Since the beginning of 2025, hackers from North Korea have stolen approximately $2 billion in cryptocurrency, according to the analytics company Elliptic. The total damage caused by these criminals, including those from previous years, exceeds $6 billion. The crypto exchange Bybit suffered the largest losses, while platforms LND.fi, WOO X, and Seedify were also affected. Elliptic attributes more than 30 incidents to North Korean cyberattacks this year.
Notably, the current figures are almost three times higher than last year. According to the UN, the stolen funds may be used to finance the country's nuclear program.
Hackers have significantly changed their attack strategy. While they previously exploited technical vulnerabilities, the focus is now on social manipulation—deceiving exchange employees and private investors. Wealthy individuals and companies associated with them are often targeted, allowing attackers to gain direct access to large sums of money.
Asset laundering methods have also become more sophisticated. Attackers employ multi-stage schemes, including mixing, cross-chain transactions, and the use of obscure networks. They also actively exploit refund addresses to move cryptocurrency to new wallets and cover their tracks.
Despite this, experts emphasize that blockchain remains a transparent system, and transaction analysis allows for the identification of stolen funds. Many exchanges implement mechanisms to block suspicious assets, limiting hackers' ability to withdraw them.
As recently as July 2025, the crypto industry lost $142 million due to 17 successful cyberattacks, demonstrating the growing threat from cybercriminals. Experts are urging companies to strengthen their defenses and train employees in fraud detection techniques.