What the record says
Chainalysis, a firm that traces money on public blockchains, publishes a theft count every year. Its figures for the last four, each from the report it published at the time: about $3.8 billion in 2022, $1.7 billion in 2023, $2.2 billion in 2024, and “over $3.4 billion in theft from January through early December 2025.”
One attack made up nearly half of that last number. Chainalysis says “the February compromise of Bybit alone” accounted for “$1.5 billion of that total.” Take it out and 2025 still beat 2023.
The thief is often a state. Chainalysis put North Korea’s take at about $1.34 billion in 2024 and “at least $2.02 billion” in 2025. Its running total for North Korea stands at no less than $6.75 billion.
The attackers with the most money and patience aren’t after exchanges only. They have time to spend on one person with a large wallet.
Individuals lost $713 million in 2025 by Chainalysis’s count, across at least 80,000 victims. The year before, personal wallets lost about $1.5 billion. Those are the losses this course is about.
How Bybit lost $1.5 billion
On 21 February 2025 the exchange Bybit moved ether from a cold wallet to a hot one, a routine transfer that needed several people to approve it through a Safe multisig wallet. The signers approved. About 401,000 ETH went to the attacker instead.
No key had to be stolen. Safe’s foundation said the attack “was achieved through a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction.”
Chainalysis puts it more plainly: the attackers used that machine “to make it appear that Bybit was signing a legitimate transaction, when in fact it was a malicious one.” The web page the signers looked at had been changed. Code injected into it altered the transaction while the signers saw a routine one.
The FBI named North Korea within five days and called the group TraderTraitor.
Three routes into your money
Name the route and you know the defense.
The first route is your keys. Someone learns your recovery phrase or private key, by malware, by a phrase typed into a website, by a photograph in a cloud account, or by a cracked password manager.
Once they have it they are you, and they can wait. Thieves can also work out a phrase that was badly made, as Coldcard owners found in July 2026.
The second is your signatures. You keep your keys and sign something you didn’t understand: an approval, a permit, a listing, a delegation.
The thief never touches your phrase. You hand over the right to move the money, one signature at a time. Bybit was a signatures attack on a company.
The third is your accounts and the people around you. Your email, your phone number, your exchange login, or a person who can be bribed, tricked or threatened.
Chainalysis found “private key compromises accounted for the largest share of stolen crypto in 2024,” 43.8 percent. Keys leave through an account or a person far more often than through the mathematics.
Why there’s no undo
A card payment runs through companies that can reverse it. A blockchain payment runs through computers that agree on one record and keep it.
Once a transaction is in a block, no bank, no exchange and no court can pull the coins back out of the thief’s address.
A court can order a person to return them, and sometimes does. A court order means little to a thief who is a state.
Stablecoin issuers are the main exception: some can freeze an address, only for their own token, and a freeze doesn’t mean you get the money back. A few layer 2 networks also have a council that can step in, as Arbitrum’s did on 30 October 2026, freezing funds from the Binance theft that press reports put at about $30 million. For ether and bitcoin on their own networks, and nearly every other coin, the transfer is final the moment it confirms.
One question for every contact
Most attacks on holders begin with a message you didn’t ask for: a support agent, a recruiter, a journalist, a wallet alert, an airdrop, a friend’s account asking for a quick favor. Chainalysis describes North Korean operators impersonating recruiters and would-be investors. Before you reply, click, install or sign, ask one thing.
Did you start this?
If you went to the site yourself, typed the address, opened the app from your own home screen, or called the number from the company’s own page, you started it. If it arrived, you didn’t, and the answer to whatever it wants is to close it and go in through your own front door.
Scams and How to Stay Safe, lesson 3, has the patterns in detail. This course assumes you know them and asks you to make the question a reflex.
Last checked: 6 November 2026