North Korean Crypto Hackers Steal $2.8 Billion in Global Attacks

The North Korean crypto hackers have generated almost $3 billion through cyberattacks, contributing about one-third of North Korea’s total foreign currency income, according to new findings by international monitors.

Massive Crypto Theft Fuels State Revenues

The Multilateral Sanctions Monitoring Team (MSMT) reported that from January 2024 to September 2025, North Korea-linked groups stole $2.84 billion in cryptocurrency. These assets accounted for a significant share of the country’s hard-currency income, underscoring how digital theft supports state finances despite global sanctions.

While the total percentage was smaller than in 2023, the DPRK increased its foreign income through arms deals and trade with Russia, the report noted.

Sophisticated Tactics and Global Impact

Groups such as TraderTraitor, CryptoCore, and Citrine Sleet used advanced social engineering and supply chain attacks to infiltrate multiple organizations. TraderTraitor alone was responsible for more than $2.5 billion in stolen funds.

The report highlighted that hackers increasingly target third-party service providers instead of crypto exchanges directly, exploiting vulnerabilities across global networks.

International Cooperation and Response

According to the MSMT, North Korean cybercriminals have collaborated with Russian-speaking hackers since the 2010s. In early 2025, actors linked to Moonstone Sleet even leased ransomware tools from Russia-based Qilin under a ransomware-as-a-service model.

In response, eleven Western and Asian governments urged all UN member states to counter North Korea’s cyber operations and reestablish the UN Panel of Experts to monitor such activities.

Conclusion

The North Korean crypto hackers have turned cyber theft into a cornerstone of the nation’s economy. Their operations reveal how state-backed cybercrime can reshape global finance, forcing governments to strengthen sanctions, improve security, and push for international unity against digital threats.