Key Takeaways
- Chainalysis logged $3.4B stolen in 2025, with Bybit’s $1.5B hack alone accounting for 44% of that total.
- H1 2026 set a record 212 incidents per Blockaid, with Lazarus-linked crews behind about 55% of these losses.
- KelpDAO’s $293M April exploit was 2026’s largest single hit.
Six Years, More Than $16 Billion Gone
Crypto theft is no longer a phase that the digital asset industry is slowly getting out of but an industry unto itself. To this point, over the past half a decade alone, onchain sleuths have counted ballooning stolen totals ($3.7 billion in 2022, $1.7 billion in 2023, $2.2 billion in 2024, and $3.4 billion in 2025), figures that have shown no signs of stopping.
In fact, it bears mentioning that nearly half of last year’s total came from a single event, i.e. the February 2025 Bybit hack, in which attackers compromised the exchange’s cold-wallet signing process and walked away with $1.5 billion (making it the largest crypto theft in history).
The first half of this year was eerily similar, adding roughly $1.1 billion across a record 212 incidents, per security firm Blockaid. The largest single hit was the April 19 exploit of restaking protocol KelpDAO (at $293 million), and TRM Labs counted 207 incidents over these six months, more than double the same period a year earlier.
The 45-Day Playbook
What typically happens after the aforementioned thefts has become almost like a script at this point, with researchers describing a distinctive laundering cycle that runs roughly 45 days in three waves.
During days zero through five, speed matters most and the stolen tokens are typically swapped through decentralized finance (DeFi) protocols (activity spikes as much as 370%) and pushed into mixing services, which pool and shuffle coins to break the link between source and destination. During days six through ten, the funds hop chains via cross-chain bridges and flow through exchanges with limited know-your-customer (KYC) checks.
Then, from roughly day 20 to day 45, the coins are cashed out in small tranches (typically under $500,000 to stay beneath reporting thresholds) through no-KYC venues, instant exchangers, and Chinese-language over-the-counter (OTC) networks and guarantee services such as the sanctioned Huione marketplace.
Consequently, by the end of the cycle, the money has crossed through so many chains, mixers and jurisdictions that even though attribution remains possible (since blockchains never forget), recovery rarely is. For perspective’s sake, less than 5% of Bybit’s stolen funds were ever recovered, even though the exchange had some of the most prolific white hat personnel on their side.
