North Korea-linked hackers stole at least $2.02 billion in cryptocurrency in 2025. That marked a 51% increase from 2024. It pushed the regime’s estimated all-time crypto haul to $6.75 billion.
The figures come from a preview chapter of Chainalysis’ 2026 Crypto Crime Report.
They underline how a small number of state-backed attacks can still dominate industry-wide losses.
They also show that defenses at major platforms remain vulnerable to rare but catastrophic failures.
Chainalysis said total crypto theft across the industry reached more than $3.4 billion in 2025.
That made it one of the worst years on record for losses.
A single breach at Bybit in March accounted for roughly $1.5 billion of that total.
What Happened
Chainalysis said Democratic People’s Republic of Korea-linked actors were responsible for 76% of all service-level compromises by value in 2025.
That share was the highest ever recorded.
The jump came despite fewer confirmed incidents overall.
According to the firm, the top three hacks made up 69% of all service losses.
The largest incident exceeded the median theft size by more than 1,000 times.
One key driver was access.
Chainalysis said DPRK-linked groups increasingly embed IT workers inside crypto companies.
Those workers gain privileged credentials and later help enable large-scale breaches across exchanges, custodians, and Web3 firms.
Private key failures remained the dominant weakness for centralized platforms.
Chainalysis said such compromises drove 88% of losses in the first quarter of 2025.
That included firms with institutional-grade security teams.
South Korean authorities have also linked recent activity to DPRK actors.
Investigators said the November breach of Upbit’s Solana (SOL) hot wallet siphoned roughly 44.5 billion won, or about $30–36 million.
Security firms attributed the attack to the Lazarus Group.
Read also: World Liberty Financial Proposes $120M Treasury Move, Faces Community Opposition
Why It Matters
The data suggests crypto crime is becoming more concentrated, not more frequent.
Fewer attacks are now doing far more damage.
For individuals, the picture is different.
Chainalysis estimated about 158,000 theft incidents in 2025 involving at least 80,000 victims.
Total losses from personal wallets fell to about $713 million.
That implies more victims but smaller losses per user.
Chainalysis also detailed how DPRK-linked funds typically move after major hacks.
The firm said stolen assets are laundered in structured stages over about 45 days.
Transfers are often broken into sub-$500,000 chunks.
Other criminals more often move $1 million to $10 million at a time.
That pattern points to disciplined, state-level operations.
It also raises fresh pressure on exchanges, regulators, and investigators to disrupt laundering routes before stolen funds fully exit the crypto system.
Read next: Taiwan Ranks 8th Globally In Government Bitcoin Holdings From Law Enforcement