Crypto Losses From North Korea Hackers in 2025 Rose 51% YoY: Report

Why It Matters

The surge underscores how state‑backed cyber actors are exploiting crypto’s pseudonymity to fund illicit activities, raising systemic risk for the digital‑asset ecosystem. Regulators and firms must tighten security to curb a growing financing channel for hostile regimes.

Key Takeaways

• DPRK hackers stole over $2 billion in crypto in 2025.
• Losses rose 51% YoY despite fewer attack campaigns.
• Drift Protocol breach alone cost $280 million.
• Hackers prioritize high‑value Web3 targets for anonymity.
• Stolen funds likely fund North Korea’s military programs.

Pulse Analysis

The 2026 CrowdStrike report highlights a stark escalation in North Korean cyber‑crime, with illicit crypto theft surpassing $2 billion last year. While the number of campaigns fell, attackers refined their focus on high‑value, low‑visibility targets, leveraging the inherent anonymity of blockchain transactions. This shift mirrors a broader trend where nation‑state actors treat digital assets as a lucrative revenue stream, funneling proceeds into weapons development and other strategic initiatives.

In‑depth analysis of the Drift Protocol incident reveals a sophisticated infiltration model. DPRK‑linked operatives met the exchange’s developers at an industry conference, cultivated trust, and later deployed custom malware that compromised internal systems, resulting in $280 million of lost funds. Such “human‑in‑the‑loop” tactics blend traditional social engineering with advanced technical exploits, blurring the line between remote hacking and on‑site espionage. The attack demonstrates that even well‑funded, security‑conscious projects remain vulnerable when adversaries embed themselves within development pipelines.

For the broader crypto ecosystem, the findings signal an urgent need for layered defenses and coordinated intelligence sharing. Exchanges and Web3 platforms must adopt zero‑trust architectures, continuous monitoring, and rigorous third‑party vetting to mitigate insider threats. Policymakers are also likely to intensify AML and sanctions enforcement, targeting the laundering pathways that convert stolen tokens into fiat. As state actors continue to weaponize cryptocurrency, the industry’s resilience will hinge on proactive security postures and cross‑border regulatory collaboration.