Crypto hacks averaged $25 million per incident in the most recent reporting period tracked by Immunefi, the bug bounty and on-chain security platform, with the headline figure pulled sharply upward by a handful of outsized exploits that dominate quarterly loss calculations.

The data, summarized by The Block, frames a structural reality that practitioners in protocol security, treasury management, and crypto underwriting have begun pricing into their operating models. The arithmetic matters: when a small number of exploits accounts for the bulk of dollars lost, the median incident tells one story about vulnerability prevalence and the mean tells another about tail risk.

What the $25 million figure captures

Immunefi, which coordinates bug bounties across a significant portion of the decentralized finance ecosystem and maintains one of the largest public databases of crypto exploits, calculates averages across disclosed incidents affecting smart contracts, bridges, custodial services, and exchanges. The $25 million mean reflects the full range from sub-six-figure access-control leaks to nine-figure protocol drains.

The asymmetry is the story. A single bridge exploit can move more dollars than hundreds of smaller incidents combined, which means any period-over-period comparison of averages requires careful reading. Practitioners comparing this data to prior intervals should look at total dollar loss and incident count before drawing conclusions about whether the security environment has genuinely improved.

Why large exploits anchor the loss curve

The skew toward large exploits reflects where the money sits. Bridges, particularly those securing wrapped assets across chains, hold concentrated value at single contract addresses, turning any compromise into an immediate, near-total drainage. Centralized exchange hot wallets present a similar target profile, as do governance contracts holding upgrade authority over billions in protocol deposits.

By contrast, decentralized finance primitives with diversified liquidity and time-locked controls tend to constrain the maximum drain per incident. The gap in loss potential explains the divergence in security budgets. Protocols with bridge exposure now allocate meaningful portions of their operating budgets to audits, continuous monitoring, and incident response retainer agreements.

What this changes for protocols and investors

The $25 million average forces a recalibration on three fronts.

• Treasury teams managing protocol-owned liquidity must size insurance or reserve capital against tail events rather than typical incidents
• Investors evaluating yield-bearing strategies across chains should price cross-chain bridging risk explicitly, given the historical concentration of losses in that segment
• Auditors and security firms face sustained demand for continuous monitoring rather than point-in-time reports, reflecting the realization that static audit windows cannot keep pace with rapid code iteration

Immunefi's tracking also underpins comparative statistics used by reinsurance underwriters writing coverage for custodians, market makers, and treasury operations. The same skewed distribution that produces a $25 million mean simultaneously pushes premium rates for high-exposure protocols well above the median and concentrates claims activity in catastrophic loss pools.

The forward question is whether expanded 2025 disclosure regimes will surface more small incidents and compress the average, or whether the largest exploits will continue to set the industry's reputational baseline. Immunefi's next quarterly release will provide the next reading.