These incidents made up over 80% of stolen funds and were far more damaging than other types of hacks.

These types of attacks focus on areas like private key access or weaknesses in front-end tools. This can include stealing seed phrases or changing how a crypto site appears to users.

TRM Labs explained that such hacks often succeed because they exploit both technical flaws and people’s trust.

Another method used by attackers was to break into smart contracts. This involved tactics like flash loans or triggering bugs that let them take funds or interfere with how systems are supposed to work. These protocol-based attacks made up 12% of the total losses this year.

A major part of the losses came from North Korea’s theft of $1.5 billion from Bybit, a Dubai-based exchange, in February. That incident made up nearly 70% of the year’s total. It also pushed the average loss per attack to around $30 million.

However, even without the Bybit

$2.31B

case, other months like January, April, May, and June each saw over $100 million in stolen crypto.

Some attacks were likely tied to political goals. On June 18, a group known as Gonjeshke Darande, which has been linked to Israel, took $100 from Iran’s largest exchange, Nobitex. How did it happen? Read the full story.

On March 18, the platform announced via X, stating, “The launch function has now been resumed after a thorough security inspection. Our team has addressed the issue and reinforced system security. Compensation for affected users is underway”.

The exploit netted the attacker 192 BNB
BNB


$615.92

, worth around $120,000. The stolen funds were later moved to the decentralized exchange FixedFloat.

Blockchain security firms CertiK and ExVul analyzed the incident, identifying it as a sandwich attack—a method used to manipulate token prices.

CertiK’s analysis revealed that the attacker influenced token prices by sending an uneven amount of un-launched tokens to a trading pair address before liquidity was added. This manipulation allowed them to execute profitable trades at launch.

CertiK detailed a specific case involving SBL tokens, noting, “The attacker sent a bit of SBL token to the pre-calculated pair address in advance, then profited 21.1 BNB by sandwiching the add liquidity transaction at launch”.

ExVul explained that the attacker pre-calculated the liquidity pool address and used one of Four.Meme’s functions to purchase tokens while bypassing restrictions. By waiting for Four.Meme to add liquidity, the attacker was able to siphon funds undetected.

On March 12, a crypto trader lost more than $215,000 in a sandwich attack. How? Read the full story.

While investigators are monitoring roughly 77% of the stolen assets, the remaining 20% has been successfully laundered, which makes further tracing impossible. Another 3%, or $42 million, has already been frozen.

On March 4, Zhou shared an update on X on the stolen 500,000 Ethereum
ETH


$2,082.42

and ongoing efforts to prevent hackers from accessing the funds. He pointed out that a large amount of the stolen crypto has been moved through laundering services or platforms designed to hide transactions.

Investigators discovered that the hackers converted approximately $1 billion of the stolen Ethereum into Bitcoin
BTC


$83,227.17

and distributed it across nearly 7,000 wallets, each holding an average of 1.71 BTC. This method makes tracing and recovering the assets even more challenging.

Zhou warned that the next couple of weeks are crucial in stopping further withdrawals. Hackers are likely to use crypto exchanges, OTC platforms, and P2P transactions to cash out before more of their funds can be frozen.

Further analysis shows that THORChain
RUNE


$1.12

was the primary platform used to convert the stolen Ether and Bitcoin, though some of the funds also passed through ExCH and OKX

$6.21B

Web3 Proxy. Bybit believes that about $65 million in Ethereum can still be recovered if the OKX Wallet team steps in to assist.

On February 26, Bybit launched a bounty program called the Lazarus Bounty to help recover stolen funds. What did Zhou say about it? Read the full story.