North Korean Hackers Steal Over $2 Billion in Cryptocurrency in 2025
- Securityish
- Threats & Incidents
Quick Summary
In 2025, North Korean hacking groups stole $2.02 billion in cryptocurrency, marking a 51% increase from the previous year, according to Chainalysis. Their total theft has now reached $6.75 billion, despite fewer attacks. The hackers are employing new tactics, such as impersonating recruiters to target employees at tech and crypto firms, leading to significant breaches in security and privacy.
The Securityish Brief
North Korean hackers have intensified their focus on cryptocurrency-related targets, stealing $2.02 billion in 2025, a 51% increase from 2024. This brings their all-time total to $6.75 billion, as reported by Chainalysis. Notably, the number of theft incidents surged to 158,000, with unique victims rising from 40,000 in 2022 to at least 80,000 in 2025.
The hackers are increasingly using sophisticated tactics to infiltrate organizations. They often pose as recruiters from well-known web3 or AI firms, targeting engineers and developers with seemingly legitimate job offers. This process typically culminates in a technical interview where victims are asked to run code or open documents, leading to compromised machines and stolen credentials.
Executives are also at risk, as attackers pose as potential investors, engaging in lengthy discussions that reveal sensitive information about security practices and internal workflows. This approach allows hackers to identify weaknesses in high-value infrastructure.
Despite the increase in incidents, the total USD value stolen from individual victims declined from $1.5 billion in 2024 to $713 million in 2025, indicating that while more users are being targeted, the amounts stolen per victim are smaller. This trend highlights the evolving landscape of cryptocurrency theft.
Implications for Users and Organizations
Everyday users and organizations must remain vigilant against these tactics. The impersonation of recruiters and investors can lead to significant breaches if employees are not cautious. Users should be wary of unsolicited job offers and verify the identities of those reaching out.
Organizations should enhance their security training to help employees recognize phishing attempts and suspicious communications. Regularly updating security protocols and monitoring for unusual activity can mitigate risks associated with these sophisticated attacks.
As the landscape of cryptocurrency theft evolves, users should also consider using hardware wallets and enabling two-factor authentication to protect their assets. Being proactive in security measures is essential in this rapidly changing environment.
Key Takeaways
- Be cautious of unsolicited job offers and verify the identities of recruiters before engaging.
- Enhance employee training on recognizing phishing attempts and suspicious communications.
- Regularly update security protocols to protect against sophisticated attacks.
- Consider using hardware wallets and enabling two-factor authentication for cryptocurrency assets.
- Monitor accounts for unusual activity and report any suspicious incidents immediately.
Key Terms & Concepts
- North Korean hackers: In this article, North Korean hackers refer to cybercriminal groups from North Korea that engage in cryptocurrency theft.
- cryptocurrency: Cryptocurrency is a digital or virtual currency that uses cryptography for security and operates on decentralized networks.
- phishing: Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
Read the original article here: https://www.helpnetsecurity.com/2025/12/18/crypto-theft-2025-north-korean-domination/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
