North Korean hackers stole $2 billion worth of cryptocurrencies this year

Hacker groups linked to North Korea stole over $2 billion worth of cryptocurrencies between the months of January and early December 2025. According to a new report published this week by blockchain analysis firm Chainalysis, this is a 51 percent increase compared to the previous year. The findings, which are part of the company’s annual review of crypto-crime, show that total global thefts reached approximately $3.4 billion this year, with North Korean activity accounting for nearly 60 percent of the total. This figure brings the country’s total cumulative crypto thefts to about $6.75 billion.

The report points to a distinct strategic shift in hacker activity: while the number of hacking incidents linked to North Korea dropped by 74 percent compared to 2024, the impact of each attack increased sharply. Attackers have shifted to focus on fewer hacks, but those aimed at larger targets with maximum impact, moving from exploiting weaknesses in decentralized finance (DeFi) to attacking centralized exchanges. The most striking example of this trend is the hacking of the Dubai-based Bybit exchange in February, in which $1.5 billion was stolen, an event defined as the largest crypto robbery ever recorded.

Chainalysis explained that a key factor in the success of these huge thefts is penetration from the inside. North Korean hackers plant IT employees inside crypto services to gain privileged access, and even impersonate recruiters at well-known Web3 and artificial intelligence companies to trick employees’ login credentials and internal code. In other cases, they present themselves as potential investors in staged meetings to gather tacit information about internal networks and potential intrusion points.

In addition, the report highlights the growing sophistication of money laundering methods. The stolen funds are split into small portions, usually under $500,000, and transferred through Chinese-language money laundering networks. The money laundering process usually takes place in stages over about 45 days after the theft, through exchanges and mixing services. In this regard, the Cambodia-based Huione Group has been cited as a critical money-laundering hub for North Korea. The American government recognized this year that the company was used to launder at least 4 billion dollars between 2021 and the beginning of 2025, and prohibited American financial institutions from doing business with it, directly or indirectly.