Firepan report finds Web3 protocols lost an estimated $3.3 billion to exploits in 2025, underscoring systemic challenges in how smart contract security is approached.

Bybit's $1.5B hack is 44% of that entire $3.3B figure and it wasn't even a smart contract bug — compromised machine in the Safe multisig signing flow. Access control failures drove 59% of total losses while actual smart contract flaws accounted for just 8% ($263M). We keep throwing money at Solidity auditors while Lazarus Group is pulling $2B+ annually through operational security gaps and supply chain attacks on signing infrastructure.

Top comment by @Benthic