The global cryptocurrency ecosystem recorded another difficult year in 2025, with stolen digital assets rising sharply to more than $3.4 billion.
This is according to a new report by blockchain analytics firm Chainalysis, which highlights a clear shift in crypto crime patterns, driven by fewer but far more devastating attacks.
For 2024, the platform reported that a total of $2.2 billion was stolen via hacks, making the 2025 figure a 54% year-on-year increase in crypto thefts.
The report also shows the continued dominance of North Korea as a threat actor, a surge in personal wallet compromises, and a notable slowdown in decentralised finance-related hacks despite a rebound in market activity.
Chainalysis said more than $3.4 billion worth of cryptocurrency was stolen between January and early December 2025, with a single incident accounting for a significant portion of that figure.
The report shows that crypto theft in 2025 was heavily outlier-driven, with a small number of attacks accounting for the bulk of losses.
Chainalysis found that the ratio between the largest hack and the median theft crossed the 1,000 times threshold for the first time, surpassing levels seen during the 2021 bull market.
The top three hacks alone accounted for 69 percent of all losses linked to services in 2025.
This concentration suggests that while the number of incidents may fluctuate, the financial impact of individual breaches is escalating at a much faster pace, raising systemic risk concerns for major platforms.
North Korea remained the most significant nation-state threat to the crypto industry in 2025, despite a sharp decline in the number of confirmed attacks attributed to the country.
Chainalysis estimates that hackers linked to the Democratic People’s Republic of Korea stole at least $2.02 billion in cryptocurrency in 2025, a 51 percent increase from 2024.
These attacks accounted for a record 76 percent of all service-related compromises during the year.
Cumulatively, the lower bound estimate of crypto stolen by North Korea has now reached $6.75 billion. The report notes that DPRK-linked actors tend to carry out fewer but much higher-value attacks, often targeting large exchanges, custodians, and web3 firms.
According to Chainalysis, North Korean actors are increasingly relying on sophisticated social engineering tactics, including embedding IT workers within crypto firms and impersonating recruiters, investors, or acquirers to gain privileged access to systems.
“Once funds are stolen, DPRK-linked hackers follow distinctive laundering patterns. Unlike other cybercriminals who move funds in large on-chain tranches, North Korean actors typically split transactions into smaller amounts, with over 60 percent of transfers below $500,000,” the report stated.
“They also show a strong preference for Chinese language money laundering networks, cross chain bridges, and mixing services, while largely avoiding lending protocols, peer-to-peer exchanges, and even some KYC-free platforms commonly used by other criminals,” it added.
“They also show a strong preference for Chinese language money laundering networks, cross chain bridges, and mixing services, while largely avoiding lending protocols, peer-to-peer exchanges, and even some KYC-free platforms commonly used by other criminals,” it added.
The crypto industry was thrown into shockwaves early this year when Crypto exchange Bybit fell victim to a “sophisticated attack,” resulting in the theft of Ethereum (ETH) valued at $1.4 billion from one of its offline wallets.
The breach was described as the largest crypto heist in history. It surpassed previous major crypto breaches, including the $624 million Ronin Network hack and the $611 million Poly Network exploit, according to data from Rekt, a platform tracking Web3 and crypto-related breaches.