Elliptic estimates cross-chain criminal and high-risk activity at $21.8B+ in 2025, up from $7B in 2023, and attributes ~12% to crypto hacks from North Korea
Context & Ripple Effects
Elliptic’s estimate extends earlier coverage of North Korea’s role in crypto theft: the firm previously tracked $2.3B stolen from businesses between 2017 and 2022, while other analytics reporting described a sharp rise in theft from crypto services in the first half of 2025.
The significance is broader than theft totals alone. A move from $7B in cross-chain criminal and high-risk activity in 2023 to an estimated $21.8B-plus in 2025 suggests that tracing risk across chains—not simply within a single network—is becoming central to the sector’s compliance and security challenge.
First-order effects
- Crypto exchanges, bridges and other services exposed to cross-chain flows face a larger apparent pool of transactions requiring risk screening and investigation.
- North Korea-linked hacks account for roughly 12% of Elliptic’s estimate, reinforcing the immediate security and sanctions relevance of the record Bybit theft in H1 2025 for crypto-service operators.
Second-order effects
- Blockchain analytics vendors and compliance teams gain a stronger case for monitoring fund movement across networks, rather than treating a transaction’s originating chain as the full risk boundary.
- Higher perceived cross-chain exposure can push platforms and liquidity providers to tighten controls around bridges and rapid asset swaps, adding friction for some users and counterparties.
Third-order effects
- If cross-chain illicit activity continues to outpace prior levels, crypto’s compliance burden will increasingly be organized around interconnected transaction paths instead of chain-by-chain oversight.
- The pattern deepens the crypto legitimacy gap: the industry’s ability to support interoperable liquidity will be judged alongside its capacity to contain theft proceeds and other high-risk flows.
The trend: Cross-chain interoperability is expanding the operational perimeter for crypto security, compliance and attribution.