North Korea's Crypto Theft Surges 61% to $1.34 Billion in 2024

North Korea's involvement in crypto crime has significantly escalated, with the regime's hackers stealing $1.34 billion in digital assets in 2024. This amount constitutes 61% of all crypto theft for the year, surpassing the combined efforts of other groups. The frequency of these hacks has also increased, occurring roughly every 11 days in 2024, compared to every 13 days in 2023. The primary method used by North Korean hackers is private key theft, which has driven their total share of stolen crypto value to nearly 61%.

Once the crypto is stolen, it is typically moved through mixers like Sinbad or obscure bridges. In 2024, approximately $147 million was laundered through Sinbad alone. Despite the sanctions on Tornado Cash, North Korea's laundering operations have not slowed down. In early 2025, the Lazarus group, a North Korean cyber unit with ties to state operations, allegedly drained $1.5 billion worth of ETH from Bybit through a vulnerable multisig bridge setup.

While North Korea remains the largest player in crypto theft, other groups are also making significant strides. Crypto scams brought in $9.9 billion in 2024, with tactics evolving to include AI-powered fake profiles, deepfake video calls, and long-term romance or investment scams. These scams are sophisticated, using full identity kits, fake apps, and websites designed to mimic legitimate trading platforms.

The decentralized finance (DeFi) sector is also facing challenges. Over $2.5 billion in trading volume last year was fake, mostly generated by bots running wash trades. Tools like Volume.li were used to create the appearance of real demand, with nearly 4% of new tokens launched in 2024 showing signs of pump-and-dump activity. Most of these tokens barely lasted a day before insiders cashed out.

Darknet markets continue to thrive, with Abacus Market growing over 180% year-on-year after AlphaBay went quiet. Chinese vendors are now selling a wide range of illicit items, including pill presses and chemical kits for synthetic opioids. Payments are primarily made in Monero or stablecoins, with some drugs labeled as "20x stronger than fentanyl" being traced to Europe and the U.S. On the laundering side, groups like Huione Guarantee have become essential middlemen, processing over $70 billion in crypto since 2021. These operations run full-fledged services, helping bad actors move money, hold fake escrows, and deal with buyers under sanctions.

North Korea's leadership in stolen volume is part of a larger system that supports weapons development, espionage, and sanctions evasion. Scam vendors, laundering services, and darknet markets continue to grow, with the tools behind crypto crime becoming more accessible and actors adapting quickly. The ecosystem of crypto crime is expanding, with North Korea playing a central but not exclusive role in its development.