The Web3.0 industry lost $364 million in April, with phishing attacks being the main cause.

The latest data shows that the Web3.0 industry is expected to suffer losses of up to $364 million due to security incidents in April 2025, with the vast majority coming from phishing attacks. This figure represents a significant increase compared to the $28.8 million in March, but it is still lower than the historic high of $1.5 billion set in February.

Data shows that of the $364 million in losses, as much as $337 million is related to phishing attacks. The most notable incident involved a single event: hackers stole 3,520 bitcoins from a wallet using carefully designed social engineering tactics. It is understood that these stolen assets were quickly transferred to multiple exchange platforms and converted into Monero, causing the XMR price to surge by 50% at one point. On-chain investigators confirmed that the victim was an "elderly person residing in the United States who had held these bitcoins since 2017."

In addition, several representative attack incidents occurred in April. A decentralized trading platform suffered a $7.5 million attack, with the attacker exploiting a vulnerability in the price oracle. Another project, Loopscale, lost $5.8 million, while an airdrop contract of an Ethereum scaling protocol was also attacked, resulting in the theft of over $5 million. Fortunately, all three platforms were able to partially recover the stolen funds with the help of white hat hackers.

Industry experts warn that despite the gradual development of blockchain technology into "an important part of the global financial infrastructure" in recent years, security challenges remain "severe." According to reports, in the first quarter of 2025 alone, the industry suffered losses of up to $1.67 billion due to hacker attacks, a quarter-on-quarter increase of 303%, with the Ethereum ecosystem becoming the primary target of these attacks.

Experts suggest that Web3.0 project parties and investors must verify the authenticity of websites and smart contracts before conducting asset transfers. At the same time, users should store assets in a cold wallet that is isolated from the internet and avoid publicly disclosing their digital asset-related information on social media. As attack methods continue to evolve, all parties in the industry need to work together to build a more secure Web3.0 ecosystem.