$2B Stolen by North Korean Hackers Over the Year

$2B stolen by North Korean hackers over the year: while technical systems are becoming more resilient, attackers are shifting focus to social engineering and also relying on multi-round cross-chain schemes.

Weex Banner

Scale, Drivers, and Victims

A recent Elliptic report shows that the current year has already become a record in terms of losses from security incidents in the crypto industry. Of course, the greatest contribution came from the Bybit incident, which was watched closely; how dangerous third-party services' compromise can be, even if the crypto platform itself is protected and secure, and how a transparent investigation can help restore the platform's reserves and even liquidity in record time. At the same time, many other incidents didn't lead to such large losses but also didn't show such consistent recovery, for example, LND.fi, WOO X, and Seedify, and more than thirty additional cases.

Thus, the 2017-2025 period shows that the outcome for 2025 far exceeds previous values and is almost triple the 2024 figure; the previous record was held by 2022, with $1.35 billion stolen in attacks on services such as Ronin Network and Harmony Bridge.

The distribution of victims is also changing. The main impact still falls on crypto exchanges, but the share of attacks on high-net-worth individuals is growing, since they often don't have corporate-level protection and are even more vulnerable to social engineering attacks.

Tactics and Laundering: The Human Factor and Multi-Chain

The year showed that social engineering is king among attack vectors. Attackers gain access through deception and manipulation, whereas earlier waves more often exploited technical vulnerabilities in infrastructure when it was much less mature.

Laundering is also becoming more sophisticated. The main tactic now is multi-round cycles of mixing and cross-chain transactions, the use of lesser-known networks with limited analytics coverage, saving on costs by purchasing specific protocols' utility tokens, exploiting refund addresses to redirect assets to fresh wallets, as well as issuing and trading tokens minted by the laundering networks themselves.

At the same time, the transparency of public ledgers makes it possible to detect and link the traces of each stolen asset, in particular to track the extremely frequent activity of various North Korean groups at the scale of losses the industry faces today.

Practices Must Not Lag Behind Technology

Another report on incidents in the crypto industry confirms the attack vectors and threat sectors that had already been emerging. Social engineering is taking up more space as the human factor becomes the weakest aspect of any system. This means that security protocols and processes must not lag behind the technologies that implement them.

This acquires additional importance also because crypto adoption is proceeding extremely rapidly, and more and more private holders are accumulating increasingly larger capital in the crypto market while remaining the most vulnerable. Be aware and stay tuned for the latest updates and opportunities in the new economy, crypto industry, and blockchain developments.