Onchain Security: The $25M Average and the $1.5B Skew

The core financial reality is a brutal baseline. The average crypto hack costs about $25 million, but this figure is a statistical mirage. The median loss has fallen to just $2.2 million, revealing a market where routine attacks are shrinking. Yet the average remains far higher because a tiny cluster of catastrophic breaches skews the totals.

That concentration is extreme. The top five hacks in 2024 and 2025 accounted for 62% of all stolen funds. The single most damaging event, a $1.5 billion breach at Bybit, represented 44% of all losses in 2025 alone. This isn't just a few big wins; it's a market dominated by rare but devastating events, with the top ten exploits making up 73% of the total.

The risk is also concentrated in custodial hands. Centralized exchanges were involved in just 20 of the 191 incidents but absorbed more than half of total losses at $2.55 billion. This custodial concentration risk remains the single largest driver of industry losses, turning a handful of exchange failures into disproportionate financial shocks.

Market Impact: Price Collapse and Liquidity Drain

The financial shock of a hack extends far beyond the initial theft. The immediate market reaction is severe, with tokens tied to hacked projects declining about 10% within two days on average. This initial panic sets the stage for a prolonged collapse, as the median token value drops 61% over six months. The recovery is rare; roughly 84% of affected tokens fail to recover to their pre-hack levels within that period.

This price destruction directly drains operational liquidity. For projects that hold their own tokens as treasury reserves, a 61% drawdown cuts into their operating runway, hiring capacity, and development budgets. The cost of recovery is high, typically consuming at least three months of focused team effort to stabilize the protocol and rebuild trust.

The liquidity drain is compounded by cascading failures. The report cites a 2025 stablecoin failure involving deUSD as an example of how losses can cascade through collateral dependencies, freezing withdrawals and triggering forced selling that wipes out value across multiple protocols. This interconnected fragility turns a single hack into a broader market stress event.

The Catalyst: North Korean Laundering and the $300M Conversion

The Bybit hack's financial impact is being amplified by a sophisticated, state-backed laundering operation. North Korean hackers, identified by the FBI as the "TraderTraitor" group, have successfully converted at least $300 million of the stolen $1.5 billion into unrecoverable funds. This isn't just a theft; it's a rapid, high-stakes conversion that turns digital assets into usable cash for the regime.

The laundering process is a model of modern cybercrime. The group uses DeFi protocols to swap stolen assets and disperses them across multiple blockchains, creating a complex trail that is difficult to trace and freeze. A detailed case study revealed they used DeFi aggregators to discreetly swap $386 million through protocols like PancakeSwap, demonstrating a high level of automation and expertise. This operational scale means the stolen capital is becoming liquid and usable much faster than traditional recovery efforts can keep pace.

The FBI's direct call for industry cooperation underscores the urgency. The agency has released a public service announcement and provided a list of Ethereum addresses linked to the stolen funds, urging exchanges, bridges, and analytics firms to block related transactions. The goal is to cut off the launderers' path to fiat currency. Yet the sheer volume of transactions and the use of privacy-enhancing tools mean that the attackers are likely to continue converting funds, turning a single hack into a sustained liquidity drain on the ecosystem.