Hackers linked to the North Korean government have stolen more than $2 billion worth of cryptocurrency so far this year — the largest annual total ever recorded — according to TechCrunch, citing blockchain analytics firm Elliptic on October 7.

Elliptic’s latest report identifies over 30 separate cyberattacks in 2025, targeting both crypto exchanges and individual investors. The firm notes that most of the year’s heists were conducted via social engineering attacks — schemes where victims are tricked into granting access to their digital wallets or authorizing malicious transactions.

Record-Breaking Crypto Heists

Elliptic’s findings reveal that North Korea’s hacking activity in 2025 marks “the largest annual total on record” — and there are still three months left in the year. The report warns that the true amount could be even higher, as many thefts go unreported or cannot be definitively linked to North Korean groups.

“Attributing cyber thefts to North Korea is not an exact science,” Elliptic stated. “The actual figure may be even higher.”

A Shift From Code Exploits to Human Targets

Unlike previous years, North Korea’s hackers are now focusing more on people than on code. Elliptic says the regime’s cyber units have shifted away from exploiting software vulnerabilities to directly targeting victims through deception and impersonation tactics.

This trend highlights a key insight: human error is now the weakest link in crypto security. Attacks have increasingly targeted high-net-worth individuals alongside major exchanges and DeFi platforms.

Billions Stolen Over the Years

With $2 billion already stolen in 2025, North Korea’s crypto thefts have now surpassed their previous record of $1.35 billion in 2022. Since 2017, the country’s hacking operations — often attributed to groups like the Lazarus Group — have amassed more than $6 billion in digital assets, according to global blockchain security firms.

“We are aware of many other thefts that share hallmarks of North Korea-linked activity but lack sufficient evidence to be definitively attributed,” Elliptic said.

A Strategic Move Amid Growing Tensions

The spike in cyber activity aligns with a recent defense policy shift announced by Kim Jong Un, which emphasizes expanding both nuclear and conventional military capabilities. Analysts believe that crypto thefts remain a key funding channel for North Korea’s sanctioned weapons programs.

What Comes Next?

With three months still remaining in 2025, experts warn that North Korean hackers are far from finished. Cybersecurity researchers urge crypto holders, exchanges, and DeFi platforms to strengthen identity verification, multi-signature protection, and anti-phishing defenses to guard against the ongoing threat.