Crypto Theft Reaches New Heights as Laundering Cycle Proves Elusive

Crypto theft has become an industry unto itself, with over $16 billion lost in the past six years alone. The most recent figures show that last year's total of $3.7 billion in stolen crypto was a significant increase from previous years, and this year is shaping up to be even worse.

The Bybit hack in February 2025 was the largest single event, with attackers compromising the exchange's cold-wallet signing process and making off with $1.5 billion. This incident highlights the 45-day laundering cycle that thieves often follow, which involves swapping stolen tokens through decentralized finance protocols, mixing services, and cross-chain bridges.

Researchers have identified three distinct waves in this cycle: the first wave, which lasts from days zero to five, sees a significant spike in activity as thieves swap their stolen tokens; the second wave, from days six to ten, involves moving funds across chains via bridges and through exchanges with limited know-your-customer checks; and the third wave, from days 20 to 45, sees the coins being cashed out in small tranches through no-KYC venues and OTC networks.

Despite the fact that blockchains can track the movement of funds, recovery rarely happens due to the complexity and speed of these laundering cycles. In fact, less than 5% of Bybit's stolen funds were ever recovered.