How do most people and companies lose crypto, through scams or through hacks?
Most reported losses come from scams that trick people, not from breaking code. Of the $11.37 billion in crypto-related losses reported to the FBI for 2025, investment fraud alone made up $7.28 billion.1 Code exploits and big hacks are real too, and many of them also start by tricking a person.2,3
Two ways to lose crypto
Broadly, crypto is lost in two ways. Someone is tricked into sending it, or into giving away a key or a permission. Or an attacker breaks something technical, such as the code of a smart contract.4,5
The US cybersecurity agency, CISA, calls the first kind social engineering: an attacker uses human contact to get information or access.4 Phishing is one form of social engineering.4 The FBI has warned about the second kind: criminals exploiting weaknesses in the smart contracts that run decentralised finance (DeFi) platforms.5
What the FBI's figures show
The FBI's Internet Crime Complaint Center (IC3) collects crime reports from the public. For 2025, it received 181,565 complaints that mentioned cryptocurrency, with $11.366 billion in reported losses.1
The FBI says crypto investment fraud caused the most losses to Americans in 2025.1 The report's summary gives $7.2 billion for it, and its table of crypto-related losses by type of crime gives $7.28 billion. The table shows how lopsided the picture is.1
| Type of crime (2025, crypto-related) | Reported losses |
|---|---|
| Investment | $7.28 billion1 |
| Tech or customer support | $1.23 billion1 |
| Phishing or spoofing | $111 million1 |
| Malware | $15.7 million1 |
By our calculation, investment fraud was about 64% of all crypto-related losses reported for 2025. Malware, software built to attack a device, was a tiny share.1
The FBI adds a caution: its statistics are an assessment at one point in time, and they may change.1
Share = the part ÷ the total × 100. For example, $7.28 billion ÷ $11.37 billion × 100 ≈ 64%. Some quiz questions use made-up tables with this method.1
Thefts and hacks
Chainalysis, a blockchain analytics firm, tracks stolen funds on the blockchain. It counted over $3.4 billion stolen from January to early December 2025. The hack of the exchange Bybit, in February 2025, made up $1.5 billion of that.3 The FBI said North Korea was responsible for the Bybit theft.6 Module 9 tells that story.
The same firm saw at least $14 billion go to crypto scams on-chain in 2025. Expecting to find more scam wallets, it estimated the full figure for scams and fraud at $17 billion.7 Both totals are the firm's own estimates, not official counts.3,7 It also counted 158,000 thefts from personal wallets in 2025, affecting at least 80,000 victims.3
Even big hacks often start with a person
In April 2022, CISA, the FBI and the US Treasury warned about North Korean state hackers targeting crypto firms.2 They sent large numbers of spearphishing messages, phishing aimed at chosen people, to staff at crypto companies.2 The messages often posed as job offers, to get people to download apps laced with malware. The hackers then stole private keys or used other gaps.2
The agencies called the malware "TraderTraitor".2 The FBI used the same name for the North Korean activity behind the Bybit theft.6
Chainalysis says centralised services lost more and more in 2025 to attacks on private keys and signing processes. It says many attackers trick real signers into approving harmful transactions.3
- 2025 IC3 Annual Report (Internet Crime Report). FBI Internet Crime Complaint Center, 2026, covering 2025.
- TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (Advisory AA22-108A). US Cybersecurity and Infrastructure Security Agency (CISA), with the FBI and the US Treasury (marked as archived content), 18 April 2022.
- 2025 Crypto Theft Reaches $3.4 Billion (2026 Crypto Crime Report). Chainalysis, a blockchain analytics firm, 18 December 2025.
- Avoiding Social Engineering and Phishing Attacks. US Cybersecurity and Infrastructure Security Agency (CISA), blog (marked as archived content), 1 February 2021.
- Cyber Criminals Increasingly Exploit Vulnerabilities in Decentralized Finance Platforms to Obtain Cryptocurrency, Causing Investors to Lose Money (Alert I-082922-PSA). FBI Internet Crime Complaint Center, 29 August 2022.
- North Korea Responsible for $1.5 Billion Bybit Hack (Alert I-022625-PSA). FBI Internet Crime Complaint Center, 26 February 2025.
- Record $17 Billion Estimated Stolen in Crypto Scams and Fraud in 2025 as Impersonation Tactics and AI Enablement Surge (2026 Crypto Crime Report). Chainalysis, a blockchain analytics firm, 13 January 2026.
General education built from the publicly available sources listed above. Not financial, legal, tax or investment advice. Naming a company, project or regulator is not an endorsement either way. Last checked 2026-10-22. Terms and disclaimer.