Loading story…
The cryptocurrency industry suffered $1.63 billion in losses from hacks in Q1 2025, a 131% increase over the previous year. Major incidents included the Bybit exploit and a $27 million supply-chain attack on BigONE exchange. These events highlight the urgent need for robust security practices across exchanges, DeFi platforms, and user custody models.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcehelpnetsecurity.com
Open sourcewelivesecurity.com
Open sourcesecuritysenses.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean hackers were responsible for stealing over $2 billion in cryptocurrency in 2025, marking a 51% increase from the previous year and pushing their all-time total to $6.75 billion. The attacks were characterized by fewer but significantly larger breaches, with the compromise of Bybit alone resulting in the theft of approximately $1.5 billion. Attackers increasingly relied on embedding IT workers within crypto services and using sophisticated impersonation tactics to target executives, while also showing a preference for Chinese-language money laundering services and rapid laundering cycles. Chainalysis data revealed that more than $3.4 billion in cryptocurrency was stolen industry-wide in 2025, with the majority of losses concentrated in a handful of high-impact incidents. The top three hacks, all attributed to North Korean actors, accounted for 69% of confirmed breaches. While individual wallet compromises surged in number, the total value stolen from these incidents decreased, suggesting improved security practices in some areas. However, the scale and sophistication of nation-state attacks on centralized services remain a critical threat to the cryptocurrency ecosystem.
Jun 29, 2026
Roger Ver, a prominent early bitcoin investor known as "Bitcoin Jesus," agreed to pay nearly $50 million to the U.S. Department of Justice to settle federal tax charges related to his cryptocurrency holdings. Ver entered into a deferred prosecution agreement after admitting that he willfully omitted a significant portion of his bitcoin assets when filing expatriation-related tax returns in 2016, which reduced his tax liability by over $16.8 million. The settlement included back taxes, penalties, and interest, and following the payment, prosecutors moved to dismiss the indictment against him. This case highlights the increasing scrutiny by U.S. authorities on cryptocurrency investors who attempt to evade taxes by renouncing citizenship or failing to report digital assets. In a separate incident, a trader suffered a loss of approximately $21 million on the decentralized exchange Hyperliquid due to a private key compromise. The attacker was able to access the trader's wallet and transfer the funds, underscoring the persistent risks associated with private key management in decentralized finance (DeFi) platforms. The Hyperliquid incident demonstrates the ongoing threat of targeted attacks against high-value cryptocurrency accounts, where a single compromised key can result in substantial financial losses. Additionally, the Ethereum Foundation and Keyring launched a fund to support the legal defense of Tornado Cash developers, reflecting the broader legal and regulatory challenges facing the crypto ecosystem. Indian authorities initiated an investigation into Binance traders for alleged crypto tax evasion, signaling a global trend of increased regulatory enforcement in the digital asset space. Hackers executed a $32.5 million dump, marking the largest crypto liquidation event of the week, which had significant market impact and raised concerns about the security of large-scale digital asset holdings. New York City established the nation's first mayoral office dedicated to digital assets and blockchain, indicating growing institutional interest in the sector. These incidents collectively illustrate the multifaceted risks in the cryptocurrency landscape, including legal, regulatory, and technical threats. The convergence of high-profile tax settlements, major thefts, and regulatory actions highlights the need for robust compliance and security measures among digital asset holders and service providers. The events also emphasize the importance of secure key management practices and the potential consequences of lapses in operational security. As the digital asset market matures, both individual investors and organizations must remain vigilant against evolving threats and regulatory developments. The week's developments serve as a reminder that the intersection of technology, finance, and law in the crypto space is increasingly complex and fraught with risk. Ongoing education, proactive risk management, and engagement with legal and regulatory frameworks are essential for mitigating exposure in this rapidly changing environment.
Jul 12, 2026
Illicit actors continue to hold and move significant amounts of cryptocurrency, with on-chain balances linked to criminal activity now exceeding $75 billion. According to blockchain analytics, nearly $15 billion is directly held by entities identified as illicit, with stolen funds representing the largest share of these holdings. Downstream wallets, which have received more than 10% of their inflows from illicit sources, collectively hold over $60 billion, indicating that the reach of criminal proceeds extends far beyond the original perpetrators. Darknet market administrators and vendors alone control over $40 billion in on-chain value, highlighting the scale of underground digital economies. Bitcoin remains the dominant cryptocurrency among illicit balances, accounting for 75% of the total, though stablecoins and ether have seen substantial growth in criminal usage. The concentration of these funds is typically high, with a small number of wallets holding the majority of assets. Illicit actors are adapting their laundering techniques, increasingly using more cashout addresses for shorter periods to evade detection. Direct transfers from illicit entities to exchanges have dropped significantly, from about 40% of quarterly value in 2021–2022 to just 15% in Q2 2025, reflecting changes in both enforcement and criminal tactics. Law enforcement agencies, particularly in the United States, are responding by establishing strategic reserves and stockpiles of seized digital assets, and have already confiscated over $12.6 billion in illicit funds with the help of blockchain analytics firms. The timing of enforcement actions varies, with market-based illicit services tending to operate longer before being disrupted. Once illicit entities stop receiving funds, the speed at which they empty their wallets depends on the type of cryptocurrency held. Meanwhile, specific high-profile incidents continue to occur, such as the $21 million theft from SBI Crypto, a subsidiary of Japan's SBI Group. In this case, hackers stole a variety of cryptocurrencies, including bitcoin, ethereum, litecoin, dogecoin, and bitcoin cash, and laundered the proceeds through Tornado Cash, a mixing service favored by cybercriminals. Investigators noted that the tactics and laundering patterns in the SBI Crypto heist closely resembled those used by North Korean hacking groups, suggesting a possible link to Pyongyang's ongoing campaign to finance illicit activities through digital asset theft. The SBI Crypto incident is part of a broader trend, with North Korean threat actors reportedly stealing a record $2 billion in cryptocurrency so far this year. These developments underscore the persistent threat posed by sophisticated cybercriminals and nation-state actors in the cryptocurrency ecosystem, as well as the evolving strategies of both criminals and law enforcement in the battle over digital assets. The growing landscape of seizable crypto assets presents both a challenge and an opportunity for authorities seeking to disrupt illicit financial flows. As criminals refine their methods, the need for advanced analytics and coordinated international enforcement becomes increasingly critical. The ongoing arms race between cybercriminals and law enforcement is likely to shape the future of digital asset security and regulation.
Jun 29, 2026