In a concerning revelation, researchers have reported that in 2025 alone, North Korean hackers stole over $2 billion through cyber crime, establishing a worrying new record for such illicit activities attributed to the regime. To put the gravity of this theft in perspective, this figure constitutes approximately 13% of North Korea’s GDP, based on United Nations estimates. The funds obtained through cyber crime are suspected to be funneled into the country’s controversial nuclear weapons and missile programs, posing serious international security concerns.
Over the years, notorious hacking groups such as the Lazarus Group have consistently targeted cryptocurrency platforms, identifying and exploiting vulnerabilities to stage large-scale thefts of digital currency. The most devastating attack this year occurred in February, when hackers infiltrated the cryptocurrency exchange ByBit, siphoning $1.4 billion. This incident underscores the growing sophistication and brazen nature of these cyber criminal activities.
Recent studies from the security firm Elliptic indicate that apart from attacking major crypto exchanges, North Korean hackers are now increasingly setting their sights on individual cryptocurrency holders, especially those with substantial digital fortunes. These individuals often lack the comprehensive security frameworks employed by larger organizations, making them attractive and vulnerable targets. Elliptic’s chief scientist, Dr. Tom Robinson, emphasizes that many of these cyber thefts targeting individuals likely go unreported, potentially leading to an underestimation of North Korea’s full engagement in cyber criminality.
Attribution remains a formidable challenge in the realm of cyber security, making it difficult to assign specific cyber thefts directly to North Korean operatives. Nonetheless, analysts from firms like Elliptic and Chainalysis are adept at tracking the flow of stolen assets, such as Bitcoin and Ethereum, through meticulous analysis of blockchain transactions. These investigations often uncover distinct patterns and methodologies favored by North Korean hackers, offering valuable insights into their tactics.
The estimated total value of known crypto assets illicitly obtained by North Korean hackers has now surpassed $6 billion, with a significant uptick in cyber attacks noted in recent years. Just in 2025, more than 30 separate incursions have been linked to North Korea, including a July heist where $14 million was stolen from nine users of the crypto platform WOO X, and another taking $1.2 million from Seedify.
In addition to direct hacking, reports suggest an elaborate North Korean scheme involving fake IT workers, which serves as an alternative revenue stream to bypass stringent international sanctions. This multifaceted approach to cyber crime and economic circumvention continues to pose formidable challenges to global cybersecurity frameworks.
As the cyber threat landscape evolves, North Korean operations in 2025 highlight the alarming increase in both the ambition and financial yield of these activities. They underscore an urgent need for bolstered cybersecurity defenses and a coordinated international effort to mitigate the financial and geopolitical risks posed by these actions.