AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
A 51% surge pushed cumulative DPRK crypto thefts to $6.75 billion, driven by larger compromises against centralized platforms.
Key points
- DPRK hackers stole $2.02 billion in 2025, lifting North Korea's cumulative crypto theft haul to at least $6.75 billion [1].
- North Korean operations accounted for 76% of all funds stolen from crypto services in 2025, led by the $1.5 billion Bybit compromise [1].
- Laundering patterns showed over 60% of transfers structured below $500,000, heavily utilizing Chinese-language guarantee services and bridges [1].
North Korean state-sponsored hackers stole $2.02 billion in cryptocurrency across 2025, marking a 51% year-over-year increase, according to a report published by blockchain analytics firm Chainalysis on Oct. 6, 2026 [1]. The record annual haul pushed estimated all-time crypto funds stolen by the Democratic People’s Republic of Korea (DPRK) to $6.75 billion, even as the overall frequency of its attacks decreased [1].
The broader digital asset sector recorded more than $3.4 billion in total stolen funds between January and early December 2025 [1]. North Korean actors accounted for 76% of all value stolen from crypto services during the year [1]. Losses became heavily concentrated in high-value incidents, driven largely by the February 2025 breach of centralized exchange Bybit, which alone represented $1.5 billion in losses [1]. Chainalysis noted that the top three exploits in 2025 made up 69% of all platform theft, with the ratio between the largest single hack and the median incident exceeding 1,000x for the first time [1].
Shifting Infiltration Tactics and Laundering Networks
Chainalysis found that North Korean operatives achieved larger returns by evolving infiltration techniques rather than launching broad attacks [1]. Threat actors expanded beyond embedding remote IT staff directly into crypto platforms [1]. Operatives increasingly impersonated corporate recruiters for artificial intelligence and web3 firms, deploying fraudulent technical screening tasks to capture virtual private network (VPN) and single sign-on (SSO) credentials, source code, and internal access [1]. Attackers also conducted social engineering schemes targeting executives while posing as strategic investors or acquirers during corporate due diligence [1].
Once funds were taken, DPRK groups executed a typical 45-day laundering cycle characterized by structured transfers [1]. In contrast to other cybercriminals who often move capital in transactions between $1 million and $10 million, North Korean actors directed over 60% of their on-chain volume in tranches under $500,000 [1]. Chainalysis tracked significant reliance on Chinese-language money laundering and guarantee networks, cross-chain bridges, mixing protocols, and specialized platforms such as Huione, while showing markedly lower participation in lending protocols and peer-to-peer exchanges [1].
Sources
- North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion — Primary document (discovered)
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.
Top comments (0)