A recent report by the Swiss blockchain analytics firm Global Ledger has brought to light the increasing speed and sophistication of cryptocurrency laundering, highlighting significant vulnerabilities within centralized exchanges (CEXs). The report reveals that cybercriminals are now capable of laundering stolen crypto in mere minutes, often before the actual hacks are even publicly disclosed.
The data indicates a concerning trend: a staggering $3.01 billion was stolen across 119 crypto hacks in the first half of 2025 alone, already exceeding the total amount for all of 2024. What's particularly alarming is the speed at which these illicit funds are being moved through mixers, bridges, and centralized exchanges. Researchers have mapped the time elapsed between the initial breach and the final laundering endpoint, revealing that the entire process now occurs within minutes.
In nearly 23% of the analyzed cases, the laundering was completed before the breach even became public knowledge. In many other instances, the stolen funds were already in motion by the time victims realized what had happened. This rapid movement of funds leaves Anti-Money Laundering (AML) systems and Virtual Asset Service Providers (VASPs) struggling to keep pace with the increasingly proficient hackers. In the fastest recorded incident, funds were moved a mere four seconds after the exploit, with the complete laundering process finalized in under three minutes. Overall, the report indicates that 31.1% of laundering activities are completed within 24 hours, while public disclosure of hacks takes an average of 37 hours. Attackers typically move funds within 15 hours after a breach, giving them a 20-hour head start before detection. Consequently, only a meager 4.2% of stolen funds were recovered in the first half of 2025.
The report highlights a disturbing pattern where, in almost seven out of ten incidents (68.1%), the funds were already being moved before any public announcement of the hack. Furthermore, in nearly one in four cases (22.7%), the laundering process was entirely completed before any internal or public disclosure. This rapid laundering underscores the urgent need for CEXs to bolster their security measures and implement real-time monitoring systems.
Several recent incidents underscore the severity of these vulnerabilities. The Bybit breach and other CEX breaches led to $2.17 billion in losses in mid-2025. The Bybit incident alone accounted for 70% of these losses, with attackers stealing $1.5 billion worth of Ethereum tokens through social engineering and compromised signature machines. The North Korea-linked Lazarus Group exploited insider access and phishing tactics to execute the theft, laundering funds via cross-chain bridges and privacy tools. Similarly, Indian exchange CoinDCX reported a $44 million breach in July 2025, also linked to the Lazarus Group. Attackers exploited misconfigured credentials and liquidity provision accounts to siphon assets without triggering alarms, mirroring methods used in the Bybit incident.
These incidents have prompted calls for stronger security frameworks, including multi-layered access controls and real-time monitoring. Experts emphasize the systemic weaknesses in CEX security, urging better real-time monitoring and preemptive defense systems.
