North Korea–linked hacking groups have reportedly stolen over $2 billion in crypto assets so far in 2025, setting what experts say may be a new global record for cybercrime. According to blockchain analytics firm Elliptic, the total stems from more than 30 confirmed hacks, led by a massive $1.46 billion breach of the Dubai-based exchange Bybit in February.

The FBI has attributed the Bybit hack to North Korean operatives under Operation “TraderTraitor,” part of a broader pattern of thefts funding Kim Jong Un’s regime. If current trends continue, analysts warn that 2025 could surpass every previous year in the scale and sophistication of crypto-related cyberattacks traced to Pyongyang.

The Bybit hack: one of the largest in crypto history

The Bybit breach is central to North Korea’s 2025 cybercrime surge. In the February attack, hackers siphoned approximately 401,000 ETH, valued at $1.46 billion at the time, from a Bybit cold wallet, a storage method typically considered one of the most secure.

The FBI confirmed that the Lazarus Group, North Korea’s most infamous hacking unit, orchestrated the operation. Investigators say the stolen assets were quickly dispersed across multiple wallets and laundered through decentralized exchanges, mixers, and cross-chain bridges to obscure their origin before conversion to fiat currency.

This single breach alone accounts for nearly three-quarters of the regime’s total crypto haul in 2025, making it one of the largest crypto thefts ever recorded.

Why 2025 may be a record-breaking year for North Korean hackers

According to Elliptic and other cybersecurity sources, North Korea-linked groups have carried out over 30 successful hacks so far this year — triple the 2024 volume. These attacks have primarily targeted:

• Centralized exchanges, where large reserves of digital assets are held.
• DeFi (Decentralized Finance) platforms, which often have weaker security controls.
• Individual insiders, compromised through social engineering tactics such as phishing, impersonation, and blackmail.

Analysts note that North Korea’s hackers have increasingly shifted focus from exploiting software vulnerabilities to manipulating people — a trend seen in targeted attacks on employees of major exchanges across Asia and the Middle East.

If Elliptic’s projections hold, 2025’s crypto thefts could exceed $2.5 billion, shattering the previous record of $1.35 billion in 2022.

The scale of crypto theft since 2017

Since 2017, North Korea’s cyber operations have stolen more than $6 billion in cryptocurrency, according to Elliptic and corroborating data from Chainalysis and the United Nations.

The cumulative total underscores how crypto theft has evolved into a core funding stream for Pyongyang’s regime, allowing it to bypass international sanctions and maintain revenue for its weapons and missile programs.

How stolen crypto fuels North Korea’s missile program

Intelligence and UN reports suggest that up to 13% of North Korea’s GDP may now stem from illicit cyber activity, including crypto theft, ransomware, and IT worker scams. More than half of the regime’s missile development budget is believed to be financed through such proceeds, although the divs remain unverified due to the country’s strict secrecy.

By converting stolen crypto into stablecoins or foreign currency via third-party brokers, North Korea allegedly channels the funds into its weapons testing, materials procurement, and global espionage operations.

A 2024 UN Security Council report concluded that cybercrime has become an “indispensable lifeline” for the country’s sanction-hit economy.

The Lazarus Group and North Korea’s cyber apparatus

Most of these operations are linked to North Korea’s Reconnaissance General Bureau (RGB), the military intelligence agency overseeing state-sponsored cyber units. The Lazarus Group, perhaps the most notorious among them, has been tied to high-profile incidents, including:

• The 2014 Sony Pictures hack, a politically motivated cyberattack.
• The 2016 Bangladesh Bank heist, which stole $81 million via SWIFT transfers.
• The 2022 Axie Infinity (Ronin Bridge) hack, which netted $625 million.

These groups reportedly operate from cyber units stationed in China and Russia, using sophisticated malware, fake company profiles, and developer recruitment scams to infiltrate cryptocurrency ecosystems.

Why North Korea targets crypto

Unlike traditional finance systems, cryptocurrency allows near-anonymous transactions, making it ideal for sanctioned regimes. North Korea’s hackers exploit this opacity to move funds undetected, often using mixing services, chain-hopping, and decentralized exchanges to obfuscate money trails.

Analysts at Chainalysis note three key motives:

1. Evasion of sanctions — bypassing restricted access to the global banking system.
2. Funding state priorities — particularly weapons programs and luxury imports.
3. Testing cyber warfare capabilities — refining offensive hacking skills.

Cybersecurity experts warn that unless international cooperation tightens, North Korea’s theft-driven economy will remain both profitable and difficult to trace.

Has Kim Jong Un acknowledged the hacks?

Officially, no. North Korea has never admitted to any cyberattacks or crypto thefts. The regime routinely denies involvement, calling such accusations “baseless slander.” Despite overwhelming evidence from the FBI, United Nations, and private cybersecurity firms, Pyongyang continues to frame the reports as part of an “anti-DPRK conspiracy.”

Nevertheless, the consistency of digital forensics and blockchain tracking data across multiple firms, including Elliptic, Chainalysis, and TRM Labs, leaves little doubt about the regime’s role in these crimes.

The global response: tightening sanctions and security

In response to the Bybit hack and related breaches, the U.S. Treasury Department has sanctioned multiple crypto wallet addresses linked to the Lazarus Group, while Interpol and Europol have increased information-sharing on blockchain-based crimes.

Crypto exchanges are also stepping up their defenses with:

• Multi-signature wallets and cold storage to reduce single-point vulnerabilities.
• Employee awareness programs to counter phishing and social engineering.
• AI-driven anomaly detection for real-time fraud identification.

However, experts caution that decentralization and regulatory fragmentation continue to make the crypto ecosystem a high-risk target for state-sponsored actors.

TL;DR

North Korean hackers have stolen over $2 billion in crypto in 2025, led by a record-setting $1.46 billion Bybit heist. The regime’s total crypto thefts since 2017 now exceed $6 billion, with much of the money allegedly funding its missile and weapons programs. The attacks underscore Pyongyang’s reliance on cybercrime to evade sanctions and highlight the urgent need for global cooperation to secure digital assets.