North Korean hackers stole over $2 billion in crypto so far in 2025, researchers say

In a staggering revelation, hackers affiliated with the North Korean government have reportedly pilfered over $2 billion in cryptocurrency during 2025, according to blockchain analysis firm Elliptic. This alarming figure, disclosed in a recent blog post by Elliptic, marks the highest annual sum ever recorded, with three months still remaining in the year. The previous record was set in 2022, when North Korea stole approximately $1.35 billion. Since 2017, the total estimated amount of stolen cryptocurrency attributed to the regime has reached a staggering $6 billion, although Elliptic cautions that this figure could be an underestimation. "The actual figure may be even higher. Attributing cyber thefts to North Korea is not an exact science," the blog post noted. Elliptic also highlighted that many thefts may exhibit characteristics of North Korean operations but lack sufficient evidence for definitive attribution. Moreover, numerous thefts likely remain unreported. The firm revealed that North Korea's primary targets continue to be cryptocurrency exchanges. However, there has been a notable shift in tactics, as the regime's hackers are increasingly targeting high-net-worth individuals who hold significant amounts of cryptocurrency. According to Elliptic, "The majority of the hacks in 2025 have been perpetrated through social engineering attacks, where hackers deceive or manipulate individuals to gain access to cryptocurrency." This marks a departure from earlier methods that often exploited technical vulnerabilities within crypto infrastructure, indicating a concerning trend where human error has become the primary weak point in cryptocurrency security. Elliptic's estimates align with findings from other organizations. The United Nations Security Council previously estimated that between 2017 and 2023, North Korean hackers stole around $3 billion in cryptocurrency. When combined with Elliptic’s current estimate of $2 billion for this year and last year’s $742.8 million, the total approaches the alarming $6 billion mark. Governments including Japan, South Korea, and the United States have accused North Korean hackers of stealing over $659 million in 2024, which aligns closely with Elliptic’s figures. The United Nations believes that the funds stolen by the regime under Kim Jong-un are being utilized to finance its nuclear weapons program. A significant portion of this year's record theft can be traced back to an enormous breach of over $1.4 billion from the cryptocurrency exchange Bybit, which has been linked to North Korea by the FBI and various blockchain monitoring firms. Notable past victims of North Korean cyberattacks in the cryptocurrency space include the play-to-earn game Axie Infinity, which lost $625 million in 2022, crypto startup Harmony, which was hit for $100 million in the same year, and crypto exchange WazirX, which suffered a loss of $235 million in 2024, among many others.