North Korean–linked hacking groups stole $2.02 billion worth of cryptocurrency in 2025, marking the largest annual total ever recorded and a sharp escalation from the previous year.
According to the report by Chainalysis, the amount stolen in 2025 exceeds 2024 levels by $681 million, underscoring a significant acceleration in activity tied to actors associated with the Democratic People’s Republic of Korea (DPRK).
Crypto Theft Reaches Record Levels
The chart accompanying the report tracks DPRK-linked hack activity from 2016 through 2025, showing both total annual losses in U.S. dollars and North Korea’s share of global service compromises.
While earlier years recorded comparatively modest figures, losses climbed sharply during major crypto market cycles. The data shows:
- Annual losses rising above $1 billion in recent years
- A notable dip followed by renewed acceleration
- 2025 standing out as the highest year on record, surpassing the $2 billion mark
The visual trend highlights that North Korean-linked actors now account for a dominant share of global crypto theft, particularly in large-scale service and protocol breaches.
A Growing Share of Global Hacks
Beyond the dollar value alone, the chart indicates a steady rise in the percentage of global crypto service hacks attributed to DPRK-linked groups. By 2025, their share reaches its highest level across the entire timeline shown.
This suggests not only higher absolute theft amounts, but also greater concentration of sophisticated attacks coming from a single geopolitical source.
Escalation From 2024 to 2025
The jump from 2024 to 2025 is especially pronounced. With an additional $681 million stolen year over year, the data points to an intensifying operational tempo rather than isolated incidents.
The pattern visible in the chart reflects:
- Larger individual attack sizes
- Increased targeting of high-value crypto services
- Sustained activity rather than one-off spikes
What the Data Signals
The 2025 figures reinforce a broader trend: crypto-related cybercrime tied to state-linked actors continues to scale with market infrastructure, not just market prices.
As the ecosystem grows in value and complexity, the data suggests that threat actors are becoming more effective at exploiting centralized services, bridges, and custodial platforms.
The record-setting $2.02 billion figure makes 2025 a defining year for crypto security, and a stark reminder that geopolitical risks remain deeply intertwined with the digital asset market.
