Hackers moved stolen crypto in as little as two seconds in 2025, laundering $4.4B before most victims could respond

In 76% of crypto exploits recorded in 2025, attackers had already moved, split, or partially laundered stolen funds before the breach was even publicly reported, with the fastest case clocking a transfer just two seconds after the hack, according to a new report by Swiss blockchain analytics firm Global Ledger.

The findings highlight a growing gap between exploit execution and mitigation, even as victims improve response times.

The report also underscores the expanding role of decentralized finance (DeFi), cross-chain bridges and mixers in crypto money laundering operations.

Hackers accelerate crypto money laundering timelines

One of the most striking findings in the Global Ledger report is the speed at which funds are moved after an exploit. In the fastest recorded case, stolen crypto assets were transferred just two seconds after the breach occurred.

“In 76% of cases, attackers managed to move, split, or partially launder funds before the exploit was intercepted or publicly reported,” — Global Ledger report, 2025.

While approximately half of stolen funds remain dormant for extended periods, attackers increasingly fragment proceeds into smaller portions and route them through multiple intermediaries.

In the second half of 2025, hackers moved funds twice as fast compared to the first half of the year.

Despite this acceleration, the average time required to fully launder funds rose slightly. In the second half of 2025, hackers took an average of 10.6 days to complete crypto money laundering operations, up from roughly eight days earlier in the year.

According to the report, this reflects a more layered and cautious approach, with funds dispersed across more addresses and platforms.

At the same time, victims are responding more quickly. Global Ledger noted that response times were cut by more than half in the second half of the year, as affected projects increasingly coordinated with exchanges and attempted to freeze funds where possible.

That faster reaction may have contributed to a relative slowdown in large-scale exploits later in 2025.

DeFi emerges as key channel for crypto money laundering

The report documents a significant migration away from centralized exchanges as primary laundering channels.

Instead, hackers are leveraging DeFi protocols as part of broader crypto money laundering strategies.

Over $732 million was laundered through DeFi platforms in the second half of 2025, compared with $170 million in the first half which is a more than fourfold increase.

This made DeFi the second most-used route for laundering, behind mixers. In 42% of exploits, attackers used the crypto mixer Tornado Cash, according to the report.

Mixers remain a central infrastructure component for obscuring transaction histories, but DeFi protocols are increasingly intertwined with these operations due to their composability and liquidity.

The shift places additional pressure on DeFi developers and governance communities to strengthen monitoring systems.

As crypto money laundering grows more sophisticated, the openness that defines DeFi ecosystems also creates exposure.

Ethereum remains primary target

Liquidity concentration continues to dictate where attackers focus their efforts. Ethereum accounted for $2.44 billion in losses in 2025 which is roughly 60% of the global total identified in the report.

“Ethereum remains the top target for attackers, accounting for $2.44 billion in losses (~60% of the global total) in 2025. If you are building on Ethereum with high liquidity, you are the default target for hackers,” — Lex Fisun, CEO and Co-founder, Global Ledger.

Fisun noted that while other chains such as Solana and Bitcoin are seeing growth in incident counts, the bulk of financial damage remains concentrated where liquidity is deepest.

Bridges also played a central role in crypto money laundering flows. Nearly half of all stolen funds of $2.01 billion were routed through cross-chain bridges in 2025, more than three times the amount that passed through mixers.

Attackers frequently use bridges to move assets back to Ethereum’s main network, where liquidity is higher and transaction volumes can help mask suspicious activity.

“Bridges still attract hackers for their liquidity, as well as for chain-hopping and disguising origins,” — Lex Fisun, CEO and Co-founder, Global Ledger.

Real-time monitoring seen as critical defense

According to Fisun, traditional manual tracing methods are no longer sufficient to counter rapid crypto money laundering operations.

“To close the gap between a hack and response, DeFi protocols need real-time action. Implementing real-time on-chain monitoring that detects anomalies the moment they happen is critical. Without internal detection and alerting, no ecosystem response can be fast enough,” — Lex Fisun, CEO and Co-founder, Global Ledger.

The report suggests that automated labeling of suspicious wallets and instant transaction monitoring could reduce losses by shrinking the window between exploit and containment.

As crypto money laundering tactics continue to evolve, 2025 may mark a turning point where speed, automation and cross-chain complexity define both attack and defense strategies across the digital asset ecosystem.