North Korean Hackers Steal Record $2 Billion In Cryptocurrencies

Elliptic’s report details over 30 separate cyberattacks throughout 2025.

A sobering report released on October 8, 2025, by blockchain analytics firm Elliptic shed light on the escalating threat of state-sponsored cybercrime, revealing that hackers linked to the North Korean government have stolen more than $2 billion worth of cryptocurrency so far this year. This alarming figure marks the largest annual total on record and surpasses the previous high set in 2022 by a significant margin.

The final figure could be even higher

Elliptic’s report details over 30 separate cyberattacks throughout 2025, with the majority targeting cryptocurrency exchanges, but increasingly focusing on “high-net-worth individuals” holding substantial digital assets. The unprecedented $2 billion theft figure is largely attributable to one single, massive event: the reported theft of $1.46 billion in crypto assets from the major exchange, Bybit.

Analysts believe the total cumulative value of digital assets stolen by North Korean threat actors has now exceeded $6 billion. The firm noted that, with three months remaining in the year, the final figure could be even higher.

The new methodology

The methodology employed by the hackers has also shifted. While they historically exploited technical vulnerabilities in crypto infrastructure, Elliptic noted that the majority of 2025’s thefts were achieved through sophisticated social engineering attacks, where victims were manipulated into granting access to their private digital assets.

In response to advanced blockchain analysis, the hackers have adopted more complex laundering techniques to conceal the stolen funds.

These new tactics include:

• 
  Relying on multiple rounds of mixing and cross-chain transactions.

• 
  Utilizing obscure, smaller blockchains to make forensic analysis more difficult.

• 
  Exploiting “refund addresses” to redirect assets into fresh, untainted wallets.

The report serves as a critical warning, emphasizing the growing scale of North Korea’s reliance on cyber-enabled theft to fund its regime and underscoring the vital importance of robust security measures—both technological and human—across the entire digital asset industry.