North Korea-Linked Hackers Steal Over $2 Billion in Cryptocurrency in 2025
- Securityish
- Threats & Incidents
Quick Summary
In 2025, North Korea-linked hackers stole at least $2.02 billion in cryptocurrency, marking a 51% increase from 2024. The attacks were primarily attributed to the Lazarus Group, which compromised exchanges like Bybit, resulting in significant financial losses. This surge in theft highlights the ongoing risks posed by state-sponsored cybercriminals to the cryptocurrency sector.
The Securityish Brief
Hackers associated with North Korea, particularly the Lazarus Group, were responsible for stealing over $2.02 billion in cryptocurrency in 2025. This figure represents a significant increase from the previous year, where $1.3 billion was stolen. The attacks accounted for 76% of all service compromises, with the Bybit exchange hack alone contributing $1.5 billion to the total theft.
The Lazarus Group has been linked to a series of high-profile cyberattacks over the past decade, including a recent breach of South Korea’s Upbit exchange, which resulted in the theft of $36 million. The group employs various tactics, including infiltrating IT positions within organizations to gain access to sensitive systems and information.
Understanding the Attack Methods
North Korean hackers utilize a range of sophisticated techniques to execute their attacks. One notable method involves embedding IT workers within companies under false pretenses, allowing them to facilitate large-scale thefts. This strategy has evolved, with hackers increasingly recruiting collaborators through freelance platforms.
The stolen funds are laundered through a structured process that involves multiple waves of transactions, utilizing services that obscure the origin of the funds. This laundering process can take up to 45 days and involves immediate distancing of stolen assets from their source.
The implications of these thefts extend beyond financial losses, as they highlight the vulnerabilities within cryptocurrency exchanges and the broader financial system. Organizations must remain vigilant against such threats and consider enhancing their security measures to protect against potential breaches.
As cybercriminals continue to adapt their strategies, users and organizations alike should be aware of the tactics employed by groups like Lazarus and take proactive steps to safeguard their digital assets.
Key Takeaways
- Regularly monitor your cryptocurrency accounts for any unauthorized transactions.
- Enable two-factor authentication on all accounts to enhance security.
- Be cautious of job offers from unknown sources that may lead to malware installation.
- Educate employees about phishing tactics and the risks of remote access tools.
- Consider using reputable security software to detect potential threats.
Key Terms & Concepts
- Lazarus Group: In this article, the Lazarus Group refers to a North Korean hacking organization known for orchestrating high-profile cyberattacks and cryptocurrency thefts.
- Bybit: Bybit is a cryptocurrency exchange that was compromised in 2025, resulting in a significant loss of funds due to a North Korean cyberattack.
- Wagemole: Wagemole is a fraudulent operation where North Korean actors embed IT workers in companies to facilitate cyberattacks.
- cryptocurrency laundering: Cryptocurrency laundering involves the process of obscuring the origins of stolen digital assets through various financial services.
Read the original article here: https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
