North Korean hackers steal record $2 billion in cryptocurrency
Researchers estimate that hackers linked to North Korea have stolen more than $2 billion in cryptocurrency so far in 2025, marking a record for the regime. This activity now represents about 13% of the country's GDP, according to United Nations figures. The funds are believed to support North Korea's nuclear and missile programs.
North Korean cyber-criminals, including operatives from the Lazarus Group, have increasingly targeted cryptocurrency companies and wealthy individuals for large-scale thefts. According to analysts at research firm Elliptic, these hackers have stolen over $2 billion (£1.49bn) in digital assets this year alone, surpassing previous records and bringing the cumulative known total to more than $6 billion.
The United Nations estimates North Korea's 2024 GDP at $15.17 billion, making the 2025 thefts equivalent to around 13% of that figure. Western security agencies assert that the proceeds finance the regime's nuclear weapons and missile development. Elliptic's chief scientist, Dr. Tom Robinson, noted that the true extent may be higher due to unreported incidents: "Other thefts are likely unreported and remain unknown as attributing cyber thefts to North Korea is not an exact science." He added, "We are aware of many other thefts that share some of the hallmarks of North Korea-linked activity but lack sufficient evidence to be definitively attributed."
Key incidents include the largest hack of the year in February 2025, when $1.4 billion was stolen from the ByBit exchange. Elliptic attributes more than 30 other attacks to North Korea this year, such as a July breach at WOO X that took $14 million from nine users and a theft of $1.2 million from Seedify. The highest individual loss reported is $100 million. This surpasses the previous record of $1.35 billion in 2022.
Companies like Elliptic and Chainalysis track stolen funds such as Bitcoin and Ethereum via public blockchain transactions, identifying patterns in North Korean hackers' methods. North Korea's UK embassy did not respond to requests for comment, though the regime has previously denied involvement in such activities. Additionally, North Korea faces accusations of running a fake IT workers program to evade sanctions and generate revenue.