In the first half of 2025, cryptocurrency thefts surged to an unprecedented $2.1 billion, marking a new record in illicit crypto activity, according to reports from blockchain intelligence firm TRM Labs. This figure represents a 10% increase over the previous H1 record of $2 billion stolen in 2022, and nearly matches the total losses recorded throughout the entire year of 2024.
The report highlights nearly 75 distinct hacks and exploits during this period, with infrastructure attacks—such as private key thefts, seed phrase compromises, and front-end platform hijacks—responsible for over 80% of stolen funds. These types of attacks caused losses on average 10 times greater than other methods.
The most significant incident was the February 2025 hack of the Dubai-based crypto exchange Bybit, in which North Korean-affiliated Lazarus Group stole $1.5 billion, accounting for nearly 70% of total losses. Other notable attacks include the June 18 hack of Iran's largest crypto exchange, Nobitex, by the pro-Israel hacker group Gonjeshke Darande (Predatory Sparrow), resulting in over $90 million stolen.
Protocol-level exploits, including flash loan and re-entrancy attacks targeting smart contract vulnerabilities, accounted for 12% of losses. Centralized exchanges bore the brunt of these thefts, making up 94% of total losses during the period, primarily due to the Bybit and Phemex breaches.
TRM Labs warned of the increasing use of crypto hacks as tools of geopolitical conflict and national policy, emphasizing that North Korea remains the dominant hacking force but other state actors are also leveraging such attacks. The firm advocates for enhanced industry security measures including multi-factor authentication, cold wallet storage, regular security audits, and advanced internal threat detection to address these growing risks.
The report underscores the critical vulnerabilities in the crypto ecosystem’s infrastructure and calls for greater global collaboration among law enforcement, financial intelligence units, and blockchain analytics communities to track and prosecute cybercriminals.