NORTH Korea–linked hacking groups has stolen more cryptocurrency than anyone else in 2025, siphoning off more than $2 billion as their operations became fewer but more targeted and higher impact, according to new research.
North Korean hackers stole about $2.02 billion worth of digital assets from January through early December, up 51 per cent from a year earlier, global blockchain analytics firm Chainalysis said in a report released this week.
The findings, part of Chainalysis’s annual overview of crypto crime, show global cryptocurrency theft reached about $3.4 billion this year, with North Korean operations accounting for nearly 60pc of the total. That pushed North Korea’s cumulative cryptocurrency theft to roughly $6.75 billion, the report showed.
While the overall number of hacking incidents linked to North Korea fell 74pc from 2024, their impact grew sharply. North Korean groups accounted for a record 76pc of all service-level compromises, excluding personal wallet hacks, underscoring a shift toward fewer but significantly larger breaches.
Chainalysis said the divergence has become more pronounced over time. Non–North Korean attackers showed a relatively even distribution across theft sizes this year, while North Korean operations dominated the highest-value ranges.
“When North Korean hackers strike, they target large services and aim for maximum impact,” the report said. Their tactics reflect a move away from exploiting decentralised finance vulnerabilities toward centralised exchanges and custodians as DeFi security improves. The $1.5 billion breach at Dubai-based exchange Bybit in February, the largest crypto heist on record, illustrates the scale of that approach.
The report pointed to insider infiltration as a key driver behind North Korea’s ability to execute such high-value thefts.
