North Korean Hackers and the Record $2.02 Billion in Cryptocurrency Theft
In 2025, North Korean hackers shattered their own previous records, amassing an astonishing $2.02 billion through global cryptocurrency thefts. This amount represents about 60% of the total $3.4 billion stolen worldwide this year, as detailed in a report by blockchain data provider Chainalysis released on December 18, 2025.
A Surging Trend in Cryptocurrency Thefts
The significant leap from 2024’s thefts, which totaled $1.3 billion, underscores an alarming trend: North Korean hackers are becoming increasingly adept at exploiting vulnerabilities in the cryptocurrency sector. The $720 million stolen in 2025 already exceeds last year’s figures by 51%, raising North Korea’s collective crypto thefts to an estimated $6.75 billion over recent years. This staggering figure highlights not just the financial implications but also the growing sophistication of cybercriminal operations linked to the rogue state.
The Record-Breaking Bybit Heist
A pivotal moment in this year’s wave of cybercrime occurred in February when North Korean hackers executed a heist of epic proportions, stealing around $1.5 billion, primarily in Ethereum, from Dubai-based cryptocurrency exchange Bybit. This breach set a new world record as the largest single theft in cryptocurrency history. Such high-profile operations demonstrate not only the ambition of North Korean hackers but also their strategic targeting of fluid and expansive markets like cryptocurrency.
Operational Tactics: Fewer Attacks with Greater Returns
Interestingly, despite the impressive haul, North Korean hackers actually carried out fewer attacks in 2025 compared to previous years. Their increased efficiency stems from leveraging sophisticated tactics, such as infiltrating cryptocurrency service providers or using impersonation to deceive crypto executives. This dual approach allows them to gather intelligence and exploit weaknesses without the need for an overwhelming number of attacks, thereby maximizing their gains from each operation.
Laundering the Proceeds
Once they’ve successfully stolen cryptocurrencies, North Korean hackers face the challenge of concealing their ill-gotten gains. Chainalysis reports that these criminals engage laundering methods predominantly through services that communicate in Chinese, making it easier to navigate the complex networks involved. They utilize various bridge services and mixing protocols, typically taking about 45 days to thoroughly launder their stolen crypto. This meticulous approach not only helps to obscure the source of funds but also allows for the reintegration of the money into global financial systems.
Continued Success in the Face of Law Enforcement
The phenomenon of North Korean cybercrime raises critical security questions, especially since the isolationist state operates under strict international scrutiny. However, experts like Matt Pearl from the Center for Strategic and International Studies argue that the unique status of North Korea as a "rogue state" complicates efforts to mitigate these cyber threats. Their relative seclusion provides a degree of sanctuary for hackers, allowing them to operate with a level of impunity that creates a significant challenge for global law enforcement.
Notable Incidents Beyond Bybit
Beyond the Bybit breach, North Korean hackers have been implicated in a series of thefts that highlight a broad and sophisticated criminal enterprise. Reports identify multiple incidents throughout 2025, including the theft of $14 million from nine accounts on the WOO X exchange in July and $1.2 million from crowdfunding platform Seedify in September. These various thefts reinforce the idea that North Korean cybercriminals are not just targeting a single platform but are instead diversifying their efforts against multiple entities.
Funding Nuclear Ambitions
A chilling aspect of this narrative is the use of the proceeds from such cybercrimes. Estimates indicate that approximately 40% of the funds raised through cryptocurrency thefts are diverted to support North Korea’s nuclear arms and weapons development programs. This cycle of theft and militarization integrates economic crime into global security issues, as the ramifications of these acts extend far beyond financial losses, impacting geopolitical stability.
The nexus between high-stakes cybercrime and national defense agendas raises pressing concerns about how nations must navigate the worlds of cybersecurity and international relations moving forward.
