Have North Korean Hackers Stolen $2 Billion in Crypto in 2025 and Remained the Top Global Threat?
Synopsis
Key Takeaways
- North Korea has become the leading threat to cryptocurrency security in 2025.
- Hackers linked to the DPRK stole $2.02 billion this year.
- Despite fewer attacks, the amounts stolen per incident have increased significantly.
- The DPRK was responsible for 76% of major crypto breaches worldwide.
- Improved security practices in the crypto industry are showing positive results.
New Delhi, Dec 21 (NationPress) North Korea has solidified its position as the foremost threat to cryptocurrency security in 2025, despite a decline in confirmed hacking incidents.
Data from blockchain analytics firm Chainalysis indicates that hackers associated with North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), have reportedly pilfered a staggering $2.02 billion worth of cryptocurrency this year.
This represents a notable 51% surge compared to 2024, bringing the nation's total crypto thefts over the years to an estimated $6.75 billion.
Chainalysis observed that while North Korean hackers are executing fewer attacks, the sums stolen per incident have significantly increased.
This indicates a transition to more targeted and sophisticated operations, enabling them to inflict maximum damage with minimal activity.
In 2025 alone, the DPRK was responsible for nearly 76% of all significant crypto service breaches globally.
The report also underlined that North Korean groups have become highly organized in laundering the stolen funds.
They demonstrated a clear preference for platforms in the Chinese language, cross-chain bridge services, and crypto mixing tools.
Typically, the laundering process unfolded over approximately 45 days following a major theft, complicating efforts to trace the funds.
Interestingly, while individual wallet hacks impacted around 80,000 unique victims across nearly 158,000 incidents in 2025, the total amount stolen from these smaller breaches fell to $713 million, a decrease from the previous year.
This suggests that overall hacking losses remained relatively contained in 2024 and 2025, indicating that enhanced security practices across the crypto industry are beginning to yield positive results.
However, the report cautioned that North Korean hackers are employing increasingly deceptive tactics to gain access.
One of their primary strategies involves embedding IT workers within crypto exchanges and web3 companies. By securing employment in these firms, hackers gain privileged access, which can subsequently be exploited for large-scale thefts.