According to the analytics firm, groups associated with Pyongyang stole more than $2 billion in digital assets in 2025 – a record figure since monitoring began, even though several months remain until the end of the year.
The total amount of cryptocurrency stolen by entities connected to North Korea has now exceeded $6 billion. The United Nations and several government agencies believe these funds are used to support the country’s nuclear and missile programs.
Analysts note that the real figure could be even higher, as not all incidents have confirmed links to North Korea and some thefts have yet to be publicly disclosed. The largest attack occurred in February, when hackers withdrew $1.46 billion from the Bybit exchange. Elliptic also attributes breaches of platforms such as LNDfi, WOO X, and Seedify to North Korean groups.
In total, the company recorded more than thirty incidents in 2025 that were likely connected to the DPRK. Experts say North Korean hackers have shifted tactics – moving away from exploiting software vulnerabilities toward social engineering, including phishing, data manipulation, and impersonation of trusted contacts.
An increasing number of attacks target wealthy investors and employees with access to corporate digital assets. Elliptic notes that rising market prices make such targets more attractive, while the human factor remains the weakest link in security.
The firm concludes that the scale of theft in 2025 reflects the growing intensity of North Korea’s cyber operations and underscores the need for stronger international coordination to detect and prevent illicit activity. Despite the surge in attacks, Elliptic adds, laundering stolen funds is getting harder – thanks to improved blockchain analytics, closer cooperation with law enforcement and exchanges, and the transparent nature of blockchain networks, which allows investigators to trace stolen assets.
Read also:
- $21 Million Drained From SBI Crypto Wallets and Moved Through Tornado Cash – ZachXBT
- ZachXBT Uncovered 25+ Attacks Involving North Korean Hackers Masquerading as Crypto Employees
- G7 Leaders Prepare Response to North Korea’s Cryptocurrency Attacks
This post is for informational purposes only and is not advertising or investment advice. Please do your own research before making any decisions.