North Korea-linked hackers steal $2.1 billion in crypto in 2025

North Korean hackers have been identified as the primary culprits behind a staggering $2.1 billion in cryptocurrency thefts during the first half of 2025. This figure represents the highest amount ever stolen in such a short period, with North Korea-linked groups responsible for approximately $1.6 billion of the total losses. The most significant incident was the $1.5 billion hack of a Dubai-based crypto exchange in February, which alone accounted for nearly 70% of the total stolen funds this year. This breach not only set a new record for the largest single crypto hack but also significantly increased the average hack size to nearly $30 million, double that of the first half of 2024.

The thefts are believed to be part of a broader strategy by North Korea to finance its national objectives, including its nuclear weapons program. The use of stolen cryptocurrency to fund such activities underscores the geopolitical implications of these cyberattacks. The involvement of state actors in crypto thefts marks a turning point in the security landscape of digital assets. The report from a blockchain intelligence firm highlighted that infrastructure attacks, such as private key and seed phrase thefts, accounted for over 80% of the stolen funds. These breaches, often facilitated by social engineering or insider access, were significantly larger on average than other types of attacks.

Protocol exploits, including flash loan and re-entrancy attacks, made up another 12% of the total losses. The report emphasized the need for the industry to strengthen basic cybersecurity practices, including multi-factor authentication, cold storage, and regular audits. It also stressed the importance of improving defenses against sophisticated nation-state threats. Coordinated international efforts, involving partnerships between law enforcement, financial intelligence units, and blockchain analytics firms, will be essential to track stolen assets and hold perpetrators accountable.

The rising trend of state actors using crypto theft for geopolitical gain suggests that digital assets are becoming increasingly intertwined with global financial systems and national security. As a result, crypto hacks may be used not just for financial gain but as instruments of geopolitical strategy. The report urged the industry to take proactive measures to mitigate these risks and protect the integrity of the crypto ecosystem. The escalating threat of state-sponsored cyberattacks highlights the need for robust security measures and international cooperation to safeguard digital assets and maintain the trust of investors and users.