Crypto theft remained elevated through 2025 and into 2026, according to the source article, with hackers stealing $3.4 billion last year after taking $2.2 billion in 2024, $1.7 billion in 2023, and $3.7 billion in 2022. In the first half of 2026 alone, about $1.1 billion was stolen across 212 incidents.

The report argues that the key constraint for victims and investigators is time. Once stolen funds begin moving, there is said to be a roughly 45-day window before laundering across decentralized protocols, bridges, mixers, exchanges and over-the-counter channels makes recovery increasingly unlikely.

Losses stay high after years of major breaches

The source frames crypto theft as a sustained and organized activity rather than a temporary spike. Over the past several years, stolen totals have remained in the billions, with 2025 ending at $3.4 billion after a lower but still significant $2.2 billion in 2024.

Nearly half of the 2025 total came from a single event: the February 2025 hack of Bybit, in which attackers took $1.5 billion. The article describes that theft as the largest in crypto history.

In 2026, losses continued to accumulate quickly. The source says about 55% of first-half losses were tied to Lazarus-linked groups, while the largest single incident in that period was the April 19 exploit of restaking protocol KelpDAO for $293 million.

How the laundering cycle unfolds

According to the article, stolen crypto tends to move through a repeating three-stage process that lasts about 45 days. In the first five days, speed is critical: stolen tokens are rapidly swapped through DeFi services and routed into mixing tools intended to weaken the connection between source and destination.

The source says activity in decentralized protocols can spike by as much as 370% during this early stage. After that, between roughly days six and ten, funds are shifted across blockchains through cross-chain bridges and sent through exchanges with limited know-your-customer requirements.

In the later phase, from around day 20 to day 45, proceeds are reportedly broken into smaller cash-out transactions, often below $500,000. Those tranches may then move through no-KYC venues, instant exchangers, OTC networks and, in some cases, sanctioned marketplaces.

Why tracing funds does not guarantee recovery

The article argues that public blockchains preserve an extensive record of fund movements, but that transparency does not necessarily translate into successful clawbacks. By the end of the laundering cycle, assets may have passed through multiple chains, services and jurisdictions, leaving investigators with a trail that is visible yet operationally difficult to act on.

It also notes that centralized stablecoins can sometimes be frozen by blacklisting addresses at the contract level. That can interrupt a laundering attempt, but it can also push attackers to convert quickly into assets such as bitcoin or ether, which the report characterizes as harder to censor and easier to launder.

Even where exchanges and blockchain analytics firms can help freeze funds on compliant platforms, launderers are described as concentrating their activity early in venues where those controls are weaker or unavailable. The article adds that sanctions on mixers may raise costs for attackers, but do not necessarily stop flows, which can migrate to replacement services.

The main confirmed constraint is speed

The report’s clearest conclusion is that legal and compliance responses often move more slowly than the laundering process itself. Because cross-border procedures can take time, the roughly 45-day laundering window may close before many formal recovery actions are completed.

That dynamic helps explain the low recovery rate in major cases. In the Bybit theft, the source says less than 5% of the $1.5 billion taken was recovered.

Based on the article, the next decisive step after a theft is immediate intervention during the earliest days of fund movement, before assets have been split, bridged and cashed out across multiple venues. Once that cycle is completed, the source suggests the odds of recovery drop sharply.

Source: news.bitcoin.com