A Good Year for North Korean Cybercriminals

North Korea’s cybercriminal groups have enjoyed a bumper year, shifting to patiently target larger payouts and jobs in the software supply chain. The article notes a $1.5 billion Ethereum theft from ByBit in February 2025, and says that, so far this year, North Korean groups have stolen at least $2.02 billion in cryptocurrency, accounting for the majority of the $3.4 billion in stolen digital assets this year, according to Chainalysis.

Over the past four years their combined haul has reached at least $6.75 billion, with continued focus on bigger targets and sophisticated laundering methods. Many of the largest hacks are attributed to Lazarus, including the ByBit operation, and several threat actors have pursued different missions and targets across 2025, GTIG states.

The report also highlights alliances and evolving techniques, noting Russia-North Korea cooperation and the increasing use of AI tools and living personas to enhance campaigns, with Chainalysis’s Fierman emphasising rapid money laundering across multiple avenues.