Crypto Laundering Now Starts Within Two Seconds After Hacks

Hackers now move stolen crypto in as little as two seconds after an attack begins, often before victims disclose breaches. Global Ledger’s 2025 analysis of 255 hacks worth $4.04 billion found that 76% of incidents saw funds moved before public disclosure, rising to 84.6% in the second half of the year.

First transfers are near-instant, but full laundering takes longer. In the second half of 2025 attackers needed about 10.6 days on average to reach final deposit points such as exchanges or mixers, up from roughly eight days earlier in the year. This shift reflects improved monitoring after disclosure, prompting criminals to split funds into smaller pieces and route them through multiple layers before attempting cash-out.

Cross-chain bridges handled nearly half of all stolen funds—about $2.01 billion—more than three times the amount routed via mixers. In the Bybit case, 94.91% of stolen funds flowed through bridges.

crypto laundering, stolen crypto, cross-chain bridges, mixers, global ledger, bybit, exchanges, cash out, 255 hacks, 2025 analysis