NK Hackers Blamed for Record $2B Crypto Heist

State-sponsored hackers linked to North Korea stole a record-breaking $2.17 billion in cryptocurrency during the first half of 2025 to fund the regime’s sanctioned weapons programs, according to data released by Chainalysis.

A Historic Spike in Cryptocurrency Thefts

Blockchain analysis firm Chainalysis disclosed in a new report on Thursday that the $2.17 billion siphoned by cybercriminals between January and June of 2025 has already eclipsed the total amount of crypto lost during the entirety of last year. Furthermore, this staggering figure represents a 17% increase compared to the first half of 2022, which previously held the record for the worst year-to-date in crypto theft history.

The Bybit Exploit and State-Sponsored Laundering

A massive portion of this year’s stolen assets stems from a single, devastating security breach at the cryptocurrency exchange Bybit. During this exploit, North Korean threat actors successfully siphoned off more than $1.4 billion. According to the FBI, a significant portion of these stolen funds was subsequently laundered and funneled directly back to the North Korean regime.

Sanctions Evasion Tactics

Chainalysis emphasized that the Bybit exploit aligns with a well-established pattern of cyber operations from Pyongyang. These digital heists have become increasingly vital to the regime’s ongoing strategies to bypass international economic sanctions and maintain cash flow.

Pyongyang’s Multi-Pronged Cyber Threat

Largely isolated from the global economy and blocked from the international banking system, North Korea has evolved into a highly sophisticated threat actor. The nation systematically targets Western enterprises to steal digital assets, directly fueling its heavily sanctioned nuclear weapons development.

Infiltration and Extortion Schemes

Beyond direct network exploits, the regime deploys thousands of highly skilled, remote IT workers who disguise their identities to secure employment at global tech firms. Once inside, these operatives earn standard wages, steal sensitive intellectual property, and extort employers by threatening to leak confidential corporate files unless paid ransom.

This aggressive cyber campaign builds on an established trend; previous findings from Chainalysis attributed nearly two-thirds of all global cryptocurrency hacks in 2024 to North Korean threat actors.