In February alone, hackers drained around $1.5 billion from the exchange Bybit, accounting for nearly half of all funds stolen this year. This incident highlighted how one breach can now dominate the industry’s annual losses.

Behind much of the damage sits North Korea. Despite carrying out fewer confirmed attacks, hackers linked to the Democratic People ’s Republic of Korea stole at least $2.02 billion in 2025 — a 51% jump from the year before and the highest annual total ever recorded.

North Korean groups were responsible for about 76% of all major service compromises this year. Overall, estimates suggest the country has now stolen at least $6.75 billion in cryptocurrency over time.

Investigators say Pyongyang’s success increasingly relies on deception. Operatives infiltrate crypto firms by posing as IT workers, recruiters, or even investors, using fake job offers and business meetings to gain access. 

Evolving method

While eye-catching exchange hacks grab headlines, the pattern of theft is shifting. Attacks on individual users’ personal wallets have risen sharply in recent years, reflecting how everyday investors are increasingly being targeted alongside large firms.

At the same time, centralised crypto services continue to suffer devastating blows. Even with professional security teams, exchanges and custodians remain vulnerable when private keys are compromised. These incidents are rare, but when they happen the losses are enormous.

As a result, crypto crime is becoming more extreme. In 2025, the three biggest hacks alone made up 69% of all losses suffered by services. The gap between a “typical” theft and the largest attacks has never been wider.

This year marked a grim milestone. For the first time, the biggest single hack was more than 1,000 times larger than the median theft, surpassing even the peaks seen during the 2021 crypto boom.

Between July 2023 and June 2024, Sub-Saharan Africa received an estimated $125 billion worth of cryptocurrency on-chain transactions, according to blockchain analytics firm Chainalysis . While this represents just 2.7% of global transaction volume, countries like Nigeria, Kenya, and South Africa consistently rank in the top 20 worldwide for grassroots adoption.

The demand is fueled by practical use cases: remittances from abroad, protection against local currency depreciation, cross-border trade, and access to stablecoins as a hedge against inflation. In Nigeria, for example, stablecoins accounted for nearly 40% of crypto transaction volume in 2024, far above the global average.

Why crypto is catching on

Sub-Saharan Africa faces some of the highest remittance costs in the world, averaging over 8% per transaction for money sent home from abroad. Crypto payments can slash these fees to under 2%, making them attractive to both senders and receivers.

Local inflation and currency volatility also play a role. In countries like Ghana and Nigeria, steep devaluations have eroded purchasing power, prompting individuals and small businesses to seek stablecoins pegged to the U.S. dollar. For many, crypto wallets accessed through mobile phones serve as a first form of “bank account.”

Despite its popularity, cryptocurrency operates in a fragmented regulatory environment. An I MF survey found that only 25% of Sub-Saharan African countries have comprehensive legislation for crypto assets, while others enforce partial restrictions or outright bans.

Nigeria’s case is illustrative. The central bank once prohibited banks from servicing crypto-related accounts, but in 2023 began to roll back restrictions in favour of regulated exchanges and digital asset licensing.

While crypto brings financial inclusion opportunities, it also comes with volatility risks, fraud concerns, and dependence on foreign-controlled platforms. Experts warn that without robust consumer protection frameworks, vulnerable users could face significant losses.

Internet access and digital literacy remain barriers. According to the GSMA Mobile Economy Report , about 40% of Sub-Saharan Africans are still offline, limiting who can participate in the crypto economy.

From small traders in Lagos to freelancers in Nairobi, millions are using digital assets to solve everyday financial problems.

MAS has ruled out grace periods or transitional arrangements as it states that failure to comply will be treated as a criminal offence, punishable by fines of up to SGD 250,000 (USD 200,000) and up to three years' imprisonment under Section 137 of the Act.

The measure closes a regulatory loophole that allowed firms to operate globally from Singapore without being licensed locally. According to MAS , the move aims to prevent regulatory arbitrage and protect Singapore’s reputation as a tightly regulated financial hub.

Experts say the law now applies regardless of company size, structure, or customer base, affecting crypto exchanges, wallet providers, DeFi projects, token issuers, and even marketing firms promoting token services abroad. Simply being incorporated in Singapore is sufficient to trigger licensing obligations, even if user activity is hosted elsewhere.

“This is not about scale; if you're offering digital token services from Singapore to any foreign market, you must comply or shut down,” said fintech lawyer Mike Chiam.

MAS has approved 33 digital payment token licences, including for major players like Coinbase and OKX. But it has also made clear that future licences will be granted only in exceptional cases, citing persistent anti-money laundering (AML) and counter-terrorism financing (CFT) concerns.

Smaller players, which lack the legal and compliance infrastructure of larger firms, face high compliance costs or total shutdown.

MAS's uncompromising stance comes as part of a broader global effort to regulate crypto markets, aligning with standards from the Financial Action Task Force (FATF).

The authority has said it will not allow its jurisdiction to be used as a regulatory shelter for crypto businesses operating without oversight elsewhere.

While some in the industry argue that the abrupt deadline offers little time for restructuring, MAS insists that the law has been communicated since April 2022, when the FSM Act was passed.

A June 6, 2025, statement reiterated that the time for transition has ended.