Crypto crime figures are quoted everywhere, but they come from sources that count very different things, and mixing them produces numbers nobody can defend. This page collects the headline statistics for 2024 and 2025 on crypto hacks, North Korean theft, scam revenue, illicit transaction volume, ransomware, fraud reported by victims and crypto ATM losses, each with the publisher, the report and the year beside it. It separates on-chain estimates from blockchain analytics firms from victim complaints collected by the FBI and FTC, and explains why the totals differ. It is written for security leaders, fraud teams and analysts who need a figure for a board paper or risk assessment and want to cite it correctly. Last reviewed: November 2026.
Key takeaways
- Victim-reported crypto losses keep climbing. The FBI IC3 recorded $11.366 billion in cryptocurrency-related losses for 2025, up 22% on 2024's $9.3 billion.
- One state dominates theft. Chainalysis attributes at least $2.02 billion of the more than $3.4 billion stolen in 2025 to North Korea, driven by the roughly $1.5 billion Bybit theft.
- Scams outgrew hacks. Chainalysis estimates about $17 billion in crypto scam revenue for 2025, about five times the value stolen in hacks.
- Illicit volume tripled on paper, mostly through sanctions. Chainalysis puts 2025 illicit volume at a lower bound of $154 billion, with sanctioned entities the main driver and stablecoins carrying 84% of it.
- Older people lose most. IC3 victims over 60 reported $4.35 billion in crypto losses in 2025, and kiosk losses rose 58% to $389 million.
How to read these numbers
Three kinds of source appear on this page, and each has a known bias.
| Source type | Examples | What it counts | Main limitation |
|---|---|---|---|
| Victim complaints | FBI IC3 Internet Crime Report; FTC Consumer Sentinel data | Losses that victims chose to report, mainly in the US | Under-reporting; some complaints mix payment types; US-centric |
| On-chain analytics | Chainalysis Crypto Crime Report | Value received by addresses the firm has attributed to illicit activity | Lower-bound estimates that are revised upward as more addresses are identified |
| Government attribution | FBI public service announcements | Specific incidents tied to a named actor | Covers only cases the government chooses to publish |
Two practical rules follow. Never add IC3 losses to Chainalysis scam revenue, because many of the same victims appear in both. And always quote the year of the report as well as the year of the data, because on-chain estimates for a given year change: Chainalysis first reported 2024 illicit volume as $40.9 billion and now puts it at $57.2 billion.
Victim-reported losses: FBI IC3
The FBI's Internet Crime Complaint Center publishes the most widely cited US loss figures each spring.
| Metric | 2024 (IC3 2024 report) | 2025 (IC3 2025 report) | Change |
|---|---|---|---|
| All complaints | 859,532 | 1,008,597 | Not stated |
| All reported losses | $16.6 billion | $20.877 billion | +26% |
| Cryptocurrency-related complaints | 149,686 | 181,565 | +21% |
| Cryptocurrency-related losses | $9.32 billion | $11.366 billion | +22% |
| Crypto investment fraud complaints | 41,557 | 61,559 | +48% |
| Crypto investment fraud losses | $5.8 billion | $7.228 billion | +25% |
| Crypto losses reported by people over 60 | $2,839,333,197 | $4,347,081,557 | About +53% (calculated) |
Crypto now accounts for more than half of all losses reported to IC3: $11.366 billion of $20.877 billion in 2025. Investment fraud, largely the long-con schemes often called pig butchering, is the largest single crypto category. See the Romance and Investment Scam Awareness Guide for how these schemes run.
Crypto ATM and kiosk fraud
Kiosk losses are small in total but very concentrated on older victims and are rising faster than most categories.
| Source and year | Complaints | Losses | Notes |
|---|---|---|---|
| FTC Data Spotlight, first half of 2024 | Not stated | Over $65 million | People 60 and over reported about 71%; median loss $10,000 |
| FBI IC3 2024 report | 10,956 (+99%) | $246.7 million (+31%) | Full year 2024 |
| FBI IC3 PSA I-051526-PSA, 2025 | 13,460 (+23%) | $388,981,267 (+58%) | More than half of complaints from people over 50, with over $302 million lost |
The same IC3 release breaks 2025 kiosk losses down by state: Texas reported $56.8 million across 1,179 complaints, Florida $32.8 million across 1,213 and California $24.0 million across 978. The IC3 notes that kiosk losses cannot be attributed solely to kiosks, because some complaints include other transaction types. See the Crypto ATM Scams Guide for the scam script and state laws.
Hacks and stolen funds
Chainalysis published its 2025 theft figures on 18 December 2025, covering January to early December.
| Metric (Chainalysis) | Figure | Comparison |
|---|---|---|
| Total stolen, 2025 | Over $3.4 billion | Bybit alone about $1.5 billion |
| Stolen by North Korea (DPRK), 2025 | At least $2.02 billion | Up $681 million (51%) on 2024 |
| DPRK all-time total | $6.75 billion | Cumulative |
| Known DPRK attacks | Down 74% | Record value from fewer, larger thefts |
| Personal wallet compromises, 2025 | 158,000 incidents, at least 80,000 victims | 54,000 incidents and 40,000 victims in 2022 |
| Value stolen from individuals, 2025 | $713 million | Down from a 2024 peak of $1.5 billion |
| Personal wallets' share of stolen value | 20% in 2025 | 44% in 2024, 7.3% in 2022 |
The FBI publicly attributed the Bybit theft, which took place on or about 21 February 2025, to North Korea and the activity cluster it tracks as TraderTraitor, and asked exchanges, bridges and DeFi services to block transactions involving the laundering addresses. The incident is a reminder that the largest losses come from compromised signing paths and developer credentials, not from broken cryptography: see the Bybit Hack 2025 breach analysis and the TraderTraitor (Jade Sleet) threat actor profile.
Scam revenue
Chainalysis' scams chapter, published 13 January 2026, estimates on-chain revenue received by scam operations.
| Metric (Chainalysis) | 2024 | 2025 |
|---|---|---|
| Estimated scam revenue | $9.9 billion as first reported, recalculated to about $12 billion | About $17 billion (at least $14 billion observed on-chain so far) |
| Average scam payment | $782 | $2,764 (+253%) |
| Impersonation scams | Baseline | Up more than 1,400% year on year, average payments up over 600% |
| Scams with on-chain links to AI vendors | Not stated | $3.2 million average revenue per operation, against $719,000 without such links |
Chainalysis reports that pig butchering and high-yield investment programmes remain the largest categories by volume. The AI comparison is a correlation in on-chain data, not proof that AI causes higher revenue, but it matches what fraud teams report about scripted, translated and deepfake-assisted contact. See the Deepfake and AI Impersonation Guide.
Illicit volume and sanctions
The broadest measure is total value received by illicit addresses, from the introduction to Chainalysis' 2026 Crypto Crime Report (8 January 2026).
- Illicit volume, 2025: at least $154 billion, which Chainalysis describes as a lower-bound estimate and a 162% year-on-year increase.
- Illicit volume, 2024: revised to $57.2 billion from the $40.9 billion first published.
- Share of activity: below 1% of all attributed on-chain volume, slightly higher than in 2024.
- Stablecoins: 84% of all illicit transaction volume in 2025.
- Sanctions: value received by sanctioned entities rose 694% and was the main driver of the increase; the Russia-linked A7A5 token alone moved over $93.3 billion in less than a year after its February 2025 launch.
The headline jump is therefore mostly sanctions evasion by state-linked networks, not a tripling of scams or theft. Anyone quoting "$154 billion of crypto crime" in a fraud context should say so.
Ransomware payments
Ransomware remains the crime most directly paid in crypto. Chainalysis' ransomware chapter (26 February 2026) estimates:
| Metric (Chainalysis) | 2024 | 2025 |
|---|---|---|
| On-chain ransomware payments | $892 million (revised from $813 million) | About $820 million (down about 8%) |
| Median payment | $12,738 | $59,556 (+368%) |
| Share of victims paying | Not stated | Potentially an all-time low of 28% |
Wider fraud context: FTC
The FTC's Consumer Sentinel figures overlap with IC3 but use a different reporting base.
- 2024: consumers reported losing more than $12.5 billion to fraud, up 25%; investment scams were the largest category at $5.7 billion, and losses paid by bank transfer or cryptocurrency exceeded all other payment methods combined.
- 2025: $15.9 billion reported lost across 3 million fraud reports; investment scams $7.9 billion; imposter scams over $3.5 billion from more than 1 million reports.
Figures that are often misquoted
| Common claim | What the source actually says |
|---|---|
| "Crypto crime hit $154 billion in 2025" | Chainalysis' lower-bound estimate of value received by illicit addresses, driven mainly by sanctioned entities; it is not fraud or theft losses |
| "Americans lost $11 billion to crypto scams" | IC3's $11.366 billion covers all cryptocurrency-related complaints in 2025, of which crypto investment fraud was $7.228 billion |
| "North Korea stole $2 billion in 2025" | Chainalysis says at least $2.02 billion, with about $1.5 billion from the single Bybit theft the FBI attributed to TraderTraitor |
| "Crypto ATMs cost victims $389 million" | IC3 complaint losses linked to kiosks in 2025; the IC3 says some complaints include other transaction types |
| "Ransomware is collapsing" | Chainalysis shows total payments down about 8% but the median payment up 368%, so fewer victims pay larger sums |
| "Scam revenue was $9.9 billion in 2024" | That was the first estimate; Chainalysis has since recalculated 2024 at about $12 billion |
When a figure cannot be traced to one of the primary publications listed below, treat it as unverified. Statistics roundup pages frequently strip out the data year, mix complaint and on-chain figures, or quote superseded first estimates.
What the numbers mean for defenders
- Exchanges and custodians: theft value is concentrated in a few large incidents against signing infrastructure. Controls on developer endpoints, cloud session tokens and transaction signing matter more than wallet cryptography. See the Crypto Exchange Identity and Key Security Guide.
- Individuals and wallet providers: personal wallet incidents nearly tripled since 2022, even though the dollar total fell in 2025. Hardware signing and transaction simulation reduce exposure. See the Crypto Wallet Security Guide.
- Banks and payment firms: crypto is now the largest category of victim-reported loss in the IC3 data, and much of it leaves the banking system by transfer or cash withdrawal. Outbound transfers to exchanges and large cash withdrawals by older customers are the points where intervention works.
- Compliance teams: stablecoins dominate illicit volume and sanctions evasion drove the 2025 increase, so screening of stablecoin flows and sanctions exposure deserves priority. See the AML programme and transaction monitoring guide.
- Security leaders: ransomware payment totals fell while the median payment rose, which points to fewer but larger payouts. Resilience and refusal to pay remain the levers.
Useful metrics for an internal programme: blocked outbound payments to high-risk crypto addresses per month; scam interventions at branch or call centre and the prevented loss; time from external attribution (an FBI PSA or sanctions listing) to address blocking; personal and corporate wallet incidents per quarter; and the share of high-value transfers with verified destination addresses.
Practitioner checklist
- Cite every figure with publisher, report name, data year and publication date.
- Do not add victim-reported losses to on-chain estimates; present them side by side.
- Recheck on-chain figures each year, since prior-year estimates are revised upward.
- Separate sanctions-driven illicit volume from fraud and theft when briefing the board.
- Use IC3 state-level kiosk data to target branch and customer awareness where losses are highest.
- Subscribe to FBI IC3 PSAs and act on published laundering addresses quickly.
- Track internal metrics that map to these categories: theft, scam intervention, ransomware, sanctions hits.
- Review this page's sources each spring, when the IC3 and FTC annual figures are released.
Standards and references
- FBI IC3: 2025 Internet Crime Report
- FBI IC3: 2024 Internet Crime Report
- FBI IC3: Cryptocurrency Kiosk Complaint Data by State
- FBI IC3: North Korea responsible for $1.5 billion Bybit hack
- Chainalysis: 2026 Crypto Crime Report introduction
- Chainalysis: 2025 crypto theft and North Korea
- Chainalysis: Crypto scams 2026
- Chainalysis: Crypto ransomware 2026
Related NHI Mgmt Group resources: Web3 and Crypto Security Guide · North Korea Cyber Operations Guide · Crypto ATM Scams Guide · Crypto Scam and Drainer Guide