Racing with Hacks: Hackers Steal Billions in Seconds

The cryptocurrency market in 2025 faced a new reality: the speed of attacks and subsequent laundering of funds reached such a scale that victims are left with almost no chance to react in time. This conclusion was reached by analysts at Global Ledger, who published a report on the dynamics of crypto hacks and stolen asset movements.

The main signal of the research is alarming: hackers act faster than the market can realize what happened. Previously, users and exchanges had at least hours, sometimes days, to freeze assets or block transactions, but now it’s literally a matter of seconds.

According to Global Ledger, in the second half of 2025, fund laundering processes accelerated compared to the first half of the year and reached extreme levels. The report cites a case where stolen funds were moved in just two seconds. This is twice as fast as similar cases earlier in the year and twice as fast as the fastest publicly reported hack recorded by experts.

In practice, this means that attackers begin moving assets long before the victim realizes the problem and the market gets information about the incident. In most cases, funds were transferred even before the official confirmation of the hack. On average over the year, this occurred in approximately 76.4% of attacks. In the first half of the year, this figure was around 68.1%, but in the second half, it rose to 84.6%. That is, in almost nine out of ten cases, hackers manage to act first, leaving victims minimal time to save assets.

Global Ledger

At the same time, researchers note a paradoxical trend: laundering itself has become on average about 25% slower. If in the first half of the year the full laundering cycle took about eight days, in the second half it extended to 10.6 days.

However, this does not mean that criminals have become less effective. On the contrary, these are more complex and multi-step schemes that take time but provide greater anonymity and resilience against tracking. Hackers no longer try to move everything at once in a single large transfer — instead, they split sums into dozens or hundreds of transactions, gradually dispersing assets across many channels.

Global Ledger emphasizes that in the second half of the year, attackers became more active in using non-custodial wallets, DeFi protocols, decentralized exchanges (DEX), cross-chain bridges, and mixers. This reflects a general shift in crypto crime toward infrastructure that is harder for regulators to control and less susceptible to blocking.

Global Ledger

The report pays special attention to Tornado Cash. After the lifting of sanctions, activity around the mixer increased sharply: the use of the service rose by more than 31 percentage points. Over the year, more than $2.05 billion in Ethereum flowed through Tornado Cash, of which around $655 million experts classified as high-risk funds linked to criminal activity.

Another important indicator is the change in withdrawal routes. During the sanctions, only 0.16% of funds passing through Tornado Cash ended up on centralized exchanges (CEX). After the restrictions were lifted, this figure rose to 4.74%. This indicates that criminals have again started actively using exchanges as the final cash-out point, as regulatory pressure has eased.

A separate Global Ledger conclusion concerns the structure of the attacks themselves. About 64% of all incidents in 2025 were due to smart contract hacks. This confirms that vulnerabilities in DeFi infrastructure remain a key risk area: coding errors, bridge exploits, and protocol manipulations continue to generate billions for criminals.

At the same time, the biggest losses were suffered not by protocols but by users themselves. The largest damage was associated with signing fake approvals — fraudulent transactions that give attackers access to victims’ funds. Total losses from such schemes reached $1.5 billion.

This is a particularly dangerous trend because it involves not complex technical hacks but social engineering disguised as familiar actions: signing permissions in a wallet, confirming access to tokens, or connecting to a fake website. The user opens the door themselves, unaware that they are doing it for the benefit of fraudsters.

Thus, the Global Ledger report paints a clear picture: crypto fraud in 2025 has become faster, more complex, and more professional. Criminals act almost instantly, using entire networks of DeFi tools and mixers, and the main targets are increasingly ordinary users rather than protocols, as they are easier to deceive than to hack a smart contract.

The main conclusion is stark: the reaction window is shrinking rapidly. If the industry does not strengthen real-time monitoring, and users do not start treating every wallet signature as a potential risk, the crypto market will continue to be a territory where hackers are always one step ahead.