According to the latest report published by blockchain analytics firm Elliptic, hacker groups linked to North Korea stole more than $2 billion in cryptocurrency in 2025. The company emphasized that this amount represents the highest annual loss ever, with three months left in the year.
The Biggest Loot Hits Bybit
Elliptic’s blog post published on Tuesday stated that it examined more than 30 cyberattacks that occurred throughout 2025. According to the analysis, the total amount of crypto assets seized by North Korea to date is approaching $6 billion.
According to Elliptic’s report, the majority of the record-breaking loss in 2025 consisted of $1.4 billion in assets stolen from the Bybit cryptocurrency exchange. The US Federal Bureau of Investigation (FBI) and various blockchain security firms confirmed that North Korean hacker groups were behind the attack. Experts note that North Korea has long targeted crypto exchanges but has recently begun targeting high-net-worth individuals.
The report also emphasized that most attacks in 2025 were carried out through social engineering methods rather than technical vulnerabilities. It noted that hackers resorted to deceiving people to infiltrate systems, demonstrating that human errors, not technical ones, are the weakest link in crypto security.
Elliptic noted that evidence of a North Korean connection to some attacks is limited, making it difficult to definitively link all cases. It also warned that there may be attacks that have not yet been detected or reported.
North Korean-linked hacker groups stole $1.35 billion worth of cryptocurrency in 2022. In 2024, the governments of Japan, South Korea, and the US announced that groups affiliated with the regime were responsible for $659 million in crypto theft. The United Nations Security Council estimates that North Korea seized a total of $3 billion worth of digital assets between 2017 and 2023. Elliptic’s latest report suggests this figure is approaching $6 billion.
According to the United Nations, Kim Jong-un’s administration is using stolen cryptocurrencies to finance its nuclear weapons program. Experts say the country, facing severe international sanctions, is resorting to this method to address its foreign exchange deficit.
North Korean hackers have also made headlines in the past with large-scale cyberattacks targeting platforms such as Axie Infinity ($625 million), Harmony ($100 million), and WazirX ($235 million).
