Key Takeaways
- • $3.4 billion stolen across cryptocurrency ecosystem in 2025, with the February Bybit breach accounting for $1.5 billion alone, representing continued upward pressure on crypto theft despite improved security implementations across some platforms.
- • North Korean state actors (DPRK) stole $2.02 billion in 2025, a 51% year-over-year increase, pushing their cumulative total to $6.75 billion while executing fewer overall attacks, indicating a shift toward higher-value, more sophisticated theft operations.
- • DPRK employs embedded IT workers and executive impersonation tactics as primary attack vectors, with clear operational preferences for Chinese-language money laundering services and a standardized 45-day laundering cycle following major thefts.
- • Individual wallet compromises surged to 158,000 incidents affecting 80,000 unique victims in 2025, though total value stolen from personal wallets decreased to $713 million, signaling a divergence between attack frequency and financial impact.
- • DeFi hack losses remained suppressed despite increased Total Value Locked, suggesting that enhanced security practices are demonstrably reducing losses in decentralized finance platforms even as centralized exchange vulnerabilities persist.
Summary
The cryptocurrency industry suffered over $3.4 billion in theft during 2025, with the theft landscape increasingly defined by state-sponsored actors and their operational sophistication. North Korean hackers emerged as the dominant threat, stealing $2.02 billion in 2025 alone—a 51% increase over the prior year—while maintaining their cumulative haul at $6.75 billion across all years of operation. The notable shift lies in operational efficiency: the DPRK is achieving significantly larger thefts through fewer attacks, suggesting a strategic pivot toward high-value targets rather than volumetric breach campaigns.
The single largest theft of 2025 was the February compromise of Bybit, which accounted for $1.5 billion of the $3.4 billion total, representing nearly 44% of annual losses from a single incident. This concentration underscores the vulnerability of major centralized exchanges to sophisticated attack vectors, despite the operational maturity these platforms typically display.
North Korean threat actors have refined their operational playbook considerably. Rather than relying solely on external breaches, they increasingly embed IT workers directly within cryptocurrency service providers or execute highly targeted impersonation campaigns against executive staff. This insider-threat methodology enables access to administrative credentials and systems architecture that external attackers cannot easily penetrate. Post-theft, the DPRK demonstrates clear operational discipline: laundered funds flow through Chinese-language mixing protocols and bridge services on a standardized 45-day cycle, indicating programmatic, repeatable processes designed to obscure blockchain traceability.
Individual wallet compromises tell a separate story. The ecosystem experienced 158,000 personal wallet compromise incidents affecting 80,000 unique victims in 2025. Despite this dramatic increase in incident frequency, the aggregate value stolen through wallet compromises declined to $713 million from the prior year, suggesting that while more users face security breaches, the average loss per incident remains constrained—possibly due to improved key management practices or lower average holdings among compromised accounts.
An important positive signal emerged from decentralized finance platforms: despite significant growth in Total Value Locked across DeFi protocols, hack losses remained suppressed through 2024-2025. This trend suggests that architectural improvements and security innovations specific to on-chain protocols are generating measurable security dividends, even as centralized service providers remain lucrative targets for nation-state actors.
The single largest theft of 2025 was the February compromise of Bybit, which accounted for $1.5 billion of the $3.4 billion total, representing nearly 44% of annual losses from a single incident. This concentration underscores the vulnerability of major centralized exchanges to sophisticated attack vectors, despite the operational maturity these platforms typically display.
North Korean threat actors have refined their operational playbook considerably. Rather than relying solely on external breaches, they increasingly embed IT workers directly within cryptocurrency service providers or execute highly targeted impersonation campaigns against executive staff. This insider-threat methodology enables access to administrative credentials and systems architecture that external attackers cannot easily penetrate. Post-theft, the DPRK demonstrates clear operational discipline: laundered funds flow through Chinese-language mixing protocols and bridge services on a standardized 45-day cycle, indicating programmatic, repeatable processes designed to obscure blockchain traceability.
Individual wallet compromises tell a separate story. The ecosystem experienced 158,000 personal wallet compromise incidents affecting 80,000 unique victims in 2025. Despite this dramatic increase in incident frequency, the aggregate value stolen through wallet compromises declined to $713 million from the prior year, suggesting that while more users face security breaches, the average loss per incident remains constrained—possibly due to improved key management practices or lower average holdings among compromised accounts.
An important positive signal emerged from decentralized finance platforms: despite significant growth in Total Value Locked across DeFi protocols, hack losses remained suppressed through 2024-2025. This trend suggests that architectural improvements and security innovations specific to on-chain protocols are generating measurable security dividends, even as centralized service providers remain lucrative targets for nation-state actors.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.