade through liquidity, as we’ve seen in multi-chain exploits. In short: routine fixes have trimmed the tail of small hacks, but a single hole in a big protocol can still blow up the entire house.

Daily Hygiene: Catching Bugs Before They Bite

The practical upshot is that basic security hygiene is paying off. More projects now assume vulnerabilities exist and build in defenses to catch them. Key practices include:

Bug bounty programs: Many protocols have raised bounty rewards dramatically. High-paying bounties incentivize white-hat hunters to dig into code that might otherwise go unchecked. A classic example: Wormhole hosted by Immunefi. In Feb 2022 a researcher disclosed a critical proxy vulnerability, and Wormhole’s team patched it that same day. No funds were lost, thanks entirely to the bounty pipeline. (The lesson: a single line fix, found early, saved potentially millions.) Wormhole even paid a record $10M bounty to demonstrate their commitment. That punchy response shows how well-funded bounties catch exactly the “small flaw” incidents that feed the median hack statistics.
Regular audits and scans: Leading firms view an audit as just the start of security. Platforms like Halborn advise performing routine security audits, not just one-off reviews. Automated tools (static analyzers, fuzzers, monitoring scripts) now run continuously on many projects. Projects often plug vulnerability scanners and script checks into their CI pipelines. For instance, Silo Finance added an Immunefi audit to their workflow. A researcher quickly found a loan calculation bug that could have cost ~$3M. Silo’s team patched it within hours, and awarded the hunter 100k USDC. This case underscores how routine scrutiny stops moderate losses. The fix was as simple as inserting a guard clause:

function borrow(uint256 amount, address asset) external {
 // Ensure there is collateral before borrowing
 require(assetStorage[asset].totalDeposits > 0, “No collateral”);
 // original borrow logic …
 }

(By requiring a non-zero deposit, Silo prevented the exploit scenario.)

Patch management and code updates: Many “gotcha” vulnerabilities are in dependency code or legacy features. Leading projects now patch common libraries and addresses proactively. When a small bug is discovered (even off-chain), teams push updates quickly. For example, after the DAO hack in Ethereum’s history, the community standardized long-required checks and revocations. Today’s equivalent: teams regularly review token approvals and revoke stale allowances. These small changes don’t make headlines, but they harden the base. Chainalysis even notes that the persistence of hygiene is visible in the data: losses stayed down in 2024–25 even as DeFi grew.
Incident response drills: Some protocols implement on-chain guardrails. Standards like ERC-7265 (circuit breaker) are being added, so an alarm automatically pauses a contract in real time. This isn’t routine yet, but it’s an extension of “always assume breach”: even if an exploit triggers, an automatic cutoff can limit damage. Such measures won’t stop all attacks, but they turn catastrophic flaws into manageable alerts. In short, think of security as a 24/7 watchtower: some threats will occur, but daily vigilance reduces the impact significantly.

Each of these steps nibbles away at median losses. Rather than catastrophes from simple bugs (e.g. unguarded withdraw calls, reentrancies, overflow errors), the worst cases that do happen are now typically nuanced logic flaws or external weaknesses. Importantly, the community acknowledges this shift: the focus has expanded from “find bugs” to “design for security.” That means audits stress threat modeling and invariants, automated alerts monitor unusual activity, and partnerships exist to fix issues on the fly. This cultural change, “security as a process”, is why Immunefi calls out a smaller median hack size as evidence that “improved security practices are making a meaningful difference”.

But the Big Fish Still Bite

However, the long-tail risk remains. Even with spotless hygiene, a single major vulnerability can incur enormous losses. In fact, studies emphasize that large-scale hacks are dominating the damage:

Concentrated losses: As noted, a few hacks now account for most of the total stolen value. Chainalysis notes that in 2025, the top three hacks made up 69% of losses, and the largest hack was ~1000× the median. These aren’t petty upsets; they are deep breaches into well-protected systems (often centralized exchanges or widely-used bridges). For example, centralized platforms saw just ~20 hacks in 2024–25, but those led to over $2.5B stolen, roughly half of all loot.
Common culprits: Typically, these massive losses come from breaches of core infrastructure: a compromised exchange hot wallet, a critical staking-slash mistake, or a cross-chain bridge exploited by economic manipulation. (Bybit’s $1.5B breach was one such case.) In DeFi, issues often hide in complex economic logic or cross-contract dependencies. The average attacker is now focusing their efforts where the money is: high-liquidity systems. Meanwhile, smaller protocols might only lose a few million, but a mega-project hack can ruin a year’s security gains with one blow.
Persistent threats: Many projects report that, despite tighter code, social engineering, or supply-chain attacks remain tough to eliminate. Chainalysis warns that even with routine fixes, attackers “continue to find success across multiple vectors”. The point is, a single lapse in private key security or a last-minute unreviewed contract can still spell disaster. As Immunefi puts it bluntly,

“The median hack has gotten smaller, but the tail risk has gotten worse. The median theft during 2024–2025 was $2,200,000, roughly half the $4,500,000 median from 2021–2023.”

The upshot: protocols must balance their approach. Routine vigilance and hygiene curb the everyday hacks, but defending against catastrophic exploits calls for defense-in-depth. This includes things like hardware key management, multi-sig validation of large transactions, incremental deployment of untested features, and even insurance/capital buffers. It also means threat modeling for the unlikely, a “black swan” event like an exploit that bypasses all known fixes. The industry response has begun to reflect this, see emerging active defense standards (circuit breakers, invariants) and regulatory pushes for security commitments.

In short, teams should celebrate the drop in median losses; it means small bugs are being caught. But no one can “set it and forget it.” As Cryptorank’s summary cautions,

“Exchanges must act now with audits and monitoring to prevent billion-dollar breaches”.

Similarly, every project (CEX or DeFi) should ask: how do we stop the next $100M attack? That requires a step beyond routine bug-fix: vigilant monitoring, responsive key controls, and continuous reassessment of architecture. After all, the very fact that top hacks are orders of magnitude larger than most shows that a reactive posture alone is not enough.

Who we are at Exploitless

Exploitless is a Web3 security firm that lives at the intersection of code and context. We specialize in smart contract audits and protocol reviews where the stakes are highest, not just checking code line-by-line, but mapping who controls value, what external systems you trust, and how those can fail. Our audit process uncovers both local bugs and broader design flaws: we examine roles, upgrade paths, oracles, and integrations to find the hidden ways a single mistake can cascade into a major exploit. The goal is simple: surface the flaws before they become someone else’s attack story.

We’re not just number-crunchers. Exploitless takes an active partnership approach. We work with your team to tighten access controls, set up safer upgrade patterns, and verify fixes, not just list them. Our analysts run tools and build threat models, so an audit is also a strategic conversation. This holistic view is exactly what’s needed in a world of both routine bugs and rare catastrophes. In practice, that means our clients see fewer “whoops” moments and are better prepared if a zero-day flaw emerges.

If you’re building or upgrading a crypto protocol, think of us as the security team you didn’t know you needed. We help keep your medians low and your tails tame by treating security as a continuous process, not a checkbox. Contact Exploitless today to fortify your code, your integrations, and your entire protocol against both the everyday and the exceptional threats.

Learn more at Exploitless

References

Crowdfund Insider: Immunefi Study Finds Largest Hacks Increase in Value
Crypto Rank: Crypto Hacks Average $25M as Risks Concentrate, Immunefi Says
Immunefi: Silo Finance Logic Error Bugfix Review | Medium
Halborn: How to Protect On-Chain Data on Public Blockchains

Routine Fixes: Why Median Hack Size Is Shrinking