Crypto Hack Statistics Compared: Why the Reports Disagree
Quick answer. They count different things: Chainalysis includes $713 million stolen from personal wallets, and CertiK includes $722.9 million in phishing. Periods and pricing differ too, so published 2025 totals run from $2.72 billion to $4.04 billion.
Video transcript
The gap comes from choices. Ask six trackers how much crypto was stolen in 2025 and you get six answers, from 2.72 billion to 4.04 billion dollars.
DefiLlama, by Guardian's own count, sits lowest. PeckShield sits highest. Guardian does not rank these sources, because each answers a different question.
The biggest driver is what counts as a hack: PeckShield adds scams, CertiK counts phishing, Chainalysis includes personal wallets, and TRM Labs tracks fraud separately.
Even one incident varies. Bybit appears in all six totals at five different sizes, from 1.4 to 1.51 billion dollars.
Pricing date matters too. TRM valued the Binance theft at about 6.36 billion dollars when each asset was taken, and about 6.23 billion at publication.
None of the reports we read says it subtracts recoveries. So stolen and net loss figures for one incident can differ by billions.
Attribution shapes headlines. Chainalysis attributes at least 2.02 billion dollars of 2025 thefts to North Korea. Check whether it rests on a government finding or a firm's own analysis.
To cite well, name the source and what it counts. Give the period. Use one source per figure. Say whether recoveries are netted. Compare years within the same report.
Whatever the total, the largest share in TRM's 2025 data came through keys, wallets and access controls. Read the full comparison, or talk to Guardian.
Ask six trackers how much crypto was stolen in 2025 and you get six answers, from $2.72 billion to $4.04 billion.
The gap comes from choices: what counts as a hack, when assets are priced, and what is left out.
Below are the published totals side by side, then the choices that separate them. We do not rank the sources; each answers a different question.
The 2025 Totals Side by Side
| Source | 2025 total | What it counts | Published |
|---|---|---|---|
| DefiLlama (Guardian count) | $2.72B, 148 incidents | Incidents at named protocols, exchanges, chains and wallets | Data read Nov 5, 2026 |
| TRM Labs | $2.87B, nearly 150 hacks | Hacks and exploits; fraud counted separately | Jan 28, 2026 |
| CertiK | $3.35B | Hacks, scams and exploits, phishing included | Dec 23, 2025 |
| Immunefi | $3.4B, 97 incidents | Publicly known hacks | Mar 25, 2026 |
| Chainalysis | Over $3.4B, to early December | Stolen funds, personal wallets included | Dec 18, 2025 |
| PeckShield | $4.04B | Hacks ($2.67B) plus scams ($1.37B) | Jan 2026, via CryptoPotato |
Each figure is the firm's own, except DefiLlama's, which is Guardian's count of its public dataset. PeckShield's figures are as CryptoPotato reported them from PeckShield's data.
One incident shows the effect. Bybit sits inside all six totals, at five different sizes:
- DefiLlama: $1.4B
- CertiK: $1.447B
- TRM Labs: $1.46B
- Chainalysis and Immunefi: $1.5B, the figure the FBI used
- PeckShield: $1.51B, per CryptoPotato
Those gaps are small next to the scope choices below.
What Each Report Counts
The biggest driver is the definition of a hack.
- PeckShield adds scams: $1.37B of its $4.04B.
- CertiK counts phishing: $722.9M across 248 incidents in 2025.
- Chainalysis counts personal wallet compromises: $713M across 158,000 incidents, about 20% of stolen value.
- TRM Labs tracks fraud separately and sorts hacks into five types, from infrastructure attacks to code exploits.
- Immunefi counts "publicly known hacks": 97 in 2025. Its 2024 report also counted alleged fraud and rug pulls.
- DefiLlama has a rug pull label, but it covers five 2025 entries worth $4.3M.
Thresholds and coverage
None of the reports we read states a minimum loss size for an incident to count.
Coverage still varies widely. Immunefi counts 97 incidents in 2025 and DefiLlama 148. CertiK lists 248 phishing incidents and 240 code vulnerability incidents.
Two firms flag their figures as minimums. Chainalysis calls its figures lower-bound estimates, and TRM calls its illicit volume estimate, hacks included, a "floor."
Even one firm's numbers move. Immunefi's 2024 report counted $1.47B in hacks across 192 incidents. Its 2026 update puts 2024 at $1.27B across 94.
Onchain and offchain incidents
Bybit was an exchange loss that began with a breached developer machine. How a report files incidents like it shapes what it says about attack vectors.
TRM puts infrastructure attacks on keys, wallets and access controls at $2.2B, 76% of 2025 hack value. CertiK files $1.45B under supply chain, across two incidents.
Our onchain vs offchain report shows how labels move money between the two buckets.
Pricing Date and Recoveries
When assets are priced
Chainalysis values funds "at the time of their theft." TRM did the same for Binance: about $6.36 billion at the moment each asset was taken.
At prices when TRM published, the same assets were worth about $6.23 billion.
The gap can be larger for older thefts. Elliptic valued the 2022 Ronin theft at $540 million when it happened and over $615 million when found; DefiLlama records $624 million.
The CertiK, Immunefi and PeckShield pages we read do not define a pricing date.
Recovered and frozen funds
Recoveries sit beside the totals, when they appear at all:
- PeckShield: $334.9M recovered or frozen in 2025, reported separately.
- Immunefi: $115.6M recovered in 2024, 7.7% of losses, reported separately.
- DefiLlama: a returnedFunds field, filled for 28 of its 1,339 entries.
- Binance: says $2.85B was frozen or intercepted; TRM's $6.36B is the amount taken.
So a "stolen" figure and a "net loss" figure for one incident can differ by billions.
Attribution to North Korea
Attribution does not change a total, but it drives the headline share.
Chainalysis attributes at least $2.02 billion of 2025's thefts to North Korea. TRM says North Korea took 63% of funds stolen worldwide in 2025.
Standards differ. TRM counts Bitget's 2026 theft as North Korean while saying it has not definitively attributed it.
Government findings come later. The FBI named TraderTraitor five days after the Bybit theft, and two days after Binance, where TRM had already named it.
Before quoting a North Korea figure, check whether it rests on a government finding or a firm's own analysis.
How to Cite Hack Statistics
- Name the source and what it counts in the same sentence.
- Give the period. Chainalysis's 2025 figure runs to early December.
- Use one source per figure. Never add CertiK's phishing to DefiLlama's hacks.
- Size each incident from one source, and say which.
- Say whether recoveries are netted.
- Compare years from the same report, not just the same firm.
Our crypto hack statistics page follows these rules. Our biggest crypto hacks list ranks by DefiLlama alone.
Where Guardian Fits
Whatever the total, the largest share in TRM's 2025 data came through keys, wallets and access controls, not contract code.
That surface changes week to week. Guardian's Risk Monitoring watches contract configuration and internet-facing hosts, confirms each finding by hand and keeps one rating over both.
For keys and signers, Managed Security maps every path to your funds and reviews each deployment and configuration change as it lands.
Frequently Asked Questions
Why do Chainalysis and CertiK report different crypto hack totals?
They count different things. Chainalysis includes $713 million from personal wallets and runs to early December; CertiK includes $722.9 million in phishing. Their 2025 totals land close, over $3.4 billion and $3.35 billion, but are built from different parts.
Do crypto hack totals include scams?
Some do. PeckShield's $4.04 billion includes $1.37 billion in scams. TRM Labs reports fraud separately from its $2.87 billion in hacks, and DefiLlama's rug pull label covers only five 2025 entries.
Do crypto hack totals subtract recovered funds?
None of the reports we read says it does. PeckShield and Immunefi report recoveries separately. TRM's $6.36 billion Binance figure is the amount taken, before the $2.85 billion Binance says was frozen or intercepted.
Which crypto hack report should I cite?
The one whose definition matches your question. An incident list like DefiLlama fits protocol and exchange hacks; Chainalysis fits all stolen funds, individuals included; PeckShield fits hacks plus scams. Name the source and the period.
Sources
- Chainalysis: North Korea Drives Record $2 Billion Crypto Theft Year (December 18, 2025)
- TRM Labs: TRM's New Crypto Crime Report Shows Illicit Flows Hit a Record USD 158B in 2025 (January 28, 2026)
- TRM Labs: 2026 Crypto Crime Report (January 2026)
- TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
- CertiK: Hack3d, The Web3 Security Report 2025 (December 23, 2025)
- Immunefi: What an Onchain Hack Actually Costs, 2024 to 2025 Update (March 25, 2026)
- Immunefi: Crypto Losses 2024 Report (January 1, 2025)
- CryptoPotato: Report, Crypto Scams and Hacks Drained Over $4B in 2025, citing PeckShield (January 18, 2026)
- DefiLlama: Hacks dataset API (read November 5, 2026)
- Elliptic: North Korea's Lazarus Group identified as exploiters behind $540 million Ronin bridge heist (March 29, 2022, updated)
- Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
- FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
- Guardian: Crypto Hack Statistics 2026 (November 2026)
- Guardian: Onchain vs Offchain Attacks, Where Hack Losses Came From (November 2026)
Stay out of every tracker's totals
Guardian watches the keys, configuration and internet-facing systems behind your protocol, where the largest losses in these reports began.