- Since records began, Pyongyang is estimated to have stolen over $6.75 billion in digital assets to fund its regime.
If stealing cryptocurrency were GDP, North Korea would be a rapidly growing developing economy. Chainalysis and TRM Labs, two blockchain analytics companies, have named 2025 the “Year of the Hack” for the DPRK, breaking all previous records.
The numbers are shocking. This year, the Lazarus Group, a North Korean state-sponsored group, stole nearly $2 billion in digital assets. There are 51% more breaches than in 2024, even though there are fewer of them.
They used to fish for small fish, but now they go after the biggest sharks in the water, which is scary.
The year started with a disaster in February 2025, when The Bybit exchange lost $1.5 billion in Ethereum and other valuable items in the biggest crypto theft ever.
The last “smash and grab” attacks were all over the place, but this one was very planned. It wasn’t just a coding flaw; it was a masterful use of social engineering. They got the keys to the castle by getting past the company’s human layer, possibly by using their fake “remote IT workers.”
This incident was worse than the 2022 Ronin Bridge breach and showed that state-level cyberwarfare can hit top-tier centralized exchanges.
For years, people called decentralized finance (DeFi) the Wild West. But things changed in 2024 and 2025. Lazarus Group goes after Centralized Exchanges again.
Why? Because that’s where the liquidity is.
- DMM Bitcoin (Japan): Hit for over $300 million in mid-2024.
- WazirX (India): Drained of $235 million in July 2024.
- Bybit (Global): The $1.5 billion behemoth in 2025.
As noted in the TRM Labs 2025 report, this shift indicates that hackers are now confident enough to tackle the sophisticated security systems of centralized platforms, often using compromised private keys rather than smart contract bugs.
These thefts can no longer be seen as separate from geopolitics; they represent a critical national security threat. It’s not about getting lambos; it’s about getting centrifuges.
The FBI and the UN Security Council, have elevated these incidents to a top-tier national security priority, stating that cybercrime funds almost half of North Korea’s missile program. When a major exchange runs out of money, the world is basically seeing a fundraising round for North Korea’s nuclear goals.
The crypto industry has become one of the biggest sources of money for the Kim regime, even though it has lost $6.75 billion in the last few years. The question isn’t “if” they will attack again as we move into 2026, but “who” will be next.
