The first half of 2025 has marked the worst period for crypto-related thefts since the industry’s inception, with over $2.1billion stolen across at least 75 confirmed hacks and exploits. 

This figure surpasses the previous H1 record set in 2022 and nearly matches the total for all of 2024.

The rise in large-scale attacks reflects a dangerous shift in the crypto threat landscape. Nation-state actors are now targeting exchanges and protocols not just for financial gain, but to advance geopolitical objectives.

Crypto hacks in 2025 have already exceeded all previous records
Crypto hacks in 2025 have already exceeded all previous records. Source: TRM Labs

Bybit hack: A $1.5bn turning point

The year’s defining incident was the February 2025 hack of Bybit, a major Dubai-based exchange. The attackers stole approximately $1.5bn, making it the largest cryptocurrency hack in history.

Analysts from multiple blockchain forensics firms attributed the breach to North Korea’s Lazarus Group, a state-backed cybercrime unit. The attack significantly skewed the year’s totals, accounting for nearly 70% of all stolen crypto in H1.

The Bybit breach elevated the average hack size to $30m, double that of early 2024. Even without this event, monthly losses in January, April, May, and June still exceeded $100m, underscoring the broader scale of systemic vulnerabilities.

North Korea’s Lazarus Group leads global crypto theft

Lazarus Group is believed to be responsible for $1.6bn of the stolen $2.1bn, indicating its continued dominance in the crypto hacking arena. Their operations are tied directly to North Korea’s efforts to evade international sanctions and fund strategic programs, including weapons development.

The group’s tactics have grown more sophisticated over time. Their operations now resemble long-term intelligence missions, involving social engineering, insider recruitment, and malware deployment to gain access to exchange infrastructure.

Other major hacks: Nobitex, Orbit Bridge, and more

The Nobitex hack in June 2025 added a new dimension to state-sponsored crypto crime. The Iranian exchange lost over $90m in an attack attributed to Gonjeshke Darande, a hacker group reportedly linked to Israel.

Unlike other attacks, the stolen funds were sent to unspendable vanity addresses, signaling a political or symbolic motive rather than financial gain. The hackers claimed the move was a response to Nobitex’s alleged role in helping the Iranian government bypass sanctions.

The incident became a flashpoint in the Iran-Israel 12-day war, which ultimately stopped with a ceasefire. Yet, it shows how crypto is increasingly being drawn into geopolitical battles.

Other notable incidents included:

How most crypto hacks happened in 2025

Most stolen funds in 2025 resulted from infrastructure attacks, not traditional smart contract bugs. Over 80% of losses came from breaches involving:

These attacks often started with social engineering, where attackers impersonated employees or lured victims with fake job offers. Once inside, they gained access to critical systems controlling wallets and approvals.

In some cases, like bridge exploits, attackers either compromised multi-signature validator nodes or used previously installed malware to extract secrets from internal machines.

Protocol-level attacks, such as re-entrancy bugs or flash loan manipulations, still occurred, but accounted for a smaller share — around 12% — of the total losses.

How crypto users can stay safe

As the scale and sophistication of crypto hacks grow, users must take stronger steps to secure their assets.

Institutional actors and exchanges must also raise their security standards. That includes regular audits, employee access controls, and real-time anomaly detection.