Analysts Outline Timing of Stolen Cryptocurrency Movements

Victims of crypto thefts report the loss of funds on average 43.83 hours after the incident. Within 46.74 hours, the assets are already being transferred to exchanges or mixers, according to a report by Global Ledger.

From the moment of the attack to the first transaction, 67.57 hours elapse. The longest delay, 78.55 hours, occurs between the public announcement of the breach and the movement of funds, creating a situation where assets have already been withdrawn before the community is informed.

According to the report, the speed of fund movement depends on the type of platform:  

• NFT projects: ~23.5 days (due to low liquidity and complex infrastructure);  
• CEX: ~425 hours (hackers use multi-step schemes);  
• DeFi protocols: ~230 hours (often serve as an intermediary);  
• gaming platforms: ~25 hours (simple architecture and small amounts);  
• payment services: ~36 minutes (instant swaps or direct withdrawals).  

Where the Money Goes

46% of funds remain unused, offering opportunities for tracking and recovery. Another 42% are moved between blockchains via cross-chain bridges. Only a small portion reaches centralized exchanges, DeFi protocols, or mixers. Less than 1% of assets are successfully frozen promptly.

Tornado Cash remains the primary tool for laundering, used in 55% of cases. Alternatives include mixers like Railgun (20%) and Wasabi Wallet (10%). Other platforms include Chainflip (6%), CoinJoin (3%), CryptoMixer (3%).

Quarterly Results

In the first quarter, the industry lost $1.93 billion due to 43 incidents. Global Ledger described the period as “one of the most destructive in history.”

76% of the funds stolen in the first quarter ($1.44 billion) are linked to groups allegedly affiliated with North Korea, experts noted. Other hackers accounted for $450 million. 

The main attack vector was vulnerabilities in smart contracts, accounting for 62.79% of all incidents (27 cases). 

CEXs were the hardest hit, suffering 79.56% of all stolen funds (~$1.54 billion).

Hackers actively use cross-chain transfers and private protocols, necessitating improved monitoring tools and rapid response, analysts believe.

In April, Global Ledger specialists reported that the total damage from 265 crypto breaches throughout 2024 and the first two months of 2025 exceeded $3.83 billion.