Illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase, according to the Chainalysis 2026 Crypto Crime Report. That number lands against a stranger backdrop: roughly 30 million Bitcoin addresses hold any BTC balance, while only 700,000 to 1,000,000 addresses are active on any given day. The crypto wallet ecosystem looks enormous on blockchain explorers and much smaller once analysts strip away the duplicates.
The data below frames that gap directly: how many on-chain addresses exist, how many translate to real holders, where wallet activity actually concentrates, and why the security losses keep growing even as hardware shipments hit record highs.
Key Takeaways
- Illicit cryptocurrency addresses received at least $154 billion in 2025, up 162% year-over-year per Chainalysis.
- Crypto theft reached $3.4 billion in 2025, with the February 2025 Bybit exchange hack alone accounting for $1.5 billion.
- Active smart accounts on EVM chains reached approximately 62 million wallets by April 2026, with Coinbase Smart Wallet and Safe leading deployments.
- The dapp industry averaged 24.3 million daily Unique Active Wallets in Q2 2025, a 2.5% decline quarter-over-quarter, per DappRadar.
- Cross-chain bridges facilitated over $1.3 trillion in annual transfers in 2025, contributing to 54% of all DeFi activity, according to DefiLlama.
- Ledger has sold over 7 million hardware wallets globally, with sales growth in 2025 approximately 31% higher than in 2024.
- Blockaid flagged over 65.4 million address-poisoning transactions since January 2025, averaging more than 160,000 per day.
Editor’s Choice
- Bitcoin: Approximately 30 million addresses hold any BTC balance, with 700,000 to 1,000,000 active sending or receiving addresses per day.
- Solana: Over 2 million daily active addresses, peaking at 2.2 million when transaction volume tops 100 million per day.
- Total UserOperations on Ethereum and Layer 2s reached approximately 2.4 billion by April 2026.
- Cross-chain bridging volume reached over $23 billion in a single month in 2025, with daily volumes around $884 million.
- Personal wallet compromises surged to at least 158,000 incidents affecting 80,000 unique victims in 2025.
- Mobile-first hot wallet usage shows 72% preference among users in 2025, while browser-extension wallets represent roughly 12%.
- Hardware wallet shipments worldwide reached approximately 5.8 million units by 2024.
Recent Developments
- April 2026: Total UserOperations on Ethereum and L2s reached approximately 2.4 billion, with active smart accounts on EVM chains at 62 million wallets, per Dune Analytics.
- February 2026: Chainalysis published its 2026 Crypto Crime Report, finding illicit addresses received at least $154 billion in 2025, and crypto theft hit $3.4 billion.
- January 2026: Address-poisoning attempts surged from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x increase, per Blockaid data published by Chainalysis.
- December 2025: A single address-poisoning attack resulted in $50 million in USDT losses when a victim copied a spoofed address just 26 minutes after a test transaction.
- March 2025: Bybit CEO Ben Zhou disclosed that hackers had converted 86.29% of the stolen ETH to BTC, with funds laundered through multiple intermediary wallets, decentralized exchanges, and cross-chain bridges.
- February 21, 2025: The FBI confirmed North Korea’s TraderTraitor actors were responsible for the theft of approximately $1.5 billion in virtual assets from Bybit.
On-Chain Address Counts Across Major Chains
Wallet writeups usually open with the address count on each chain’s block explorer. These counts are large, public, updated in real time, and routinely misread.
- Bitcoin: Approximately 30 million addresses hold any BTC balance, per BitInfoCharts.
- Bitcoin: Between 700,000 and 1,000,000 active addresses per day.
- Ethereum: Total unique address count tracked by Etherscan, with daily increase plotted on the same dashboard.
- Solana: Over 2 million daily active addresses, with peaks at 2.2 million during high-volume days, per Solscan analytics.
| Chain | Address Metric | Data Point | Source |
| Bitcoin | Holding any BTC balance | ~30 million | BitInfoCharts |
| Bitcoin | Daily active (sender or receiver) | 700K to 1M | BitInfoCharts |
| Solana | Daily active addresses | 2M+ (peak 2.2M) | Solscan |
| Ethereum | Total unique addresses | Tracked live | Etherscan Unique Addresses chart |
Source: BitInfoCharts, Solscan, Etherscan
The Bitcoin holder-address figure gets repeated as if it were a user count. It is not. The next section explains why.
Why Address Counts Are Not User Counts: The Inflation Gap
Block explorers count cryptographic addresses, not people. Glassnode’s documentation states directly that using address counts as a user proxy is fallacious because a single entity can own and control multiple Bitcoin addresses, and conversely, Bitcoin addresses can hold funds from more than one individual, for example, exchange addresses.
That double-counting flows in two directions:
- One user, many addresses: Glassnode applies industry-standard heuristics, proprietary clustering algorithms, and advanced data science methods to map multiple addresses to a single entity.
- One address, many users: Glassnode does not tackle the case in which a single address holds funds of multiple users, and therefore deliberately refers to its numbers as entities rather than users or individuals.
- Glassnode’s mechanisms keep entity-metric fluctuations to less than 1% on average.
- Etherscan presents the same caveat from the chain side: each address represents a separate cryptographic identifier rather than a unique user, since one user can control many addresses and one address can be a custodial pool for many users.
| Counting layer | What it measures | What it does not measure |
| Block explorer address count | Cryptographic identifiers ever recorded | People |
| Block explorer active address count | Identifiers active in a window | Repeat users versus new users |
| Glassnode entity-adjusted count | Clustered address groups (entities) | Pooled custodial holders |
| Wallet brand MAU | App-level monthly active accounts | On-chain confirmation of activity |
Source: Glassnode entity-adjusted metrics documentation, Etherscan
Key finding: According to Glassnode, address-based counts are fallacious as user proxies because a single entity can control many addresses while exchange addresses pool funds from many individuals. Glassnode’s clustering keeps entity-metric fluctuations to a low level on average, but the platform deliberately uses the term entities, not users.
Across CoinLaw’s coverage of wallet, exchange, and adoption statistics, the same gap shows up every time a headline cites a billion-address figure: the on-chain count is real, the user equivalence is not. Stats-first reporting exposes the gap that narrative coverage usually papers over.
The gap matters because the next set of figures, daily activity, gets read against the inflated baseline.
Daily Active Address Trends Across Networks
Active address counts are a closer proxy for usage than total addresses, but they still capture cryptographic identifiers, not people.
- Bitcoin daily active addresses run between 700,000 and 1,000,000, per BitInfoCharts.
- Solana shows over 2 million daily active addresses, per Solscan, with peak days around 2.2 million.
- Ethereum’s daily active count is tracked on Etherscan’s Daily Active Ethereum Address chart, which records unique addresses active as senders or receivers each day.
- Across all chains DappRadar tracks, the dapp industry averaged 24.3 million daily Unique Active Wallets in Q2 2025.
DappRadar’s methodology, like the explorers, notes that one person can have multiple wallets, so daily active wallet counts overstate the number of distinct people.
| Chain | Daily Active Addresses (2025) | Methodology Note |
| Bitcoin | 700K to 1M | Sender or receiver in a 24-hour window |
| Solana | 2M+ (peak 2.2M) | Active wallet with at least one signature |
| Industry-wide (DappRadar) | 24.3M (Q2 2025 average) | Wallets interacting with any tracked dapp |
Source: BitInfoCharts, Solscan, DappRadar State of the Dapp Industry quarterly report
The industry-wide dapp wallet count already factors in DeFi, gaming, social, and other categories. DeFi alone tells a different story.
DeFi Wallet Activity and Daily Unique Active Wallets
DeFi participation flowed downward through the period even as DeFi total value locked rose, signalling a smaller, more concentrated user base. For a broader sector context, see CoinLaw’s DeFi market statistics overview.
- DeFi recorded a 33% decrease in active wallets in Q2 2025, per DappRadar.
- The dapp industry as a whole averaged 24.3 million daily Unique Active Wallets in Q2 2025, a 2.5% quarter-over-quarter decline.
- Active smart accounts on EVM chains reached approximately 62 million wallets by April 2026, with Coinbase Smart Wallet and Safe leading deployments.
- Over 40 million smart accounts have been deployed across Ethereum and Layer 2 networks, with nearly 20 million deployed in 2024 alone.
| DeFi metric | 2025 reading | Source |
| Q2 2025 industry dUAW | 24.3 million daily | DappRadar |
| Q2 2025 industry change | -2.5% QoQ | DappRadar |
| Q2 2025 DeFi wallet change | -33% | DappRadar |
| Smart accounts on EVM (April 2026) | ~62 million | Dune Analytics |
| Smart accounts deployed in 2024 | ~20 million | Dune Analytics |
Source: DappRadar State of the Dapp Industry quarterly report, Dune Analytics wallet infrastructure report
Position 5 from CoinLaw’s editorial coverage shows up here too: even when daily wallet counts dropped, total smart-account deployments and DeFi TVL kept climbing. Adoption metrics and price metrics keep telling different stories.
DeFi wallet activity is one piece of usage. Cross-chain transfers are the other.
Cross-Chain Bridge Volume and Multi-Chain Adoption
Bridges are now the dominant pipe for moving value between chains, and the volumes have grown to the point that they account for the majority of DeFi activity.
- Total cross-chain bridging volume reached over $23 billion in a single month in 2025, with daily volumes around $884 million and weekly volumes exceeding $5.2 billion, per DefiLlama.
- By January 2025, total value locked in bridges reached approximately $19.5 billion.
- Cross-chain bridges collectively facilitated over $1.3 trillion in annual transfers, contributing to 54% of all DeFi activity.
- DefiLlama tracks bridge volume rankings across protocols, including Symbiosis, THORChain, and Stargate.
By the numbers: According to DefiLlama, cross-chain bridges collectively facilitated over $1.3 trillion in annual transfers in 2025, contributing to 54% of all DeFi activity. Multi-chain wallets are now the default user posture rather than the exception, given the magnitude of bridge throughput.
A user who bridges value moves between wallets and apps. A user who custodies value increasingly buys hardware to do it.
Hardware Wallet Shipments and Sales Growth
Hardware wallet sales hit a record annual peak. Ledger and Trezor stay ahead of other vendors by shipment volume.
- Ledger has sold over 7 million hardware wallets globally, with more recent company communications indicating around 8 million devices sold as the product line expanded.
- Ledger holds the largest market share, with more than 3.5 million units sold globally during 2024 alone.
- Sales growth in 2025 was approximately 31% higher than in 2024.
- Ledger revenue surpassed triple-digit millions in 2025, a company record.
- Hardware wallet shipments worldwide reached approximately 5.8 million units by 2024.
| Vendor | Cumulative units | 2024 units | 2025 growth |
| Ledger | 7M+ (recent communications cite ~8M) | 3.5M+ | ~31% YoY |
| Industry total | ~5.8 million units shipped by 2024 | n/a | n/a |
Source: Ledger company communications and corroborating coverage
For deeper hardware-wallet detail, see CoinLaw’s self-custody wallet data page. The shipment growth runs alongside something less reassuring.
Smart Account and ERC-4337 Adoption
Smart accounts use Ethereum’s ERC standard to give wallets programmable features such as gas sponsorship, batch transactions, and social recovery. Adoption broke past the mainstream-experiment scale recently.
- Active smart accounts on EVM chains reached approximately 62 million wallets by April 2026, with Coinbase Smart Wallet and Safe leading deployments.
- Over 40 million smart accounts have been deployed across Ethereum and Layer 2 networks, with nearly 20 million deployed in 2024 alone.
- Total UserOperations on Ethereum and Layer 2s reached approximately 2.4 billion by April 2026.
- The standard has enabled over 100 million UserOperations, marking a tenfold increase from 2023.
- Paymaster sponsorship spending reached approximately $180 million in cumulative gas sponsored by dApps and infrastructure teams since launch.
- Base, Polygon, and Optimism lead ERC-4337 adoption.
Adoption is the easy story. Security losses are the harder one.
Wallet Security Losses by Attack Type
Stolen funds in the period were split across exchange hacks, personal wallet compromises, and scams. The headline figure is dominated by Bybit, but the long tail of personal-wallet losses tells the more useful story for self-custody users.
- Crypto theft reached $3.4 billion in 2025, per Chainalysis.
- Illicit actors stole approximately $2.87 billion across nearly 150 hacks in 2025; the Bybit breach drove $1.46 billion (51%) of that total.
- Phishing attacks targeting exchange users led to over $1.1 billion in wallet-related thefts in 2025.
- Individual wallet compromises surged to a minimum of 158,000 incidents affecting 80,000 unique victims in 2025, though total value stolen ($713 million) decreased from prior-year levels.
- An estimated $17 billion was stolen globally through cryptocurrency scams and fraud in 2025.
- The average scam payment grew 253% year-over-year to reach $2,764, with impersonation scams growing more than 1400% compared to the prior year.
For richer breakdowns of fraud categories, see CoinLaw’s cryptocurrency security data page. The exchange-side losses reach the news; the user-side losses keep growing quietly.
Address Poisoning Surge and Phishing Statistics
Address poisoning has become the most common on-chain attack pattern. Attackers send tiny transactions from addresses that share the start and end characters of a victim’s frequently-used address, hoping the victim copies the wrong destination from their transaction history.
- Blockaid flagged over 65.4 million address-poisoning transactions since January 2025, averaging more than 160,000 per day.
- Poisoning attempts surged from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x increase.
- A single address-poisoning attack in December 2025 resulted in $50 million in USDT losses when a victim copied a spoofed address just 26 minutes after a test transaction.
- Address poisoning works by sending tiny transactions from addresses that share the first and last characters of a victim’s frequently-used address, in the hope that the victim will copy the wrong address from their transaction history.
| Address-poisoning metric | Reading |
| Total transactions since Jan 2025 | 65.4 million+ (Blockaid) |
| Daily average | 160,000+ |
| November 2025 attempts | 628,000 |
| January 2026 attempts | 3.4 million (5.5x growth) |
| Single-attack peak loss | $50 million USDT (Dec 2025) |
| Time from test to drain (worst case) | 26 minutes |
Source: Chainalysis Crypto Crime Report, Blockaid telemetry
Why it matters: According to Chainalysis, address-poisoning transactions surged from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x increase. Self-custody users now face an attack surface that scales faster than wallet-vendor mitigations, with one late-period drain reaching tens of millions in USDT.
The attack pattern is mechanical, the volume is scaling, and the gap between hardware ownership and safe custody is widening.
The Security Gap: Ownership vs Safe Custody
Hardware wallet sales rose substantially year-over-year. Address-poisoning and personal wallet compromises rose much faster. The gap between people who own a self-custody device and people who custody safely is the most useful single chart for wallet-security planning.
- Ledger sales growth in 2025 was approximately 31% higher than in 2024, with over 3.5 million units sold in 2024 alone.
- Address-poisoning transactions surged 5.5x between November 2025 and January 2026.
- Personal wallet compromises hit at least 158,000 incidents affecting 80,000 unique victims in 2025, even as total dollars stolen at this layer fell to $713 million.
- Phishing attacks targeting exchange users led to over $1.1 billion in wallet-related thefts in 2025.
| Direction | 2025 movement | Source |
| Hardware wallet shipments | +31% YoY (Ledger) | Ledger company communications |
| Personal wallet incidents | 158,000 incidents (up) | Chainalysis |
| Address-poisoning transactions | 5.5x growth in 2 months | Blockaid via Chainalysis |
| Personal wallet dollars stolen | $713 million (down from 2024) | Chainalysis |
Source: Ledger company communications, Chainalysis Crypto Crime Report
Two things move at once in this dataset. Ownership of self-custody hardware grew by roughly a third in 2025, in line with the post-Bybit shift CoinLaw has tracked across coverage of every major exchange failure. Attack volume against those same self-custody users grew faster, particularly through address poisoning. The fix is less a hardware-purchase decision and more a behavioural one: verifying every paste, holding a recipient address in a contacts file, and reviewing transaction history rather than copying recently used destinations.
The platform mix users choose to run their wallets on shapes how often they are exposed to those attacks.
Mobile vs Browser Extension vs Desktop Usage Split
Wallet usage is now mobile-dominant. Browser extensions remain important for desktop-native DeFi flows, while desktop-only wallets have shrunk to a small share.
- Mobile-first hot wallet usage shows 72% preference among users in 2025.
- Browser-extension wallets represent roughly 12% of total crypto wallet usage in 2025.
- Over 78% of hot wallet users access via mobile apps in 2025.
- On mobile platforms, Android represents 61% of wallet installs, and iOS represents 39% in 2025.
- Cold wallets constituted around 22% of all crypto wallets in 2025.
- Desktop wallet usage dropped to just 9% of hot wallet usage in 2025.
For a head-to-head wallet view across mobile and browser surfaces, see CoinLaw’s MetaMask wallet data page.
Region matters too, because mobile-friendly wallets dominate exactly the markets where mobile is the only practical computing layer for most users.
Regional Wallet Adoption: Asia-Pacific Leads
Wallet activity is geographically concentrated. Asia-Pacific’s mobile-friendly crypto market also reports the heaviest wallet-count totals globally.
- Asia-Pacific leads globally with approximately 350 million wallet users in 2025.
- North America holds approximately 134 million wallets, making up about 16% of global users in 2025.
- Europe’s wallet user base expanded to approximately 140 million, with a 12% year-over-year increase in 2025.
| Region | Wallet users (2025) | Share / growth |
| Asia-Pacific | ~350 million | Largest single region |
| Europe | ~140 million | +12% YoY |
| North America | ~134 million | ~16% of global |
Source: SQ Magazine cryptocurrency wallet adoption research
For demographic details on who holds these wallets, CoinLaw’s crypto user demographics page maps age and income splits. Underneath the regional totals, the same address-versus-user gap from the on-chain data still applies.
Methodology Note: How Wallet Counts Are Measured
Wallet figures come from three structurally different counting layers. Using them interchangeably is the most common mistake in wallet write-ups.
- On-chain explorers (Bitcoin, Ethereum, Solana): count cryptographic addresses, not users. Etherscan flags this directly, noting that each address represents a separate cryptographic identifier rather than a unique user.
- Entity-adjusted analytics (Glassnode, Chainalysis): cluster addresses controlled by a single actor. Glassnode uses proprietary clustering algorithms and statistical methods on top of raw on-chain data, with mechanisms keeping fluctuations to less than 1% on average.
- Wallet brand metrics (MAU): count app-level monthly active accounts. They include people who have not transacted on chain in the measurement window.
- dApp aggregators (DappRadar): track unique active wallets across tracked dapps. DappRadar tracks unique active wallets, transaction counts, and volume across all major chains.
| Layer | What it counts | Best for |
| Block explorer total addresses | Identifiers ever recorded | Network-scale baseline |
| Block explorer active addresses | Identifiers active in window | Activity trend |
| Glassnode entity-adjusted | Clustered groups (entities) | Realistic holder estimate |
| Wallet brand MAU | App-level accounts | Wallet vendor reach |
| DappRadar dUAW | Wallets touching tracked dapps | Application-layer activity |
Source: Etherscan, Glassnode, DappRadar
Frequently Asked Questions (FAQs)
Wallet counts depend on what is being counted. Block explorers report large totals of cryptographic addresses across major chains, while Glassnode’s entity-adjusted methodology shows that real holder counts are far lower because one entity controls many addresses and exchange addresses pool many users.
Address inflation refers to the gap between the number of cryptographic addresses on a blockchain and the number of distinct users behind them. A single user can control many addresses, while a single exchange address can hold funds for many users. Glassnode addresses the first case but not the second, which is why the platform uses the term entities, not users.
Ledger has sold more than 7 million hardware wallets globally, with more recent company communications citing around 8 million devices as the product line has expanded. Ledger sold more than 3.5 million units during 2024 alone, and 2025 sales growth was approximately 31% higher than during the prior year. Ledger revenue surpassed triple-digit millions in 2025, a company record.
Crypto theft reached $3.4 billion in 2025, per Chainalysis. Wallet hacks took approximately $2.87 billion across nearly 150 incidents, with the February Bybit exchange hack driving $1.46 billion (51%) of that total. Phishing of exchange users added over $1.1 billion. Personal wallet compromises hit a minimum of 158,000 incidents affecting 80,000 unique victims.
Blockaid flagged over 65.4 million address-poisoning transactions since January 2025, averaging more than 160,000 per day. Attempts surged from 628,000 in November 2025 to 3.4 million in January 2026, a 5.5x increase. The mechanic is cheap to scale: attackers send tiny transactions from addresses sharing the leading and trailing characters of a victim’s frequently-used address, hoping the victim copies the wrong destination from transaction history.
Conclusion
The crypto wallet ecosystem in this year’s data is much larger and much smaller than the headline numbers suggest. Block explorers count cryptographic addresses in very large totals; Glassnode’s entity-adjusted view, the most rigorous available, deliberately stops short of calling those addresses users. Real holder counts run far below the explorer totals, because one user controls many addresses, and the exchange addresses pool many users into a single record.
Adoption keeps growing on every measurement layer that matters for usage. Active smart accounts on EVM chains reached approximately 62 million wallets by April 2026. Cross-chain bridges moved over $1.3 trillion in 2025 and now account for 54% of DeFi activity, per DefiLlama. Ledger and Trezor combined for record hardware shipments. Mobile-first usage settled at 72% preference, with Asia-Pacific holding approximately 350 million wallets.
The harder pattern is the security gap. Ledger reported sales growth of approximately 31% during 2025. Address-poisoning transactions surged 5.5x between November 2025 and January 2026. Personal wallet compromises hit a minimum of 158,000 incidents in 2025, and the Bybit hack alone drove $1.46 billion in losses. Ownership of a self-custody device is now common; safe custody behaviour is not. The Chainalysis macro figure that opened this report is the macro frame; the per-user incidents are where the cost actually lands.
CoinLaw will continue tracking these figures quarterly: address counts, entity-adjusted comparisons, hardware shipments, and security losses by attack type. The wallet metrics that matter for the next twelve months are the ones that survive the explorer-versus-entity gap, not the ones that rely on it.
