North Korean hackers set a new record in 2025 by stealing an estimated $2.02 billion in cryptocurrency, a 51% year-over-year surge that pushed their historical total to $6.75 billion, according to the Chainalysis Crypto Crime 2026 Report.
This record haul came despite a sharp decline in the number of known attacks, underscoring Pyongyang’s growing efficiency in conducting high‑value, low‑volume operations.
Sophisticated Infiltration and Targeting
The Democratic People’s Republic of Korea (DPRK) continues to dominate state‑sponsored crypto theft, accounting for 76% of all service compromises in 2025.
The year’s most significant incident, the February hack of Bybit Exchange, contributed nearly $1.5 billion to the total, highlighting the outlier-driven nature of crypto crime.
Investigators note a key evolution in DPRK tactics. Beyond embedding covert IT workers within exchanges and custodians, North Korean operators are now impersonating recruiters and investors to infiltrate sensitive infrastructure.
In one scheme, hackers posed as hiring managers from leading blockchain or AI firms, staging fake technical interviews to harvest VPN credentials and source code from employees.
Executive-level scams mirrored this approach by using counterfeit merger or investment discussions to extract privileged system data.
Distinctive Laundering Patterns
Chainalysis’s blockchain tracking reveals that DPRK-linked groups follow a structured 45‑day laundering cycle after major thefts.
Their process comprises three key phases: early obfuscation via DeFi mixers and cross‑chain bridges, integration via no‑KYC or centralized exchanges, and final cash‑outs via Chinese-language money-laundering services and OTC networks.
The analysis found that 60% of DPRK laundering volume involves transactions under $500,000, a stark contrast to other cybercriminals who move larger sums.
DPRK actors relied heavily on Chinese-language money movement services, bridge protocols, and mixing tools, avoiding typical DeFi lending or peer-to-peer venues.
This pattern aligns with long-standing ties between North Korean operatives and China-based financial facilitators.
Broader Crypto Crime Trends
Overall, the crypto ecosystem lost more than $3.4 billion to theft in 2025. Despite explosive DPRK activity, DeFi-related hacks remained unusually low, even as total value locked surged, indicating greater security maturity and faster incident response across protocols.
Individual wallet compromises, meanwhile, increased to 158,000 incidents affecting 80,000 users, although total losses declined to $713 million, suggesting tighter user protection.
Analysts warn that North Korea’s ability to achieve devastating results through fewer attacks signals rising sophistication and patience.
With the regime relying on stolen digital assets to fund state priorities, identifying the DPRK’s laundering footprint and infiltration tactics remains critical to preventing another Bybit-scale breach in 2026.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
