In Short:
– North Korean hackers stole over $2 billion in cryptocurrency in 2025, nearly tripling last year’s total.
– A shift to social engineering tactics has led to increased targeting of high-net-worth individuals for cyber attacks.

North Korean hackers have reportedly stolen over $2 billion in cryptocurrency assets in 2025, setting a record with three months still left in the year.

Data from blockchain analytics firm Elliptic indicates that this amount nearly triples the total stolen last year, accounting for approximately 13% of North Korea’s estimated GDP and raising the regime’s total crypto theft to over $6 billion since 2017.

A significant portion of the 2025 theft is attributed to the February hack of cryptocurrency exchange Bybit, which amounted to $1.46 billion.

The FBI has linked this breach to state-sponsored North Korean hackers, who exploited weaknesses in Bybit’s wallet management system. More than 30 additional cyber attacks have also been associated with North Korea this year, including notable breaches at LND.fi and WOO X.

Shift In Tactics

A shift in methodology among North Korean hackers has been observed, as they now focus on social engineering rather than technical exploits. According to Elliptic, the primary vulnerability lies with individuals rather than technology.

High-net-worth individuals and corporate executives are increasingly targeted due to their relatively weaker security measures.

The hackers utilise deceptive tactics, including phishing schemes and fake job offers, to access private cryptocurrency wallets. Intelligence reports suggest that the stolen funds are used to finance North Korea’s nuclear programmes.

The regime has also improved its money laundering techniques by employing various cryptocurrencies and mixing methods to obscure fund origins. Blockchain analysts are actively tracking these stolen assets, with notable progress achieved in identifying recoverable funds.