North Korean Hackers Steal Record $2 Billion in Cryptocurrency in 2025, Chainalysis Reports
North Korean hackers stole at least $2 billion in cryptocurrency in 2025, marking a 51% increase from 2024 and raising the total DPRK crypto theft to $6.75 billion. The attacks in 2025 shifted towards fewer but larger breaches, with DPRK actors responsible for 76% of service-level compromises, the highest on record.
The largest breach of the year was the $1.4 billion hack of Bybit in March. Laundering of stolen crypto relies heavily on Chinese-language brokers, guarantee services, over-the-counter (OTC) networks, bridges, and mixers, typically operating within a 45-day cash-out window. DPRK wallets predominantly use Chinese-language services, largely avoiding decentralized finance (DeFi) lending protocols, decentralized exchanges (DEXs), and peer-to-peer (P2P) platforms. This pattern suggests structural constraints and dependence on regional facilitators rather than access to broad global financial systems.
Beyond major exchanges, personal-wallet compromises accounted for 20% of the total value stolen in 2025. While the number of these incidents rose to 158,000, the dollar value declined by 52% to $713 million. Post-hack activity generally proceeds over approximately 45 days from initial obfuscation through to final integration.
Chainalysis notes indications that artificial intelligence supports the laundering workflow, enabling large-scale cryptocurrency thefts.
