Odaily reports that $3.4 billion in cryptocurrency was stolen in 2025. The Bybit breach alone cost $1.5 billion, equal to 44% of the annual total. Theft remained persistent into 2026: the first half saw 212 incidents with losses of about $1.1 billion. Lazarus-linked groups were tied to roughly 55% of those cases. KelpDAO lost $293 million in an attack in April. Stolen funds typically move through a three-stage laundering process lasting about 45 days. In the first five days, attackers swap assets through DeFi protocols and deposit them into mixing services. The money then crosses blockchain bridges and passes through exchanges with weaker KYC checks. Between day 20 and day 45, the funds are cashed out in batches through no-KYC platforms, instant exchangers, and over-the-counter networks. Tracking can remain feasible after stolen assets cross multiple blockchains, mixing services, and jurisdictions, but recovery becomes noticeably harder. Bybit recovered less than 5% of the funds taken in its attack. Tether and Circle are able to freeze USDT and USDC addresses. Still, attackers usually exchange stablecoins for ether or bitcoin within minutes of a breach, limiting the window for such action.
Cryptocurrency theft reached $3.4 billion in 2025, and the biggest single incident was the Bybit attack, which resulted in losses of $1.5 billion. That amount accounts for 44% of the year's total, according to Odaily.
The problem continued into 2026. In the first half of the year, 212 separate incidents were reported, with combined losses around $1.1 billion. Groups linked to the Lazarus hacking collective were involved in about 55% of those cases. April brought a $293 million loss for KelpDAO after an attack.
Odaily's report also details how stolen money typically moves. The laundering process runs for about 45 days in three stages. During the first five days, stolen assets are swapped through DeFi protocols and sent into mixing services. After that, the funds are moved across blockchain bridges and routed through exchanges that apply lower KYC requirements. From day 20 to day 45, the money is cashed out in smaller batches using no-KYC platforms, instant exchange services, and over-the-counter trading networks.
Transactions do not become impossible to follow once funds cross multiple blockchains, pass through mixers, and move across jurisdictions. Tracking may still work, but recovering the funds is much harder. Bybit, for example, eventually recovered less than 5% of what was stolen. Tether and Circle have the power to freeze USDT and USDC addresses. Attackers, however, tend to swap stablecoins into ether or bitcoin within minutes of an attack.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
