According to CoinMeta, in 2025, the amount of cryptocurrency theft reached $3.4 billion, of which Bybit suffered losses of $1.5 billion from attacks, accounting for 44% of the total for that year. In the first half of 2026, there were 212 related incidents resulting in losses of about $1.1 billion, with Lazarus-associated gangs being involved in approximately 55% of these cases. KelpDAO was attacked in April and lost $293 million. The stolen funds typically go through a three-stage transfer process over about 45 days: in the first 5 days, they are exchanged using the DeFi protocol and enter mixers; then they are bridged across chains and flow through trading platforms with lower requirements via KYC. During the 20 to 45-day period, they are cashed out in batches through platforms without KYC, instant exchangers, and over-the-counter trading networks. Although it is still possible to track the funds once they have crossed multiple blockchains, mixers, and judicial jurisdictions, the difficulty of recovering them significantly increases. Less than 5% of the stolen funds are ultimately recovered. Tether and Circle can be frozen, while addresses such as USDT and USDC are often used. Attackers usually exchange stablecoins for Ethereum or Bitcoin within minutes after the attack.