North Korean Hackers Stole Over $2 Billion in Crypto in 2025, CrowdStrike Report Reveals

North Korean state-sponsored hacking groups and their affiliates stole more than $2 billion in cryptocurrency during 2025, marking a 51% increase from the previous year, according to a new report from cybersecurity firm CrowdStrike. The “2026 Financial Services Threat Landscape Report” reveals that while the number of attacks decreased, the groups shifted their focus to high-value targets, particularly Web3 projects and cryptocurrency exchanges.

Strategic Shift Toward High-Value Targets

According to CrowdStrike’s analysis, North Korean hackers are deliberately concentrating on platforms within the decentralized finance (DeFi) ecosystem. The report notes that these groups are drawn to Web3 projects and exchanges because of the higher degree of anonymity they offer and the relative ease of laundering stolen funds compared to the traditional financial system. This strategic pivot has allowed them to extract larger sums from fewer, more lucrative operations.

Record-Breaking Theft Despite Fewer Incidents

The $2 billion figure represents a significant escalation in the financial impact of North Korean cyber operations. In 2024, the same groups stole approximately $1.32 billion. The 51% year-over-year increase underscores a growing sophistication in targeting and execution. CrowdStrike’s findings align with broader industry observations that state-sponsored hacking groups are becoming more selective and methodical, often spending months infiltrating a single exchange or protocol before executing a large-scale theft.

Implications for the Crypto Industry

The report serves as a stark warning for cryptocurrency businesses and investors. The focus on Web3 projects highlights persistent vulnerabilities in smart contract security, private key management, and cross-chain bridge protocols. For exchanges and DeFi platforms, the threat demands continuous investment in advanced threat detection, regular security audits, and robust incident response plans. For individual investors, the trend reinforces the importance of using reputable platforms with strong security track records and maintaining personal security practices, such as using hardware wallets and enabling multi-factor authentication.

Broader Geopolitical Context

North Korean cyber operations are widely believed to be a key source of revenue for the regime, bypassing international sanctions and funding weapons development programs. The United Nations and various national governments have repeatedly condemned these activities. The CrowdStrike report adds to a growing body of evidence that cryptocurrency remains a primary vector for these illicit financial flows, despite increased regulatory scrutiny and enforcement actions globally.

Conclusion

The CrowdStrike report provides a clear, data-driven picture of an evolving threat landscape. North Korean hackers are not retreating; they are refining their methods to maximize financial gain while minimizing operational risk. For the cryptocurrency industry, the message is unequivocal: security must remain the highest priority. For regulators and law enforcement, the findings underscore the need for continued international cooperation to track, freeze, and recover stolen assets.

FAQs

Q1: How did North Korean hackers steal over $2 billion in crypto in 2025?
They conducted fewer but more targeted attacks, focusing on high-value Web3 projects and cryptocurrency exchanges. They exploited vulnerabilities in smart contracts, private key security, and cross-chain bridges to drain large amounts of assets from single targets.

Q2: What is the significance of the 51% increase from 2024?
The increase shows that North Korean cyber operations are becoming more effective and damaging, even as the total number of attacks decreases. It indicates a strategic shift toward quality over quantity, targeting platforms where larger sums can be stolen and more easily laundered.

Q3: What can cryptocurrency exchanges and DeFi projects do to protect themselves?
Platforms should invest in advanced threat detection systems, conduct regular and thorough security audits, implement robust multi-signature and cold storage solutions, and develop rapid incident response protocols. Collaboration with cybersecurity firms and information-sharing networks is also critical.