North Korea-linked hackers steal more than $2B in 2025 crypto thefts

North Korea linked hacking groups have stolen more than $2 billion in cryptocurrency so far in 2025, driven largely by a single February breach of the Bybit exchange, according to a new analysis by blockchain forensics firm Elliptic. The figure, the largest annual total on record with three months of the year remaining, reflects a surge in high‑value intrusions against exchanges, platforms and wealthy individual holders across multiple jurisdictions.

Elliptic said the bulk of the 2025 haul is attributable to the Lazarus Group, a hacking organization long linked to North Korean intelligence, which investigators say took roughly $1.46 billion in the February Bybit attack. The firm credited its estimate to blockchain tracing and analysis of laundering patterns and identified more than 30 separate incidents this year that bear hallmarks of North Korea linked activity. Other exchanges and platforms named in analysts reports include LND.fi, WOO X and Seedify, among smaller targets.

Analysts describe a tactical shift in the attackers’ approach. Where earlier campaigns exploited technical vulnerabilities in decentralized finance infrastructure, many 2025 operations relied heavily on...