Key Takeaways
- • Crypto theft losses reached $4.04 billion in 2025, representing a 34.2% increase from $3.01 billion in 2024 and marking the worst year on record for the industry, according to PeckShield's annual security report.
- • Recovery efforts significantly lagged behind losses, with only $334.9 million in stolen assets recovered or frozen in 2025, down 31.4% from $488.5 million recovered in 2024, indicating declining recovery efficacy despite sophisticated response capabilities.
- • Match Systems successfully recovered $68 million in stolen crypto assets from a May 2024 dust attack on a crypto whale through rapid intervention, demonstrating the critical importance of immediate professional response in asset recovery scenarios.
- • Exploits dominated theft vectors at 66% of total losses ($2.67 billion), while scams surged 64.2% year-over-year to $1.37 billion, with social engineering attacks accounting for 12% of losses and reflecting a strategic shift toward fewer but higher-impact incidents.
- • North Korean-linked actors orchestrated approximately $2.02 billion in thefts (51% increase year-over-year), with the February Bybit breach representing the largest single crypto theft ever recorded at approximately $1.4 billion.
Summary
The cryptocurrency industry experienced an unprecedented loss of $4.04 billion to theft in 2025, marking a significant escalation in both the scale and sophistication of attacks targeting digital assets. According to PeckShield's comprehensive annual security report, this figure represents a 34.2% increase from the $3.01 billion stolen in 2024 and approximately 55% higher than 2023's $2.61 billion. Despite a decrease in the total number of security incidents, the concentration of losses in fewer, larger-scale attacks indicates a strategic shift by threat actors toward high-impact targeting of centralized infrastructure vulnerabilities and social engineering techniques.
The composition of theft losses reveals distinct attack vectors with varying growth trajectories. Exploits—including smart contract flaws, compromised private keys, and infrastructure breaches—accounted for $2.67 billion or 66% of total losses, a 24.2% year-over-year increase. Scams emerged as the second-largest threat category, generating $1.37 billion in losses and representing a dramatic 64.2% surge compared to 2024. Social engineering attacks, encompassing phishing and impersonation tactics, contributed an additional 12% of total losses, underscoring the industry's vulnerability to non-technical manipulation strategies. PeckShield analysts attributed these trends to "systemic vulnerabilities in centralized infrastructure and a strategic shift toward targeted social engineering."
Recovery capabilities proved insufficient to stem the rising tide of losses. Only $334.9 million in stolen assets were recovered or frozen during 2025—a 31.4% decline from the $488.5 million recovered in 2024. The deterioration in recovery rates reflects the increased velocity with which threat actors move stolen funds through cross-chain bridges, mixer services, and decentralized routing mechanisms, effectively obscuring asset trails and reducing recovery probability. This gap between theft and recovery represents a critical operational challenge for institutional stakeholders and cybersecurity firms operating in the crypto ecosystem.
Notable recovery successes demonstrate that rapid professional intervention can yield full asset restitution despite large-scale theft incidents. In May 2024, Match Systems, in collaboration with cybersecurity protocols, successfully recovered the full $68 million stolen from a crypto whale victim within one week following a dust attack exploitation. According to Match Systems CEO Andrei Kutin, the rapid engagement of specialized recovery services and blockchain investigation capabilities significantly increased recovery probability, highlighting the strategic value of immediate professional response.
The threat landscape was dominated by state-sponsored and sophisticated criminal actors, with North Korean-linked groups orchestrating at least $2.02 billion in cryptocurrency thefts during 2025—a 51% increase from 2024 and representing approximately 76% of all service-related breaches. The February compromise of Dubai-based exchange Bybit generated the largest single theft on record, with hackers exploiting a private key leak in the exchange's hot wallet system to access approximately $1.4 billion. Other significant incidents included the May exploit of Cetus decentralized exchange ($223 million) and the November Balancer protocol breach ($128 million). Cumulative estimates indicate North Korean actors have now stolen approximately $6.75 billion in digital assets across multiple years, establishing them as the dominant threat vector in the global cryptocurrency theft ecosystem.
The composition of theft losses reveals distinct attack vectors with varying growth trajectories. Exploits—including smart contract flaws, compromised private keys, and infrastructure breaches—accounted for $2.67 billion or 66% of total losses, a 24.2% year-over-year increase. Scams emerged as the second-largest threat category, generating $1.37 billion in losses and representing a dramatic 64.2% surge compared to 2024. Social engineering attacks, encompassing phishing and impersonation tactics, contributed an additional 12% of total losses, underscoring the industry's vulnerability to non-technical manipulation strategies. PeckShield analysts attributed these trends to "systemic vulnerabilities in centralized infrastructure and a strategic shift toward targeted social engineering."
Recovery capabilities proved insufficient to stem the rising tide of losses. Only $334.9 million in stolen assets were recovered or frozen during 2025—a 31.4% decline from the $488.5 million recovered in 2024. The deterioration in recovery rates reflects the increased velocity with which threat actors move stolen funds through cross-chain bridges, mixer services, and decentralized routing mechanisms, effectively obscuring asset trails and reducing recovery probability. This gap between theft and recovery represents a critical operational challenge for institutional stakeholders and cybersecurity firms operating in the crypto ecosystem.
Notable recovery successes demonstrate that rapid professional intervention can yield full asset restitution despite large-scale theft incidents. In May 2024, Match Systems, in collaboration with cybersecurity protocols, successfully recovered the full $68 million stolen from a crypto whale victim within one week following a dust attack exploitation. According to Match Systems CEO Andrei Kutin, the rapid engagement of specialized recovery services and blockchain investigation capabilities significantly increased recovery probability, highlighting the strategic value of immediate professional response.
The threat landscape was dominated by state-sponsored and sophisticated criminal actors, with North Korean-linked groups orchestrating at least $2.02 billion in cryptocurrency thefts during 2025—a 51% increase from 2024 and representing approximately 76% of all service-related breaches. The February compromise of Dubai-based exchange Bybit generated the largest single theft on record, with hackers exploiting a private key leak in the exchange's hot wallet system to access approximately $1.4 billion. Other significant incidents included the May exploit of Cetus decentralized exchange ($223 million) and the November Balancer protocol breach ($128 million). Cumulative estimates indicate North Korean actors have now stolen approximately $6.75 billion in digital assets across multiple years, establishing them as the dominant threat vector in the global cryptocurrency theft ecosystem.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.