North Korean Hackers Stole Record $2.02B in Crypto in 2025, Chainalysis Reports

North Korean state-sponsored hackers stole $2.02 billion in cryptocurrency across 2025, marking a 51% year-over-year increase, according to a report published by blockchain analytics firm Chainalysis on Oct. 6, 2026 ¹. The record annual haul pushed estimated all-time crypto funds stolen by the Democratic People’s Republic of Korea (DPRK) to $6.75 billion, even as the overall frequency of its attacks decreased ¹.

The broader digital asset sector recorded more than $3.4 billion in total stolen funds between January and early December 2025 ¹. North Korean actors accounted for 76% of all value stolen from crypto services during the year ¹. Losses became heavily concentrated in high-value incidents, driven largely by the February 2025 breach of centralized exchange Bybit, which alone represented $1.5 billion in losses ¹. Chainalysis noted that the top three exploits in 2025 made up 69% of all platform theft, with the ratio between the largest single hack and the median incident exceeding 1,000x for the first time ¹.

Shifting Infiltration Tactics and Laundering Networks

Chainalysis found that North Korean operatives achieved larger returns by evolving infiltration techniques rather than launching broad attacks ¹. Threat actors expanded beyond embedding remote IT staff directly into crypto platforms ¹. Operatives increasingly impersonated corporate recruiters for artificial intelligence and web3 firms, deploying fraudulent technical screening tasks to capture virtual private network (VPN) and single sign-on (SSO) credentials, source code, and internal access ¹. Attackers also conducted social engineering schemes targeting executives while posing as strategic investors or acquirers during corporate due diligence ¹.

Once funds were taken, DPRK groups executed a typical 45-day laundering cycle characterized by structured transfers ¹. In contrast to other cybercriminals who often move capital in transactions between $1 million and $10 million, North Korean actors directed over 60% of their on-chain volume in tranches under $500,000 ¹. Chainalysis tracked significant reliance on Chinese-language money laundering and guarantee networks, cross-chain bridges, mixing protocols, and specialized platforms such as Huione, while showing markedly lower participation in lending protocols and peer-to-peer exchanges ¹.