Key Takeaways
- • North Korea stole a record $2.02 billion in cryptocurrency during 2025, representing a 51% increase from 2024's $1.3 billion and breaking its own previous annual theft record for the second consecutive year, according to blockchain analytics firm Chainalysis.
- • The Bybit exchange hack in February 2025 accounted for approximately $1.5 billion of the year's total theft, mostly in ethereum, with the U.S. Secret Service attributing the operation to North Korea's state-sponsored hacking unit.
- • North Korea's cumulative cryptocurrency theft now totals approximately $6.75 billion, while global crypto theft reached $3.4 billion in 2025, meaning North Korean actors account for a disproportionate share of international cryptocurrency crime.
- • A significant portion of North Korean hacking success stems from operatives fraudulently obtaining remote technical positions at international companies, which grants them network access to steal cryptocurrency keys and facilitate transfers to Pyongyang.
- • Cybersecurity experts characterize the threat as difficult to counter due to North Korea's international isolation and sanctions regime, which insulates the regime from conventional law enforcement and diplomatic pressure.
Summary
North Korea's state-sponsored cryptocurrency theft operation achieved record-breaking results in 2025, stealing $2.02 billion across the year according to research published by Chainalysis, a leading blockchain analytics firm. This represents a 51% increase from 2024's prior record of $1.3 billion and marks the second consecutive year the country has surpassed its own theft benchmarks. The cumulative total of North Korean cryptocurrency thefts now stands at approximately $6.75 billion.
The February 2025 hack of Bybit, a Dubai-based cryptocurrency exchange, represents the largest single incident in the 2025 theft campaign. The operation, attributed by the U.S. Secret Service to North Korea's government hacking unit, yielded approximately $1.5 billion in stolen assets, predominantly in ethereum. According to reports, North Korean actors successfully dispersed and laundered a substantial portion of these funds through sophisticated cross-chain networks, complicating recovery and asset tracing efforts.
Global cryptocurrency theft reached $3.4 billion in 2025, meaning North Korean actors captured roughly 59% of all cryptocurrency crime losses—a disproportionate concentration that reflects the sophistication and scale of state-sponsored operations relative to independent cybercriminal activity. Intelligence analysts and researchers attribute the escalating theft volumes partly to an emerging tactic: North Korean operatives fraudulently securing remote employment positions at international technology and cryptocurrency firms, which grants them insider network access to extract cryptocurrency keys and execute large-scale transfers.
The United Nations and private researchers have established that North Korea leverages stolen cryptocurrency proceeds to fund its nuclear weapons and missile development programs, effectively converting digital assets into strategic military capabilities. Matt Pearl, director of the Strategic Technologies Program at the Center for Strategic and International Studies, characterized the threat as exceptionally difficult to mitigate, noting that North Korea's extreme international isolation and limited diplomatic relations create asymmetric vulnerabilities that conventional cybersecurity and law enforcement approaches struggle to address.
The February 2025 hack of Bybit, a Dubai-based cryptocurrency exchange, represents the largest single incident in the 2025 theft campaign. The operation, attributed by the U.S. Secret Service to North Korea's government hacking unit, yielded approximately $1.5 billion in stolen assets, predominantly in ethereum. According to reports, North Korean actors successfully dispersed and laundered a substantial portion of these funds through sophisticated cross-chain networks, complicating recovery and asset tracing efforts.
Global cryptocurrency theft reached $3.4 billion in 2025, meaning North Korean actors captured roughly 59% of all cryptocurrency crime losses—a disproportionate concentration that reflects the sophistication and scale of state-sponsored operations relative to independent cybercriminal activity. Intelligence analysts and researchers attribute the escalating theft volumes partly to an emerging tactic: North Korean operatives fraudulently securing remote employment positions at international technology and cryptocurrency firms, which grants them insider network access to extract cryptocurrency keys and execute large-scale transfers.
The United Nations and private researchers have established that North Korea leverages stolen cryptocurrency proceeds to fund its nuclear weapons and missile development programs, effectively converting digital assets into strategic military capabilities. Matt Pearl, director of the Strategic Technologies Program at the Center for Strategic and International Studies, characterized the threat as exceptionally difficult to mitigate, noting that North Korea's extreme international isolation and limited diplomatic relations create asymmetric vulnerabilities that conventional cybersecurity and law enforcement approaches struggle to address.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.