The cryptocurrency ecosystem endured another difficult year in 2025, as the total value of stolen digital assets continued to rise.
According to a Chainalysis report, more than $3.4 billion was stolen from January through early December 2025, with a single breach, the February compromise of Bybit accounting for $1.5 billion of that figure.
The report highlights a notable shift in crypto theft dynamics, shaped by four major trends.
These include;
- The continued dominance of the Democratic People’s Republic of Korea (DPRK) as the leading threat actor.
- The growing severity of attacks on centralized platforms.
- A sharp increase in personal wallet compromises.
- A surprising divergence in decentralized finance (DeFi) hack patterns.
Personal wallet compromises expanded significantly over recent years, rising from 7.3% of total stolen value in 2022 to 44% in 2024. In 2025, this figure would have stood at 37% were it not for the outsized impact of the Bybit breach.
At the same time, centralized services recorded increasingly severe losses, largely driven by private key compromises. Despite strong institutional resources and professional security teams, these platforms remain vulnerable to this fundamental weakness. Although such incidents are relatively rare, their magnitude is substantial, accounting for 88% of total losses in the first quarter of 2025 alone.
The persistence of high theft volumes suggests that while some areas of crypto security have improved, attackers continue to exploit multiple attack vectors successfully.
A defining feature of 2025 was the growing concentration of losses in a handful of extreme events. The ratio between the largest hack and the median incident exceeded 1,000 times for the first time, surpassing even the peak levels seen during the 2021 bull market.
Based on the USD value of funds at the time of theft, the top three hacks in 2025 accounted for 69% of all service-related losses, underscoring how single breaches can now dramatically influence annual totals.
Nation-state threats remained central to this trend. The DPRK recorded its most severe year on record for crypto theft, stealing at least $2.02 billion in 2025—an increase of 51% year-on-year and $681 million more than in 2024. DPRK-linked actors were responsible for a record 76% of all service compromises, pushing the lower-bound estimate of cumulative DPRK crypto theft to $6.75 billion.
Despite a significant reduction in the number of known attacks, North Korean hackers achieved larger impacts by increasingly embedding IT workers within crypto firms. This approach enabled privileged access, faster lateral movement, and ultimately large-scale thefts from exchanges, custodians, and web3 companies.
Personal wallet compromises accounted for an estimated 20% of total stolen value in 2025, down from 44% in 2024, reflecting a shift in both scale and strategy. Theft incidents surged to 158,000 in 2025, nearly triple the 54,000 recorded in 2022, while the number of unique victims doubled from 40,000 to at least 80,000.
These increases are largely attributed to broader crypto adoption. For instance, Solana—one of the most actively used blockchains—recorded the highest number of personal wallet incidents, with approximately 26,500 victims.
However, despite more incidents and victims, the total value stolen from individuals declined sharply, falling from $1.5 billion in 2024 to $713 million in 2025. This indicates that attackers are compromising more wallets but extracting smaller amounts per victim.
When adjusted for active wallet counts, Ethereum and Tron recorded the highest theft rates per 100,000 wallets in 2025. Ethereum combined high victim counts with elevated theft rates, while Tron exhibited a high rate despite a smaller user base. In contrast, Base and Solana showed comparatively lower victimization rates relative to their large and growing communities.
As the DPRK continues to leverage cryptocurrency theft to fund state objectives and bypass international sanctions, the industry faces a distinct and evolving threat. The country’s record-breaking performance in 2025—achieved with 74% fewer known attacks—suggests that only the most visible operations are being detected.
Looking ahead to 2026, the central challenge for the crypto industry will be identifying and disrupting these high-impact campaigns before another breach on the scale of Bybit occurs.
