Key insights
- North Korea-linked hackers stole over $2 billion in crypto last year.
- There were fewer attacks, which led to much larger losses than in previous years.
- Personal wallet theft rose sharply, while DeFi losses stayed low.
North Korea’s exploits reached a new high last year. Data from Chainalysis shows a rise in stolen value, even as the number of attacks fell.
While over $3.4 billion was stolen this year, North Korean hackers were responsible for around $2 billion.
This trend indicates how threat actors are now focusing on fewer but far larger targets.
Related: North Koreans Hackers Stealing Crypto with Fake Zoom Calls
North Korea Crypto Theft Pushes Total Losses Higher
According to Chainalysis, hackers from North Korea stole about $2.02 billion. That figure stands as a 51% increase from the prior year, and the new total pushed all-time losses tied to the country to roughly $6.75 billion.
Attack frequency dropped, yet the stolen value surged. This change came from a handful of very large hacks, with the February 2025 attack on Bybit alone accounting for $1.5 billion.
Billions stolen in a year | source: Chainalysis
Service providers also faced the biggest losses as centralised platforms saw rare but massive private key compromises that erased large sums in minutes.
According to Chainalysis, over $3.4 billion in crypto vanished across the industry by early December and North Korea-linked actors caused most of the damage.
Fewer Attacks Deliver Far Greater Returns
Data from the hacks show that there is a growing gap between average losses and extreme cases. Last year alone, the largest hack exceeded the median incident by more than 1,000 times.
This is also the first time the gap crossed that level.
Median crypto hack occurrences are rising | source: Chainalysis
Chainalysis also notes that only three attacks caused 69% of all service losses. This concentration shows how single breaches now define yearly outcomes. In all, smaller incidents still happen but they barely move totals.
North Korea reportedly stole the most from 2022 to date, with these attacks clustered at the highest value ranges. Other criminals also showed a wider spread of smaller thefts.
Laundering Patterns After Major Thefts
Chainalysis also called attention to clear laundering habits from North Korean hackers. According to the analytics platform, hackers rarely move stolen funds in huge chunks and tend to keep transfers below $500,000.
Other criminals often move funds in larger batches and this contrast helps analysts spot patterns.
They also reportedly used cross-chain bridges heavily, including Celer and Stargate to help move assets across networks.
North Korea-linked actors also tend to avoid lending protocols and peer-to-peer exchanges. They also interact less with decentralised exchanges than other groups.
Personal Wallet Theft Hits More Users
Thefts from North Korea now dominate headlines, yet individual users also face heavy risk. Wallet compromises reached about 158,000 incidents and that figure nearly tripled the counts from 2022.
Unique victims climbed to at least 80,000 and adoption growth partly explains the rise. Despite higher counts, total value stolen from individuals fell to $713 million. That amount dropped from $1.5 billion the year before and attackers may have targeted more users but took less per person.
Solana recorded the highest number of victims (around 26,500) while Ethereum and Tron showed the highest theft rates per active wallet.
Overall, this year’s thefts show that hackers have developed patience and planning. Fewer attacks caused record losses and that approach may continue.
This all means that crypto crime did not disappear. Instead, its shape changed and those changes might offer clues for prevention.
Disclaimer: BFM Times acts as a source of information for knowledge purposes and does not claim to be a financial advisor. Kindly consult your financial advisor before investing.
