June 2025 was a relatively quiet month in terms of the amount of value stolen in major DeFi hacks. Four incidents involved losses of at least $1 million; however, the total losses were only approximately $112 million, compared to $238 million the previous month.
Biggest DeFi Hacks of June 2025
In June 2025, four incidents incurred at least $1 million in losses. These include:
Force Bridge: Force Bridge was exploited for an estimated $3.6 million, about a day after an announcement that the cross-chain bridge was to be sunset over the next six months. The attacker likely used compromised private keys to access privileged functions within the project’s smart contracts, allowing them to drain value from the protocol.
ALEX Protocol: The ALEX Protocol suffered a $8.3 million hack due to weak access controls within the protocol. The attacker created a fake token and vault, and tricked the protocol into calling its malicious transfer function, allowing them to bypass access controls and drain value.
Nobitex: Nobitex, Iran’s largest cryptocurrency exchange, was the victim of a politically motivated attack in June 2025. A pro-Israel hacking group allegedly exploited the protocol via compromised private keys, stealing an estimated $90 million from hot wallets across multiple blockchains. Additionally, the group stole and leaked the protocol’s source code and other sensitive documents a day later, placing any remaining funds held by the exchange potentially at risk of theft as well.
Resupply: In June 2025, Resupply, a DeFi lending protocol, fell victim to a malicious donation attack. The attacker exploited a newly deployed vault and manipulated the exchange rate to take out an estimated $9.8 million in loans with negligible collateral.
Lessons Learned from the Attacks
Weak access management was a common theme in many of the biggest DeFi hacks of June 2025. Both Force Bridge and Nobitex were likely exploited via compromised private keys, resulting in $3.6 million and $90 million in losses, respectively. The ALEX Protocol also suffered from weak access controls, where the attacker exploited vulnerable code in the protocol’s smart contract.