Key Takeaways
- In 2022, hackers stole $3.8 billion worth of cryptocurrency, primarily from DeFi protocols and centralized exchanges, according to Chainalysis
- The Ronin Network hack in March 2022 resulted in the theft of $625 million in bridged ETH and USDC by the Lazarus Group
- Poly Network exploit in August 2021 saw $611 million stolen, most of which was returned after social engineering
- Investment scams caused $2.57 billion in losses in 2022, up 38% from 2021
- Pig butchering scams accounted for $1.7 billion of scam revenue in 2022
- $1.3 billion lost to crypto rug pulls in 2022, primarily in memecoins
- Ransomware payments in crypto hit $456.8 million in 2022, down 40% from 2021 peak
- Conti ransomware group received $180 million in BTC payments before disbanding in 2022
- LockBit extracted $91 million in ransoms in 2022, targeting 1,000+ victims
- Crypto laundering volume from ransomware hit $400 million in 2022
- Total illicit crypto volume including laundering: $20.1 billion in 2022
- Mixer services like Tornado Cash laundered $7 billion since inception, sanctioned in 2022
- Darknet market crypto volume: $1.7 billion in 2022
- Hydra market, before shutdown, handled $5.2 billion since 2015
- Drugs accounted for 55% of darknet crypto payments, $900 million in 2022
Cryptocurrency crime hit a devastating $3.8 billion in hacks and scams last year.
Hacks and Thefts
- In 2022, hackers stole $3.8 billion worth of cryptocurrency, primarily from DeFi protocols and centralized exchanges, according to Chainalysis
- The Ronin Network hack in March 2022 resulted in the theft of $625 million in bridged ETH and USDC by the Lazarus Group
- Poly Network exploit in August 2021 saw $611 million stolen, most of which was returned after social engineering
- Binance was hacked for $570 million in BNB tokens in October 2022 via a private key compromise
- Wormhole bridge hack in February 2022 led to $325 million stolen in wrapped ETH
- FTX exchange suffered a post-bankruptcy hack in November 2022, with $415 million drained from hot wallets
- Bitfinex hack in 2016 involved 119,756 BTC stolen, valued at $72 million then but over $4.5 billion today
- KuCoin hack in September 2020 resulted in $280 million stolen across 80+ tokens
- Liquid Global hack in October 2021 saw $97 million in various assets stolen
- Mango Markets exploit in October 2022 caused $110 million loss via oracle manipulation
- Badger DAO flash loan attack in December 2021 led to $120 million stolen
- Cream Finance was hacked multiple times, with $130 million stolen in October 2021 alone
- Harvest Finance exploit in October 2020 resulted in $24 million stolen via price manipulation
- bZx protocol suffered two flash loan attacks in February 2020, totaling $1 million loss
- Value DeFi hack in November 2020 saw $6 million in yCRV and yDAI stolen
- Total DeFi hacks in 2022 amounted to $3.1 billion, 80% of all crypto thefts
- North Korean hackers stole $1.7 billion in crypto since 2017, per UN report
- Lazarus Group responsible for 20% of all crypto hacks in 2022
- State-sponsored hacks rose 50% in 2022, totaling $1.5 billion stolen
- Cross-chain bridge hacks accounted for $2 billion in losses in 2022
- Centralized exchange hacks dropped 51% in 2022 to $214 million from 2021's $436 million
- Private key compromises caused 25% of hacks in 2022
- Flash loan attacks made up 15% of DeFi exploits, averaging $10 million each
- Oracle manipulation exploits totaled $300 million in 2022
- Smart contract vulnerabilities led to 60% of DeFi hacks
- Total crypto stolen via hacks 2014-2022: over $10 billion
- 70% of stolen funds in hacks are laundered through mixers like Tornado Cash
- Recovery rate of hacked funds is under 10%, with $700 million recovered in 2022
- Phishing attacks led to $200 million in crypto thefts in 2022
- SIM swap attacks stole $70 million in crypto in 2022
Hacks and Thefts Interpretation
Money Laundering
- Crypto laundering volume from ransomware hit $400 million in 2022
- Total illicit crypto volume including laundering: $20.1 billion in 2022
- Mixer services like Tornado Cash laundered $7 billion since inception, sanctioned in 2022
- DeFi protocols used for laundering $1.2 billion in 2022, up 400%
- Cross-chain bridges facilitated $500 million laundering in 2022
- OTC brokers laundered $2.5 billion for illicit actors in 2022
- 1,000+ virtual asset service providers (VASPs) involved in suspicious transactions
- North Korea laundered $300 million stolen crypto through Chinese exchanges
- Russian darknet markets laundered $1 billion via BTC tumblers
- USDT stablecoin used in 60% of laundering transactions over $1 million
- Gambling sites washed $8 billion illicit funds in 2022
- 10% of all DEX volume tied to illicit funds, $3 billion total
- Fiat off-ramps processed $1.5 billion dirty crypto in 2022
- ChipMixer laundered $3 billion before shutdown in 2023
- Blender.io mixer processed $20 million DPRK funds before sanction
- 50% of ransomware proceeds laundered via China-based VASPs
- Illicit funds received by exchanges: $12.4 billion in 2022, down 24%
Money Laundering Interpretation
Other Illicit Activities
- Darknet market crypto volume: $1.7 billion in 2022
- Hydra market, before shutdown, handled $5.2 billion since 2015
- Drugs accounted for 55% of darknet crypto payments, $900 million in 2022
- Stolen credit card markets on darknet used $200 million crypto
- Counterfeit goods sales on darknet: $300 million crypto volume
- Human trafficking darknet sites received $50 million crypto
- Terrorist financing via crypto: $50 million detected 2017-2022
- Sanctions evasion by Russia post-Ukraine invasion: $500 million crypto
- Fentanyl precursor chemicals traded for $100 million BTC on darknet
- Weapons sales on darknet generated $150 million crypto revenue
- Cryptocurrency used in 1,200+ terrorism cases by ISIS/Al-Qaeda
- Silk Road successor markets handled $1 billion post-2013 shutdown
- AlphaBay darknet market seized with $20 million crypto in 2017
- Bitcoin mixer services on darknet laundered $500 million for markets
- 20% of darknet volume shifted to Telegram channels post-Hydra ban
- Illicit services like hacking tools sold for $100 million crypto
- Child exploitation material sites received $40 million crypto donations
- Total darknet revenue 2022: $1.7 billion, 16% of peak 2021
Other Illicit Activities Interpretation
Ransomware
- Ransomware payments in crypto hit $456.8 million in 2022, down 40% from 2021 peak
- Conti ransomware group received $180 million in BTC payments before disbanding in 2022
- LockBit extracted $91 million in ransoms in 2022, targeting 1,000+ victims
- BlackCat/ALPHV ransomware payments totaled $60 million in 2022
- Hive ransomware group took $100 million before FBI disruption in 2023
- Average ransomware demand in crypto: $1.5 million, paid in 20% of cases
- Colonial Pipeline paid $4.4 million in BTC to DarkSide in May 2021
- JBS Foods paid $11 million ransom to REvil in June 2021
- Costa Rica government paid $20 million+ to Conti in 2022 cyberattack
- Ireland HSE paid undisclosed but estimated $20 million to Conti in 2021
- 65% of ransomware payments made in BTC, 20% in USDT in 2022
- Ransomware-as-a-service (RaaS) affiliates received 80% of payments
- US healthcare sector paid $50 million in ransoms in 2022
- Critical infrastructure attacks saw 30% of victims pay, averaging $2 million each
- Ransomware gangs laundered 90% of proceeds via mixers and exchanges
- Phobos ransomware targeted SMBs, collecting $10 million in 2022
- Ryuk ransomware extracted $150 million pre-2022
- REvil shutdown led to $200 million seized by US authorities in 2021
- Total ransomware revenue 2021-2022: $1.1 billion
- Double extortion tactics used in 70% of attacks, increasing payments by 20%
Ransomware Interpretation
Scams and Frauds
- Investment scams caused $2.57 billion in losses in 2022, up 38% from 2021
- Pig butchering scams accounted for $1.7 billion of scam revenue in 2022
- $1.3 billion lost to crypto rug pulls in 2022, primarily in memecoins
- Fake celebrity endorsement scams on social media defrauded victims of $500 million in 2022
- Ponzi schemes in crypto generated $1 billion illicit revenue in 2022
- Romance scams involving crypto promises led to $300 million losses in 2022
- Job scams promising crypto payments stole $100 million in 2022
- NFT scams caused $250 million in losses, with wash trading inflating 80% of volumes
- Impersonation scams on Telegram and Discord totaled $400 million
- High-yield investment programs (HYIPs) in crypto defrauded $200 million
- Fake ICOs and token sales scammed $150 million post-2021 bull run
- Phishing for wallet seeds in scams led to $300 million thefts
- 90% of crypto scams originate from East Asia, per Chainalysis
- Victims of pig butchering often lose average $120,000 per victim
- Scam websites mimicking exchanges defrauded $250 million
- Social media ads for fake crypto giveaways stole $100 million
- Rug pull projects numbered 10,000+ in 2022, averaging $100k each
- Total fraud reports to FTC involving crypto: 46,000 in 2022, losses $1 billion
- Bitcoin ATM scams caused $100 million median loss per victim in 2022
- Fake trading apps downloaded 1 million times stole $50 million crypto
- Pump-and-dump schemes on DEXes generated $200 million illicit profit
- Elder fraud via crypto scams totaled $500 million, 25% increase YoY
Scams and Frauds Interpretation
Sources & References
- Reference 1CHAINALYSISchainalysis.comVisit source
- Reference 2ELLIPTICelliptic.coVisit source
- Reference 3BLOGblog.chainalysis.comVisit source
- Reference 4REUTERSreuters.comVisit source
- Reference 5REKTrekt.newsVisit source
- Reference 6UNun.orgVisit source
- Reference 7GOgo.trmlabs.comVisit source
- Reference 8TRMLABStrmlabs.comVisit source
- Reference 9FBIfbi.govVisit source
- Reference 10IC3ic3.govVisit source
- Reference 11JUSTICEjustice.govVisit source
- Reference 12FTCftc.govVisit source
- Reference 13FINCENfincen.govVisit source
- Reference 14SOPHOSsophos.comVisit source
- Reference 15BLOOMBERGbloomberg.comVisit source
- Reference 16HOMEhome.treasury.govVisit source
- Reference 17FATF-GAFIfatf-gafi.orgVisit source
- Reference 18EUROPOLeuropol.europa.euVisit source
- Reference 19DEAdea.govVisit source
- Reference 20STATEstate.govVisit source





