In short
- North Korea-linked hackers were responsible for 60% of all crypto theft losses in 2025, according to CertiK, totaling $2.06 billion in attributed losses.
- State-sponsored groups have evolved from opportunistic exploits to coordinated campaigns targeting DeFi protocols.
- More than 86% of the stolen money in one large case was laundered within a month via DEXs and cross-chain bridges.
North Korean hackers have stolen $6.75 billion worth of cryptocurrency in 263 incidents since 2016, making state-sponsored theft the dominant threat to decentralized finance, according to a new report from blockchain security firm CertiK.
The security company Web3 Skynet Analysis documents how DPRK-linked groups have transformed from opportunistic attackers into the main force in crypto crime, accounting for approximately 60% of all theft losses by 2025 alone, amounting to $2.06 billion.
This dominance extends into 2026, with North Korean hackers responsible for 55% of global crypto losses since the start of the year.
Social engineering is the “dominant attack vector,” according to report author Taylor Monahan, following incidents such as the $285 million Drift Protocol hack in April, in which North Korean hackers infiltrated the DeFi platform for six months by posing as a quantitative trading firm.
Perhaps most worrying is the speed at which stolen money disappears, with North Korean hackers using a “massive money laundering infrastructure” including decentralized exchanges and cross-chain bridges to quickly obfuscate the money trail. In one major case, CertiK noted, 86% of the money was laundered in just one month.
The findings paint a picture of North Korea’s crypto theft evolving into a “primary state revenue mechanism,” systematically siphoning billions from the crypto ecosystem while staying ahead of law enforcement efforts.
The timing of the report underlines the ongoing threat, which arises as DPRK hackers continue their relentless assault on crypto infrastructure. From April Drift Protocol attack marked as the largest of 2026 DeFi hack, but even the $285 million stolen in that incident pales in comparison to the record-breaking Bybit breach of 2025, in which hackers Raised $1.46 billion in just two transactions on February 21. Blockchain security firms report that more than $1 billion of the Bybit funds have since been laundered through the same cross-chain infrastructure detailed in CertiK’s findings.
Security experts describe North Korea’s crypto operations as unprecedented in size and sophistication, with blockchain analytics firm TRM laboratories characterizing the threat as one on an “industrial scale,” utilizing “cyber activity, intelligence support, illicit financial infrastructure, and partnerships with foreign enablers.”
The regime’s money laundering network – dubbed the ‘Chinese Laundromat’ by researchers – consists of underground bankers, OTC brokers, money transmitters and trade-based money laundering intermediaries.
US authorities have stepped up efforts to disrupt these operations through targeted asset seizures. The Justice Department filed a civil forfeiture complaint last June, targeting $7.7 million in cryptocurrency linked to North Korea’s money laundering networks for IT workers. Court documents revealed one wallet operated by Sim Hyon Sop, a representative of the North Korea-sanctioned Foreign Trade Bank, received more than $24 million worth of cryptocurrency between August 2021 and March 2023.
Meanwhile, security companies are racing to develop tools and techniques to counter the sophistication of cross-chain money laundering techniques, with CertiK recommending that high-risk companies adopt rigorous ID verification, including video interviews, zero-trust hiring policies and ‘tech hardening’ of DeFi infrastructure such as bridges and hot wallets.
Daily debriefing Newsletter
Start every day with today’s top news stories, plus original articles, a podcast, videos and more.