A recent report by blockchain analytics firm Chainalysis has identified two highly professional hacking groups as the dominant forces behind cryptocurrency exchange thefts, together responsible for stealing approximately $1 billion to date.
Two Groups Dominate Crypto Hacks
By analyzing the money-laundering techniques used by cybercriminals, Chainalysis researchers pinpointed two distinct hacker collectives. The average theft incident involving these groups amounted to $90 million. The first group is described as a "giant, tightly controlled organization" that may be partially motivated by non-monetary goals. The second group is smaller and less organized but ruthlessly focused on profit, with little regard for evading detection.
“Hacking dwarfs all other forms of crypto crime, and it is dominated by two prominent, professional hacking groups,” the Chainalysis team wrote. “Together, these two groups are responsible for stealing around $1 billion to date, at least 60% of all publicly reported hacks. And given the potential rewards, there’s no question hacking will continue; it is the most lucrative of all crypto crimes.”
Laundering the Stolen Funds
The report found that at least 50% of stolen funds were cashed out through some type of conversion service within 112 days of the hacks. Specifically, 64.3% of the funds were sent to centralized cryptocurrency exchanges, 11.9% to peer-to-peer exchanges, and the remaining 23.8% went through mixing services, Bitcoin ATMs, gambling sites, and other conversion services.
“Exchanges are regularly processing the stolen funds, allowing the hackers to convert the funds to traditional currencies or other cryptocurrencies,” the Chainalysis team explained. “This is in part because unless you’re the exchange that was hacked, these funds look like they have come from legitimate owners (that is, the original entities who were hacked); it is hard to tell which funds have been stolen and which haven’t without specialized investigation software.”
To address this challenge, Chainalysis recently launched Know Your Transaction (KYT) for stablecoins, an anti-money laundering (AML) compliance solution that monitors stablecoin transactions from issuance to redemption. The report underscores the ongoing arms race between cybercriminals and security firms in the crypto ecosystem, as exchanges and regulators seek new tools to identify and disrupt illicit flows.