Global cryptocurrency thefts soared to $3.4 billion in 2025, marking a 54% increase from the previous year, according to a new report by blockchain analytics firm Chainalysis. This significant surge was primarily driven by a few exceptionally large incidents, with North Korea emerging as the most dominant state-sponsored threat actor responsible for a substantial portion of the illicit gains. The February 2025 breach of crypto exchange Bybit alone accounted for a staggering $1.5 billion, making it the largest individual crypto theft ever recorded.
The total stolen digital assets for the year surpassed the $2.2 billion reported in 2024, highlighting an escalating risk landscape for the crypto industry. Chainalysis’s findings reveal a clear evolution in cybercrime methodologies, shifting away from a high volume of smaller attacks towards a concentrated number of highly sophisticated and financially devastating breaches that target major platforms and individual users alike.
This trend towards outlier-driven crime is starkly illustrated by the data: the top three hacks in 2025 alone constituted 69% of all service-related losses. For the first time, the ratio between the largest hack and the median theft crossed the 1,000-times threshold, exceeding levels observed during the 2021 bull market and underscoring the growing financial impact of individual security compromises.
North Korea maintained its position as the most significant nation-state threat, despite a decline in the sheer number of confirmed attacks attributed to the rogue state. Chainalysis estimates that hackers linked to the Democratic People’s Republic of Korea (DPRK) stole at least $2.02 billion in cryptocurrency during 2025, representing a 51% increase from the previous year. These state-sponsored operations were responsible for a record 76% of all service-related compromises throughout the period.
Cumulatively, the lower-bound estimate of cryptocurrency stolen by North Korea has now reached $6.75 billion, underscoring a persistent and sophisticated campaign to fund its illicit programs. DPRK-linked actors consistently target high-value entities such as large exchanges, custodians, and Web3 firms, deploying advanced social engineering tactics to achieve their objectives.
These tactics often involve embedding IT workers within crypto firms or impersonating recruiters, investors, or potential acquirers to gain privileged access to critical systems. Once funds are exfiltrated, North Korean hackers employ distinctive laundering patterns, typically splitting transactions into smaller amounts, with over 60% of transfers below $500,000, to obscure their movements.
Their laundering networks show a strong preference for Chinese-language money laundering services, cross-chain bridges, and mixing services. Notably, they largely avoid lending protocols, peer-to-peer exchanges, and even some KYC-free platforms commonly utilized by other cybercriminals, suggesting a highly specialized and compartmentalized approach to asset obfuscation.
Beyond institutional breaches, the report also highlighted a significant increase in personal wallet compromises over the past three years. This vector of attack grew from 7.3% of total stolen value in 2022 to 44% in 2024, indicating a broadening scope of targets for cybercriminals. In 2025, personal wallet compromises would have accounted for 37% of losses had it not been for the extraordinary scale of the Bybit incident.
While overall theft figures surged, Chainalysis observed a notable slowdown in decentralised finance (DeFi)-related hacks, even as the broader crypto market experienced a rebound in activity. This suggests a potential maturation or improved security posture within certain segments of the DeFi ecosystem, though the overall landscape remains fraught with peril, particularly for centralized entities and individual holders.
The Bybit breach, which saw approximately $1.4 billion in Ethereum stolen from one of its offline wallets, sent shockwaves through the industry. This single incident dwarfed previous major crypto heists, including the $624 million Ronin Network hack and the $611 million Poly Network exploit, firmly establishing it as the largest crypto heist in history and underscoring the severe financial vulnerabilities present within the digital asset space.
The escalating financial impact of individual breaches, driven by sophisticated state-sponsored actors and increasingly adept cybercriminals, raises significant systemic risk concerns for major cryptocurrency platforms and the broader digital economy. As the value of digital assets grows, so too does the incentive for illicit activity, necessitating enhanced security measures and international cooperation to combat these evolving threats.
