Overview
- SlowMist tallied $2.935 billion lost across 200 incidents in 2025, while other firms placed losses above $3.3 billion, reflecting differing methodologies.
- U.S. authorities linked the year’s largest theft—the roughly $1.46–$1.5 billion Bybit breach—to North Korea’s Lazarus Group, reinforcing findings that DPRK-linked actors took a large share of value stolen.
- Access-control and account-compromise failures, not smart contract bugs, were the leading cause of losses, with centralized exchanges suffering outsized damage from a handful of attacks.
- Social engineering and supply‑chain compromises expanded in sophistication, with recruiter lures, phishing and poisoned frontends contributing heavily to 2025’s losses.
- Enforcement and on‑chain actions produced some wins, with 18 cases seeing about $387 million recovered or frozen even as most stolen funds continued to move through laundering pipelines.