CertiK: Total Loss of Security Incidents Within the Year Is Approximately $3.35 Billion, Supply Chain Security Emerges as Unignorable Systemic Risk

BlockBeats News, December 23, Web3 security company CertiK released a report stating that the total loss from Web3 security incidents in 2025 was approximately $3.35 billion, with supply chain attacks accounting for as much as $1.45 billion, nearly half of the annual total loss, becoming the most disruptive risk source of the year.

A typical case is the February incident involving an exchange, where the attacker did not directly breach the trading platform's system but instead implanted malicious code through a third-party multisig wallet service provider's developer environment, bypassing the multi-approval process and resulting in a loss of around $1.4 billion. Attackers are now focusing their resources on key service providers and underlying tools rather than a single protocol, making supply chain security an unavoidable systemic risk.