Crypto Hacks Steal $3.01B in H1 2025 as 23% Laundered Before Public Disclosure

A new report from Swiss blockchain analytics firm Global Ledger has uncovered alarming trends in cryptocurrency security, revealing that $3.01 billion was stolen across 119 crypto hacks in the first half of 2025—a figure exceeding the total losses from all of 2024 [1]. The data highlights not only the escalating scale of attacks but also a critical shift in speed: cybercriminals are now laundering stolen funds in minutes, often before breaches are publicly disclosed.

The report analyzed on-chain data to track the velocity of post-exploit transactions, mapping the time between initial theft and the final laundering endpoint. It found that in 23% of cases, the laundering process was fully completed before any public announcement of the hack. In nearly 68% of incidents, stolen funds were already in motion when victims became aware of the breach, leaving compliance teams with a mere 10–15 minutes to act before assets were irreversibly hidden [1].

The speed of these operations has outpaced traditional anti-money laundering (AML) systems. In the fastest incident documented, funds were moved just four seconds after the exploit, with full laundering completed in under three minutes. Overall, 31.1% of laundering was finalized within 24 hours, while public disclosures averaged 37 hours. This 20-hour window between attack and awareness gives attackers a decisive edge, with only 4.2% of stolen funds recovered in H1 2025 [1].

Centralized exchanges (CEXs) emerged as the most vulnerable points in the ecosystem, accounting for 54.26% of total losses in the period. Despite their role as custodial gatekeepers, CEXs facilitated 15.1% of laundered crypto, exposing systemic weaknesses in real-time monitoring. The report argues that manual or ticket-based compliance processes are inadequate against modern threats, urging exchanges to adopt automated, real-time detection systems capable of matching the speed of attacks [1].

Regulatory pressures are intensifying as a result. The Genius Act, signed into law by U.S. President Donald Trump on July 18, mandates stricter AML expectations and faster response times for virtual asset service providers (VASPs). Meanwhile, the ongoing trial of Tornado Cash developer Roman Storm has underscored a growing legal philosophy: platforms and developers may now face liability for failing to proactively prevent illicit activity. Prosecutors allege Storm could have implemented controls to curb the platform’s $1 billion in illicit transactions, including those tied to North Korea’s Lazarus Group [1].

The implications for the industry are profound. As cybercriminals refine their techniques—leveraging mixers, bridges, and CEX infrastructure—regulators and service providers must align with this accelerated threat landscape. The report emphasizes that speed is no longer a technical challenge but a strategic imperative: if laundering occurs in minutes, defenses must operate at the same pace to minimize losses.

Source: [1] [Real-time crypto laundering exposes CEX vulnerabilities — Report](https://cointelegraph.com/news/real-time-crypto-laundering-cex-vulnerabilities-report)