RWA Protocol Exploits Hit $14.6M in First Half of 2025, Surpassing 2024 Losses

Exploits targeting real-world asset (RWA) protocols surged in the first half of 2025, with losses climbing to $14.6 million — more than double all of 2024, according to blockchain security firm CertiK.

• Losses in H1 2025: $14.6 million from RWA protocol exploits.
• Comparison: Over twice 2024’s $6 million, nearing 2023’s $17.9 million.
• Main causes: Onchain and operational failures driving the exploits.
• Largest incident: Zoth protocol hack, $8.5 million lost to compromised key.
• Other cases: Loopscale exploited for $5.8M via oracle manipulation.
• Market context: RWA sector surged 260% in H1 2025, topping $23B valuation.

The growing popularity of RWA tokenization protocols has also attracted malicious actors. CertiK reported that $14.6 million was lost in RWA-specific exploits during the first half of 2025, already surpassing the $6 million lost throughout 2024. If the trend continues, losses could outpace the $17.9 million recorded in 2023.

RWA tokenization enables the issuance of financial and tangible assets on blockchain networks, thereby broadening investor access. However, these systems introduce “hybrid” security risks because tokenized assets rely not only on smart contracts but also on off-chain processes, custodians, and legal frameworks.

According to CertiK, the evolving threat landscape is characterized by on-chain and operational failures, including:

• Oracle manipulation
• Compromised private keys
• Counterparty or custodial risks
• Fraudulent proof-of-reserves attestations
• Unenforceable legal frameworks

The largest exploit so far this year involved RWA restaking protocol Zoth, which lost $8.5 million on March 21 due to a compromised private key — a classic operational failure. In the same month, another attacker exploited a smart contract logic flaw to mint $385,000 in uncollateralized assets.

In April, Loopscale suffered the second-largest attack, losing $5.8 million through oracle price manipulation. The project later recovered $2.8 million of stolen funds by April 29.

The surge in attacks coincides with the rapid expansion of the RWA sector, which grew 260% in the first half of 2025, surpassing $23 billion in valuation by June. According to Binance Research, tokenized private credit now makes up 58% of the RWA market, followed by tokenized U.S. Treasuries at 34%, supported by growing institutional participation and clearer regulations.

Final Thought

As RWA tokenization gains traction and institutional adoption rises, so too does its attractiveness to hackers. With losses already exceeding 2024 levels, the sector faces mounting pressure to address its hybrid vulnerabilities — combining both blockchain and traditional financial risks — before scaling further.