The industry got much better at auditing smart contracts. Attackers responded by attacking almost everything else.
Blockchain analytics firms put stolen-crypto totals for 2025 above $2 billion, a figure dominated by the roughly $1.46 billion taken from the exchange Bybit in an incident attributed by investigators to North Korea''s Lazarus Group. That attack did not break a contract. It compromised the signing process around one.
The pattern has continued this year. The largest losses trace to key compromise, malicious transaction signing, hijacked front ends and compromised developer infrastructure — the September 2025 npm supply-chain incident, in which a maintainer account was used to inject a wallet-drainer into widely installed packages, remains the template.
For defenders this is an awkward shift, because the mitigations are organizational rather than cryptographic: hardware-enforced signing, independent verification of what a transaction actually does, and treating build pipelines as production systems.
Multisignature setups have proved weaker in practice than on paper. When every signer reviews the same compromised interface, additional signatures add ceremony rather than security.
The one encouraging trend is recovery. Coordination between exchanges, issuers and analytics firms in the hours after a theft now regularly freezes a meaningful share of proceeds — rarely most of it, but enough that laundering large sums has become materially slower.