(Credit: Tatevrika via Getty Images)
The year isn't even over, but North Korean hackers have already stolen an estimated $2 billion+ in cryptocurrency in 2025, a record-breaking haul.
This is the most North Korean hackers have ever looted in a single year, according to blockchain tracking firm Elliptic. “This brings the cumulative known value of cryptoassets stolen by the [North Korean] regime to more than $6 billion,” it says.
This year in particular, North Korean hackers made a killing by stealing over $1.4 billion from the Bybit exchange in February, what’s become the largest crypto heist in history. To do so, hackers first infiltrated a digit wallet provider, which paved a way for them to compromise an offline “cold wallet” at the Bybit exchange that held 400,000 Ethereum coins.
(Credit: Elliptic)Although the suspected North Koreans managed to loot the cryptocurrency, Bybit reported in April that about 68% of the funds remained traceable, suggesting the North Koreans were only able to cash out part of their earnings.
Elliptic adds: “Other thefts publicly attributed to North Korea in 2025 include those suffered by LND.fi, WOO X and Seedify. Elliptic has attributed more than thirty additional hacks to North Korea so far this year.” Chainalysis, another blockchain tracking firm, has also pegged the losses to the North Koreans hackers at $2.17 billion for this year so far.
The ongoing heists show the North Korean government continues to exploit cryptocurrrency to generate funds for the regime, despite strict sanctions against the country. Back in 2019, a confidential United Nations report also estimated North Korean state-sponsored hackers had already stolen $2 billion to help fund the country’s nuclear weapons program.
Both Elliptic and Chainalysis supply blockchain tracking to help law enforcement crack down on illegal cryptocurrency transactions. Still, the companies warn that North Korean hackers have also been targeting “high-net-worth individuals” rather than merely preying on cryptocurrency exchanges and blockchain-related firms.
hackers are using social engineering schemes, such as phishing attacks to impersonate companies and trick users into installing malware. “Personal wallet compromises now represent a growing share of total ecosystem theft, with attackers increasingly targeting individual users, making up 23.35% of all stolen fund activity YTD in 2025,” Chainalysis added.