North Korea-linked hacking groups have stolen more cryptocurrency than any other nation in 2025, siphoning off over $2 billion as their operations became fewer but more targeted and higher impact, according to new research.
Read More: US crypto expert jailed for 63 months for helping North Korea
Blockchain analytics firm Chainalysis reported that from January through early December, North Korean hackers stole about $2.02 billion worth of digital assets, a 51% increase from the previous year. Globally, cryptocurrency theft reached roughly $3.4 billion in 2025, with North Korean operations accounting for nearly 60% of the total. This brings the country’s cumulative crypto theft to approximately $6.75 billion.
❗️🇰🇵 According to Bloomberg, anew surge in large-scale cryptocurrency theft is underway, setting unprecedented records.
Hackers linked to North Korea have stolen an estimated $2 billion in digital assets, the highest annual total ever attributed to a single state-backed actor. A… pic.twitter.com/YXNOq4Zc6J
— NSTRIKE (@NSTRIKE1231) December 22, 2025
While the total number of North Korea-linked incidents fell 74% compared to 2024, their financial impact grew sharply. The report noted that North Korean groups accounted for a record 76% of all service-level compromises, excluding personal wallet hacks. This indicates a strategic shift toward fewer but significantly larger breaches, focusing on exchanges and custodians rather than smaller decentralized finance (DeFi) platforms, whose security has improved.
A major example is the $1.5 billion theft from Dubai-based exchange Bybit in February, the largest crypto heist on record. Chainalysis attributed much of North Korea’s success to insider infiltration, which allows their operations to bypass conventional security measures.
“This year, North Korean hackers demonstrated a clear strategy: when they strike, they aim for maximum financial impact,” the report said. Non–North Korean attackers, by contrast, showed a relatively even distribution across theft sizes.
Read More: Xi declares China ‘unstoppable’ with Putin, Kim, Shehbaz by his side
The findings highlight the growing sophistication and global reach of state-linked cybercrime, raising concerns for cryptocurrency exchanges and regulators worldwide.