Crypto Thieves Siphon Over $1.1 Billion in Record First-Half Heist

Cryptocurrency theft accelerated to a record pace in the first half of 2026, with more than $1.1 billion stolen across 212 documented incidents, officials said based on the source material.

The same material links roughly 55% of the reported losses to state-connected actors, with activity highlighted as being associated in particular with North Korean operations.

Faster laundering is designed to beat recovery timelines North Korean A central change described in the source is operational speed: stolen assets are moved through a repeatable, time-limited laundering playbook intended to stay ahead of tracing, freezes, and legal processes. The process is described as a standardized 45-day cycle, with the most consequential obfuscation steps concentrated in the first five days after a theft. Days 1–5: DeFi routes and mixing to blur attribution During the first five days, attackers are described as pushing stolen funds through decentralized finance protocols and mixing services.

Compliance teams and authorities often attempt to map transaction clusters and pursue freezes or seizures, but the source material says these early transfers are designed to remove clear on-chain attribution before recovery mechanisms can keep pace. Days 6–45: Dispersion and cash-out through weak controls From day six through day 45, the laundering phase shifts toward dispersing value and moving toward cash-out channels, according to the source material. The stolen sums are broken into smaller tranches and routed through non-compliant exchanges and over-the-counter networks, a pattern the material says can frustrate account-information requests and coordinated enforcement across jurisdictions. Why recovery efforts fall behind The material describes rapid cross-border movement as a key reason recovery attempts frequently fail, especially when funds pass through multiple jurisdictions and venues.

It characterizes many recovery efforts as futile once assets have been transformed and broadly dispersed, because legal and compliance pathways often become slower and less effective over time.

Asset conversion reduces the impact of freeze tools

One tactic highlighted is converting stolen proceeds into tokens described as more censorship-resistant before authorities can intervene.

While centralized stablecoin issuers are said to retain the technical ability to freeze assets, attackers are described as prioritizing fast conversion into volatile assets that are not immediately freezeable after a breach.

Sanctions raise costs, but the pipeline persists The source material says sanctions targeting mixing services have increased attackers’ costs, but it adds that these measures have not dismantled the underlying laundering infrastructure.

For institutions, the stated risk is less about any single laundering method and more about the pace at which illicit funds can move compared with cross-border legal coordination and compliance response times.

Uncertainty and limits in the available information

The figures and the 45-day model are presented in the source material without independent corroboration in the same document, leaving open questions about how broadly the described pattern applies across all incidents.

Even so, the dataset and process description together underscore the operational gap the source says can be exploited repeatedly as long as accessible laundering routes remain available.