North Korean hackers steal $2 billion in crypto in 2025, remain top global threat

New Delhi: North Korea has emerged as the biggest threat to cryptocurrency security in 2025, even as the number of confirmed hacking incidents has come down.

The data compiled by blockchain analytics firm Chainalysis said hackers linked to North Korea, also known as the Democratic People’s Republic of Korea (DPRK), allegedly stole a record $2.02 billion worth of cryptocurrency this year.

This marks a sharp 51 per cent increase compared to 2024 and takes the country’s total crypto thefts over the years to an estimated $6.75 billion.

Chainalysis noted that North Korean hackers are now carrying out fewer attacks but are stealing much larger amounts of money in each incident.

This shows a shift towards more targeted and sophisticated operations, allowing them to cause maximum damage with limited activity.

In 2025 alone, the DPRK accounted for nearly 76 per cent of all major crypto service breaches worldwide.

The report also highlighted that North Korean groups have become highly organised in laundering stolen funds.

They showed a clear preference for Chinese-language platforms, cross-chain bridge services and crypto mixing tools.

Typically, the laundering process was spread over about 45 days after a major theft, making it harder to track the funds.

Interestingly, while individual wallet hacks affected around 80,000 unique victims across nearly 1.58 lakh incidents in 2025, the total amount stolen from these smaller attacks fell to $713 million, lower than last year.

This suggests that overall hacking losses remained relatively controlled in 2024 and 2025 — indicating that improved security practices across the crypto industry are starting to make a difference.

However, the report warned that North Korean hackers are using increasingly deceptive methods to gain access.

One of their main strategies involves placing IT workers inside crypto exchanges and web3 firms. By securing jobs within these companies, the hackers gain privileged access, which can later be used to carry out large-scale thefts.

IANS