Record Crypto Theft by North Korea Hits $2 Billion in 2025 as Wealthy Individuals and Exchanges Targeted

North Korean Hackers Steal Record $2 Billion In Crypto This Year

North Korea-linked cybercriminals have taken more than $2 billion in cryptocurrency so far in 2025, setting a new annual record and pushing the total known theft by the regime to over $6 billion since 2017, according to blockchain forensics firm Elliptic.

The majority of the losses came from February’s $1.46 billion breach of Bybit, one of the largest crypto thefts on record, while attacks on LND.fi, WOO X, Seedify, and over 30 smaller platforms also contributed to the total.

Are Wealthy Individuals The New Target Of North Korean Hackers?

While large exchanges remain a prime target, Elliptic reports a notable shift toward high-net-worth individuals, company executives, and smaller platforms.

The firm said,

“The weak point in cryptocurrency security is now human, not technological.”

Hackers increasingly rely on social engineering tactics—phishing, fake job offers, and compromised social media accounts—to access wallets and private keys, rather than exploiting technical vulnerabilities.

The highest reported theft from a single individual this year is $100 million.

How North Korea Launders Stolen Crypto

Elliptic’s analysis shows that North Korean groups are using increasingly complex laundering methods to obscure stolen funds.

After the Bybit hack, investigators traced multiple rounds of cross-chain swaps involving Bitcoin, Ethereum, BTTC, and Tron, often using obscure protocols and self-issued tokens.

Techniques now include multiple mixing rounds, transfers across lesser-known blockchains, and creating new tokens issued by laundering networks to make tracking more difficult.

The Impact On North Korea’s Economy And Weapons Programs

According to United Nations estimates, the regime’s cyber theft accounts for around 13% of North Korea’s GDP.

Western security agencies and the UN suggest the proceeds fund the country’s nuclear weapons and ballistic missile programmes.

Dr Tom Robinson, chief scientist at Elliptic, warned that the true scale of North Korean cybercrime is likely higher than reported:

“Other thefts are likely unreported and remain unknown as attributing cyber thefts to North Korea is not an exact science.”

Is The Era Of Big Exchange Hacks Giving Way To Smaller, Targeted Attacks

This year has seen a mix of high-profile breaches and smaller, targeted thefts.

July’s WOO X attack resulted in $14 million stolen from just nine users, while Seedify saw $1.2 million taken.

Elliptic has also worked privately with victims of attacks costing tens or even hundreds of millions.

Compared with 2024, when North Korean hackers stole $659 million in crypto, 2025 has been exceptional, nearly tripling last year’s total and surpassing the previous record of $1.35 billion set in 2022.

Why North Korea Prefers Deception Over Code Exploits

The move toward social engineering reflects a strategic evolution.

With crypto prices recovering, wealthy individuals now present lucrative targets, often without the security measures of institutional platforms.

Elliptic said,

“Now, the weakness of cryptocurrency security is humans, not technology.”

Researchers note that the regime also runs fake IT worker programmes to generate additional income and bypass sanctions, blending cybercrime with sophisticated fraud operations.

Can Blockchain Tracking Keep Up With Increasingly Sophisticated Hacks

Despite the growing scale of thefts, blockchain’s transparency enables analysts to follow stolen assets.

Elliptic and other firms like Chainalysis track transactions in real time, helping freeze funds on exchanges and limit hackers’ ability to cash out.

Yet the combination of complex laundering methods and targeting of individuals makes complete prevention challenging.

What The Largest Hacks Reveal About North Korea’s Cyber Strategy

The Bybit incident alone accounted for nearly three-quarters of 2025’s total theft, but analysts point to over 30 other incidents, including attacks on LND.fi, WOO X, and Seedify, as evidence of a sustained and expanding campaign.

Experts warn that as North Korea increasingly targets individuals and diversifies laundering techniques, the reported $2 billion figure may still underestimate the true scale of the regime’s crypto theft operations.