North Korean Crypto Hackers Steal Over $2 Billion in 2025

The North Korean crypto hackers have already stolen over $2 billion in digital assets this year, setting a new record. Their increasingly advanced methods now focus on individuals instead of exchanges, reflecting a major strategic shift in cybercrime.

Shift from Exchanges to Individuals

In previous years, North Korean groups mainly targeted cryptocurrency exchanges. However, 2025 has seen a clear change in their priorities. Hackers now focus on private investors, using social engineering and fake recruitment campaigns to compromise wallets. Smaller targets often lack strong defenses, making them easier to exploit.

The total value of assets stolen by North Korean cybercriminals now exceeds $6 billion. Experts believe the actual figure may be higher since many incidents remain unreported or unattributed.

Major Heists and Methods

One of the largest attacks this year involved the Bybit exchange, which suffered losses of over $1.4 billion. Other major breaches included Seedify, LND, and WOO X, with damages ranging from several million to tens of millions.

These North Korean crypto hackers use complex phishing campaigns, fake job offers, and malware disguised as professional tools. In recent operations, the group deployed a new Trojan called PylangGhost to compromise employees at crypto firms. Attackers often create fake interview pages to lure victims into running malicious code.

Motives and Global Impact

Analysts believe the stolen cryptocurrency helps fund North Korea’s nuclear and missile programs. With ongoing international sanctions, cyber theft has become one of the regime’s most profitable income sources. The trend underlines the growing link between cybercrime and global security risks.

Conclusion

The activities of North Korean crypto hackers reveal how state-backed groups adapt to exploit emerging financial technologies. As their tactics evolve, individuals and companies in the crypto industry must strengthen defenses, improve awareness, and treat social engineering as a primary security threat.