According to ChainCatcher, cryptocurrency theft reached $3.4 billion in 2025. The Bybit attack alone caused $1.5 billion in losses, representing 44% of the annual total. In the first half of 2026, 212 incidents generated roughly $1.1 billion in losses. About 55% of those incidents were tied to groups linked to Lazarus, and KelpDAO lost $293 million in an April attack. The typical laundering flow for stolen funds follows a three-stage pattern over roughly 45 days: assets are swapped through DeFi protocols and sent into mixing services during the first five days; then they are bridged across blockchains and moved through exchanges with lower KYC standards; between day 20 and day 45, the funds exit in batches through no-KYC platforms, instant exchangers, and OTC trading networks. Tracing remains possible even after funds cross multiple blockchains, mixing services, and jurisdictions, but recovery becomes significantly harder. Bybit recovered less than 5% of its stolen funds. Tether and Circle have the ability to freeze USDT and USDC addresses, though attackers typically convert stablecoins to Ethereum or Bitcoin within minutes.
ChainCatcher says cryptocurrency theft hit $3.4 billion in 2025. The Bybit attack made up $1.5 billion of that figure, equal to 44% of the yearly total.
In the first half of 2026, there were 212 theft-related incidents, with losses of about $1.1 billion. Roughly 55% of those cases were tied to Lazarus-linked groups. And in April, KelpDAO lost $293 million in an attack.
Stolen money usually moves in a three-stage cycle that lasts around 45 days. First, over roughly five days, the assets are swapped through DeFi protocols and pushed into mixing services. Then the funds are bridged across chains and funneled through exchanges with weaker KYC rules. After that, between day 20 and day 45, the money is cashed out in batches through no-KYC platforms, instant exchangers, and over-the-counter trading networks.
Tracing can still succeed even after funds move across several blockchains, mixing services, and jurisdictions. But recovery gets far tougher by then. Less than 5% of the funds stolen from Bybit were ever recovered. Tether and Circle can freeze USDT and USDC addresses, yet attackers usually swap stablecoins into Ethereum or Bitcoin within minutes of an attack.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
