Crypto theft in 2025: US$3.4 billion, a North Korean record and the Bybit case in Chainalysis and CertiK data
Two December 2025 reports show a year among the worst for crypto theft, though it did not surpass 2022. The record belonged to North Korea, driven by the attack on Bybit.
Historical reference: January 8, 2026. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- Chainalysis counted more than US$3.4 billion stolen in 2025 and CertiK counted US$3.35 billion. That is a lot, but less than the US$3.8 billion of 2022, the worst year in Chainalysis's series.
- The 2025 record belongs to North Korea: at least US$2.02 billion stolen, the largest annual amount ever attributed to the country. The Bybit attack alone took US$1.5 billion.
- The number of thefts grew, but the value stolen from personal wallets fell to US$713 million, according to Chainalysis.
- The reports' totals differ because of methodology. Always compare numbers within the same source.
São Paulo, January 8, 2026 — The year 2025 closed among the worst ever measured for cryptocurrency theft by value, driven by the largest single theft in history. Chainalysis, a blockchain analytics company, counted more than US$3.4 billion taken from January to early December. CertiK, a smart contract security firm, reached US$3.35 billion for the year. The total does not surpass 2022, when Chainalysis counted US$3.8 billion stolen from companies in the sector. The 2025 record is a different one: North Korea's. Both reports came out in December and point to the same pattern: a few giant attacks, most of them of North Korean origin.
For a company that pays foreign suppliers in USDT, the relevant data point is not the number itself. It is where the risk lies: in exchanges and providers with compromised keys, in social engineering fraud and in operational errors, which remain the most common way in.
- Stolen in 2025, from January to early December (Chainalysis, 12/18/2025)
- US$3.4 bn
- Losses in 2025 according to CertiK, up 37% from 2024 (12/23/2025)
- US$3.35 bn
- Stolen by hackers linked to North Korea, up 51% (Chainalysis)
- US$2.02 bn
- Share of the three largest attacks in total service losses (Chainalysis)
- 69%
The year's numbers according to each report
The two reports use different methodologies, which is why the totals do not match. Chainalysis tracks stolen funds on public blockchains and attributes cases to groups. CertiK counts security incidents at protocols and platforms, with gross losses.
| Indicator | Chainalysis | CertiK |
|---|---|---|
| Total in 2025 | More than US$3.4 billion (Jan. to early Dec.) | US$3,352,850,816 |
| Comparison with 2024 | Value from personal wallets fell from US$1.5 bn to US$713 mn | US$2,446,285,251 in 2024; up 37.06% |
| Largest case | Bybit: US$1.5 billion (Feb.) | Bybit: US$1,447,063,421 |
| Phishing fraud | Not detailed in the summary | US$722,885,398 in 248 incidents |
| Without the Bybit case | Not reported | Losses would have fallen compared with 2024 |
CertiK also shows that the typical attack got smaller while the big ones got bigger: the average loss per incident rose 66.6%, to US$5.3 million, while the median fell 35.8%, to US$104,000. The year had many small scams and a few events that concentrate the value.
The weight of North Korea and the Bybit case
According to Chainalysis, hackers linked to North Korea stole at least US$2.02 billion in 2025, US$681 million more than in 2024 (up 51%). The company calls 2025 the most severe year in the series for North Korean theft and estimates the country's cumulative total at US$6.75 billion. The year's amount is equivalent to about 59% of the total stolen, and North Korean attacks accounted for 76% of service compromises, another record.
The heaviest case was Bybit, on February 21: about US$1.5 billion in ether. On February 26, the FBI attributed the attack to North Korea, in an activity the agency calls TraderTraitor. The breach came from a compromised interface, not from a blockchain flaw, a topic detailed in The Bybit attack: the US$1.5 billion theft. CertiK classifies the case as a supply chain attack, the vector that cost the most in the year, with US$1.45 billion in just two incidents.
The software supply chain has become a target: a tampered package or a compromised interface is enough to empty a wallet or an exchange.
Swapo editorial team
The npm case, in September, showed the same risk for those who develop wallet and payment software, as described in The npm attack and the wallet address swap.
What changed for individuals
For the individual user, Chainalysis's numbers show a mixed picture: the number of personal wallet compromises was high (158,000 incidents, at least 80,000 unique victims), but the value stolen fell from a peak of US$1.5 billion in 2024 to US$713 million in 2025. These wallets accounted for 20% of the total value stolen, against 44% in 2024. Their relative weight shrank because attacks on platforms grew so much, not because crime against individuals disappeared.
What companies should do with this data
- Treat keys and access as the main asset: your own wallet, two-factor authentication and approval by more than one person for payments.
- Check the destination address through a second channel and on the device, never only on the computer screen.
- Be suspicious of any support agent who asks for a seed phrase, password or code, and of anyone who offers to recover lost funds.
- Do not leave a balance sitting on a third-party platform longer than necessary; prefer to complete the payment on the same day.
- Keep the hash and the receipt of each transaction for reconciliation and audit.
Theft totals vary according to what each company counts (hacks, scams, gross or net amounts) and the cutoff date. The numbers above come from the December 2025 reports and may be revised.
Frequently asked questions
How much was stolen in cryptocurrency in 2025?
Chainalysis counted more than US$3.4 billion from January to early December 2025. CertiK, which counts security incidents with gross losses, reached US$3.35 billion for the year. The totals differ because of methodology.
Was 2025 the record year for crypto theft?
Not in total. Chainalysis counted more than US$3.4 billion in 2025, below the US$3.8 billion of 2022, the worst year in the company's series. The 2025 records are North Korea's, with at least US$2.02 billion, and the largest single theft, Bybit's.
What was the largest crypto theft of 2025?
The attack on the Bybit exchange, on February 21, 2025, with about US$1.5 billion in ether, attributed by the FBI to North Korea. According to CertiK, the loss was US$1.447 billion.
How much did North Korea steal in 2025?
According to Chainalysis, at least US$2.02 billion, up 51% from 2024 and the largest annual amount ever attributed to the country. The North Korean cumulative total reaches US$6.75 billion, at the floor of the company's estimate.
Did attacks on personal wallets increase in 2025?
Chainalysis recorded 158,000 personal wallet compromises, but the value stolen fell from US$1.5 billion in 2024 to US$713 million in 2025. The share of the total went from 44% to 20%, because attacks on platforms grew.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion · Chainalysis, Dec 18, 2025
- Hack3d: The Web3 Security Report 2025 · CertiK, Dec 23, 2025
- 2022 Biggest Year Ever For Crypto Hacking with $3.8 Billion Stolen, Primarily from DeFi Protocols and by North Korea-linked Attackers · Chainalysis, Feb 1, 2023
- North Korea Responsible for $1.5 Billion Bybit Hack · FBI Internet Crime Complaint Center (IC3), Feb 26, 2025
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
