Where Stolen Crypto Really Goes: Inside the 45-Day Laundering Machine

Crypto theft has become a persistent industry, with over $16 billion stolen in the past six years. In 2025 alone, Chainalysis logged $3.4 billion in stolen funds, nearly half from the February 2025 Bybit hack ($1.5 billion). The first half of 2026 added roughly $1.1 billion across 212 incidents, with the KelpDAO exploit ($293 million) being the largest single hit. North Korean Lazarus-linked groups were behind about 55% of first-half losses.

Once stolen, funds follow a distinctive 45-day laundering cycle in three waves. During days 0-5, tokens are swapped through decentralized finance (DeFi) protocols and pushed into mixing services, breaking the on-chain link. Days 6-10 involve hopping chains via cross-chain bridges and flowing through exchanges with limited KYC checks. From day 20 to 45, the coins are cashed out in small tranches (under $500,000) through no-KYC venues, instant exchangers, and Chinese-language OTC networks like the sanctioned Huione marketplace.

By the end of the cycle, money has crossed enough chains, mixers, and jurisdictions that recovery is rare. Less than 5% of Bybit’s stolen funds were ever recovered. The 2026 Coldcard hardware-wallet exploit showed the playbook adapting to Bitcoin: after draining $116 million from weak-seed wallets, the attacker consolidated coins while onlookers watched every hop. Bitcoin’s transparency and irreversibility became double-edged swords.

Centralized stablecoin freezes (e.g., Tether, Circle) are a reliable recovery lever, but sophisticated attackers swap stolen stablecoins into ether or Bitcoin within minutes to escape the freeze radius. The asymmetry is revealing: censorship-resistant assets are easiest to launder, while freezable ones are easiest to recover. Every laundering playbook races to convert catchable into uncatchable before anyone with a pause button notices.

Prevention remains nearly the whole game. Exchanges and analytics firms can freeze funds on compliant platforms, but launderers front-load DeFi and mixers. Sanctions raise costs but push flows to successors. The 45-day clock means by the time cross-border legal processes begin, coins have usually finished their journey. For users and platforms, the lesson is clear: once stolen, the overwhelming majority of funds never return. The blockchain records everything but returns nothing.

Source: https://news.bitcoin.com/learning-insights/where-stolen-crypto-goes-laundering-explained/