North Korea Hit 1,640 Firms-Crypto Is Still the Real $2 Billion Target

North Korea's reach is broad, but crypto is still the payout

North Korean-linked operations have touched 1,640 companies across 57 countries, with roughly 700 to 800 "really damaging" intrusions. That scale can make the threat look scattered. The more important question is where the money is actually going.

Broad targeting, concentrated theft

In 2025, those actors stole $2.02 billion in cryptocurrency, a 51% year-over-year increase, pushing their all-time total to $6.75 billion. The breadth of targeting is notable, but the monetization remains concentrated in digital assets.

2026 is pointing the same way

Through April, North Korean-linked groups took about $577 million in 2026 YTD, equal to 76% of all crypto hack losses. That money came from a small number of major strikes rather than a flood of smaller breaches. The pattern is fewer events, larger payouts.

Why crypto stays the main target

Non-crypto breaches can cause serious damage, but crypto offers immediate liquidity. For crypto victims, the reported access was not limited to servers and files; it extended to keys and blockchain access. That helps explain why the attack surface looks wide while the payoff stays narrowly focused on digital assets.

How small breaches turn into fast, large losses

The critical risk is not just getting in. It is how quickly attackers can move value once they have a foothold.

From contractor access to key control

The attack path often starts with individual employees and contractors, then moves into company access, server root access, and, for crypto targets, keys and blockchain access. Once an attacker reaches a signer or a high-value treasury workflow, the incident shifts from abstract cybersecurity risk to an immediate cash-out event.

Individual wallet compromises show how wide the net is

In 2025, 158,000 wallet-compromise incidents hit 80,000 unique victims. That scale can sound diffuse, but it also shows how broadly attackers are casting for footholds. The bigger danger appears when those footholds help attackers move laterally into systems involved in signing, deployments, or cross-chain operations.

Drift and KelpDAO showed different paths to the same lesson

Drift showed how quickly funds can disappear after staging. After three weeks of pre-attack staging and months of social engineering to compromise protocol signers, attackers drained about $285 million in roughly 12 minutes. KelpDAO showed a different route to a similar outcome: a single-verifier design flaw in a LayerZero bridge led to about $292 million in losses.

The practical takeaway is not just "use better passwords." It is more like this:

• Treat bridges, routers, and signers as concentration points for well-funded attackers.
• Expect staging to take time, but execution to happen in minutes.
• Price capital-lock risk into protocols that rely on thin verification or external signing workflows.

Laundering and exit routes keep the risk alive

After KelpDAO, some stolen funds were rerouted following a freeze on Arbitrum and moved through THORChain, where stolen ETH was converted to Bitcoin with no operator willing to block the transfers. That helps explain why exit liquidity can matter as much as the initial exploit. If stolen funds can still move efficiently, the market may underprice failure risk.

What gets repriced: bridges, signers, and crypto infrastructure with weak isolation

The valuation question is not "how many firms were touched?" It is where money can leave fastest. The more relevant fault lines are withdrawal control, weak-verifier bridges, and any crypto service that lets outside contractors or external signers get closer to production keys. That is the part of the stack that gets repriced when breaches turn into instant balance-sheet hits keys and blockchain access.

The market split: improvement versus concentration risk

Bulls can point out that, despite larger individual attacks, hack losses remained suppressed in 2024-2025, suggesting improved security practices have had a meaningful effect.

Bears have the sharper near-term case. North Korean-linked operations took 76% of all crypto hack losses through April across just a handful of attributed incidents. Analysts also believe AI is helping upgrade reconnaissance and social engineering flows. That does not prove attacker gains are outrunning defensive gains everywhere, but it does suggest the threat is still evolving.

What to watch now

• How signers, bridges, and treasury workflows are being isolated
• Whether stolen funds still find liquid exit routes after major exploits
• Whether high-value signer or bridge incidents remain rare

What would weaken the thesis

• Fewer high-value signer or bridge incidents
• Clearer friction in laundering or moving stolen funds after exploits
• Evidence that industry security gains are consistently outpacing attacker gains from AI-assisted reconnaissance and social engineering