A report released Thursday by Chainalysis shows that North Korea's cryptocurrency hacking activities stole $2.02 billion in 2025, breaking records again. Previously, the highest amount of cryptocurrency stolen by North Korea through hacking and theft (such as Bitcoin and Ethereum) was $1.3 billion. This brings North Korea's total stolen cryptocurrency holdings to approximately $6.75 billion. The total amount of stolen cryptocurrency globally has risen to $3.4 billion.
A large portion of this stems from the attack on Dubai-based cryptocurrency exchange Bybit earlier this year. Bybit's CEO stated that, according to the U.S. Secret Service, these hackers, working for a group of elite North Korean government hackers, stole approximately $1.5 billion in February, the majority of which was Ethereum.
The United Nations and private researchers have long accused North Korea, which is subject to international sanctions and maintains relations with only a few countries, of deploying hackers to steal cryptocurrencies to fund its nuclear weapons and missile programs.
Chainalysis is one of a growing number of companies mapping cryptocurrency transaction networks, including tracking stolen funds laundered by criminals. The Chainalysis report notes that despite these platforms having institutional resources and professional security teams, they remain vulnerable to attack due to this fundamental security challenge.
Matt Pearl, director of the Strategic Technology Program at the Center for Strategic and International Studies, said that North Korea is difficult to stop because it is largely isolated from the world and is a “rogue state.”
The report states that some of the thefts are most likely due to North Korean hackers increasingly obtaining remote technical positions at international companies through fraudulent means. This access allows them to provide their hacking colleagues with a foothold to steal cryptocurrency keys and transfer cryptocurrency to Pyongyang.
Pearl stated that given North Korea is already facing extreme sanctions, there are few other ways to stop it from continuing to fund military operations by attacking digital assets.
