In 2025, $3.4 billion in cryptocurrency was stolen, and the funds are usually laundered within 45 days

In 2025, the amount of cryptocurrency theft reached $3.4 billion, with Bybit suffering a loss of $1.5 billion, accounting for 44% of the total for the year. In the first half of 2026, there were 212 related incidents, resulting in losses of approximately $1.1 billion, with about 55% involving the Lazarus-linked group. KelpDAO was attacked in April, resulting in a loss of $293 million.

Stolen funds typically undergo a three-phase transfer process lasting about 45 days: the first 5 days involve exchanging through DeFi protocols and entering mixing services, followed by cross-chain bridging and flowing through trading platforms with lower KYC requirements. During the 20 to 45 days period, funds are further cashed out in batches through non-KYC platforms, instant exchangers, and over-the-counter trading networks. Once funds cross multiple blockchains, mixing services, and jurisdictions, tracking may still be possible, but the difficulty of recovery significantly increases. The recovery rate of stolen funds from Bybit is less than 5%; Tether and Circle can freeze USDT and USDC addresses, and attackers typically exchange stablecoins for Ethereum or Bitcoin within minutes after the attack.