North Korea-Linked Hackers “Industrialize” Crypto Theft, Stealing $2.06B in 2025: CertiK Report

North Korea linked cyber groups stole roughly $2.06 billion in crypto during 2025, accounting for about 60% of total global crypto hack losses, according to a new CertiK Skynet report. The findings highlight a sharp escalation in both scale and organization of digital asset theft tied to the regime.

Out of an estimated $3.4 billion lost in crypto security incidents last year, researchers attribute 79 of 656 cases directly to DPRK-linked actors. Over a longer timeline, from 2016 to early 2026, total stolen crypto is estimated at $6.75 billion across 263 incidents.

Shift From Phishing to Large-Scale Coordinated Attacks

The report shows a clear evolution in tactics. Earlier phishing-based attacks have been replaced by more complex operations targeting high-value systems and infrastructure. While only around 12% of incidents were linked to North Korea, they accounted for the majority of total stolen value, signaling a shift toward fewer but far larger attacks.

One of the largest incidents cited is the 2025 Bybit exploit, where about $1.5 billion was stolen through a supply chain compromise, with most funds later converted and laundered using cross-chain tools and mixers.

Physical Infiltration and Global Security Concerns

CertiK also notes a growing trend toward physical infiltration, where attackers build real-world connections, attend events, and manipulate access before executing exploits. The report warns that crypto theft has become a structured funding channel supporting North Korea’s broader military and missile programs, raising global security concerns beyond cybersecurity alone.