Hackers linked to the North Korean government have stolen more than $2 billion in cryptocurrency so far this year, marking the largest annual total on record, according to blockchain analysis firm Elliptic. With three months still remaining in 2025, the figure surpasses previous records, driven by over 30 cyberattacks targeting crypto exchanges and high-net-worth individuals.
Elliptic revealed the findings in a blog post on Tuesday, highlighting that the majority of the thefts this year have been carried out through social engineering attacks. “This marks a shift from earlier attacks where technical flaws in crypto infrastructure were exploited,” the company said. “The weak point in cryptocurrency security is increasingly human, rather than technical.”
The record-breaking figure is fueled largely by February’s massive $1.46 billion hack of the cryptocurrency exchange Bybit, which has been attributed to North Korean operatives by the FBI and several blockchain monitoring firms. Other victims this year include LND.fi, WOO X, and Seedify.
Since 2017, North Korean hackers have stolen at least $6 billion in cryptoassets, with past high-profile attacks including $625 million from play-to-earn game Axie Infinity in 2022, $100 million from crypto startup Harmony in 2022, and $235 million from crypto exchange WazirX in 2024. Elliptic notes that the true figure could be even higher, as many thefts remain unreported or cannot be definitively linked to North Korea.
Governments including Japan, South Korea, and the United States, as well as the United Nations, have expressed concern that North Korea uses these stolen funds to support its nuclear weapons and missile programs.
Elliptic also highlighted the increasingly sophisticated methods used to launder stolen cryptocurrency. Techniques now include multiple rounds of mixing, cross-chain transactions, obscure blockchains with limited analytics coverage, and even trading tokens issued directly by laundering networks. Despite these tactics, blockchain transparency continues to enable investigators to track illicit funds across multiple networks.
“The record-breaking $2 billion stolen this year underlines both the scale of the threat and the importance of robust blockchain analytics,” Elliptic said. “By shining a light on illicit activity through the transparency of blockchains, we empower businesses and law enforcement to ensure that the crypto ecosystem remains a place of trust, safety, and innovation.”
As North Korea adapts its cyber theft tactics, experts warn that both individuals and exchanges must remain vigilant, as social engineering attacks increasingly target humans rather than infrastructure, making awareness and security practices critical in the fight against cyber-enabled crime.
