Crypto payment security has fundamentally shifted. The largest hacks of 2025 reveal that attackers are no longer hunting for bugs in smart contracts; instead, they're exploiting the infrastructure around those contracts: the signing tools that manage them, the private keys that control them, and the people who operate them.

What Happened in Crypto's Three Biggest Payment Hacks?

Three incidents in 2025 map out the new attack surface. In February, Bybit lost $1.5 billion when attackers compromised the Safe{Wallet} interface, a third-party multisig management tool that Bybit's signers trusted. The attackers injected malicious JavaScript into the front-end code, making a routine "internal transfer" look legitimate on screen. When Bybit's signers approved what appeared to be a normal transaction, they were actually signing a delegatecall operation that replaced the proxy contract's core logic with an attacker-controlled version. Within minutes, the entire wallet was drained.

UPCX, a payment protocol, suffered a $70 million loss through a simpler but equally devastating attack: a leaked admin private key. The attacker used the ProxyAdmin key to upgrade the implementation contract to a malicious version, then called a withdrawByAdmin function to drain all funds. No signing tricks were needed; the attacker simply had the key.

MoonPay's incident was different still. According to a 2025 U.S. Department of Justice forfeiture filing, the CEO and CFO were phished out of $250,000 in USDT through a single email. The attacker impersonated a well-known figure and used typosquatting, swapping a lowercase "l" for a capital "I" in the sender address, nearly invisible in a sans-serif font. No technical vulnerability, no key system compromise, no smart contract exploit. It was pure social engineering.

Where Is the Attack Surface Actually Located?

These three cases reveal that the attack surface has expanded far beyond the contract layer. Each incident maps to a distinct failure point and a corresponding defense:

• Supply-Chain Attack on Signing Infrastructure: Bybit's loss occurred because the signers' web UI came from a third party with no independent verification, transaction verification was blind (signers couldn't tell a normal transfer from a delegatecall on-screen), the proxy upgrade privilege had no timelock protection, and the signing environment wasn't physically isolated from the everyday office environment.
• Leaked Admin Key: UPCX's loss happened because a single private key holder had total control over contract upgrades, and there was no timelock delay to catch anomalies before an upgrade took effect.
• Social Engineering of Operations Staff: MoonPay's loss occurred because executives didn't verify recipient addresses independently before sending funds, and there was no cooling-off period for large transfers.

The pattern is clear: even a well-resourced exchange like Bybit can lose $1.5 billion when several safeguards fail at once. The attack surface is no longer just about smart-contract bugs; it's the signing infrastructure, the admin keys, and the operations staff around them.

How to Defend Crypto Payment Systems Against These Attack Vectors

• Signing Tool Security: Use independent verification of transactions before signing, implement signing-environment isolation (physically separate the signing environment from everyday office networks), and verify that third-party tools like multisig wallets have no unvetted code injection points.
• Admin Key Management: Never allow a single person to hold an admin private key; use multisig or MPC (multiparty computation) to split control, and implement a timelock on contract upgrades (for example, a 48-hour delay) that gives the team a window to spot anomalies before an upgrade takes effect.
• Operations Staff Protection: Require address verification through independent channels before sending funds, implement whitelisting for recipient addresses, add a cooling-off period for large transfers, and conduct regular security awareness training to help executives recognize phishing and typosquatting attacks.

The practical takeaway for anyone responsible for a crypto payment system is to defend all three attack surfaces separately, each with its own controls. That said, contract privileges featured in two of the three cases: the untimelocked proxy upgrade was one of four failures behind Bybit, and UPCX's ProxyAdmin key was the entire attack.

What Role Do Smart Contracts Still Play in Payment Security?

Smart contracts remain important, but payment companies typically don't face the complexity of decentralized finance (DeFi) protocols. Payment contract logic is usually far more direct. Most payment systems rely on stablecoin contracts like USDC and USDT, which have admin functions such as mint, burn, blacklist, and pause. Companies using these contracts need to understand their permission model and freeze capability, even though they don't deploy the contracts themselves.

Contract multisigs like Safe manage funds and contract privileges at the wallet layer. Account abstraction (ERC-4337) has begun entering payment scenarios too, powering gasless payments where a paymaster covers the gas so the user doesn't need to hold the native token, enterprise spending limits, and session keys. Automatic splits, conditional release, and cross-chain settlement represent the scaling category right now, where programmable money earns its name.

The 2025 payment hacks demonstrate that security is not a single layer. It spans the signing infrastructure, the key management system, the contract design, and the human operations around them. Defending all three, with separate controls for each, is what separates a $1.5 billion loss from a secure payment system.