North Korea Crypto Heists: $2 Billion Stolen in 2025

North Korean Hackers Amass Billions in Cryptocurrency Theft

Blockchain analytics firm Elliptic reports that cybercriminals associated with the North Korean government have illicitly obtained over $2 billion in cryptocurrency during the current year.

A recently published blog post by Elliptic details this new assessment, noting it represents the “highest annual sum recorded to date,” with a full three months remaining in the year. This figure is based on analysis of more than 30 separate hacking incidents.

Surpassing Previous Records

The prior record for annual crypto theft attributed to North Korea was established in 2022, totaling $1.35 billion. Elliptic estimates the regime’s cumulative stolen cryptocurrency holdings since 2017 to be at least $6 billion, acknowledging this may be a conservative estimate.

Attributing cyber thefts definitively to North Korea presents challenges, as stated in the Elliptic report: “Determining the origin of cyber thefts is not always straightforward.”

The firm further clarifies that numerous other thefts exhibit characteristics consistent with North Korean involvement, yet lack conclusive evidence for attribution. Additionally, some breaches likely go unreported and remain undetected.

Shifting Tactics and Targets

While cryptocurrency exchanges remain primary targets, North Korean hackers are increasingly focusing on individuals possessing substantial crypto assets – so-called “high-net-worth individuals.”

A notable shift in tactics has also been observed. The majority of hacks in the current year have involved social engineering, where individuals are deceived into granting access to their cryptocurrency holdings.

This represents a departure from earlier methods that frequently exploited technical vulnerabilities within crypto infrastructure. This change underscores that the weakest link in cryptocurrency security is increasingly human behavior, rather than technical flaws.

Corroborating Estimates

Elliptic’s assessment aligns with findings from other organizations. The United Nations Security Council previously estimated that North Korean hackers stole $3 billion in cryptocurrency between 2017 and 2023.

Combining Elliptic’s current year estimate of $2 billion with the $742.8 million reported for 2023 brings the total close to the $6 billion figure.

Furthermore, the governments of Japan, South Korea, and the United States have jointly accused North Korean hackers of stealing over $659 million in 2024, a figure comparable to Elliptic’s findings.

Funding Nuclear Programs

The United Nations believes the regime of Kim Jong-Un utilizes the stolen cryptocurrency to finance its nuclear weapons development program.

Significant Breaches in 2025

The record-breaking theft total for this year was largely driven by a substantial breach targeting crypto exchange Bybit, resulting in losses exceeding $1.4 billion. The FBI and multiple blockchain analysis firms have attributed this attack to North Korean actors.

Past Victims

Over the years, North Korean hackers have targeted a variety of entities within the cryptocurrency space, including:

• Play-to-earn game Axie Infinity ($625 million in 2022)
• Crypto startup Harmony ($100 million in 2022)
• Crypto exchange WazirX ($235 million in 2024)

These represent only a fraction of the numerous successful attacks perpetrated by these groups.