Hackers stole $3.4 billion in crypto in 2025 and topped $1 billion again in the first half of 2026. Once the coins start moving, investigators have roughly 45 days before the trail goes cold.
Key Takeaways
Chainalysis logged $3.4B stolen in 2025, with Bybit’s $1.5B hack alone accounting for 44% of that total.H1 2026 set a record 212 incidents per Blockaid, with Lazarus-linked crews behind about 55% of these losses.KelpDAO’s $293M April exploit was 2026’s largest single hit.What typically happens after the aforementioned thefts has become almost like a script at this point, with researchers describing a distinctive laundering cycle that runs roughly 45 days in three waves.
During days zero through five, speed matters most and the stolen tokens are typically swapped through decentralized finance (DeFi) protocols (activity spikes as much as 370%) and pushed into mixing services, which pool and shuffle coins to break the link between source and destination. During days six through ten, the funds hop chains via cross-chain bridges and flow through exchanges with limited know-your-customer (KYC) checks.
Then, from roughly day 20 to day 45, the coins are cashed out in small tranches (typically under $500,000 to stay beneath reporting thresholds) through no-KYC venues, instant exchangers, and Chinese-language over-the-counter (OTC) networks and guarantee services such as the sanctioned Huione marketplace.
2026: More Hacks, Smaller HaulsWhen all of these attacks are going down, the one lever that has time and again worked reliably is the centralized stablecoin freeze. Tether and Circle can blacklist addresses at the contract level, instantly stranding any USDT or USDC that thieves are still holding, which is precisely why sophisticated attackers swap stolen stablecoins into ether or bitcoin within minutes of a breach, accepting price risk to escape the freeze radius.
It’s a revealing asymmetry, i.e. the most censorship-resistant assets are the easiest to launder, and the most freezable ones are the easiest to recover. Every laundering playbook is ultimately a race to convert the catchable into the uncatchable before anyone with a pause button notices.
The uncomfortable math of crypto theft is that prevention is nearly the whole game. Exchanges and analytics firms can freeze funds that touch compliant platforms, which is exactly why launderers front-load DeFi and mixers, where no one can freeze anything.
Sanctions on mixers and services like Huione raise costs but merely push flows to successors rather than stopping them. And the 45-day clock means that by the time cross-border legal process is even underway, the coins have usually finished their journey.
For users and platforms, the lesson is that, once stolen, the overwhelming majority of their funds are never coming back. Furthermore, the attackers’ cycle is faster than compliance, and every year that “crypto theft is declining” appears in a headline, the next billion-dollar counterexample is already in motion. The blockchain records everything and returns nothing.
