North Korean State-Sponsored Cryptocurrency Theft Surpasses $2 Billion

North Korean hackers have stolen over $2 billion in cryptocurrency assets in 2025, marking the largest annual total ever attributed to the regime’s cyber operations. The majority of this record-breaking sum was taken in a single attack on the cryptocurrency exchange Bybit in February, where $1.46 billion was stolen. In addition to this major breach, blockchain analytics firm Elliptic has linked North Korean actors to more than thirty other cryptocurrency heists throughout the year. These attacks have targeted both exchanges and high-net-worth individuals, reflecting a shift in tactics by North Korean threat groups. The hackers have increasingly focused on wealthy crypto holders and employees of companies with significant digital asset holdings, exploiting the fact that individuals often have weaker security defenses than organizations. Social engineering has become a primary method, with attackers impersonating recruiters or investors to gain the trust of their targets. One common technique involves setting up fake video calls, during which the victim is tricked into running malicious command-line code, resulting in malware installation and subsequent theft of funds. The hackers have also been observed building elaborate fake profiles and leveraging compromised social media accounts to approach their targets. Notable additional breaches attributed to North Korean groups in 2025 include attacks on LND.fi, WOO X, Seedify, and the Taiwanese exchange BitoPro, with the latter resulting in an $11 million loss. The total amount stolen by North Korean hackers in 2025 is nearly triple the amount reported in 2024 and far exceeds the previous record of $1.35 billion set in 2022. These cyber-enabled thefts are believed to directly fund North Korea’s nuclear weapons program, according to the United Nations and various government agencies. Experts caution that the actual amount stolen may be even higher, as many incidents go unreported or lack sufficient evidence for definitive attribution. Discrepancies in reporting between blockchain analytics firms, such as Elliptic and Chainalysis, further complicate the assessment of the true scale of losses. The trend of targeting individuals, especially those with professional connections to major crypto firms, has made detection and prevention more challenging for standard cybersecurity tools. The sophistication and persistence of North Korean cyber operations underscore the regime’s growing reliance on cryptocurrency theft as a means of circumventing international sanctions and funding state objectives. The ongoing rise in cryptocurrency prices, particularly Bitcoin reaching all-time highs, has made the sector an even more attractive target for these state-sponsored actors. Security experts recommend heightened vigilance and advanced security measures for both organizations and individuals involved in the cryptocurrency ecosystem. The evolving tactics and increasing scale of North Korean cyber thefts highlight the urgent need for improved threat intelligence sharing and coordinated international response.