North Korea-Linked Crypto Thefts Surpass $2B in 2025, Totaling $6.75B

In a striking revelation, North Korea-associated hackers have recorded their highest year of cryptocurrency thefts to date, transforming 2025 into a serious cautionary tale for the industry. A few state-sponsored attacks have proven to be enough to breach even the most robust defenses.

Key Takeaways

North Korean hackers recorded more than $2 billion in cryptocurrency thefts in 2025, accounting for 76% of all breaches.
Major incidents indicate that just a few large hacks can cause significant damage to the industry.
Investigators attribute high-impact breaches to the presence of DPRK-linked IT workers embedded within crypto services.
Private key compromises have been identified as a central issue for centralized platforms, driving most losses.
The total number of reported theft incidents surged to 158,000 in 2025, with a notable shift towards more targets involving smaller thefts per victim.

Image Source: Chainalysis

North Korea

According to Chainalysis's Crypto Crime Report released on Thursday, the cryptocurrency industry suffered losses exceeding $3.4 billion due to theft from January until early December 2025. A lone incident in March involving Bybit accounted for a staggering $1.5 billion of that total. North Korea's regime, the Democratic People's Republic of Korea (DPRK), has emerged as the leading threat actor, responsible for at least $2.02 billion in theft—marking a 51% increase from the previous year. These attacks constituted a record 76% of all service breaches, leading to a cumulative theft total of $6.75 billion.

High-Impact Breaches Driven by Embedded Workers

Chainalysis revealed that the top three hacks of 2025 accounted for an alarming 69% of service losses, with the largest single event surpassing $1 billion in theft for the first time. The organization highlighted that North Korean-affiliated hackers are increasingly placing IT workers within cryptocurrency companies. This strategy grants them privileged access, which they leverage to execute significant breaches across exchanges, custodians, and Web3 firms.

The report further indicated that private key breaches remain a persistent issue for centralized platforms. In the first quarter of 2025 alone, these compromises accounted for 88% of total losses—even in firms equipped with institutional-level resources and professional security teams. Concurrently, individual wallet thefts became increasingly common, despite the average loss per attack decreasing.

South Korean Investigation Connects Solana Wallet Breach to DPRK

Authorities in South Korea, along with cybersecurity firms, suspect that the breach of Upbit's Solana hot wallet in November 2025 was executed by Lazarus, North Korea's state-sponsored hacking group. This breach reportedly siphoned off approximately 44.5 billion won, or $30 to $36 million, in Solana-based tokens.

According to Chainalysis, the total number of theft incidents in 2025 skyrocketed to 158,000, impacting over 80,000 victims and resulting in $713 million stolen from individuals; this suggests that attackers are now targeting a larger number of users but with reduced amounts per theft.

When DPRK-linked funds are transferred, they typically follow a disciplined pattern. Chainalysis detailed a multi-wave laundering process that generally unfolds over approximately 45 days after major thefts. This process includes quick layering, integration via selected venues, and final conversion touchpoints.

Additionally, the report highlighted unique operational tactics, such as a heavy reliance on Chinese-language money movement and guarantee services. Notably, DPRK actors also showed a preference for using bridges and mixing services, rather than pursuing lending protocols or peer-to-peer venues, unlike many other criminals.

Lastly, the laundering patterns of DPRK actors appear distinct. Chainalysis noted that over 60% of the transaction volume involved transfers of less than $500,000, diverging from other actors who typically transact in larger amounts, indicating a more sophisticated approach to structuring their illicit activities.