1. Access Control Failures
Poorly configured privileges, missing ownership and role checks, vulnerable upgrade mechanisms, and MFA failures.
According to Hacken, this type of attack caused more than $1.83 billion in losses during the first half of 2025.
2. Social Engineering and Phishing
RPC reconfiguration, fake websites, fraudulent support bots, and malicious transaction signatures.
QuillAudits estimates that these methods caused approximately 15% of all losses.
3. Algorithmic Smart Contract Flaws
Defects in business logic, calculations, and validation cause failures in DeFi protocols, AMMs, and lending platforms.
According to OKX/Beosin, more than 70% of attacks are associated with such vulnerabilities.
4. Inconsistent State Updates
Race conditions, data synchronization failures between modules or chains, and incorrect call ordering.
Researchers discovered 116 such vulnerabilities across 352 projects.
5. Hidden Backdoors in NFT Contracts
Backdoors were found in approximately 50 000 audited NFT contracts on Ethereum, allowing their creators to perform unauthorized actions,
often as part of rug pull schemes.
During the first six months of 2025 alone, the Web3 sector lost more than $3.1 billion because of these and other vulnerabilities. This once again highlights the need for regular smart contract audits, bug bounty programs, and user education.