North Korean state-sponsored hackers made off with $2 billion in cryptocurrency during 2025 — a 51% jump from the year before, according to fresh data. The thefts focused on Web3 projects and exchanges, marking another aggressive year for the country's cyber operations.
The 2025 tally
The $2 billion figure represents a significant escalation. The 51% year-over-year increase shows that Pyongyang's hacking units are not slowing down. These aren't random smash-and-grab jobs; the attacks are methodical, targeting the infrastructure of decentralized finance and centralized trading platforms alike.
Targeting Web3 and exchanges
The pattern is clear: Web3 projects and exchanges took the brunt of the damage. Smart contract exploits, private key compromises, and social engineering campaigns were the tools of choice. For exchanges, the threat is existential — one bad exploit can wipe out user funds and destroy trust built over years.
North Korea's motivations are well understood: crypto provides a way around international sanctions, funding weapons programs and regime stability. The 2025 haul underscores how reliant the country has become on this pipeline.
What comes next
2026 is already underway, and there's no sign the groups are letting up. Security teams at exchanges and DeFi protocols are racing to harden defenses, but the hackers keep adapting. The question now is whether the industry — and the governments monitoring these flows — can cut off the spigot before this year's tally tops last year's.
