Bottom line: Data collected this year shows North Korea's 2025 crypto theft operations are the most aggressive ever recorded. With months still left in the year, analysts expect totals to rise further, highlighting a pattern of state-backed cybercrime that is reshaping how governments and financial institutions approach digital asset security.
Hackers linked to North Korea have stolen more than $2 billion in cryptocurrency this year, a record that already exceeds any previous annual haul, according to London blockchain analytics firm Elliptic. Analysts used blockchain tracing, laundering pattern recognition, and intelligence assessments and found that Pyongyang's cyber operations have become a key pillar of state financing, with much of the stolen digital currency believed to fund the country's weapons and missile programs.
Elliptic said the $2 billion figure includes only thefts analysts could attribute with high confidence to North Korean-linked groups. Some attacks show similar traits but lack definitive evidence, so the actual total may be higher. Since 2017, Elliptic estimates the regime has stolen at least $6 billion in digital assets. TechCrunch notes that the United Nations and multiple governments, including the United States, Japan, and South Korea, have reached similar conclusions.
Much of this year's total comes from the massive $1.46 billion breach at cryptocurrency exchange Bybit in February, one of the largest digital asset thefts ever recorded. Investigations by the FBI, Elliptic, and independent blockchain researchers traced the stolen funds through wallet addresses and transaction obfuscation tools matching known tactics of North Korea's Lazarus Group. More minor thefts have targeted platforms such as LND.fi, WOO X, and Seedify, bringing the publicly attributed incidents linked to North Korea this year to more than 30.
In 2022, North Korean thieves stole roughly $1.35 billion, mostly from attacks on decentralized finance platforms such as the Ronin Network and Harmony Bridge. Last year's total, about $660 million, aligned more closely with pre-2022 averages. The resurgence of large-scale thefts highlights analysts' view of Pyongyang's growing reliance on cybercrime as both an economic strategy and a sanctions workaround.
Elliptic's findings also highlight a shift in tactics. While earlier attacks often exploited vulnerabilities in smart contracts or decentralized exchange infrastructure, this year's incidents have relied heavily on social engineering. Hackers increasingly target high-net-worth individuals who control substantial cryptocurrency holdings, sometimes obtaining private keys or authentication materials through impersonation, phishing, or fake job recruitment schemes. With crypto prices rising in 2025, these individuals have become even more attractive targets, especially those linked to asset management or trading firms.
Experts say this transition shows that the weakest link in cryptocurrency security has shifted from software to human behavior. Security protocols on major platforms have improved, with more rigorous monitoring of on-chain transactions and bridge functions. Yet personal accounts often remain less secure than institutional holdings, making individual users and executives easier targets for attackers.
Even as detection and recovery tools become more sophisticated, North Korea's money-laundering efforts have evolved in parallel. According to Elliptic's follow-up report on the Bybit breach, hackers now employ increasingly complex methods to conceal stolen assets. These include multi-stage cross-chain transfers – shifting funds across multiple blockchains to obscure their path – and repeated mixing of digital tokens through services designed to break transaction trails. Analysts have also documented the use of obscure or low-traffic blockchains with limited analytics coverage, along with tactics such as rerouting assets via refund addresses and issuing custom laundering tokens to disguise flows between wallets.
Despite these countermeasures, blockchain analytics firms and law enforcement agencies continue to make progress in tracing illicit transactions. Advanced data tools can increasingly detect patterns characteristic of North Korean laundering, allowing authorities to intercept funds earlier in the process. However, because stolen assets are often moved almost immediately across jurisdictions and into privacy-focused networks, recovery remains limited and extremely time-sensitive.
North Korean hackers stole $2 billion in crypto, and the year's not over
