2025 年和 2026 年初的加密貨幣駭客攻擊，按金額計算已超過以往所有年度紀錄，損失高達 34 億美元，橫跨智慧合約漏洞、供應鏈被入侵、預言機操縱、金鑰竊取以及政治動機的破壞行動，整體揭露出真正致命的弱點並不只是不良程式碼，而是那些高度集中的信任節點。
2025–2026 年加密駭客現況
數字幾乎無可爭辯，儘管不同機構的估算方法略有差異。
Chainalysis估計，2025 年加密貨幣竊盜總額達 34 億美元，創下史上最糟紀錄。TRM Labs 與 TechCrunch 分別報導為 27 億美元。CertiK 則公布，2025 年上半年在 344 起事件中損失 24.7 億美元，已超越 2024 年全年的 19.8 億美元淨損失。
作為對照，TRM Labs 曾測算，2024 年全年被盜金額為 22 億美元。這代表僅 2025 年前六個月，就超越前一整年。
讓這段時期顯得與眾不同的，並不是事件數量，而是損失高度集中。
Immunefi指出，2025 年第一季是加密產業史上駭客攻擊最嚴重的一季，僅 40 起事件就造成 16.4 億美元損失，較 2024 年第一季增加 4.7 倍。僅 Bybit 與 Cetus 兩起事件，就約佔 17.8 億美元，相當於 CertiK 所統計上半年損失的 72%。
攻擊類型本身並沒有太大變化：智慧合約漏洞、預言機操縱、私鑰外洩、交易所營運失誤，以及國家級網攻等都仍存在。真正改變的是「規模」。2025 年上半年，平均每起駭客攻擊的規模，較前一年同期足足翻倍，損失也高度集中在少數幾起災難級事件中。
串起下文這些最嚴重案例的主線，並不是技術複雜度，而是「信任」——集中在單一私鑰、單一供應商、單一治理架構，或單一流動性場域。
延伸閱讀： Trump's 48-Hour Iran Warning: What It Did To BTC, ETH And XRP
Resolv：一筆無抵押增發如何把穩定幣變成資產負債表危機
2026 年 3 月 22 日，有攻擊者竊取了儲存在 Resolv AWS Key Management Service 中的一把特權私鑰，並利用它對協議的 USR 穩定幣發起兩筆嚴重超額的增發操作。
第一筆在僅約 10 萬美元 USDC(USDC) 存入的情況下，增發了 5,000 萬枚 USR；第二筆又增發了 3,000 萬枚。
總計約 8,000 萬枚無抵押代幣被鑄造並流入市場。增發金鑰是一個單一外部帳戶（EOA），而非多簽；合約也缺乏最大增發上限、預言機檢查或金額驗證。
攻擊者將鑄出的 USR 經由 wstUSR 和各種穩定幣轉換為約 11,400 枚 Ether(ETH)，價值約 2,400 萬至 2,500 萬美元。USR 價格在 Curve Finance 上於 17 分鐘內暴跌至約 0.025 美元，跌幅達 97.5%。
穩定幣攻擊之所以特別具破壞力，在於它會瞬間揭露抵押品到底是真實穩固，還是脆弱不堪。
協議原本約 9,500 萬美元的抵押池在技術上仍然存在，但多了 8,000 萬枚無抵押代幣在外流通，導致 Resolv 僅有約 9,500 萬美元資產，卻背負約 1.73 億美元負債。包括 Aave、Morpho、Euler、Venus 和 Fluid 在內的 DeFi 協議，紛紛採取防範措施，隔離自身曝險。
這一連串連鎖反應——被駭、被迫拋售、脫鉤、資產負債缺口、恐慌——全在不到一天內完成。
延伸閱讀： Bitcoin's S&P 500 Correlation Just Flashed A Crash Warning
Bybit：改寫年度風險輪廓的 15 億美元超級大案
以金額來看，加密貨幣史上沒有任何單一事件，可與 2025 年 2 月 21 日發生在Bybit 身上的駭客攻擊相提並論。
鏈上調查員 ZachXBT 最先發現，該交易所的 Ethereum(ETH) 冷錢包出現超過 14.6 億美元的可疑外流。FBI 隨後認定，這起竊案由北韓 TraderTraitor 集團執行，屬於 Lazarus Group 的一部分，並將金額定調在約 15 億美元。
約有 401,347 枚 ETH 被盜，超過先前兩大駭客事件——Ronin Network 與 Poly Network——的總和。
這起入侵並非 Bybit 自家程式碼失誤所致。Sygnia 與 Verichains 的鑑識調查追溯到第三方多簽平台 Safe{Wallet} 的供應鏈被攻陷。攻擊者早在 2 月 4 日便入侵一名 Safe 開發者的 macOS 工作站，竊取 AWS session token，並在 2 月 19 日將惡意 JavaScript 注入 Safe 的網頁介面。
這段惡意程式碼僅在 Bybit 的特定 Ethereum 冷錢包發起交易時啟動。多簽的 6 位簽署者中有 3 位在未察覺操縱情況下批准了該筆交易。
Bybit 執行長 周斌（Ben Zhou）證實，交易所仍維持償付能力，駭客事件前的儲備資產超過 160 億美元。在 72 小時內，Bybit 透過 Galaxy Digital、FalconX、Wintermute 與 Bitget 的緊急貸款，補足其 ETH 儲備。但截至 3 月 20 日，約 86% 被盜 ETH 已在近 7,000 個錢包中被兌換為 Bitcoin(BTC)。
教訓相當直接：一個平台，一次入侵，一場事件，就足以完全改寫當年的整體風險輪廓。有些最嚴重的加密災難，往往發生在使用者以為「規模等於安全」的地方。
延伸閱讀： After A $44M Hack, CoinDCX Now Faces A Fraud FIR
Sui 上的 Cetus：2.23 億美元攻擊如何凍結旗艦 DEX
2025 年 5 月，Cetus——Sui(SUI) 網路上最大的去中心化交易所——遭到攻擊，其流動性池被抽走約 2.23 億美元。根本原因是一個存在於協議集中流動性數學函式庫中的整數溢位錯誤。
某個函式在比較數值與門檻時，出現一個「少一個 bit」的誤差，使攻擊者得以僅存入象徵性的一枚代幣，卻獲得價值數百萬的流動性頭寸。
Sui 驗證者採取了前所未見的措施，在鏈上凍結約 1.62 億美元被盜資金，此舉獲得治理投票 90.9% 的同意。約 6,000 萬美元已在凍結前被橋接到 Ethereum。
Cetus 在停機 17 天後恢復營運，透過追回資金、自有金庫拿出 700 萬美元，以及 Sui Foundation 提供的 3,000 萬美元 USDC 貸款，重新注入流動性池。
當一個旗艦流動性場域出問題，整條鏈的公信力都會受損。代幣價格、鏈的聲譽、使用者信心，以及生態系關鍵參與者被迫緊急出手的壓力——爆炸半徑遠遠超出單一協議本身。
延伸閱讀： Brazil Freezes Crypto Tax Rules
GMX：頂級永續合約平台為何仍慘失逾 4,200 萬美元
2025 年 7 月，GMX 在其部署於 Arbitrum 的 V1 版本中，因跨合約重入漏洞遭到攻擊，損失超過 4,200 萬美元。執行減倉指令的函式允許將「智慧合約地址」作為參數傳入，而非強制要求使用一般錢包地址。
在 ETH 退款步驟執行期間，控制權被轉交給攻擊者的惡意合約，啟動重入攻擊，使其得以將內部定價資料操縱至實際市場價格的約 1/57。
GMX 隨後提出 10% 的白帽賞金，約 500 萬美元，並設下 48 小時期限，試圖敦促攻擊者歸還資金。 a threat of legal action. The attacker returned approximately $37.5 million to $40.5 million in tranches, retaining the bounty. GMX later completed a $44 million compensation plan for affected GLP holders.
The fact that funds were returned does not mean the system worked. White-hat framing, bounty offers, and partial recovery can soften the market reaction without removing the underlying security failure.
The vulnerability had been ironically introduced during a 2022 fix for a previous bug. GMX V2 was unaffected.
Also Read: Bitcoin Drops In Hours After Trump Threatens Iran Power Plants
Nobitex: When a Crypto Hack Becomes Geopolitical Warfare
In Jun. 2025, Nobitex, Iran's largest cryptocurrency exchange, was hacked for approximately $90 million across multiple blockchains including Bitcoin (BTC), Ethereum, Dogecoin (DOGE), XRP (XRP), Solana (SOL), Tron (TRX), and TON (TON).
The pro-Israel hacker group Gonjeshke Darande, also known as Predatory Sparrow, claimed responsibility.
The attack took place during active Israel-Iran military hostilities.
This was not a financially motivated theft. Stolen funds were sent to vanity burner addresses containing anti-IRGC messages with no recoverable private keys — effectively burning $90 million as a political statement.
The next day, the attackers publicly released Nobitex's entire source code, infrastructure documentation, and internal privacy R&D.
Some crypto hacks are not profit-maximizing attacks at all. They are sabotage, signaling, or cyberwarfare. That makes them different from protocol exploits in practically every dimension: motivation, method, aftermath, and the impossibility of recovery. Nobitex reported a partial resumption of operations afterward, but incoming transaction volumes dropped more than 70 percent year-over-year in early July.
Also Read: SBF Backs Trump's Iran Strikes From Prison
Abracadabra: The Exploit That Hit DeFi Borrowing Through GMX-Linked Cauldrons
On Mar. 25, 2025, an attacker drained approximately 6,260 ETH — worth about $13 million — from Abracadabra Finance's lending markets, known as cauldrons. The targeted cauldrons used GMX V2 liquidity pool tokens as collateral, and the exploit relied on a flash-loan-assisted self-liquidation technique that took advantage of state tracking errors within the gmCauldron contracts.
Stolen funds were bridged from Arbitrum to Ethereum. PeckShield was among the first security firms to flag the incident. GMX confirmed its own contracts were not affected.
Abracadabra offered a 20 percent bug bounty. This was the protocol's second major hack; a $6.49 million exploit had hit Abracadabra in January 2024.
The episode illustrates composability risk. A protocol may look secure on its own but become vulnerable through integrations and dependencies.
For DeFi users, what sits under the hood — which collateral types a protocol accepts, which external contracts it calls — matters more than the top-level brand they deposit into.
Also Read: CFTC And SEC Align On Crypto Haircuts
Hyperliquid and JELLY: Market-Structure Drama and Centralization Questions
On Mar. 26, 2025, an attacker opened a $4.1 million short position on the illiquid JELLY memecoin on Hyperliquid, alongside two offsetting long positions, then pumped the token's spot price by more than 400 percent.
When the short was liquidated, Hyperliquid's automated HLP vault inherited the underwater position, and the vault's unrealized losses reached approximately $13.5 million.
Hyperliquid's validators then force-closed all JELLY positions, settling at the attacker's original short entry of $0.0095 rather than the $0.50 that external oracles were reporting.
The maneuver was executed within two minutes and revealed that the protocol relied on only four validators per set.
The scandal here is not just the loss.
Bitget CEO Gracy Chen publicly called Hyperliquid "FTX 2.0." The protocol's total value locked collapsed from $540 million to $150 million in the following month, and the HYPE token fell 20 percent. Hyperliquid later upgraded to on-chain validator voting for asset delisting decisions.
What happens when a decentralized venue acts centrally in a crisis? That question is useful for any research audience even when the dollar loss is smaller than the biggest breaches. It exposed a credibility fault line.
Also Read: Strategy Holds 3.6% Of All Bitcoin
Meta Pool: Infinite Mint Risk and Why Low Liquidity Can Mask a Bigger Bug
In Jun. 2025, Meta Pool suffered a smart-contract exploit that allowed an attacker to mint 9,705 mpETH — worth approximately $27 million — without depositing any ETH collateral.
The vulnerability sat in the ERC-4626 mint function. The attacker bypassed the normal cooldown period through the protocol's fast unstake functionality.
But the realized loss was only around $132,000. Thin liquidity in the relevant Uniswap swap pools meant the attacker could extract only 52.5 ETH.
An MEV bot front-ran part of the attack, extracting roughly 90 ETH in liquidity that was later returned to the protocol. The 913 ETH originally staked by users remained safe with SSV Network operators.
Sometimes the bug is far worse than the realized loss. The exploit path in this case implied catastrophic theoretical damage, but poor liquidity capped extraction. That distinction matters for anyone evaluating DeFi risk, and it gives this case more depth than a simple ranking by dollar losses would suggest.
Also Read: UK Set To Block Crypto Donations
Cork Protocol: a16z-Backed, Still Exploited
On May 28, 2025, Cork Protocol was exploited for approximately $12 million. The attacker extracted 3,761 wstETH by exploiting flaws in the Cork Hook's beforeSwap logic and missing access controls.
The root cause was a lack of input validation combined with permissionless market creation without guard rails, which allowed the attacker to create a fake market using a legitimate DS token as the redemption asset.
Cork had received investments from a16z crypto and OrangeDAO in September 2024.
The takeaway is simple. Institutional investors, top-tier venture capital backing, and polished branding do not eliminate technical risk. Readers should not confuse fundraising quality with protocol safety, and audits — however thorough — are not guarantees. All contracts were immediately paused after detection, but the money was gone.
Also Read: Early Ethereum Whale Buys $19.5M In ETH
KiloEx: Oracle Manipulation as a Recurring DeFi Weakness
In Apr. 2025, KiloEx lost approximately $7 million to $7.5 million across Base, opBNB, and BNB Smart Chain after an attacker exploited an access-control vulnerability in the platform's MinimalForwarder contract. The flaw allowed anyone to call price-setting functions.
The attacker manipulated the oracle to report an absurdly low price for ETH — $100 — when opening leveraged positions, then closed at $10,000.
KiloEx offered a 10 percent white-hat bounty of $750,000. Four days later, the attacker returned all stolen funds, and KiloEx announced it would not pursue legal action.
The platform resumed after a 10-day pause and published a compensation plan for users whose trades remained open during the outage.
This is the cleanest case for explaining oracle risk. Bad pricing data can let attackers open and close positions at false values. Many exploits marketed as sophisticated are still built on old primitives — bad price feeds, predictable assumptions, poor validation. Oracle manipulation remains one of DeFi's most persistent weaknesses.
Also Read: Gold's Worst Week Since 1983
模式揭示了什麼
上面這 10 起案例，在運作機制、規模和動機上各不相同，但它們共享一個結構性的模式。
財務損失最慘重的事件——Bybit 和 Resolv——根本不是由鏈上程式錯誤造成的。它們是基礎設施層級的失敗：一個案例是開發者電腦被入侵，另一個則是單一、未受防護的鑄幣金鑰被存放在雲端基礎設施中。這兩起事件之所以造成災難性損失，正是因為在使用者以為不存在的地方，實際上存在高度集中的信任節點。
像 Cetus 和 GMX 這類協議層級的攻擊確實涉及程式碼漏洞，但實際的衝擊範圍則是由治理應對所決定——包括驗證者能否凍結資金、漏洞賞金協商是否成功，以及生態系參與者是否出手提供緊急資金支援。
Nobitex 嚴格來說並不是任何意義上的協議漏洞；那是一場地緣政治破壞行動。
整體情況並不樂觀。事件數量減少並不代表損失縮小。平均嚴重程度正在上升。僅北韓一國就在 2025 年的竊盜案中就占據超過 20 億美元，比前一年成長 51%。
在加密貨幣領域中，最關鍵的安全邊界已從鏈上邏輯，轉移到鏈下基礎設施、金鑰管理，以及人的作業安全。
對散戶使用者、代幣投資人與協議團隊而言，這些數據都指向同一個結論。問題已經不再只是協議智慧合約是否經過稽核，而是：信任被集中在什麼地方——以及當那個信任點崩壞時，會發生什麼事。
Read Next: Bitcoin Mining Difficulty Falls 7.76%