🧔♂️ A friendly human may check it before it goes live. More news here
North Korean hackers steal crypto worth $2b: report
North Korean hackers stole US$2 billion in cryptocurrency in 2025, marking a record haul and a more than 50% rise from 2024, according to blockchain analytics firm Chainalysis.
A major portion of this total came from a US$1.5 billion theft at Bybit, a crypto-exchange, in February.
Chainalysis estimates that North Korea-linked cryptocurrency thefts have reached at least US$6.8 billion since records began.
The country was responsible for most of the US$3.4 billion stolen from the global cryptocurrency industry between January and early December 2025.
Researchers noted that while the number of incidents linked to North Korea was lower this year, the use of insiders to gain privileged access led to more significant thefts.
Chainalysis observed that North Korean hackers launder funds by breaking transactions into smaller amounts to avoid detection.
In November, South Korea’s Upbit exchange reported a US$30 million theft, with media linking the incident to North Korea’s Lazarus hacking group.
🔗 Source: Bloomberg
🧠 Food for thought
Implications, context, and why it matters.
Frozen funds reduce losses from headline US$2 billion figure
- North Korean groups took US$2 billion, including US$1.5 billion from Bybit. Bybit refilled reserves within 72 hours, kept withdrawals open, and said client assets stayed fully backed 1.
- Of the Bybit haul, 88.87% stayed traceable weeks later, with 3.54% frozen (immobilized so thieves can’t move them) 2. A prior case recovered US$30 million from Lazarus Group’s US$600 million Axie Infinity theft in 2022 1.
- That gap between “stolen” and “net loss” shapes systemic risk. Exchanges can raise emergency funding from Galaxy Digital (a crypto-focused financial services company) and FalconX (a digital asset prime brokerage) to cover losses 1. Blockchain analytics firms track most funds 2.
Insider threat detection opens a market
- North Korea in 2025 leaned on insider-enabled breaches, placing IT workers inside crypto services or posing as recruiters to harvest credentials 3.
- Vendors plus managed security service providers (MSSPs) can sell to crypto exchanges and custodians (companies that safekeep digital assets), plus decentralized finance (DeFi) protocols. Offerings cover privileged access management (PAM), endpoint monitoring with session recording 4, plus behavioral analytics that flag anomalous data access patterns 5. Coinbase, a US crypto exchange, used audit logs with real-time alerts to catch insider threats months early 5.
- The tech stack includes hardware security modules (HSMs) and real-time transaction monitoring. Exchanges seeking Virtual Asset Service Provider (VASP) licensing in Dubai or compliance with the European Union’s Markets in Crypto-Assets (MiCA) regulation may need these tools as rules tighten after high-profile incidents 6.
Stay updated on the go with our mobile app.
Get latest insights with smoother, more personalized experience through TIA mobile app.