North Korean hackers stole $2.02 billion in cryptocurrency in 2025, setting a new record

A report released by Chainalysis on Thursday shows that North Korea's cryptocurrency hacking operations stole $2.02 billion in 2025, setting a new record. Previously, the highest record for cryptocurrency stolen by North Korea through hacking and theft (such as Bitcoin and Ethereum) was $1.3 billion. This brings the total amount of cryptocurrency stolen by North Korea to approximately $6.75 billion. The total amount of stolen cryptocurrency globally has risen to $3.4 billion, a significant portion of which comes from this year's attack on the Dubai cryptocurrency exchange Bybit.

The CEO of Bybit stated that, according to the U.S. Secret Service, hackers working for North Korea's elite government hacking group stole about $1.5 billion in February, most of which was Ethereum. The United Nations and private researchers have long accused North Korea, which is under international sanctions and maintains relations with only a few countries, of deploying hackers to steal cryptocurrency to fund its nuclear weapons and missile programs. Chainalysis is one of the growing number of companies mapping cryptocurrency transaction networks, including tracking stolen funds laundered by criminals.

The Chainalysis report notes that despite these platforms having institutional resources and professional security teams, they remain vulnerable to attacks due to this fundamental security challenge. Matt Pearl, director of the Strategic Technology Program at the Center for Strategic and International Studies, stated that it is difficult to stop North Korea's actions because it is largely isolated from the world and is a "rogue state." The report indicates that some of the thefts are likely due to North Korean hackers increasingly obtaining remote technical positions in international companies through fraudulent means. This access can provide them with opportunities to offer their hacking colleagues keys to steal cryptocurrency and transfer it to bases in Pyongyang. Pearl stated that given North Korea is already facing extreme sanctions, there are virtually no other ways to stop it from continuing to fund military operations through attacks on digital assets.