Total Web3 security losses reached approximately $4 billion in 2025.
While the broader digital asset market has matured, stabilizing into a recognized component of the global financial system, the criminal element targeting it has evolved with equal speed.
The era of opportunistic script kiddies exploiting basic code errors is largely over. The vacuum left by amateurs has been filled by state-sponsored syndicates possessing the budget and patience of national intelligence units.
This evolution comes at a crucial moment as Binance has recently passed the 300 million user mark, and the responsibility to secure this growing demographic has intensified.
The industry is no longer just protecting code; it is safeguarding a massive, global population.
State-Linked Crypto Theft Cost Over $2 Billion in 2025
The 2025 data reveals a stark consolidation of cybercrime capabilities. Data from Chainalysis and Elliptic indicates North Korean actors stole at least $2.02 billion last year—a 51% jump from 2024.
The sheer volume suggests that current sanctions and standard interdiction efforts are struggling to cut off the regime’s illicit revenue streams.
What is most alarming is the efficiency of these actors. While the total number of hacks attributed to DPRK groups actually decreased, the value per hack skyrocketed.
Chainalysis data indicates that the top three hacks of 2025 accounted for 69% of all service losses. Outliers in theft size are now reaching 1,000 times the median theft size. This fundamentally alters the risk profile for large custodians.
It’s a trend driven primarily by a single breach in February 2025. This was when nearly $1.5 billion was stolen from Bybit. The mega-hack skewed the year’s statistics and demonstrated a strategic pivot.
As noted by TRM Labs, state-linked actors have moved away from attacking decentralized bridges, a dominant trend in 2022, and are now aggressively targeting high-value centralized targets where the payout justifies the resource expenditure.
The Shift to Exploiting Human and Key Vulnerabilities
The industry has successfully hardened its code, forcing attackers to change tactics.
Data from the 2025 Hacken report shows that while smart contract security has improved, operational security has become the new battleground:
| | Access Control Exploits | Smart Contract Bugs |
| Total Losses ($) | $2.1 billion | $512 million |
| Percentage of Total Losses | 53% of all losses | 13% of all losses |
| Key Issues | Weak key management, compromised signers, and human error in operational security | Code vulnerabilities and technical flaws in protocol design |
This stark contrast reveals a fundamental shift in crypto security. The battlefield has moved from the code itself to the humans and processes managing it.
Access Control Exploits accounted for approximately $2.1 billion, roughly 53% of all losses, while smart contract bugs accounted for only $512 million.
The vulnerability is no longer primarily in the Solidity code. It’s in the hiring process, internal communication channels, and operational procedures.
Attackers are bypassing the blockchain entirely to target the people managing it, and North Korean actors have industrialized social engineering—utilizing an “IT worker” model to infiltrate crypto firms.
As detailed by Chainalysis and TRM Labs, these operatives pose as employees, recruiters, or venture capitalists to compromise executives and gain access to internal systems.
The vulnerability is no longer in the Solidity code, but in the hiring process and internal communication channels. This specific threat vector has prompted leading platforms to reimagine their security architecture from the ground up.
Binance’s trust-by-design framework directly addresses the IT worker infiltration risk through enhanced vetting protocols, behavioral monitoring systems, and layered identity verification processes.
These are designed to detect and block fraudulent actors before they gain system access. The approach recognizes that defense must evolve to match when attackers target the human layer rather than the code layer.
This includes mandatory video interviews, IP and geolocation monitoring, and continuous screening of employee behavior patterns. All of these must be calibrated to identify the inconsistencies that often signal a sophisticated infiltration attempt.
.webp)
The results are already measurable for this approach as Binance’s risk measures prevented $6.69 billion in potential fraud losses for 5.4 million users in 2025 alone.
Internal data also shows a 96% drop in direct illicit exposure since 2023 and suggests that compliance infrastructure can keep pace with rapid user growth.
But internal controls represent only half the equation. Active collaboration is equally vital. Binance handled over 71,000 law enforcement requests and helped confiscate $131 million in illicit funds last year.
The exchange also reinforced its technical defenses, earning ISO 42001 certification to ensure its use of generative AI for threat detection operates under rigorous standards.
Noah Perlman, Chief Compliance Officer at Binance, contextualized this progress: “Analysis of independent industry data shows a steep reduction in our direct illicit exposure between early 2023 and mid-2025,” he said, “even as Binance handled growing volumes comparable to the next six largest exchanges combined.”
The Chinese Laundromat
Once funds are stolen, the laundering process has also become industrialized. TRM Labs identifies a shift toward the “Chinese laundromat,” a complex network of OTC brokers and underground banking systems.
Stolen funds are not merely mixed on-chain but are off-ramped through these shadow banks to bypass traditional blockchain forensics. The Chinese laundromat represents a fundamental evolution in crypto money laundering.
Unlike earlier methods that relied on on-chain mixers like Tornado Cash or simple chain-hopping, this network operates as a professionalized service layer.
High-volume OTC brokers absorb stolen assets and provide off-chain settlement, often in Chinese yuan, distancing the theft operation from the cash-out point.
These intermediaries facilitate rapid movement across chains and services to break traceability, then route liquidity toward cash-out channels that exist largely outside the traditional financial system.
The sophistication lies in the fragmentation and specialization. Stolen funds are split into smaller tranches. Data shows DPRK-linked actors concentrate over 60% of their transactions below $500,000 to avoid detection thresholds.
These funds then flow through multiple layers: cross-chain bridges, decentralized exchanges, and eventually to Chinese-language guarantee services and underground banking channels.
The network handles billions in volume annually, operating across Southeast Asia with connections to informal value transfer systems that settle transactions through mirror payments, trade-based offsets, or direct goods transfers.
The funds have passed through so many intermediaries and jurisdictions that recovery becomes nearly impossible by the time they reach their final destination.
This creates a defense challenge where the threat vector is human and the exit strategy is opaque requiring institutions to secure their internal culture and personnel as rigorously as their cryptographic keys.
From Reactive Defense to Institutional Resilience
The threat landscape has fundamentally changed.
We have moved from an era of code exploits to one of state-sponsored social engineering and infrastructure attacks. The adversaries are well-funded, patient, and capable of striking the industry’s largest players.
The future of the crypto industry depends on collaborative defense. Security cannot be a proprietary advantage but must be a shared standard.
This involves sharing real-time threat intelligence and ruthlessly eliminating single points of failure in both technical and human systems.
Security is no longer just a technical requirement; it is the foundation upon which the financial future of the next billion users will be built.
