In a shocking revelation, North Korean hackers have been linked to the theft of billions of dollars in cryptocurrency over recent years, targeting exchanges and firms worldwide. Reports indicate that these state-sponsored cybercriminals are using sophisticated tactics to infiltrate the crypto industry, funding Pyongyang’s weapons programs and evading international sanctions.
The scale of these attacks is staggering, with estimates suggesting that over $3 billion in digital assets have been stolen since 2017. High-profile incidents include the recent $1.5 billion Bybit hack in February 2025, attributed to the notorious Lazarus Group, a hacking collective tied to the North Korean regime.
These hackers employ a range of strategies, from social engineering to posing as legitimate IT workers. By infiltrating blockchain startups and crypto firms with fake identities, they gain insider access to steal funds, as seen in a recent case where operatives siphoned nearly $1 million from U.S. and Serbian companies.
Additionally, North Korean operatives are reportedly using advanced malware, including versions targeting Mac systems, distributed through fake Zoom invites. This allows them to bypass security measures and extract sensitive data from Web3 and DeFi platforms.
The stolen cryptocurrency is often laundered through complex networks, making it difficult to trace. Experts warn that weak KYC (Know Your Customer) protocols in the crypto industry are fueling these security threats, with hundreds of North Korean operatives allegedly embedded in legitimate roles at crypto firms.
As the crypto sector continues to grow, the international community faces mounting pressure to address these cyber threats. Governments and companies must strengthen defenses and collaborate to prevent further exploitation by state-sponsored actors like those from North Korea.
Andrew Lee
