Chainalysis: two hacker groups are responsible for almost 60% of publicly reported cryptocurrency hacks and stole around $1B to date
Two “prominent professional hacking groups” are responsible for the majority of publicly reported hacks of cryptocurrency exchanges and other cryptocurrency organizations …
Context & Ripple Effects
Chainalysis' 2019 finding — that just two professional groups drive nearly 60% of publicly reported crypto hacks and roughly $1B in losses — is the founding data point for what has become the firm's annual theft accounting. It established that crypto crime is concentrated and organized rather than opportunistic, the premise behind every later tally.
The numbers since then confirm the arc: 2022 set a then-record with $3.8B stolen, mainly from DeFi protocols by North Korea-tied hackers like Lazarus Group, 2024 saw $2.2B taken across 303 hacks, and Chainalysis and TRM Labs now put 2025 at $2.7B, capped by the $1.4B Bybit breach — losses that scale with crypto prices rather than shrinking as security matures.
First-order effects
- Exchanges and crypto organizations now know their threat model is dominated by two identifiable professional groups, shifting defense spending toward attribution-aware monitoring rather than generic perimeter security.
- Chainalysis converts the finding into commercial demand for its blockchain-forensics services from exchanges and, later, government agencies.
Second-order effects
- Rival analytics firms such as TRM Labs build competing tracking capabilities on the same premise, turning annual hack-loss estimates into a contested but standardized industry benchmark.
- Insurers and custodians price counterparty risk around concentrated attacker profiles, making provenance of funds a due-diligence requirement for listing and settlement.
Third-order effects
- If the pattern holds, state-tied groups become the dominant structural force in crypto crime — the 2019 'two groups' concentration matures into nation-state-scale operations targeting DeFi as it grows.
- Persistent, rising theft totals feed the legitimacy gap: every record year gives regulators evidence for stricter custody, KYC, and surveillance requirements on exchanges.
The trend: Crypto theft is industrializing around a small number of professional and state-tied groups, with blockchain-analytics firms' annual loss estimates becoming the industry's de facto risk benchmark.