North Korea–linked hacking groups have stolen more cryptocurrency than any other actors in 2025, taking over $2 billion as their operations became fewer, more precise, and higher-impact, according to new research.
From January through early December, North Korean hackers reportedly siphoned about $2.02 billion in digital assets—a 51 percent increase compared to the previous year—according to a report by global blockchain analytics firm Chainalysis.
The annual overview of crypto crime by Chainalysis revealed that global cryptocurrency theft totaled approximately $3.4 billion in 2025, with North Korean operations responsible for nearly 60 percent of the total. This brings North Korea’s cumulative crypto theft to roughly $6.75 billion.
While the overall number of North Korea–linked hacking incidents dropped 74 percent from 2024, their impact surged. These groups accounted for a record 76 percent of all service-level breaches, excluding personal wallet hacks, highlighting a shift toward fewer but much larger attacks.
Chainalysis noted that this trend has intensified over time. Unlike non–North Korean attackers, who targeted a relatively even range of theft sizes, North Korean operations dominated the highest-value attacks.
“When North Korean hackers strike, they target large services and aim for maximum impact,” the report said. The groups have shifted focus from decentralized finance vulnerabilities to centralized exchanges and custodians as DeFi security has strengthened. A striking example is the $1.5 billion breach at Dubai-based exchange Bybit in February, the largest crypto heist on record.
The report also cited insider infiltration as a major factor enabling North Korea to carry out these high-value thefts.
