2025: A new high in North Korea’s financial cyber warfare
The $2 billion already stolen in 2025 has shattered North Korea’s previous cyber‑theft record of $1.35 billion, set earlier in 2022.
This surge highlights an acceleration in the regime’s digital capabilities and ambition. Operatives from notorious hacking teams, primarily the Lazarus Group, have intensified their focus on exploiting the lucrative, yet often less‑regulated, cryptocurrency industry.
The year’s most significant attack occurred in February, when North Korean hackers successfully swiped $1.4 billion from the crypto exchange ByBit. This single event accounts for the vast majority of the 2025 total and is one of the largest cryptocurrency thefts in history.
However, the regime’s activity is not limited to high‑profile exchange hacks. Investigators at the research firm Elliptic warn they have attributed more than 30 other attacks to North Korea this year alone, including a July attack on the WOO X platform that saw $14 million stolen from nine users, and another case that led to $1.2 million in digital coins stolen from Seedify.
The cumulative known value of cryptoassets stolen by the regime has now surged to more than $6 billion, including fake IT workers, according to Elliptic estimates.
The shift in targeting
While the majority of losses in 2025 were suffered by large crypto exchanges, Elliptic warns that an increasing number of victims are high‑net‑worth individuals.
Dr Tom Robinson, chief scientist at Elliptic, notes that individuals often lack the sophisticated, multi‑layered security measures employed by major businesses and exchanges, making them an attractive and relatively softer target.
“Other thefts are likely unreported and remain unknown as attributing cyber thefts to North Korea is not an exact science,” Robinson said, adding that many other hacks share the hallmarks of North Korean activity but lack definitive attribution.
As crypto prices have risen, individuals holding large amounts of digital assets have become increasingly attractive targets. Unlike large businesses, these individuals often lack the institutional‑grade security measures employed by exchanges, making them vulnerable.
Furthermore, some individuals are targeted specifically because of their association with companies holding large amounts of cryptoassets, a strategic move by hackers looking to find a backdoor into bigger funds.
The ability of companies like Elliptic and Chainalysis to track stolen funds relies on following transaction patterns on the public blockchain, which often reveals the distinct methods and tools favoured by North Korean operatives, even when the initial source of the hack remains murky.
The stark economic implication: 13% of GDP
The statistic emerging from the new research is the sheer impact of cybercrime on North Korea’s isolated economy. The $2 billion stolen in 2025, combined with previous thefts, is now estimated by the UN to contribute around 13% of the country’s Gross Domestic Product (GDP).
This massive reliance on criminal activity demonstrates the effectiveness of the state’s hacking teams in circumventing international sanctions. By generating foreign currency through untraceable digital theft, the regime is effectively self‑funding its most globally provocative and dangerous pursuits.
Western security agencies have repeatedly confirmed that this stolen money is the primary financial lifeline for the country’s nuclear and ballistic missile programs.
In addition to direct cyber‑theft, the regime is also increasingly accused of operating an elaborate fake IT workers programme.
This scheme involves placing thousands of highly skilled North Korean IT professionals in remote jobs globally using false identities, bringing in additional legitimate revenue and further skirting international sanctions.
North Korea’s UK embassy was approached for comment regarding the latest findings, but did not immediately respond. The regime has consistently denied any involvement in cyberattacks in the past.
As 2025 continues to set records, the global community faces the urgent challenge of disrupting a cyber‑criminal enterprise that has become fundamentally intertwined with a nation‑state’s weapons development.