Key Takeaways
- • North Korea stole a record $2.02 billion in cryptocurrency in 2025, a 51% increase from $1.3 billion in 2024, according to blockchain watchdog Chainalysis, bringing the country's cumulative stolen crypto total to approximately $6.75 billion.
- • The Bybit exchange hack in February 2025 accounted for $1.5 billion of North Korea's annual theft, with the U.S. Secret Service attributing the breach to North Korea's state-sponsored hacking unit; most stolen funds were in ethereum.
- • North Korean hackers now account for roughly 60% of all global cryptocurrency theft, with global crypto losses reaching $3.4 billion in 2025, demonstrating the disproportionate scale of state-sponsored North Korean cyber operations relative to other criminal actors.
- • A significant portion of North Korea's cyber theft involves fraudulent acquisition of remote technical positions at international companies, allowing operatives to obtain cryptocurrency keys and facilitate fund transfers to Pyongyang without detection.
- • Experts attribute North Korea's aggressive cyber theft campaign to funding constraints imposed by international sanctions, with stolen cryptocurrency directly supporting the country's nuclear weapons and missile development programs.
Summary
North Korea's cryptocurrency theft operation reached unprecedented scale in 2025, stealing $2.02 billion according to research published by Chainalysis on Thursday. This represents a 51% increase over 2024's $1.3 billion and marks the second consecutive year the country has broken its own theft record. The cumulative value of cryptocurrency stolen by North Korean operatives now totals approximately $6.75 billion, according to the blockchain analysis firm. This year's theft accounts for roughly 60% of the $3.4 billion in total cryptocurrency losses recorded globally during 2025.
The single largest theft component came from the February 2025 hack of Bybit, a Dubai-based cryptocurrency exchange, where North Korean state-sponsored hackers stole approximately $1.5 billion, predominantly in ethereum. The U.S. Secret Service attributed the breach to North Korea's elite government hacking operations. According to Bybit's CEO, the stolen funds have been partially dispersed through laundering operations, though authorities and blockchain analysts continue tracking the movement of these assets through cryptocurrency networks.
North Korea's persistent cryptocurrency theft campaign reflects the country's reliance on illicit cyber operations to circumvent international sanctions. The United Nations and private researchers have long documented that North Korean hackers funnel stolen cryptocurrency directly to support the country's nuclear weapons and ballistic missile programs. Matt Pearl, director of the Strategic Technologies Program at the Center for Strategic and International Studies, noted the challenge of disrupting these operations: "It's very difficult to stop, because there's an asymmetry where they're in general so cut off from the world and such a rogue state."
A critical element of North Korea's attack infrastructure involves operatives fraudulently obtaining remote technical employment positions at international firms. These positions provide access to internal systems, cryptocurrency storage mechanisms, and transaction authorization protocols—allowing hackers to steal digital asset keys and execute large-scale transfers to wallets controlled by Pyongyang. Chainalysis's report indicates this employment-based infiltration method has become increasingly common, expanding North Korea's attack surface beyond traditional exchange vulnerabilities.
The single largest theft component came from the February 2025 hack of Bybit, a Dubai-based cryptocurrency exchange, where North Korean state-sponsored hackers stole approximately $1.5 billion, predominantly in ethereum. The U.S. Secret Service attributed the breach to North Korea's elite government hacking operations. According to Bybit's CEO, the stolen funds have been partially dispersed through laundering operations, though authorities and blockchain analysts continue tracking the movement of these assets through cryptocurrency networks.
North Korea's persistent cryptocurrency theft campaign reflects the country's reliance on illicit cyber operations to circumvent international sanctions. The United Nations and private researchers have long documented that North Korean hackers funnel stolen cryptocurrency directly to support the country's nuclear weapons and ballistic missile programs. Matt Pearl, director of the Strategic Technologies Program at the Center for Strategic and International Studies, noted the challenge of disrupting these operations: "It's very difficult to stop, because there's an asymmetry where they're in general so cut off from the world and such a rogue state."
A critical element of North Korea's attack infrastructure involves operatives fraudulently obtaining remote technical employment positions at international firms. These positions provide access to internal systems, cryptocurrency storage mechanisms, and transaction authorization protocols—allowing hackers to steal digital asset keys and execute large-scale transfers to wallets controlled by Pyongyang. Chainalysis's report indicates this employment-based infiltration method has become increasingly common, expanding North Korea's attack surface beyond traditional exchange vulnerabilities.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.