North Korea-linked hacks net $3B since 2017

North Korean cyberattacks targeting the cryptocurrency industry have grown increasingly sophisticated, according to multiple reports, including one from crypto firm Paradigm and blockchain analytics company TRM Labs.

The Democratic People's Republic of Korea (DPRK) has stolen nearly $3 billion in cryptocurrency since 2017, with $1.5 billion taken in the last two years alone.

These cyber intrusions often involve social engineering, phishing attacks, and compromising private keys or seed phrases to access digital wallets.

Once assets are stolen, North Korean operatives use complex laundering techniques, breaking funds into smaller portions and converting them into Bitcoin (CRYPTO:BTC) or other liquid cryptocurrencies before using high-volume OTC brokers to convert them into hard currency.

Paradigm highlights that North Korean hacking groups like Lazarus Group, Spinout, AppleJeus, Dangerous Password, and TraitorTrader are behind many of these attacks.

The Lazarus Group is particularly notorious for its high-profile breaches, including the Sony hack in 2016 and the WannaCry ransomware attack in 2017.

It has also targeted cryptocurrency exchanges such as Youbit and Bithumb in 2017 and exploited the Ronin Bridge in 2022, resulting in hundreds of millions of dollars in losses.

In 2025, Lazarus Group reportedly stole $1.5 billion from Bybit, marking one of the largest crypto heists to date.

TRM Labs notes that DPRK-linked hacks are ten times more damaging than those conducted by other actors.

These financially motivated attacks are believed to fund North Korea's weapons programs amid international sanctions.

Law enforcement agencies have made progress in combating these thefts by sanctioning crypto mixers like Tornado Cash (CRYPTO:TORN) and ChipMixer, but North Korean hackers continue to adapt by exploring new laundering tools such as Sinbad.

“North Korea’s hacking prowess demands continuous vigilance and innovation from businesses and governments,” TRM Labs stated.

Despite advancements in cybersecurity measures and international collaboration, experts predict further disruption from DPRK hackers in 2024.