Crypto Hack Losses Surge 27% in July to $142M, CoinDCX and GMX Hit Hard

Highlights:

• Crypto hackers stole $142 million in July through 17 separate attacks and scams.
• Five major attacks caused most losses, with CoinDCX and GMX hit the hardest.
• Hackers now use social engineering and offchain tricks instead of smart contract flaws.

In July, hackers and scammers took over $142 million in 17 separate crypto attacks. The largest loss in July came from an attack on CoinDCX, a crypto exchange. Blockchain security firm PeckShield reported that overall losses were 27% higher than the $111 million stolen in June. However, the amount stolen this July is still 46% less than what was lost in July 2024, when hackers took $266 million.

#PeckShieldAlert In July 2025, ~17 major crypto hacks were recorded, resulting in total losses of $142M—a 27.2% increase (from $111.6M in June). Notably, the #GMX exploiter has returned ~$40.5M worth of cryptos, including 10K ETH and 10.5M $FRAX.#Top5 Hacks in July 2025:… pic.twitter.com/Y5VLUILq5Z

— PeckShieldAlert (@PeckShieldAlert) August 1, 2025

Major Crypto Hacks in July and Key Incidents

Most of the crypto losses in July were caused by five major hacks. The largest incident occurred at CoinDCX, which suffered a loss of $44.2 million on July 18. In connection with the breach, a CoinDCX employee named Rahul Agarwal was recently taken into custody. According to local media, the attackers may have accessed the company’s systems using his login credentials to carry out the theft. CoinDCX CEO Sumit Gupta said it looks like a “sophisticated social engineering attack,” where hackers trick employees to gain access.

The next big hack happened at GMX, with a loss of about $42 million on July 11. Surprisingly, the hacker gave back around $40.5 million. This included 10,000 ETH and 10.5 million FRAX. Such returns are rare and have started talks in the DeFi space about why hackers return funds and how deals are made.

Some media reports have surfaced referencing the FIR we filed with the Karnataka Police regarding the security incident that impacted our platform.

As this is an ongoing investigation, we unfortunately cannot engage with the media or public on this issue. We want to ensure the…

— Sumit Gupta (CoinDCX) (@smtgpt) July 31, 2025

BigONE exchange suffered a loss of more than $27 million on July 16 when attackers breached its hot wallets via a third-party provider. Later, on July 24, WOO X lost $14 million after a hacker used a phishing attack to deceive a team member and access their device.

WOO X was also hacked on July 24, losing around $14 million in the attack. Rob Behnke, CEO of blockchain security firm Halborn, stated in a Tuesday report that the WOO X attackers used social engineering tactics to deceive a team member and gain control of their device.

🚨 WOO X, a Taiwanese crypto trading platform, was hit by a $14 million hack in July 2025 😱

The attacker used a phishing attack on a team member to access the platform's development environment and make malicious withdrawal requests 💸

📰 Read more 👇

— Halborn (@HalbornSecurity) July 30, 2025

The stolen funds were taken from several blockchains, including Bitcoin, Ethereum, BNB, and Arbitrum. Later, the company used its own funds (from its treasury) to restore the affected user accounts. Behnke said that hackers are now focusing more on attacking offchain systems (outside the blockchain) to carry out big hacks. Future Protocol was also hacked during this time, losing $4.2 million.

How Hackers Are Changing Their Tactics

Instead of trying to find bugs in smart contracts, which can be found and fixed through audits, they look for weak spots in the back-end systems and company processes. According to a report from Global Ledger, some hackers managed to launder stolen funds within just 3 minutes, with the quickest transfer completed in only 4 seconds. In almost 70% of cases, the money was already being moved before the hack was even announced. Due to the rapid movement of stolen funds, just 4.6% was recovered in early 2025. At the same time, attacks on AI-powered Web3 projects are rising quickly.