North Korea’s crypto crime wave hits unprecedented $2 billion in 2025 – and there’s still more time!

It’s an alarming trend: hackers tied to North Korea have already swiped over $2 billion in crypto assets this year, making it the biggest annual haul on record – and we still have three months left in 2025! This brings the total known value of crypto stolen by the regime to a mind-boggling $6 billion. And get this: the United Nations and various government agencies believe this ill-gotten cash is absolutely vital for funding North Korea’s nuclear weapons and missile development programs.

The actual figure could be even higher. Pinning these cyber thefts directly on North Korea isn’t always straightforward. Experts use a combination of blockchain analysis, observed money laundering patterns, and intelligence sources to make their best guesses. We know about many other thefts that bear the hallmarks of North Korean activity, but there just isn’t enough solid proof to definitively point the finger. Plus, countless other thefts likely go unreported and completely unnoticed.

A Record-Shattering Scale of Theft

This year’s losses are truly monumental. A huge chunk of that $2 billion comes from the massive $1.46 billion heist from the Bybit cryptocurrency exchange back in February. Other attacks publicly linked to North Korea in 2025 include those against LND.fi, WOO X, and Seedify, with experts connecting over thirty more hacks to the nation so far this year. The 2025 total absolutely dwarfs previous years, almost tripling last year’s sum, which really underscores how much North Korea depends on these digital robberies to keep its government afloat. To put it in perspective, the previous record year was 2022, when $1.35 billion in crypto assets were stolen from services like Ronin Network and Harmony Bridge.

Shifting Tactics: Humans Are Now the Weakest Link

It seems their game plan is changing too, with people becoming the primary target. While crypto exchanges have borne the brunt of the losses in 2025, we’re seeing an increasing number of high-net-worth individuals falling victim. As crypto prices climb, these individuals become more attractive targets, often lacking the sophisticated security measures that businesses employ. Some are even targeted because of their connections to companies holding significant amounts of crypto, which is the hackers’ ultimate prize.

The majority of 2025’s hacks have been carried out through social engineering – essentially, hackers tricking or manipulating individuals to gain access to their cryptocurrency. This marks a significant shift from earlier attacks that often exploited technical flaws in crypto infrastructure. It highlights a crucial point: the weakest link in cryptocurrency security is increasingly human, rather than technical systems.

A crypto-laundering arms race

As blockchain analysis tools get smarter, law enforcement and financial institutions are becoming more effective at identifying, tracking, and stopping these illegal flows of crypto. In response, North Korea’s methods for laundering stolen crypto assets have become incredibly complex and resourceful.

Their laundering strategies now include:

• Multiple rounds of mixing and transactions across different blockchains.
• Using obscure blockchains that are harder to track.
• Cutting costs by buying utility tokens of specific protocols.
• Exploiting “refund addresses” to divert assets to fresh wallets.
• Even creating and trading tokens issued directly by their own laundering networks.

These ongoing changes really highlight the back-and-forth struggle between investigators and these really skilled illegal operators.
Blockchain’s Unavoidable Transparency

Despite these challenges, blockchain’s fundamental transparency means that illicit activity doesn’t simply disappear. Every stolen asset leaves a digital trail that can be analyzed, tracked, and linked – providing unique opportunities for investigators to follow the money across the entire crypto ecosystem.

Protecting the future of crypto

The record-breaking $2 billion stolen this year powerfully illustrates both the massive scale of the threat and the critical importance of robust blockchain analytics. North Korea may be adapting its tactics, but with advanced forensic capabilities, the crypto industry and law enforcement are well-positioned to detect and trace these threats. By using the transparency inherent in blockchains to expose illicit activity, businesses and law enforcement can work together to ensure the crypto ecosystem remains a place of trust, safety, and innovation.