North Korean hackers stole a record $2 billion of crypto in 2025, Chainalysis says

Finance

Share

Share this article

Copy linkX (Twitter)LinkedInFacebookEmail

North Korean hackers stole a record $2 billion of crypto in 2025, Chainalysis says

North Korea-linked hackers drove a record year for crypto thefts, favoring rare but massive attacks on centralized services, led by Bybit’s $1.4 billion breach.

By Oliver Knight|Edited by Sheldon Reback

Dec 18, 2025, 1:00 p.m.

North Korea hackers stole $2 billion in 2025 (Micha Brändli, Unsplash modified by CoinDesk)

What to know:

• North Korean hackers stole at least $2 billion in 2025, up 51% from the year before, pushing their all-time haul to $6.75 billion.
• The hackers were behind 76% of service-level hacks, reflecting a shift toward fewer, larger breaches.
• Laundering patterns show heavy use of Chinese-language brokers, bridges and mixers, with a typical 45-day cash-out window.

North Korean hackers stole at least $2 billion in cryptocurrency this year, the most on record, pushing the Democratic People’s Republic of Korea's (DPRK) all-time haul to $6.75 billion, according to a new Chainalysis report.

The figure represents a 51% increase over 2024 from fewer confirmed incidents. The numbers underscore a shift toward fewer, dramatically larger attacks, underpinned by March's $1.4 billion hack of Bybit.

STORY CONTINUES BELOW

Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters

Sign me up

By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.

In contrast to other cybercriminals, North Korean groups overwhelmingly target large, centralized crypto services, aiming for maximum impact rather than frequency, the report said. DPRK-linked actors were responsible for 76% of all service-level compromises in 2025, the most ever recorded.

How they launder the cash also stands out. While other hackers tend to distribute stolen funds in large onchain transfers, DPRK actors consistently work with smaller tranches below $500,000, a sign of increasingly sophisticated operational security.

DPRK-linked wallets show a heavy reliance on Chinese-language guarantee services, brokers and over-the-counter networks, as well as extensive use of bridges and mixing services. They largely avoid the DeFi lending protocols, decentralized exchanges and peer-to-peer platforms favored by other criminals. These patterns suggest structural constraints and a dependence on specific regional facilitators rather than broad access to global financial infrastructure.

Earlier this year, CoinDesk reported on how North Korea is now using AI as a "superpower" in its hacking efforts.

"North Korea facilitates the laundering of their crypto heists with consistency and fluidity indicative of the use of AI," Andrew Fierman, head of national security intelligence at Chainalysis told CoinDesk.

"The mechanism by which the laundering is structured, and the scale at which it is done, creates a workflow that combines mixers, DeFi protocols, and bridges early on in the laundering process to convert funds across various crypto assets," he said. "To execute this type of efficacy in stealing such large volumes of crypto, North Korea needs a large laundering network, along with streamlined mechanisms to facilitate that laundering, which likely comes in the form of the use of AI."

Analysis of post-hack activity reveals that major North Korean thefts typically unfold over a roughly 45-day laundering window, moving through distinct phases from immediate obfuscation to final integration, Chainalysis said. While not universal, the consistency of this timeline across multiple years provides valuable intelligence for law enforcement and compliance teams seeking to intercept stolen funds before they are fully cashed out.

At the same time, the broader theft landscape is shifting. Personal wallet compromises accounted for 20% of total value stolen in 2025, dropping from 44% last year. While the number of incidents surged to 158,000, the dollar value taken from individual victims fell 52% to $713 million. The data suggest attackers are targeting more users but stealing less from each.

As the year winds to a close, North Korea's crypto hacking efforts show no sign of curtailing, the report's findings point to an increasingly polarized threat environment: mass, low-value thefts from individuals on one end, and rare but catastrophic service-level breaches on the other, with North Korea firmly at the center of the latter.

North KoreaChainalysisHackCrime

More For You

Protocol Research: GoPlus Security

By CoinDesk Research

Nov 14, 2025

Commissioned byGoPlus

What to know:

• As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
• GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
• Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

View Full Report

More For You

SoFi unveils the first bank-issued stablecoin for enterprise payments

By Helene Braun, AI Boost|Edited by Cheyenne Ligon

46 minutes ago

SoFi Bank becomes the first U.S. national bank to launch a stablecoin, positioning SoFiUSD as a faster, safer alternative to crypto-native tokens.

What to know:

• SoFi has launched SoFiUSD, a U.S. dollar stablecoin backed 1:1 by cash held at the Federal Reserve and issued by its FDIC-insured national bank.
• The coin runs on a public blockchain, offering instant, low-cost settlement and opening the door to white-labeled stablecoin services for fintechs, banks and enterprises.
• Initially limited to internal use, SoFiUSD is expected to roll out to SoFi members in the coming months as part of a broader payments strategy.

Read full story

Latest Crypto News

U.S. inflation data surprises, with CPI higher by just 2.7% in November

11 minutes ago

SoFi unveils the first bank-issued stablecoin for enterprise payments

46 minutes ago

Dogecoin and Shiba Inu lag market as memecoins continue to lose ground to bitcoin

53 minutes ago

Hut 8 price target boosted at Cantor and Canaccord after Google-backed AI deal

1 hour ago

BNB holds onto fourth-largest crypto spot even as price falls, selling pressure builds

1 hour ago

Uniswap vote could soon tie UNI token value to its multibillion-dollar trading engine

1 hour ago

Top Stories

U.S. inflation data surprises, with CPI higher by just 2.7% in November

11 minutes ago

Crypto Market Today: Bitcoin-gold ratio drops to lowest since January 2024

1 hour ago

Micron crushes earnings, calming markets and helping boost bitcoin back above $87,000

1 hour ago

Hut 8 price target boosted at Cantor and Canaccord after Google-backed AI deal

1 hour ago

JPMorgan’s tokenized dollars are quietly rewiring how Wall Street moves money

4 hours ago

World Liberty Financial proposes using treasury funds to boost USD1 stablecoin growth

1 hour ago