In 2025, North Korean state-sponsored hacking groups have stolen approximately $2.02 billion in cryptocurrency, marking a 51% increase from the previous year. This escalation brings the total amount stolen by these actors to $6.75 billion since 2016. ([chainalysis.com](https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/?utm_source=openai))
The most significant incident contributing to this surge was the February 2025 breach of the Bybit exchange, resulting in the theft of $1.5 billion. ([techcrunch.com](https://techcrunch.com/2025/07/17/north-korean-hackers-blamed-for-record-spike-in-crypto-thefts-in-2025/?utm_source=openai))
These groups have shifted their tactics, focusing on fewer but more substantial attacks. They have been embedding IT workers within cryptocurrency services to gain privileged access and employing sophisticated impersonation techniques targeting executives. ([chainalysis.com](https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/?utm_source=openai))
Once the funds are stolen, the laundering process typically spans 45 days and involves multiple stages, including the use of Chinese-language money laundering services, cross-chain bridges, and mixing protocols. ([whale-alert.io](https://whale-alert.io/stories/cf6e926a27b7/Chainalysis-DPRK-linked-hackers-stole-202B-in-crypto-in-2025-using-crosschain-bridges-mixers-and-45day-laundering-waves?utm_source=openai))
Felix Shipkevich, a professor of law at Hofstra Law who teaches the business and policies of cryptocurrencies, commented, “This underscores that crypto theft is not merely a technological issue but a governance and risk-management problem that continues to outpace defensive controls.” ([chainalysis.com](https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/?utm_source=openai))
These developments highlight the need for enhanced security measures and regulatory frameworks to address the evolving threats posed by state-sponsored cybercriminal activities in the cryptocurrency sector.