North Korea\u2019s state-backed hackers are having their most profitable year yet. According to blockchain analytics firm Elliptic, cybercriminals linked to Pyongyang have already stolen more than $2 billion worth of cryptocurrency in 2025, setting a new record with nearly three months still to go.<\/p>\n
The unprecedented total nearly triples last year\u2019s figure, bringing the regime\u2019s known crypto theft to over $6 billion since its hackers first began targeting the digital currency world in 2017. Intelligence agencies and the United Nations say these funds are used to help bankroll North Korea\u2019s nuclear weapons and missile programs, which are otherwise constrained by global sanctions.<\/p>\n
\u201cThe 2025 total already dwarfs previous years and is almost triple last year\u2019s tally, underscoring the growing scale of North Korea\u2019s dependence on cyber-enabled theft to fund its regime,\u201d Elliptic wrote in its latest blog post.<\/p>\n
A Record-Breaking Hack<\/strong><\/p>\n The biggest contributor to 2025\u2019s staggering total was the $1.46 billion hack in February from the crypto exchange Bybit, which now ranks as one of the largest cryptocurrency thefts in history. The attackers infiltrated systems tied to an offline \u201ccold wallet\u201d containing 400,000 Ethereum coins.<\/p>\n Elliptic also linked North Korea to thefts at LND.fi, WOO X, Seedify, and more than 30 additional smaller hacks this year alone. In comparison, North Korea\u2019s 2025 haul far exceeds its previous record of $1.35 billion in 2022, which means the regime\u2019s hackers have shattered their own record by a wide margin.<\/p>\n A Shift in Strategy: From Code Exploits To Human Deception<\/strong><\/p>\n This year has also marked a clear shift in North Korean hackers’ tactics, moving from exploiting code flaws to targeting individuals through phishing schemes, fake job offers, or impersonating trusted crypto companies to steal wallet credentials.<\/p>\n \u201cThe majority of the hacks in 2025 have been perpetrated through social engineering attacks, where hackers deceive or manipulate individuals to gain access to cryptocurrency,\u201d Elliptic explained.<\/p>\n High-net-worth crypto holders and exchange employees are now common targets. These individuals often lack enterprise-level security, making them easier prey.<\/p>\n \u201cThis shift highlights that the weak point in cryptocurrency security is increasingly human, rather than technical,\u201d the company warned.<\/p>\n A High-Tech Laundering Operation<\/strong><\/p>\n Once the money is stolen, North Korea\u2019s hackers go to great lengths to launder their crypto. Elliptic found that laundering techniques now include multiple rounds of cross-chain swaps, use of obscure blockchains, and even self-issued tokens designed to hide stolen assets.<\/p>\n Despite the broader arms race between blockchain investigators and state-sponsored cybercriminals, Elliptic says blockchain transparency remains a powerful tool, allowing law enforcement and compliance teams to trace transactions and block illicit deposits.<\/p>\n A Growing Security Concern<\/strong><\/p>\n The United Nations estimates North Korea\u2019s total GDP at roughly $15 billion, meaning the regime\u2019s stolen crypto could account for as much as 13% of the country\u2019s total economy.<\/p>\n Western governments warn that the stolen crypto is helping fund North Korea\u2019s weapons programs \u2014 transforming what might look like digital theft into a serious global security concern.<\/p>\n Dr. Tom Robinson, Elliptic\u2019s Chief Scientist, says the actual figure could be even higher and that attributing cyber thefts to North Korea is not an exact science.<\/p>\n \u201cWe are aware of many other thefts that share some of the hallmarks of North Korea-linked activity but lack sufficient evidence to be definitively attributed. Other thefts are likely unreported and remain unknown,\u201d he said.<\/p>\n With $2 billion stolen and counting, one thing is clear: North Korea has turned crypto theft into an industry \u2014 and its cyber army isn\u2019t slowing down, it\u2019s only getting smarter.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" North Korea\u2019s state-backed hackers are having their most profitable year yet. According to blockchain analytics firm Elliptic, cybercriminals linked to Pyongyang have already stolen more than $2 billion worth of cryptocurrency in 2025, setting a new record with nearly three months still to go. The unprecedented total nearly triples last year\u2019s figure, bringing the regime\u2019s […]<\/p>\n","protected":false},"author":20,"featured_media":127881,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48520,3141],"tags":[63845,9608,64559,2333,64560,64199,1627,617,6846,10726],"class_list":{"0":"post-127878","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"category-news","9":"tag-bybit","10":"tag-crypto","11":"tag-crypto-theft","12":"tag-cryptocurrency","13":"tag-elliptic","14":"tag-financial-theft","15":"tag-hack","16":"tag-hackers","17":"tag-north-korea","18":"tag-north-korean-hackers"},"yoast_head":"\n