Hackers Launder $1.5 Billion in Crypto in 2025 via Cross-Chain Bridges

Hackers have shifted away from traditional crypto mixers in favor of cross-chain bridges to launder stolen funds at unprecedented speed, according to a recent report from Global Ledger shared with crypto.news. In early 2025, over $1.5 billion in hacked cryptocurrency was funneled through these bridges, far outpacing the $339 million sent to mixers like Tornado Cash [1]. The preference for bridges, the report suggests, stems from their speed, liquidity, and relatively lighter regulatory scrutiny [1].

The first half of 2025 marked a surge in crypto hacks, with more than $3 billion stolen across 119 incidents—a 50% increase over all of 2024 [1]. What sets this period apart is not just the volume but the rapidity with which stolen funds are moved. In some cases, hackers laundered assets in under four seconds, leaving little room for detection or intervention [1]. Attackers are now moving faster than ever, often obscuring the origins of stolen funds before any public announcement is made, significantly reducing the window for regulatory or law enforcement action [1].

The report highlights how stolen assets move through the crypto ecosystem, with centralized exchanges serving as the primary cash-out points. Around $453 million—15% of hacked funds—was funneled into these platforms, far exceeding the amount received by decentralized finance (DeFi) protocols, which captured just 5.6% of the total [1]. Despite DeFi’s growth in total value locked, centralized platforms continue to dominate as the main off-ramp for hackers seeking to convert digital assets into fiat or less-traceable forms [1].

Recovery efforts remain limited, with nearly $379 million—about 13% of the total—either frozen or burned, likely due to enforcement actions or security mechanisms. Only a small fraction, $140 million, was voluntarily returned [1]. The report emphasizes that voluntary restitution is rare and that most recovery still relies on swift intervention rather than goodwill [1].

A critical insight from the analysis is the alarming speed of hacker operations. In nearly one in four cases, funds were fully laundered before any public disclosure occurred. The fastest complete laundering process was recorded at just two minutes and 57 seconds [1]. Once funds begin moving, the trail often goes cold within hours or minutes. In over 30% of incidents, attackers completed laundering within a day of the first wallet movement [1].

More than half of the stolen funds—$1.6 billion—remained unspent at the time of the report. While some of this may indicate stalled movements, the report warns that a portion could still be in the process of being laundered, with attackers waiting for the situation to cool before proceeding [1].

Sources:

[1] https://coinmarketcap.com/community/articles/688cac398da7375e6a5eddf0/