Attacks on exchanges and wallets: Why 2025 became record year for crypto thieves

Traders Union
All News
Editors' Picks
Attacks on exchanges and wallets

Who is behind the billion-dollar thefts

Analysts at Chainalysis estimate that roughly $3.4 billion in crypto assets was stolen in 2025. Most of these losses stemmed from just a handful of major incidents that shaped the year’s overall picture. This suggests that modern crypto hacks are increasingly rare but catastrophic events rather than a steady stream of mid-sized attacks.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The key threat actor remains North Korea (DPRK), which accounted for around 76% of all crypto service compromises in 2025. North Korean groups stole at least $2 billion, a 51% increase year over year, operating less frequently but with significantly higher efficiency.

DPRK operators have even developed a distinct laundering “style.” Instead of moving large chunks of $1–10 million or more, as many other groups do, they split stolen funds into smaller tranches, with most transfers falling below $500,000. These funds are then routed through cross-chain bridges and mixing services. A critical role is played by Chinese-language services and intermediary networks that act as transaction “guarantors,” helping convert assets while bypassing strict compliance checks. As a result, the money “dissolves” across chains and ultimately ends up with less transparent providers, making fiat off-ramps easier.

The most high-profile hack of 2025

As noted above, the defining feature of the year was not dozens of mid-level attacks, but a few extremely large ones. The most illustrative case was the February attack on Bybit, where roughly $1.5 billion in crypto — primarily ETH — was siphoned from the exchange’s infrastructure. It became one of the largest thefts in the history of the crypto market.

The attack was carried out by the same North Korean hackers. It was not a “blockchain hack” per se, but a compromise of a critical asset-management control point: the attackers gained the ability to legitimately sign withdrawal transactions, effectively bypassing internal controls and turning the transfer into what appeared to be an authorized operation.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Bybit publicly stated that client funds were safe and that the exchange remained solvent, meaning users would not bear the losses. Although the news triggered anxiety and a spike in withdrawals, the platform quickly restored normal operations and stabilized the situation.

Who suffers most from hacks

The year 2025 will be remembered for the changing “geography” of victims: increasingly, it is individual users, not protocols, who are under attack. The number of incidents involving compromised personal wallets rose to 158,000 in a single year, while the number of unique victims at least doubled compared to 2022.

Personal wallets accounted for about 20% of the total value stolen in 2025. These thefts became highly mass-scale — attackers targeted more people while the average loss per victim declined. In practice, this most often takes the form of phishing, fake websites and browser extensions, “customer support” scams in messengers, and malicious transaction-signing schemes — attacks where user mistakes matter more than code vulnerabilities.

Solana stands out in particular: by the number of affected users, it became one of the most prominent targets, with tens of thousands of wallet compromises recorded. The reason is not weaker security, but the scale of retail usage — many active wallets, popular applications, a high share of newcomers, and fast interaction flows where users are more likely to sign transactions on autopilot.

How threats are changing — and what to do about it

Crypto crime reached a new level in 2025. On one hand, the industry faces rare but massive attacks by state-backed actors like the DPRK; on the other, widespread theft from everyday users. Risks are no longer confined to vulnerable protocols or poorly secured services — both large centralized platforms and individual wallets are in the crosshairs.

At the service level, the primary threat remains the compromise of access and asset-management processes: a single successful attack on keys or signers can result in losses of hundreds of millions of dollars. For users, the main risks are phishing and social engineering. As criminals increasingly rely on scale, security depends less on blockchain complexity and more on basic digital hygiene.

Looking ahead to 2026, crypto protection will continue to shift toward prevention: hardware wallets for long-term storage, splitting assets across multiple addresses, avoiding suspicious links and extensions, and carefully reviewing transactions and permissions. For the industry as a whole, this means stronger monitoring, tighter access controls, and faster incident response. The lesson of 2025 is clear: threats are growing, but most of them can be significantly reduced if security is treated not as an abstraction, but as a daily practice.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.