Crypto Theft Hits $3.4B in 2025, Funds Laundered Within 45 Days

Bybit accounts for 44% of $3.4B stolen in 2025. Lazarus-linked groups drive 55% of attacks. Funds are laundered via DeFi and bridges within 45 days, with recovery rates below 5%.

Woofun AI reports that cryptocurrency thefts totaled $3.4 billion in 2025, with Bybit suffering $1.5 billion in losses, representing 44% of the annual total. In the first half of 2026, 212 incidents resulted in approximately $1.1 billion in losses, with Lazarus-linked groups responsible for roughly 55% of these attacks, including a $293 million loss at KelpDAO in April.

Stolen funds typically undergo a three-stage laundering process lasting about 45 days. Within the first five days, assets are converted via DeFi protocols and sent to mixing services. Subsequently, funds move through bridges to trading platforms with lower KYC requirements. Between days 20 and 45, attackers cash out in batches using non-KYC platforms, instant exchangers, and OTC networks. Although cross-chain tracking remains possible, recovery is difficult; less than 5% of Bybit's stolen funds were recovered, as attackers usually convert stablecoins into Ethereum or Bitcoin within minutes.