Cryptocurrency Thefts Surge to $3.4 Billion in 2025 as Personal Wallet Attacks Triple, Chainalysis Reports

Cryptocurrency theft reached $3.4 billion globally in 2025, with a dramatic shift toward targeting individual users as personal wallet attacks tripled while traditional DeFi exploits declined, according to new findings from blockchain analytics firm Chainalysis released today.

The figures, drawn from the company’s forthcoming 2026 Crypto Crime Report, reveal a fundamental transformation in the threat landscape facing digital asset holders. While decentralized finance platforms have historically been prime targets for hackers, criminal groups are increasingly focusing their efforts on individual wallet holders and centralized service providers.

North Korea emerged as the dominant force behind crypto theft in 2025, accounting for 60% of all stolen funds with approximately $2.02 billion in successful attacks. The hermit kingdom’s cyber operations reached new heights with the February breach of Dubai-based exchange Bybit, resulting in the largest cryptocurrency heist in history at $1.5 billion, primarily in ethereum tokens.

The shift toward personal wallet targeting represents a marked evolution in cybercriminal tactics. Chainalysis data shows the number of individual theft incidents jumped from roughly 50,000 in 2022 to 158,000 in 2025, while unique victims doubled from 40,000 to 80,000 over the same period. Despite the increase in attack volume, the average value stolen per individual victim decreased significantly.

“Personal wallet compromises now account for 20% of all value stolen in 2025, down from 44% in 2024,” the report states, indicating that while attacks on individuals are becoming more frequent, they tend to involve smaller amounts compared to high-value institutional targets.

Private key breaches at centralized services have become another major vulnerability point. Unlike the complex smart contract exploits that characterized DeFi attacks in previous years, these breaches often involve more straightforward methods such as phishing, social engineering, and credential theft targeting service providers and their customers.

The decline in DeFi-focused attacks marks a notable departure from recent trends. November 2025 recorded approximately $168 million in DeFi losses, making it only the third-worst month of the year after February’s massive Bybit theft and May’s $240 million in combined exploits. For the full year, DeFi losses exceeded $2.5 billion, but the frequency and sophistication of these attacks appeared to stabilize compared to the explosive growth seen in 2023 and 2024.

Industry analysts attribute the shift partly to improved security practices among major DeFi protocols and the maturation of smart contract auditing processes. However, recent exploits of established platforms like Balancer and Yearn Finance demonstrate that even battle-tested protocols remain vulnerable to sophisticated attacks, particularly those involving legacy code or complex token interactions.

The concentration of theft activity among state-sponsored actors, particularly North Korea’s Lazarus Group and affiliated operations, underscores the geopolitical dimensions of cryptocurrency crime. U.S. authorities have linked the Bybit attack to North Korea’s elite government hacking units, highlighting how the regime continues to use cryptocurrency theft as a means of evading international sanctions.

Beyond headline-grabbing exchange hacks, the data reveals concerning trends in the broader security ecosystem. The total number of security incidents across the cryptocurrency space increased by 303% in the first quarter alone, with 197 separate incidents recorded compared to the previous quarter. This surge in attack frequency suggests that as cryptocurrency adoption expands, so too does the attack surface available to malicious actors.

The findings arrive as the cryptocurrency market continues to mature, with Bitcoin trading near $90,589 and institutional adoption accelerating through exchange-traded funds and corporate treasury allocations. However, the persistent security challenges highlighted in the Chainalysis report underscore the ongoing risks facing both individual and institutional participants in digital asset markets.

Looking ahead, security experts warn that the trend toward personal wallet targeting may accelerate as artificial intelligence tools make it easier for criminals to identify and exploit individual vulnerabilities at scale. The combination of expanding cryptocurrency adoption and evolving attack methodologies suggests that 2026 could see continued pressure on personal security practices across the digital asset ecosystem.