More crypto has been stolen in the first half of this year alone than in the entirety of 2024, according to new research from Chainalysis, with North Korea’s hack of ByBit accounting for more than half of that loss.

The blockchain data platform’s 2025 Crypto Crime Mid-year Update found that by the end of June, over $2.17 billion (£1.6bn) had been stolen from cryptocurrency services, 17% more than in 2022, which had previously been the worst year on record.

If current trends continue, Chainalysis said that over $4 billion (£2.9bn) could be lost to theft by the end of the year, while crypto volumes from illicit activity are already on pace to match, or even surpass, last year’s $51 billion (£37.9bn) total, despite a shifting landscape following the closure of major criminal exchanges.

The defining moment of this year, however, was the DPRK’s ByBit hack in February, which Chainalysis claims has set a new benchmark in cyber-crime.

At $1.5 billion (£1.1bn), this ‘mega-breach’ represents the largest crypto theft in history, and accounts for around 69% of all funds stolen from services this year, underscoring the increasing sophistication and scale of state-sponsored threat actors in the crypto space.

Of particular concern, the report highlights the use of sharp social engineering tactics by the ByBit hackers, similar to those in past DPRK missions, which infiltrated crypto platforms by compromising IT personnel. 

That initial compromise gave rise to a surprisingly effective new strategy that has since been rolled out more extensively, and seen Western tech firms unknowingly hire fake IT workers from North Korea, committed to data extortion and exfiltrating proprietary and sensitive information.

While the DPRK was responsible for the biggest known crypto theft, digital wallets have emerged as a quieter, less reported battleground for crypto-related crime.

After developing what it claims are new methods to identify and trace theft activity across personal wallets, Chainalysis found that significant illegal activity is going unreported.

The research found that although last year witnessed the most losses from personal wallets over the last few years, at $1.5 billion, crypto thefts across 2025 are catching up, with losses already reaching more than $500 million (£372m) YTD.

Chainalysis’ asset-level breakdown of stolen personal wallets uncovered some key insights regarding cybercriminals’ targets. First, bitcoin dominates in terms of total theft, accounting for around $900 million (£669m) in lost funds, with attackers appearing to be going after bigger individual holdings. 

Meanwhile, victim counts on chains that sit outside the Bitcoin and EVM ecosystem, like Solana, account for relatively low losses, less than $250 million (£186m) in 2024 and in the region of $100 million (£74.4m) so far this year, but these are rising.

Bitcoin, however, seems to be driving an even more worrying trend. Chainalysis found that this year is on track to have potentially twice as many physical attacks than 2021, the next highest year on record.

These ‘wrench attacks’, where cyber-criminals use physical violence or coercion to access an individual’s crypto holdings, are spiking as the price of bitcoin continues to skyrocket, with incidents of maiming, kidnapping, and even murder.

Recommended reading

• UK Crypto Groups Urge Government to Back Blockchain
• Seven Crypto ATMs Seized and Two Arrested In FCA Raid
• Chancellor Announces New Rules for UK Crypto Firms

“The surge in both service and personal wallet compromises demands a multi-layered approach to crypto security,” concludes the report.

“For service providers, the lessons from 2025’s major breaches underscore the continued importance of robust security cultures, regular security audits, and employee screening processes that can detect social engineering attempts.

“For individuals, the growing threat to personal wallets requires a fundamental reassessment of security practices. 

“The correlation between violent attacks and bitcoin price movements suggests that operational security, such as keeping cryptocurrency holdings private, may be as important as technical security measures. 

“Users in high-growth victimisation countries should be particularly vigilant about their digital footprint and physical security.”