North Korea Escalates Crypto Thefts to Record Billion-Dollar Year

In 2025, North Korean hackers, notably the Lazarus Group, have escalated cryptocurrency thefts, stealing $2 billion, primarily targeting major exchanges like Bybit and Upbit.

The increased hacks underscore growing threats to the crypto market, potentially destabilizing exchanges and raising concerns over global cybersecurity and financing of sanctioned North Korean programs.

Article

Global Cyber Threat Growth

North Korean hackers, predominantly associated with the Lazarus Group, have reached unprecedented levels of crypto theft in 2025. At least $2 billion was stolen, contributing to nuclear program funding through these cyber activities.

Key actors include the Lazarus Group, linked to Pyongyang’s Reconnaissance General Bureau. The group executed the thefts via sophisticated tactics, such as “Operation Dream Job.” This involves posing as IT recruiters to deploy malware.

Major Exchange Targets

This spike in thefts directly affects global cryptocurrency exchanges. Bybit and Upbit were among the main targets, suffering substantial losses. Bybit’s February hack alone accounted for a significant share of thefts.

Financial implications extend beyond individual exchanges, influencing the broader cryptocurrency market. Exchange-held assets, predominantly altcoins, face increased vulnerabilities. The use of cross-chain bridges and mixers for laundering adds complexity.

Broader Implications

The hacks’ consequences resonate across geopolitical and financial realms, escalating tensions and prompting enhanced security measures. Policymakers globally are assessing these developments for adjustments.

Insights from sources like Chainalysis indicate North Korea’s sophisticated laundering techniques continue to evolve. Andrew Fierman, Head of National Security Intelligence, Chainalysis, highlighted this by stating, “North Korea’s sophistication and efficacy in laundering the proceeds from these incidents is continuing to improve.” This suggests potential regulatory tightening and emphasis on strengthening exchange security worldwide, given the historical context of cyber-theft expansion.