Hackers in the cryptocurrency space are increasingly targeting protocols for real-world asset (RWA) tokenization, endangering the growing institutional interest in this evolving blockchain area.
Tokenization of real-world assets involves minting financial and physical assets on an immutable blockchain ledger, enhancing accessibility and trading options for investors.
Recently, hackers have begun to focus on RWA protocols, as losses from RWA-specific attacks hit $14.6 million in the first half of 2025, according to a report from blockchain security firm CertiK shared with Cointelegraph.
This $14.6 million figure is more than double the $6 million lost to RWA protocol exploits throughout 2024 and could exceed the $17.9 million lost in 2023.
The reported RWA exploits were attributed “entirely to onchain and operational failures,” highlighting a “distinct shift in the RWA threat landscape from 2023 to 2025,” as noted by CertiK.
Related: Tokenized stocks soar 220% in July, reminiscent of the ‘early DeFi boom’
The escalation in malicious activities comes as the RWA market thrived, increasing over 260% in the first half of 2025 and surpassing a total valuation of $23 billion by June 5, as reported by Cointelegraph.
Tokenized private credit led the RWA market surge, making up about 58% of the market share, while tokenized US Treasury debt held 34%, driven by “increased involvement from major industry players” and “clearer regulatory frameworks,” according to a Binance Research report shared with Cointelegraph.
Related: $2.1B in crypto stolen in 2025 as hackers shift focus from code to users: CertiK
RWA tokenization brings “hybrid” security vulnerabilities due to offchain assets
RWA protocols face more intricate, “hybrid” security challenges, as the worth of an RWA token represents a claim on an offchain asset, broadening the attack surface beyond mere smart contracts.
According to CertiK’s report, each part of this five-layer security architecture can present its own vulnerability:
“Key risks arise from this interaction as offchain processes involve human actors, are open to legal interpretation, and adhere to operational workflows.”
Risks include oracle manipulation, custodial and counterparty failures, the “unenforceability of legal frameworks, and fraudulent proof of reserves attestations,” the report added.
The RWA restaking protocol Zoth experienced the most significant exploit among RWA protocols in 2025, losing $8.5 million due to a “classic operational security failure,” a compromised private key on March 21. In the same month, a different attacker exploited a smart contract logic flaw to mint assets worth $385,000 without adequate collateral.
Loopscale was hit with the second-largest hack, amounting to $5.8 million on April 26, due to blockchain oracle price manipulation. However, in a positive development, the protocol managed to recover $2.8 million of the stolen assets by April 29, as reported by Cointelegraph.
Magazine: TradFi is developing Ethereum L2s to tokenize trillions in RWAs — Inside story
