Hackers working on behalf of the North Korean government have stolen more than $2 billion in cryptocurrency so far this year, according to a new estimate from blockchain analysis firm Elliptic. The company published a blog post with the data, stating that the figure is the “largest annual total on record, with three months still to go,” and is based on more than 30 hacks this year.
Record-Breaking Theft and Underestimation
The current total of over $2 billion already surpasses the previous record of $1.35 billion stolen by the regime in 2022. Elliptic estimates that the regime’s cumulative known crypto theft since 2017 now stands at least at **$6 billion**, though the firm cautions this figure may be an underestimate. The blog post explained the difficulty in precise attribution: “The actual figure may be even higher. Attributing cyber thefts to North Korea is not an exact science.” The company noted that many other thefts share the hallmarks of North Korean activity but lack sufficient evidence for definitive attribution, while others are likely unreported.
The massive record total this year was predominantly fueled by a single incident: the theft of more than $1.4 billion from crypto exchange Bybit. This attack was attributed to North Korea by the FBI and several blockchain monitoring firms. While North Korea’s primary targets remain crypto exchanges, the regime’s hackers are now increasingly targeting “high-net-worth individuals,” who own large amounts of cryptocurrency.
This change in targets is accompanied by a significant shift in tactics. Elliptic stated that “The majority of the hacks in 2025 have been perpetrated through social engineering attacks,” where hackers manipulate or deceive individuals to gain access to cryptocurrency. This marks a departure from earlier attacks that often exploited technical flaws in crypto infrastructure. This shift, according to the company, “highlights that the weak point in cryptocurrency security is increasingly human, rather than technical.”
Funding the Weapons Program
Elliptic’s current estimate aligns with that of other organizations; the United Nations Security Council estimated last year that North Korean hackers stole $3 billion in cryptocurrency between 2017 and 2023. Government bodies including the United States, South Korea, and Japan also accused North Korean hackers of stealing roughly $659 million in 2024. The United Nations believes the regime led by Kim Jong-Un uses the stolen crypto to fund its nuclear weapons program. Previous victims of North Korean hackers over the years have included the play-to-earn game Axie Infinity ($625 million in 2022), the crypto startup Harmony ($100 million in 2022), and the crypto exchange WazirX ($235 million in 2024), among many others.
What The Author Thinks
North Korea’s record-breaking crypto theft, driven by a strategic pivot toward social engineering, confirms that the most sophisticated state actors are now successfully bypassing technical cybersecurity defenses by exploiting human error. This shift is a critical wake-up call for the cryptocurrency industry: as code and infrastructure become more robust, investment must rapidly pivot toward training and layered human security, otherwise, individual employees and high-net-worth individuals will remain the most exploitable weak points. The fact that billions of dollars are flowing directly into a nuclear weapons program via phishing scams and impersonations underscores the severe national security threat posed by the regulatory immaturity and porous human element of the digital asset space.
Featured image credit: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.