Crypto Crime Report 2026: $3.4B Stolen in 2025

• Crypto theft hit new highs in 2025: $2.17B was stolen by midyear and more than $3.4B by early December, led by the $1.5B Bybit hack.
• Even so, illicit transactions remain a tiny fraction of crypto activity (under 1%).
• Scams set a record of at least $14B on-chain in 2025 (possibly over $17B) as AI-enabled impersonation surged, while ransomware payments fell about 8% and darknet market flows edged up.
• Proactive defenses are crucial: penetration testing, audits, and compliance can uncover vulnerabilities before criminals strike. See DeepStrike’s Penetration Testing Services.

Cryptocurrency’s meteoric rise has brought both innovation and crime. Crypto Crime Report 2026 drills down on the latest trends: hackers, scammers, and even nation states exploiting digital assets. According to Chainalysis, $2.17 billion was stolen from crypto services by mid-2025, nearly matching the $2.2 billion stolen in all of 2024, and the full-year total passed $3.4 billion by early December. Yet illicit activity still accounts for less than 1% of on-chain volume, so most blockchain activity is legitimate. The key takeaway: as crypto adoption grows, so do the threats. This report compiles the latest data and expert insights to help you defend your assets.

For the largest individual incidents, see Biggest Crypto Hacks of All Time.

What is Crypto Crime?

Crypto crime covers any illicit activity involving cryptocurrencies or blockchain technology. That includes theft (draining exchange or wallet funds, exploiting smart contracts), fraud (Ponzi/ICO schemes, fake trading apps, romance/pig-butchering scams), ransomware (encrypting data and demanding crypto ransom payments), and money laundering (using mixers, privacy coins, or corrupt exchanges to hide stolen funds). For context, Chainalysis found that illicit crypto addresses received at least $154 billion in 2025, a record driven largely by sanctioned entities, and it revised 2024 up to $57.2 billion from the $40.9 billion it first reported. Even so, illicit activity remains below 1% of all on-chain transaction volume. In short, while the absolute dollar amounts are huge, illicit activity remains a small slice of overall blockchain usage.

Why Crypto Crime Matters in 2026

The stakes are higher than ever. Millions of people and businesses now hold cryptocurrency, and criminals have taken notice. The U.S. Treasury estimates Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024, and the FBI IC3 2025 report logged $11.37 billion in losses tied to cryptocurrency complaints in 2025, including $7.2 billion from crypto investment fraud. Major thefts like the $1.5B Bybit hack and widespread fraud undermine confidence in digital finance. Meanwhile, law enforcement has dramatically stepped up actions. In October 2025 the DOJ filed a forfeiture action against about 127,271 bitcoin, worth roughly $15 billion, tied to the Prince Group pig butchering network, the largest forfeiture action in the department’s history. These developments mean crypto security is no longer optional but essential.

Key Crypto Crime Trends in 2026

• Record Theft Spree: Crypto platform hacks dominated 2025’s headlines. By mid-2025, Chainalysis tracked over $2.17 billion stolen from crypto services, nearly matching the 2024 full-year total, and theft passed $3.4 billion by early December. North Korean hackers took at least $2.02 billion of that, up 51% year over year. One huge event drove much of this: North Korea’s Lazarus Group stole $1.5 billion in Ethereum from Bybit, the largest crypto heist ever, which the FBI attributed to North Korea. Other notable 2025 incidents include the May 2025 Coinbase insider data breach, which Coinbase estimated would cost $180- $400M to remediate, and a roughly $223M exploit of the Cetus DeFi exchange.
• Stablecoin Laundering: Criminals favor stablecoins (USDT, USDC, etc.) for swift, cross-border laundering. Chainalysis reported stablecoins made up 63% of illicit crypto transfers in 2024, and that share rose to 84% in 2025. Large hack and scam proceeds are often immediately converted to stablecoins. Regulators are targeting this channel: for example, in October 2025 FinCEN issued a final rule cutting Cambodia’s Huione Group, a financial conglomerate it found laundered at least $4 billion in illicit proceeds, off from the U.S. financial system, and exchanges now face strict KYC/AML scrutiny.
• Evolving Scams: Fraud schemes remain pervasive and are growing again. TRM Labs counted at least $10.7 billion sent to crypto fraud in 2024, but Chainalysis found scams received at least $14 billion on-chain in 2025, a figure that could exceed $17 billion as more wallets are identified. Popular pig butchering romance/investment scams still net multibillion dollar hauls by grooming victims with fake crypto trades. Criminals are also getting tech savvy: impersonation scams grew about 1,400% year over year, and scams with on-chain links to AI vendors took in about 4.5 times more per operation than other scams. As AI-generated content becomes harder to distinguish from human-created material, an AI checker can help identify suspicious or artificially generated messages before they are used to deceive victims.
• Ransomware Shifts: Ransomware remains a multimillion-dollar menace but is under pressure. Chainalysis counted more than $820 million in on-chain ransom payments in 2025, down about 8% from a revised $892 million in 2024, and the share of victims who paid may have fallen to an all-time low of 28%. Major gangs were disrupted (LockBit, BlackCat) and many victims now refuse to pay. Still, new gangs emerged (e.g., Medusa, Rhysida), focusing on smaller targets. Verizon’s 2026 DBIR found ransomware in 48% of breaches, yet 69% of ransomware victims didn’t pay. Attackers often get in through stolen credentials, exploited vulnerabilities, or phishing emails, and Chainalysis has flagged growing AI use across fraud and extortion in its crypto crime reporting.
• Darknet & Laundering: Crypto is still the currency of choice on darknet markets (drugs, stolen data, weapons). Chainalysis shows darknet markets received about $2.0B in crypto in 2024, down from $2.3B in 2023. Combined crypto inflows to darknet markets and drug vendors, a broader measure, rose slightly to just over $2.5B in 2025. Marketplaces keep rising and falling as enforcement actions and exit scams take them down. Laundering networks responded by decentralizing, but tracking is improving. For example, U.S. and EU rules now require exchanges and wallet providers to report suspicious crypto flows, making it harder for criminals to hide illicit funds.

Notable Crypto Crimes of 2025

The Cost of Crypto Breaches vs Security

Data breach costs are staggering: IBM’s 2026 Cost of a Data Breach study puts the average U.S. breach at about $11.5 million, up from $10.22 million a year earlier. In contrast, proactive security is far cheaper: a penetration test or smart contract audit typically costs a small fraction of a single breach. The table below illustrates the payoff of prevention:

Spending even tens of thousands on a thorough security review can prevent losses in the millions or billions. Think of it as insurance for your crypto business: a small premium now to avoid catastrophic breach costs later.

How to Strengthen Crypto Security: Step by Step Guide

• Secure by Design: Build safety in from day one. Use references like the OWASP Smart Contract Top 10 when designing contracts, and NIST SP 800-115 when planning security testing. Segment privileges (for example, multi-signature wallets across separate servers) and enforce robust KYC/AML for users; this deters money launderers and unauthorized transfers.
• Continuous Penetration Testing: Regularly simulate real attacks on your systems. Use expert teams or platforms such as DeepStrike’s continuous penetration testing platform. Conduct targeted tests as well for example, run web application penetration testing services on your exchange or API, and mobile app penetration testing solution for mobile wallets to cover every attack surface.
• Smart Contract Audits: If you use blockchain code, get it audited carefully. Manual code review, static analysis, and formal verification can catch bugs like reentrancy, math overflows, or flawed access controls. Even a small error can be catastrophic: past DeFi hacks cost hundreds of millions. An audit costs a small fraction of the funds it protects.
• Bug Bounty Programs: Encourage ethical hackers to test your systems by offering rewards. Well run bug bounty initiatives via platforms or custom programs uncover tricky vulnerabilities that automated tools miss. Many white hat researchers find clever flaws e.g. in smart contract logic or wallet UI before criminals do.
• Real Time Monitoring & Response: Track blockchain transactions and network logs continuously. Set alerts for large transfers, new high value addresses, or hits flagged by blockchain analytics. Have an incident response plan: know how to freeze compromised wallets, rotate keys, notify users, and engage law enforcement immediately if a breach happens. Quick response can limit damage dramatically.
• Phishing Defenses: Train your team to spot scams. Phishing is behind many breaches: IBM’s 2025 study found it was the most common initial attack vector, at 16% of breaches. Enforce multi-factor authentication (MFA) everywhere, run routine phishing simulations, and cultivate a verify-before-trust culture (e.g., phone confirmation for large wire transfers). For more on phishing threats, see DeepStrike’s analysis of phishing attack trends and statistics.

The crypto landscape of 2025 saw both record-setting thefts and unprecedented crackdowns, and those trends carry into 2026. Digital assets remain attractive to crooks, but coordinated enforcement efforts are disrupting many schemes. Organizations can no longer afford complacency: with billions on the line, proactive security measures are mandatory. By staying informed about evolving threats (from state-sponsored hacks to AI-enhanced scams) and investing in defenses (secure architecture, pentesting, continuous monitoring), businesses and individuals can significantly reduce risk.

Ready to strengthen your defenses? The threats of 2026 demand more than just awareness; they require readiness. If you're looking to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike is here to help. Our team of practitioners provides clear, actionable guidance to protect your business.

Explore our penetration testing services to see how we can uncover vulnerabilities before attackers do. Drop us a line. We’re always ready to dive in. Virtual asset service providers licensed in Dubai can start with VARA penetration testing.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

FAQs

• How much cryptocurrency was stolen in 2024 and 2025?

It has been massive. In 2024, hackers stole roughly $2.2 billion in crypto, according to Chainalysis. By mid 2025, $2.17 billion had already been stolen from crypto services, and the 2025 total passed $3.4 billion by early December. The single biggest event was the $1.5B Bybit hack.

• What was the biggest crypto theft ever?

The record now belongs to the Feb 2025 Bybit exchange hack. DPRK linked hackers stole about $1.5 billion in Ethereum, surpassing all previous crypto heists by a wide margin.

• Are crypto crime rates increasing or decreasing?

In absolute dollars, losses are up: more was stolen in 2025 than in 2024, and Chainalysis counted a record $154 billion in illicit volume, driven largely by sanctioned entities. Viewed alongside broader cybersecurity statistics, crypto activity is also soaring: Chainalysis says illicit activity is still below 1% of on-chain volume, and TRM Labs puts the illicit share at about 1.2% in 2025 (its methodology changed, so comparisons with earlier years are approximate). In other words, the percentage of crypto used in crime is small, but the total sums at risk are significant and rising.

• Who is most targeted in crypto crimes?

Everyone: individuals, businesses, and governments. Consumers often fall for scams, while exchanges and fintech firms face hacks and insider fraud. State sponsored groups focus on high value infrastructure: for instance, North Korean hackers stole at least $2.02 billion in 2025, mostly from exchanges and crypto firms. If you handle crypto or have valuable data, you could be a target.

• How are authorities fighting crypto crime?

Aggressively. U.S. and international agencies have charged key perpetrators and gone after enormous assets. For example, in October 2025 the DOJ filed a forfeiture action against about 127,271 bitcoin, worth roughly $15B, tied to the Prince Group scam network, while Treasury sanctioned 146 Prince Group targets and FinCEN cut Huione Group off from the U.S. financial system. INTERPOL’s HAECHI VI operation, spanning 40 countries and territories, recovered $439M in cash and assets from fraudsters in 2025. Regulators now force crypto platforms to enforce strict KYC/AML and report suspicious transactions, closing many loopholes.

• What is pig butchering in crypto?

It’s a scam where criminals befriend victims (often on social media or dating apps), build trust, and coax them into fake crypto investments. Early small returns lure victims into investing more; eventually the scammers disappear with all the money. Global authorities say pig butchering has drained billions from victims worldwide; the FBI recorded $7.2 billion in U.S. crypto investment fraud losses in 2025 alone. The Prince Group case above is a prime example of this tactic.

• How can I protect my crypto assets?

Use strong security hygiene. Keep the bulk of crypto in cold/hardware wallets, enable MFA on all accounts, and use unique, complex passwords. Double check any investment or transfer requests, especially unsolicited ones. For organizations: invest in security reviews and training. Regular penetration tests and code audits of your crypto systems can find vulnerabilities before hackers do. Staying on top of security best practices is essential.