Centralized platforms faced the highest financial impact, exemplified by a single $1.5 billion breach at the Bybit exchange.
The year 2025 has proved to be a record-breaking year for illicit activities related to digital assets, with an estimated theft of $6.5 billion by global cryptocurrency hackers. The majority of these losses were led by the primary hacker groups, sponsored by the government of North Korea.
This marks a 51% increase from the past year, while the number of incidents has actually reduced. According to the 2026 Crypto Crime Report, the substantial rise in stolen value can be attributed to the entry points that involved the hiring of phishing IT staff to gain entry. Although it is noted that the number of incidents has reduced.
2025 has now officially been the worst year on record thus far when considering the severity of crypto security. Although exploits in the decentralized finance space had been the leading sources within previous market cycles, this year boasted an enormous uptick in attacks on centralized platforms.
The largest incident occurred in the second week of February, when the centralized exchange Bybit was compromised, causing the loss of $1.5 billion. Chainalysis noted that North Korean threat actors have become increasingly good at such scale largely by using IT professionals, one of the key attack methods that the DPRK employs, within the crypto industry to attain privileged access on the inside.
According to The Crypto Times, the year was marked by a unique overlap of state-level policy endorsements, mostly through President Trump’s January executive order and the passage of the GENIUS and CLARITY Acts, alongside technical milestones like Ethereum’s Pectra and Fusaka upgrades.
While Bitcoin reached a record high of $126,000, the industry also faced a $1.5 billion hack of Bybit and a $20 billion liquidation event in the fourth quarter. Overall, 2025 served as a “year of extremes” that replaced legal uncertainty with federal frameworks and long-awaited court sentences.
Over the last decade, the total amount of cryptocurrency illicitly acquired by the country is in excess of $6.7 billion. In 2024, the DPRK accounted for approximately $1.3 billion in illicit acquisition, a figure that rose to over $2 billion in 2025.
Traditionally, North Korean cyberattacks specifically targeted technical vulnerabilities in smart contracts or cross-chain bridges. As a result of improvements in the security of the protocol, malicious actors switched to targeting human vulnerability. As Chainalysis clarified, “Part of this record year likely reflects an expanded reliance on IT worker infiltration at exchanges, custodians, and web3 firms, which can accelerate initial access and lateral movement ahead of large‑scale theft.”
The future outlook for the industry has far-reaching ramifications, given that these figures indicate that traditional code reviews are no longer adequate. The success of the “2025” attacks highlights the need for background screening and verification processes for remote workers across the industry.
Additionally, it has been found that the trail of laundering activities this year reveals an even bigger use of Chinese-based services, which makes it even more difficult for law enforcers to freeze money transfers when they go out of a platform. There has been an even bigger use of personal wallet hacks within the industry this year, which has resulted in losses in excess of $713 million.
In light of the foregoing discussion, it is safe to say that the year 2025 crypto market was characterized by a “quality over quantity” hacker trend, whereby even a smaller number of attacks saw tremendous economic gains. The 51% jump in stolen funds to $6.5 billion is no doubt a wake-up call regarding the current state of threats from nation-state hackers.
As the calendar progresses to 2026, the spotlight will likely be on operations security instead of technological security. The world of crypto will be unable to sustain its current momentum without fixing the vulnerabilities observed in the current crop of high-level social engineering attacks.
