Study: 83% of Crypto Investors have been Scammed or Hacked

Crypto scams continue to plague investors, turning promising investments into costly lessons. In 2025, the severity of crypto fraud remains alarming, impacting trust and financial stability across the crypto landscape. ChainPlay collaborated with Storible to investigate 444 projects and survey 2,101 crypto investors, revealing just how pervasive and destructive these scams have become.

Key Findings

1. 83% of crypto investors have been scammed or hacked at least once.
2. On average, crypto investors lost $2,622 from scams and hacks.
3. 64% of hacks targeted DEXs, but losses on CEXs were 27 times higher.
4. The average CEX hack resulted in losses of $177M, 15 times greater than DEX incidents.
5. CEX users lost over $26B, while DEX users lost over $800M.

Crypto Crime Epidemic: How Vulnerable Are Investors?

We surveyed 2,101 crypto investors via Prolific and uncovered startling realities: an alarming 83% reported being scammed at least once, with each victim losing an average of $2,622 and experiencing around five scams or hacks.

Top scams dominating the crypto scene are:

1. Social media impersonation (34.02%)
2. Exchange/platform hacks (21.30%)
3. Phishing attacks (18.64%)

Social Media Impersonation and Phishing: Hidden Threats in Plain Sight

As the survey reveals, social media impersonation and phishing attacks are the primary threats driving crypto scams and hacks. To examine how severe these threats truly are, we conducted a targeted research:

We selected the top 300 crypto projects by market cap from CoinGecko, compiling each project's official website and Twitter profile. Then, for each project, we generated 200 potential phishing websites and 200 potential fake Twitter accounts, verifying how many were active.

Here's what we found:

Each crypto project is targeted by an average of eight phishing links and faces seven fake Twitter accounts aiming to deceive potential investors. This exploitation of social media platforms demonstrates the high degree of sophistication, meticulous planning, and aggressive tactics used by scammers to capitalize on investor trust and interest. Such incidents have become a critical concern due to the ease of setting up deceptive accounts and websites designed specifically to mislead.

Exchange Hacks: DEX vs CEX

We analyzed data from the REKT database on exchange hacks and manually investigated whether these incidents impacted the platforms directly or their users. Here's what our analysis revealed:

Decentralized exchanges (DEXs) may attract more hack attempts (64%), yet centralized exchanges (CEXs) suffer significantly higher financial losses—27 times greater. 

On average, a single hack costs CEXs approximately $177 million, dwarfing DEX hacks by fifteenfold. 

Overall, cumulative losses due to exchange hacks are starkly divided: centralized exchange users collectively lost over $26 billion, while decentralized exchange users incurred around $800 million in losses.

These alarming figures reveal a clear and troubling pattern: while centralized exchanges face fewer attacks, the magnitude and financial impact of these incidents are considerably greater. For example, the high-profile Bybit hack in 2025 resulted in substantial financial damage to the platform itself - $1.5B, underscoring the massive scale and devastating effects such breaches can inflict upon centralized exchanges. 

Meanwhile, decentralized platforms endure frequent breaches, continuously testing user trust and limiting broader market adoption.

Conclusion

The ongoing epidemic of crypto scams and hacks presents an undeniable threat that must be urgently addressed. Heightened security protocols, comprehensive investor education, vigilant regulatory oversight, and proactive industry-wide collaboration are vital steps toward mitigating these risks. While cryptocurrency continues to offer transformative possibilities, its sustained growth and credibility depend significantly on the industry's collective and decisive action against fraud, scams, and security breaches.