North Korea-linked hackers stole approximately $2.06 billion out of $3.4 billion in total crypto losses during 2025, according to a new CertiK report. The figure underscores how one nation-state has effectively monopolized crypto theft on a massive scale.
CertiK's analysis reveals a troubling evolution in North Korean hacking operations. The regime has shifted tactics from basic phishing attacks to physical infiltration of crypto companies and exchanges. This escalation reflects a more sophisticated, organized approach to stealing digital assets. The group now operates with what CertiK describes as an "industrialized" methodology, treating crypto theft as a systematic enterprise rather than opportunistic attacks.
The $2.06 billion haul represents roughly 61 percent of all crypto stolen globally in 2025. North Korean actors have become the dominant force in large-scale theft operations, demonstrating capability and coordination across multiple attack vectors. Physical infiltration represents a significant tactical shift. Rather than relying solely on remote hacking, the operatives now directly access crypto infrastructure through on-site personnel placement or direct compromise of physical security measures.
Laundering stolen crypto has become equally refined. North Korean actors use sophisticated mixing services, cross-chain bridges, and decentralized finance protocols to obscure fund flows. The proceeds ultimately fund the regime's weapons programs and circumvent international sanctions. This creates a direct pipeline from crypto thefts to geopolitical threats.
The CertiK report signals that traditional cybersecurity measures prove insufficient against state-backed actors with unlimited resources and personnel. Exchanges and crypto firms now face an adversary with nation-state backing, intelligence operations, and patience for long-term infiltration campaigns.
The theft scale has expanded dramatically year over year. North Korea's crypto operations have become a reliable revenue stream for Kim Jong Un's government, offsetting sanctions impact and funding military