North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft

According to Chainalysis' Crypto Crime Report, threat actors tied to North Korea accounted for at least $2.02 billion of more than $3.4 billion stolen from January through early December 2025, marking a 51% year‑over‑year increase. The report describes this as the most severe year on record for DPRK crypto theft in value, with DPRK attacks also accounting for a record 76% of all service compromises, and it pegs the lower‑bound cumulative DPRK theft at $6.75 billion.

The February Bybit compromise alone is responsible for $1.5 billion of the $2.02 billion; the attack has been attributed to a threat cluster known as TraderTraitor (also known as Jade Sleet and Slow Pisces). Lazarus Group, the DPRK‑backed outfit linked to these operations, is affiliated with Pyongyang’s Reconnaissance General Bureau and has a history of large heists, including activity from 2020 to 2023.

The report notes a broader pattern of IT worker infiltration and recruitment, with DPRK actors embedding collaborators via platforms like Upwork and Freelancer to scale operations and gain access to crypto services.