Significant Portion of Stolen Cryptocurrency Remains Idle, Research Reveals

Approximately 46% of cryptocurrency that has been hacked remains unspent, indicating potential opportunities for recovery following incidents, according to analysts at Global Ledger.

Key Takeaways

Stolen Funds Remain Idle: Nearly 46% of hacked cryptocurrency is still unspent, offering prospects for recovery.
Rapid Movement by Hackers: On average, it takes hackers around 46.74 hours after a breach to transfer stolen funds to laundering recipients.
Slow Disclosures: The average delay between a hack occurring and it being publicly reported is about 43.83 hours.
NFT Hacking Trends: Attacks on NFT projects show the slowest laundering movements, with transfers taking an average of 563.63 hours.
Cross-Chain Laundering: More than 42% of stolen funds are moved across blockchain networks, complicating tracing efforts.
Dominance of Tornado Cash: This protocol is the leading laundering method, utilized in over 50% of tracked cases despite regulatory pressures.

Nearly half of stolen crypto remains unspent, data shows

In a revealing new report from the blockchain intelligence firm Global Ledger, findings indicate that while hackers are quick to act, systems designed to track stolen assets are still catching up. The report highlights timelines from breaches to fund movements and shows that a significant amount of stolen crypto remains untouched, raising questions about the efficacy of current tracking methods.

The Challenges of Tracking Stolen Crypto

Hackers are known for their speed, and a recent report from blockchain intelligence firm Global Ledger, which analyzes numerous on-chain incidents, shows that stolen funds often end up in laundering destinations even before the incidents are publicly disclosed.

On average, it takes about 43.83 hours from the time of the initial on-chain breach until victims or third-party investigators report the incident to the public. Hackers typically transfer stolen funds to identifiable entities like exchanges, crypto mixers, or DeFi protocols within about 46.74 hours.

However, the longest delay reported is the time between the public announcement and the attackers engaging with a laundering service, which averages 78.55 hours. This suggests that funds may be in transit before a hack is widely known.

Global Ledger examined four important timelines across various incidents: the duration from breach to fund movement, breach to reporting, breach to initial entity contact, and the time from public disclosure to laundering activity. Each timeframe reveals distinct insights.

NFT Attacks and Fund Movement

Attacks targeting NFT projects tend to show the slowest movements of stolen funds. On average, it takes nearly 24 days (563.63 hours) for funds from NFT-related exploits to transition through the laundering chain, which is significantly slower than the average time of about 425 hours seen in centralized exchange-related hacks.

Lex Fisun, co-founder and CEO of Global Ledger, mentioned in an exclusive comment to crypto.news that the sluggish pace for NFTs is not solely due to their low liquidity; these tokens are unique and therefore more challenging to offload discreetly. “There’s no clear playbook for laundering; it often involves methods like wash trading or social engineering,” he noted.

Variations in Laundering Timelines

The research also shows that laundering paths are greatly influenced by the type of exploited project. DeFi platforms generally see funds move through laundering channels within about 230 hours, while payment platforms have the fastest turnaround of approximately 0.6 hours. Gaming and metaverse hacks also exhibit quick movements, typically under 25 hours.

Interestingly, despite the rapid transitions of some funds, a considerable portion of hacked assets remains unspent. Data from the report indicates that nearly 46% of stolen funds haven’t been utilized, hinting at the potential for ongoing tracking and recovery efforts long after a hacking incident has occurred.

Cross-Chain Movements and Laundering Techniques

While many funds sit idle, a growing segment is being shifted through hard-to-track cross-chain routes. The report reveals that approximately 42.23% of stolen funds have crossed different blockchain networks, effectively evading monitoring systems specific to individual chains.

Fisun explained that cross-chain bridges have emerged as significant tools for money laundering, enabling perpetrators to bypass chain-specific scrutiny. Although consistent abuse may attract anti-money laundering (AML) attention, the Tornado Cash case illustrates a key point: “sanctions change strategies, not demand.”

Tornado Cash remains the most prevalent laundering protocol, utilized in over half of the cases monitored by Global Ledger. This service continues to function even after U.S. Treasury sanctions were placed in 2022 and further intensified post a U.S. court ruling that overturned those sanctions in 2024 on constitutional grounds.

The Rise of Alternative Privacy Tools

Other privacy tools are also increasingly being adopted. For instance, Railgun has appeared in 20% of laundering cases, while Wasabi Wallet has been involved in 10%. Protocols such as Chainflip, CoinJoin, and CryptoMixer were each associated with less than 7% of laundering activities, according to the data.

Fisun added that slower fund movements through centralized exchanges, currently averaging over 425 hours, do not necessarily indicate improved compliance. Instead, these delays could be intentional, as hackers divide assets, switch chains, and utilize privacy protocols to manage stolen funds through exchanges that aim to stall suspicious transactions.

Unfortunately, only a small fraction of stolen funds are frozen by law enforcement or compliance teams, with the report suggesting that timely responses remain uncommon, despite advancements in analytics and monitoring technologies.

While the data highlight ongoing obstacles, they also emphasize opportunities for defenders. The time gaps—sometimes spanning several days—illustrate that there remains room for action before stolen funds vanish entirely.