Attack on crypto: what and how hackers steal

In 2025, the crypto market faced a record volume of thefts: from January through December, criminals stole more than $3.4 billion. The key feature of the year is not the amount of losses, but the transformation of the threats themselves: the number of attacks declined, but each attack caused significantly greater damage.

North Korea continues to play a dominant role in crypto crime. It accounted for approximately 76% of all crypto service compromises during the year. North Korean groups stole at least $2 billion, which is 51% more than a year earlier, while acting less frequently but far more efficiently.

Another defining characteristic was the evolution of laundering schemes. Unlike other groups that use large transfers worth millions of dollars, DPRK hackers break flows into tranches, typically up to $300,000. The assets then pass through cross-chain bridges and mixers. Networks of intermediaries and Asian (most often Chinese) crypto services play a key role, acting as deal guarantors and helping bypass strict compliance procedures. As a result, the stolen crypto quickly “dissolves” into chains of transfers, migrates between networks, and is ultimately converted into fiat currency through opaque providers.

For example, the February attack involving the theft from Bybit, when approximately $1.5 billion (mostly in ETH) “disappeared” from the exchange’s infrastructure, is also attributed to North Korean “specialists.” Notably, the attack was not related to a “blockchain hack.” The key vulnerability was located in the asset management system: hackers gained the ability to legitimately sign withdrawal transactions, effectively bypassing internal control mechanisms and disguising the theft as an authorized transfer.

The outcome of 2025 was a transformation of the “victim profile”:

• Ordinary users are increasingly being targeted, not just protocols and service infrastructure. About 158,000 incidents related to compromised personal wallets were recorded during the year.
• Private wallets accounted for roughly 20% of the total stolen value. Typical scenarios include phishing, fake websites and extensions, “support services” in messengers, and schemes involving the signing of malicious transactions. The key factor here is not code vulnerabilities, but user errors.
• Solana stands out separately: by the number of affected users, it became one of the most prominent targets. Tens of thousands of wallet compromise cases were recorded. The reason is not that the network is “less secure,” but the scale of retail usage.
• Risks are no longer limited to vulnerable protocols or poorly protected services: both large centralized platforms and individual wallets are under threat.
• For services, the critical point remains the compromise of access and asset management processes — a single successful attack on keys or signers can lead to losses of hundreds of millions of dollars.

In an environment where criminals focus on scale, security increasingly depends not on blockchain complexity, but on basic digital hygiene. In the coming year, crypto asset protection will shift even more toward preventive measures:

• hardware wallets for long-term storage,
• asset separation across multiple addresses,
• avoiding suspicious links and extensions,
• careful verification of transactions and granted permissions.

For the industry as a whole, this means enhanced monitoring, stricter access control, and the fastest possible response to incidents. The practice of 2025 has shown: threats are growing, but a significant portion of them can be mitigated if security is treated not as an abstract concept, but as a daily operational task.

So we act wisely and avoid unnecessary risks.

Profits to y’all!