The first half of 2025 has proven brutal for the blockchain industry, with over $2.37 billion lost to security breaches, scams, and sophisticated fraud much of it fueled by emerging technologies like AI.<\/p>\n\n\n\n
According to SlowMist\u2019s mid-year Blockchain Security and Anti-Money Laundering (AML) Report<\/strong>, the sector suffered losses across 121 security incidents from January through June. Despite fewer total incidents than the same period in 2024, financial losses have soared by nearly 66%, highlighting how attacks have become more severe and costly.<\/p>\n\n\n\n DeFi and Centralized Exchanges Under Fire<\/strong><\/p>\n\n\n\n Decentralized Finance (DeFi) remains the prime target for hackers, accounting for roughly 76% of all incidents and around $470 million in losses. However, centralized exchanges (CEXs) were hit even harder in dollar terms, suffering a staggering $1.883 billion in losses from just 11 major incidents\u2014evidence that attackers increasingly focus on high-value targets.<\/p>\n\n\n\n Account takeovers topped the list of attack vectors, closely followed by vulnerabilities in smart contracts.<\/p>\n\n\n\n AI Supercharges Scams and Phishing Attacks<\/strong><\/p>\n\n\n\n Beyond traditional exploits, 2025 has seen a surge in scams directly targeting individual users, many of them powered by advances in generative AI. SlowMist\u2019s report shines a spotlight on the evolving tactics cybercriminals are using:<\/p>\n\n\n\n \ud83d\udd39 Phishing with EIP-7702 Exploits<\/strong> \ud83d\udd39 Deepfake Scams<\/strong> \ud83d\udd39 Telegram Fake Safeguard Attacks<\/strong> \ud83d\udd39 Malicious Browser Extensions<\/strong> \ud83d\udd39 LinkedIn Recruitment Phishing<\/strong> \ud83d\udd39 Social Engineering at Scale<\/strong> \ud83d\udd39 Supply Chain Attacks via AI Tools<\/strong> \ud83d\udd39 Jailbroken Large Language Models<\/strong> Looking Ahead<\/strong><\/p>\n\n\n\n The explosive growth in blockchain adoption and the surge of institutional capital flowing into crypto markets has made the sector an ever more attractive target for attackers. As AI continues to evolve, security experts warn that scams and cybercrime will only become more sophisticated, making vigilance and robust security measures more critical than ever.<\/p>\n","protected":false},"excerpt":{"rendered":" The first half of 2025 has proven brutal for the blockchain industry, with over $2.37 billion lost to security breaches, scams, and sophisticated fraud much of it fueled by emerging technologies like AI. According to SlowMist\u2019s mid-year Blockchain Security and Anti-Money Laundering (AML) Report, the sector suffered losses across 121 security incidents from January through…<\/p>\n","protected":false},"author":3,"featured_media":9831,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72,73],"tags":[130,1348,94],"class_list":["post-9830","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","category-blockchain","tag-ai","tag-ai-scam","tag-blockchain"],"yoast_head":"\n
With Ethereum\u2019s Pectra upgrade introducing new contract delegation capabilities under EIP-7702, scammers have quickly adapted. On May 24, a user lost $146,551 after being tricked by the Inferno Drainer group. The attackers exploited the EIP-7702 delegation feature in MetaMask, using a legitimate-looking contract to secure bulk token approvals and drain funds.<\/p>\n\n\n\n
AI-generated deepfakes are driving a new breed of \u201ctrust-based scams.\u201d In one high-profile case earlier this year, Mehdi Farooq, a partner at Hypersphere Ventures, lost his entire crypto portfolio after joining a fake Zoom call featuring deepfake versions of trusted contacts. Similar scams have surfaced using AI-generated videos of Elon Musk and government officials in Singapore to promote fake investment schemes.<\/p>\n\n\n\n
Scammers have been using fake X (formerly Twitter) accounts posing as crypto influencers to lure victims into Telegram groups. Once there, unsuspecting users are prompted to click \u201cTap to verify\u201d links, which execute malicious PowerShell commands. These attacks have resulted in full device compromises, allowing hackers to steal wallet files, private keys, and even take over Telegram accounts on both Windows and macOS devices.<\/p>\n\n\n\n
Attackers have increasingly hidden malware in browser extensions masquerading as \u201cWeb3 security tools.\u201d One notable example is the \u201cOsiris\u201d extension, where attackers hijacked a legitimate developer\u2019s Chrome Web Store account through an OAuth phishing exploit. They then pushed a malicious update that ultimately targeted over 2.6 million users, stealing private keys and login credentials.<\/p>\n\n\n\n
Phishing attacks on LinkedIn have exploded this year, with scammers posing as blockchain startups to lure engineers into downloading malware. The fraudsters share professional-looking project briefs and then send victims to repositories hosting encrypted malicious payloads. Once installed, these backdoors harvest sensitive data like host details, credentials, SSH keys, and macOS Keychain data.<\/p>\n\n\n\n
One of the biggest social engineering incidents of the year involved Coinbase. Hackers bribed overseas customer support staff for internal user data and then posed as Coinbase representatives via spoofed phone calls and phishing messages. The elaborate ruse led to more than $100 million in user losses.<\/p>\n\n\n\n
Developers searching for \u201cunlimited access\u201d to AI models through unofficial channels have inadvertently opened themselves to supply chain attacks. In one documented case, a startup lost hundreds of thousands of dollars after installing malicious npm packages generated by an unauthorized AI tool. These packages planted backdoors, granting attackers remote access and enabling credential theft across systems used by over 4,200 developers, mainly on macOS.<\/p>\n\n\n\n
The rise of \u201cjailbroken\u201d large language models (LLMs) is also raising red flags. Tools like WormGPT help criminals write malware and phishing emails, while FraudGPT generates convincing fake project documentation and phishing websites. DarkBERT, trained on dark web data, is used for precision-targeted social engineering campaigns, and GhostGPT crafts realistic deepfake scams impersonating executives from crypto exchanges.<\/p>\n\n\n\n