The speed at which hackers are transferring stolen funds has been revealed., 2026/02/12 18:27:56

Cybercriminals have learned to withdraw stolen cryptocurrencies within just two seconds after breaching victims’ wallets, according to experts from the Swiss cybersecurity firm Global Ledger.

After analyzing 255 incidents from the previous year, which resulted in a total loss of $4.04 billion, security specialists reported that in 76% of cases, the first transfer of stolen coins occurred before the public disclosure of the incident. In the second half of 2025, this percentage increased to 84.6%.

“Hackers operate more swiftly than cryptocurrency exchanges, analytics firms, or law enforcement can coordinate their responses. However, this rapid action is primarily characteristic of the initial phase of the attack,” clarified Global Ledger.

Although the initial transactions are executed almost instantaneously, the overall process of laundering assets has slowed down. In the latter half of last year, hackers required ten days to reach the final stage of money laundering through platforms such as exchanges or mixers. Previously, this process took around eight days.

Experts from Global Ledger believe that this new trend may indicate improvements in security systems. Following the publication of breach data, companies mark addresses and enhance monitoring. Consequently, criminals are compelled to break down amounts into smaller portions and conduct multiple iterations before cashing out.

Protocols that facilitate the transfer of data and digital assets (cross-chain bridges) have become the primary means of moving funds. Nearly half of all stolen cryptocurrencies, approximately $2.01 billion, have passed through such services. This volume is three times greater than the amounts routed through mixers or anonymization protocols.

Direct withdrawals to centralized trading platforms significantly decreased in the second half of the year, as hackers increasingly favored decentralized finance (DeFi) platforms, according to Global Ledger.

The majority of losses were attributed to Ethereum — $2.44 billion (60.64% of the total volume). Despite the efforts of exchange teams and crypto projects, the asset recovery rates remained low. Only 9.52% of the funds were frozen, and 6.52% were returned to their owners.

Nearly half of all stolen assets remain untouched. Billions of dollars are still held in cryptocurrency wallets, awaiting a moment for legalization, stated experts from Global Ledger.

Previously, the co-founder of the cybersecurity firm CDSecurity, known by the pseudonym Chris Dior, indicated that hackers are altering their cryptocurrency laundering schemes, shifting from mixers to network switching.