North Korean Hackers Set Record with $2 Billion Crypto Heist in 2025

In 2025, North Korean cybercriminals achieved a record-breaking $2.02 billion in cryptocurrency theft, marking the most successful year for state-sponsored digital theft despite fewer confirmed attacks. This represents a 51% increase from the previous year, contributing to a cumulative total of $6.75 billion. The Democratic People’s Republic of Korea (DPRK) has become the leading threat actor in cryptocurrency crime.

According to blockchain analysis firm Chainalysis, these thefts accounted for 76% of all service compromises in 2025. The increase of $681 million over the previous year demonstrates a strategic shift towards targeting high-value assets rather than numerous smaller ones.

North Korean threat actors have refined their approach using two main methods: embedding IT workers within cryptocurrency services and advanced impersonation schemes. The funds from the largest attacks are significantly larger than typical incidents, surpassing even the 2021 bull market peak.

The DPRK's operations have evolved to include impersonating recruiters for web3 and AI firms, conducting fake hiring processes to obtain credentials, source code, and VPN access. At the executive level, they use fake strategic investor outreach to extract sensitive information and access high-value infrastructure.

The money laundering methods of these operations involve a structured 45-day cycle. Initially, stolen funds move through DeFi protocols and mixing services. The first five days witness a 370% increase in DeFi activity, followed by integration through exchanges with limited KYC requirements and eventual conversion to fiat currency.

DPRK-linked actors show distinct operational patterns, favoring Chinese-language money movement and guarantee services significantly more than other threat actors. They also demonstrate higher utilization of bridge and mixing services.

North Korean hackers avoid lending protocols, P2P exchanges, and decentralized exchanges, aligning more with professional Asia-Pacific illicit networks. This approach is exemplified by the Bybit hack in February 2025, which accounted for $1.5 billion of the year's losses.

The DPRK's strategy of fewer but more impactful attacks is evident in the broader cryptocurrency crime landscape, with the top three hacks in 2025 comprising 69% of all stolen funds. This concentration of losses creates a significant threat environment.

Despite rising Total Value Locked, DeFi protocols showed resilience with reduced hack losses. However, personal wallet compromises increased, affecting 80,000 unique victims, though the total value stolen decreased to $713 million from 2024's $1.5 billion.

The cryptocurrency industry faces the challenge of detecting and preventing high-impact DPRK operations in 2026. While consistent laundering patterns offer detection opportunities, the DPRK's ability to execute fewer but more damaging attacks indicates growing sophistication. The industry's capacity to disrupt these operations will determine future theft levels.

Based on reporting by GBHackers.