How Did North Korea Steal $2 Billion in Crypto This Year?

North Korean hackers have shattered records in 2025 by stealing more than $2 billion in cryptocurrencies, with three months left in the year. Elliptic, a blockchain analytics firm, reports the unprecedented total is nearly triple last year’s figure, raising fresh alarms across the digital asset industry.

This wave of theft accounts for approximately 13 percent of North Korea’s estimated GDP, underscoring the scale and impact of state-linked cybercrime.

The regime's cumulative crypto theft since 2017 now tops $6 billion, fueling international concern and law enforcement efforts to stem further losses.

How Did North Korea Pull Off the Record Heist?

The 2025 spree of thefts relied on a blend of advanced technical exploits and increasingly sophisticated social engineering attacks. North Korea’s state-sponsored Lazarus Group and related hacking teams combined malware deployment with deceptive schemes, aiming to breach high-value targets both institutionally and individually.

Where earlier hacks leaned heavily on smart contract and wallet vulnerabilities, recent incidents have blurred technological and psychological boundaries.

Attackers used tailored phishing emails, fraudulent job offers, and compromised social media accounts to sidestep security systems, reaching assets beyond traditional cyber-defense perimeters.

Did you know?
North Korea's malicious cyber activity, often attributed to groups like Lazarus Group (also known as TraderTraitor or HIDDEN COBRA), is government-sponsored and sanctioned by the regime.

Why Was Bybit a Primary Target?

The single most significant theft of 2025 was the February Bybit hack, where criminals stole $1.46 billion by exploiting the exchange’s wallet management system.

The FBI attributed the attack to North Korean hackers, who compromised supplier software to reroute 401,000 Ethereum tokens into coordinated wallets.

The Bybit breach exposed vulnerabilities in third-party dependencies and software integrations, highlighting the interconnected risks present in major digital asset platforms.

Beyond Bybit, North Korea-linked attacks struck platforms such as LND.fi, WOO X, and Seedify, collectively contributing millions to the year’s losses.

What Tactics Shifted in 2025?

Elliptic’s analysis reveals North Korean hackers have fundamentally shifted away from pure technical exploits toward targeting humans. High-net-worth individuals and company executives often lack institutional-grade security, leaving them increasingly vulnerable to phishing campaigns, social engineering attempts, and targeted deception operations.

In practice, attackers sent convincingly crafted emails, impersonated business contacts, and offered fake employment to extract private keys and credentials.

The threat landscape has evolved to the point where human error and trust now surpass software vulnerabilities as the primary entry points for significant breaches.

ALSO READ | Nobel Prize in Physics Awarded for Macroscopic Quantum Tunneling Discovery

How Do Stolen Funds Get Laundered?

North Korean hackers have developed intricate laundering techniques to evade detection once assets are stolen. Their methods include cryptocurrency mixing services, multiple cross-chain transfers across obscure or under-regulated blockchains, and the use of custom tokens designed to muddy asset trails.

Despite these advanced tactics, blockchain forensic analysts continue to track and sometimes recover stolen funds.

Bybit’s bounty initiative has resulted in $40 million in identified assets and more than $4 million in tipster rewards, demonstrating the complex cat-and-mouse game now defining global cryptocurrency security.

What are the Implications for Crypto Security?

The scale of the North Korean threat has triggered rapid innovation and policy shifts among exchanges and wallet providers. There is a growing awareness that security must address both technological weaknesses and the human element, causing many firms to revisit their user education programs and invest in AI-powered fraud detection.

Governments and regulators are increasingly involved, collaborating on international intelligence sharing and enforcement.

As North Korean hackers adapt, the cryptocurrency sector faces new challenges in striking a balance between openness and robust safeguards to protect users and platforms worldwide.

With the year not yet over, the global crypto community must remain vigilant and proactive to prevent further catastrophic breaches.

The lessons from 2025’s headline heist serve as a sobering reminder that cybersecurity in the digital finance era requires constant adaptation and resilience.