A recent report by Certik evaluated the RWA (real-world assets) market in 2025 and identified an increasing trend of hacks. Criminals have begun modifying their tactics in the year’s first half, targeting vulnerabilities in the technology.
The report also emphasizes that most tokenized assets are concentrated on Ethereum and a few leading protocols. This concentration indicates that a significant exploit could have a widespread impact on the entire $13.9 billion+ RWA sector.
RWA Hacks on the Rise
Blockchain security researchers at Certik released their Skynet RWA Security Report today. It reveals how threats against RWA projects have changed since 2023, with the attack surface now encompassing both on and off-chain assets.
From January to July, the RWA sector experienced losses of $14.6 million due to hacks and fraud, nearly matching the total losses for all of 2023. Currently, there are no indications of a slowdown, particularly as RWAs have garnered significant market interest this year.
Unique Hybrid Vulnerabilities
However, Certik does not attribute economic factors to this shift. In past years, RWA-related crimes primarily targeted off-chain threats, with credit and loan defaults accounting for a large portion of incidents.
Now, the RWA market is clearly becoming more vulnerable to hacks:
“The data indicates a marked transformation in the RWA threat landscape. The first half of 2025 demonstrates a complete shift: losses surged to nearly $14.6 million, entirely due to on-chain and operational failures. The threat has transitioned from exploiting external financial arrangements to directly attacking the core technology itself,” Certik stated.
Additionally, RWA’s unique connection with TradFi leaves it vulnerable to attacks from both sides. Oracles act as the crucial link between on-chain and off-chain realms, meaning that a single breach here can cause smart contracts to malfunction. This can completely disconnect the RWA from its underlying assets, leading to profitable exploits.
In essence, a firm might offer RWAs based on “rock solid” assets like gold or US Treasury bonds, but a well-timed hack could jeopardize the entire security framework.
Many firms rely on stable assets like real estate for RWAs, but the illiquid nature of this market can also facilitate oracle manipulation. Currently, most RWAs in the US consist of these assets, not private credit, but this does not guarantee real protection.
Security Measures and TradFi’s Role
Certik outlines several layers of security, some of which may seem counterintuitive. It’s important to note that while it prioritizes traditional crypto protection, it also includes other necessary steps.
For instance, Certik emphasizes the importance of legally sound contracts, as “a poorly drafted agreement might…invalidate the entire structure.” This could have dire consequences in the event of a significant breach.
Consequently, the firm posits that the involvement of TradFi institutions is crucial for RWA security. Companies like BlackRock already adhere to many of Certik’s recommendations, including legal clarity, robust asset storage, administrative guidelines, and more.
Unfortunately, this makes JPMorgan’s recent report about TradFi institutions losing interest in RWAs particularly alarming. If crypto-native companies soon dominate the RWA market, they will require meticulous preparations to counter this rising wave of hacks.
At this juncture, the report outlines numerous measures that can be implemented and evaluates the leading players in today’s RWA market based on their security protocols. Provided these firms continue to proactively enhance their security measures, they can stay ahead of these threats.
The post Crypto Hackers are Shifting Focus to RWA Projects, Certik Report Shows appeared first on BeInCrypto.
