North Korean hackers stole a record $2.02 billion in cryptocurrency in 2025.

A report released by Chainalysis on Thursday shows that North Korea's cryptocurrency hacking operations stole $2.02 billion in 2025, breaking records again. Previously, the highest amount of cryptocurrency stolen by North Korea through hacking and theft (such as Bitcoin and Ethereum) was $1.3 billion. This brings North Korea's total stolen cryptocurrency holdings to approximately $6.75 billion. The total amount of stolen cryptocurrency globally has risen to $3.4 billion. A significant portion of this stems from the attack on the Dubai-based cryptocurrency exchange Bybit this year. Bybit's CEO stated that, according to the US Secret Service, hackers working for North Korea's elite government hacking group stole approximately $1.5 billion in February, mostly in Ethereum. The United Nations and private researchers have long accused North Korea, which is subject to international sanctions and maintains relations with only a few countries, of deploying hackers to steal cryptocurrencies to fund its nuclear weapons and missile programs. Chainalysis is one of a growing number of companies mapping cryptocurrency trading networks, including tracking stolen funds laundered by criminals. A Chainalysis report points out that despite these platforms possessing institutional resources and professional security teams, they remain vulnerable to attack due to this fundamental security challenge. Matt Pearl, director of the Strategic Technology Program at the Center for Strategic and International Studies, stated that North Korea's largely isolated position and status as a "rogue state" make it difficult to stop its activities. The report states that some of the thefts are most likely due to North Korean hackers increasingly obtaining remote technical positions at international companies through fraudulent means. This access allows them to provide their hacking colleagues with a foothold to steal cryptocurrency keys and transfer cryptocurrency to Pyongyang. Pearl stated that given North Korea's current stringent sanctions, there are few other ways to prevent it from continuing to fund military operations by attacking digital assets.