North Korea's Record Year: $2 Billion in Crypto Stolen With Far Fewer Attacks
Chainalysis says Pyongyang-linked hackers took at least $2.02 billion in 2025, led by the Bybit heist, and washed it through Chinese-language money networks.
Key takeaways
- Chainalysis attributes at least $2.02 billion of roughly $3.4 billion in 2025 crypto theft to North Korean hackers.
- Incidents fell sharply while the haul grew: Bybit alone was about $1.5 billion, stolen in February.
- Laundering ran in roughly $500,000 chunks through bridges, mixers and Chinese-language over-the-counter networks.
North Korea had its most lucrative year of crypto theft on record. Blockchain analytics firm Chainalysis, in its December 2025 update, attributes at least $2.02 billion to North Korean hackers, about 59% of the roughly $3.4 billion stolen across the industry, with far fewer known attacks than a year earlier.
The numbers
The 2025 figure is up about $681 million from the previous year's estimate, implying roughly $1.34 billion in 2024. Chainalysis has tracked $6.75 billion in North Korean theft since 2022. Most of the surge traces to a single event: the roughly $1.5 billion theft from Dubai-based exchange Bybit in February, which the FBI attributed to the North Korean cluster it calls TraderTraitor. The report counts the year through early December, so it is not a final tally.
The pattern is fewer, bigger raids. Pyongyang's operators concentrated on centralised services holding large reserves, typically by obtaining private keys that grant full control of wallets. South Korean officials separately accused North Korea of stealing about $30 million from the Upbit exchange.
How the money moves
Stealing is half the job; cashing out is the other. Chainalysis says North Korean actors typically launder in chunks of about $500,000, smaller than the $1 million to $10 million range common among other cybercriminals. They stage funds through cross-chain bridges, mixers, DeFi protocols and no-KYC exchanges, then lean on Chinese-language over-the-counter traders and platforms with weak compliance. Cambodia's Huione, sanctioned by the US this year, processed more than $49 billion in transactions since 2021, according to the firm.
Why it matters
The thefts are widely understood to fund state priorities, and the tactics keep evolving. Chainalysis points to social engineering as the main vector, including operatives posing as recruiters or hiring in as remote IT workers at exchanges, custodians and web3 firms. That blurs the line between fraud, insider threat and nation-state intrusion, and it makes technical controls on wallets only part of the defence.
Bybit and the supply-chain angle
The Bybit theft deserves its own note because it rewrote the scale of what an exchange breach can be. The Dubai-based exchange lost about $1.5 billion in February 2025, and The Record reports the intrusion involved a supply-chain exploit through a third-party vendor rather than a flaw in the blockchain itself. The FBI publicly attributed the theft to North Korea, and the funds were quickly split and moved onward. Bybit later sued North Korea, its Reconnaissance General Bureau and the Lazarus Group over the loss and obtained an asset freeze, an unusual civil tactic against a sovereign-backed actor.
Chainalysis reports that the shift toward fewer incidents was dramatic: the 2025 record was reached with roughly 74 percent fewer known attacks than the previous year. That suggests a strategy of patient preparation, in which operators spend months gaining access and trust before a single high-value strike. It also helps explain why the number of individual wallet owners hit by theft rose even as North Korea's operational footprint shrank: other criminals continued to prey on individuals while Pyongyang hunted whales.
The defender lessons are about process rather than cryptography. Large custodians should assume that vendors, signing interfaces and developer tools are part of the attack surface. Transaction-signing workflows need independent verification of what is actually being approved, not only what the user interface displays. Hiring pipelines need identity checks strong enough to catch operatives posing as remote contractors. And exchanges that see unusual patterns, such as repeated deposits of roughly $500,000, can help investigators by freezing flows early, which is often the only point at which stolen funds can still be recovered.
What to watch
- Final-year figures from Chainalysis and other analysts, which may differ from the early-December count.
- Legal action: Bybit has sued North Korea and sought asset freezes.
- More sanctions on laundering hubs and OTC brokers, the choke point between stolen coins and cash.
Sources
- Over $3 billion in crypto stolen in 2025, North Korea responsible for most — The Record
- North Korean hackers have stolen $2 billion in crypto this year: report — Decrypt
- North Korea leads global crypto hacks with $2bn in 2025 — Dawn
- FBI confirms Lazarus hackers were behind $1.5B Bybit crypto heist — BleepingComputer
