New research reveals North Korean-affiliated hacker groups have stolen over $2 billion in 2025, marking a new annual high in the regime’s cyber theft operations. Much of the theft targets cryptocurrency exchanges and wallets, mirroring the state’s long reliance on digital raids to skirt sanctions and fund its military ambitions.
Analysts estimate that these thefts now amount to nearly 13% of North Korea’s GDP, signaling how deeply embedded cyber raids have become in the country’s economy. The largest known single incident this year involved $1.4 billion stolen from the crypto platform ByBit in February.
Key groups behind the thefts include Lazarus Group and other state-linked actors who have refined their techniques. These attacks increasingly focus not only on exchanges but also high net worth individuals’ wallets, making attribution and recovery more challenging.
Over the years, tracking agencies estimate that North Korea has stolen over $60 billion in crypto assets. Beyond direct hacks, the state is accused of running fake IT job scams to attract and defraud foreign talent as a revenue source.
Researchers warn the trend is accelerating: smart hackers using mixing services and anonymity tools complicate law enforcement efforts. As long as sanctions persist, cyber theft remains a vital lifeline for isolated regimes to finance nuclear, missile, and military programs.
