Crypto Investors Lose $2.1 Billion in First Half 2025 Hacks

Crypto investors have suffered significant losses in the first half of 2025, with over $2.1 billion stolen through hacks and exploits. This period marks the worst six-month stretch on record for crypto security, highlighting the intensifying cyber campaigns by certain nation-states in the crypto space.

The 75 recorded incidents in the first half of 2025 surpassed the previous high from the first half of 2022 by approximately 10% and nearly matched the total number of incidents for the entire year of 2024. The alarming aspect is the identity of the primary perpetrators behind these thefts.

Researchers have identified North Korean-linked groups as responsible for $1.6 billion, or 70% of all stolen funds this year. The most notable incident is the $1.5 billion hack of Bybit in February, which is now believed to have been carried out by North Korea. This theft is the largest in crypto history and has significantly increased the average hack size for the year to $30 million, double the level of the previous year.

The threat of cyber attacks is not confined to North Korea. On June 18, a group believed to be linked to Israel, known as Gonjeshke Darande (Predatory Sparrow), stole $90 million from the Iranian exchange Nobitex. This attack is reportedly in retaliation for the platform’s alleged role in sanction evasion. The stolen funds were sent to vanity addresses, which are un-spendable by design, suggesting a political motive rather than a profit-driven one.

Attack vectors in the crypto space are evolving rapidly. Over 80% of the stolen funds resulted from infrastructure-level breaches, including private key thefts and front-end hijacks. These attacks, often involving social engineering or insider access, are proving to be ten times more lucrative than traditional smart contract exploits. DeFi vulnerabilities, such as flash loan and reentrancy attacks, which were prevalent in 2021-22, accounted for a relatively small 12% of the losses.