Category deep-dive: $2.2 billion was stolen in crypto-related hacks in 2024

Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. In previous posts, we examined overall 2024 crypto transaction volumes, how sanctioned entities drove illicit crypto volume in 2024, trends in the use of crypto in terrorism financing, and the growing threat of crypto-enabled ransomware attacks. 

To read the 2025 Crypto Crime Report in full and download your copy, click here.

{{horizontal-line}}

In 2024, USD 2.2 billion was stolen in hacks and exploits — a 17% increase from 2023 — bringing the three-year total to over USD 7.7 billion. 

The crypto space continues to grapple with evolving threats, with decentralized finance (DeFi) protocols remaining prime targets. The average hack size stood at USD 14 million, reflecting both the sophistication and scale of modern breaches. 

Infrastructure attacks (primarily private key and seed phrase compromises) accounted for nearly 70% of stolen funds in 2024. These compromises are common because private keys and seed phrases serve as the foundational access credentials for crypto wallets and platforms. Hackers exploit poor storage practices, conduct phishing campaigns, and deploy malware to gain access to these sensitive credentials. Once the private key is stolen, the thief typically transfers the funds to their own wallet — often obfuscating the trail using mixers, tumblers, or other money-laundering techniques to evade detection.

North Korea stole nearly USD 800 million of cryptocurrency in 2024

The surge in hacking activity in 2024 highlights the evolving threat landscape in the crypto space. With a 17% year-over-year increase in stolen funds and North Korea’s outsized role in these attacks, the industry faces mounting pressure to implement stronger security measures. The scale of North Korean operations, combined with their reliance on private key and seed phrase theft, underscores the need for innovation in securing digital assets and mitigating state-sponsored cyber threats.

North Korea accounted for approximately 35% of all stolen funds in 2024, approaching nearly USD 800 million in stolen cryptocurrency (including only attacks for which TRM has moderate or higher confidence). On average, North Korean attacks were nearly 5 times larger than those by other actors, underscoring their emphasis on high-impact operations. Their primary method — stealing private keys and seed phrases — highlights the urgent need for robust key management solutions. 

{{BlogAd-2025CryptoCrimeReport-Report-2}}

Pressure from US and international law enforcement on the crypto mixing industry led to the shutdown of key services like Samourai Wallet and Wasabi's original coordinator. In their place, North Korea has turned to smaller services like JoinMarket, Mixero, and the new, independent coordinators for Wasabi's protocol.

Law enforcement continues to face steep hurdles blocking and recovering stolen funds. North Korea, and the laundering groups it works with, have increased and diversified the number of bridges and blockchains they use to move crypto assets. Many of these services are truly decentralized and incapable of freezing stolen funds as they transit their protocols. The movement of many of these funds from theft addresses to ultimate disposition with likely brokers, mostly on the TRON blockchain, often occurs within the space of hours. The speed and efficiency of these transfers make freezes by law enforcement extremely challenging; TRM's analysis of recent thefts suggests frictional losses to freezes or other interdictions by government remain small.

{{horizontal-line}}

Next up in this series: We take a closer look at crypto volumes lost to scams and fraud in 2024.

Ready to dive into the full 2025 Crypto Crime Report? Get your copy here.