North Korean Hackers Steal $2B in ETH, SOL, and Cryptos in 2025

In 2025, crypto hacks increased significantly. The cybercriminals associated with the North Korean government stole more than $2 billion in digital currencies, particularly Ethereum and Solana.

According to investigators, their attacks had fallen by 74% relative to the previous year, but was significantly more impactful. Hence, the total theft was higher despite security improvements by crypto firms.

Why North Korean Crypto Attacks Are Getting Bigger

This dramatic shift shows how the isolated nation has perfected its crypto theft strategy. Instead of launching many small attacks, they now focus on massive heists that yield billions.

The biggest theft came in February when hackers took $1.5 billion from Bybit exchange. That single hack accounted for most of 2025’s stolen funds. It also ranked as the largest crypto theft in history. The fact that further breaches, such as the Upbit hack, highlighted the growing risks crypto firms continue to face.

Chainalysis published results to show that since 2016, North Korea has now stolen $6.75B in crypto. However, their strategies have changed tremendously. The spies install themselves within crypto firms as IT employees. This insider access gives them privileged information about security systems and private keys.

Some hackers go further by impersonating recruiters from major crypto firms. They conduct fake job interviews that trick victims into downloading malicious software. These “technical screens” actually harvest login credentials and access to company networks.

Why North Korea Dominates Crypto Hacks

The strategy works because crypto exchanges handle billions in assets daily. According to Chainalysis, the success of one breach can sustain state activities for months and even years. At the beginning of December 2025, the amount of stolen crypto grew to $3.4 billion, with North Korean attacks constituting 59% of the total, which demonstrates their supremacy in this market.

Personal wallet attacks were also high in 2012. Approximately 158,000 hack cases were committed against approximately 80,000 victims.

Nevertheless, the total amount stolen off people decreased to $713 million compared to $1.5 billion in 2024. Scrutinization from the law is on the rise. A court recently ruled that XRP needs to be considered as property, following recent cases of stolen crypto assets.

This implies that hackers are attacking more individuals but lesser amounts are stolen from each person. This is probably an indication of better security in large crypto exchanges areas, driving offenders to individuals, who they would consider as easier targets.

North Korean hackers have specific ways of laundering money, which helped investigators trace the movement of the funds. They use money-laundering services from Chinese firms and cross-chain bridges. Also, a 45-day cycle after significant thefts characterized most of the stolen money they transferred.