In brief – North Korea-linked hackers were responsible for 60% of all crypto theft losses in 2025, totaling $2.06 billion in attributed losses, according to CertiK. – State-sponsored groups have evolved from opportunistic exploits to coordinated campaigns targeting DeFi…
otocols. – Over 86% of stolen funds in one major case was laundered within a month through DEXs and cross-chain bridges. North Korean hackers have stolen $6.75 billion in cryptocurrency across 263 incidents since 2016, establishing state-sponsored theft as the dominant threat to decentralized finance, according to a new
The Web3 security firm’s Skynet analysis documents how DPRK-linked groups have transformed from opportunistic attackers into the primary force in crypto crime, responsible for some 60% of all theft losses in 2025 alone, amounting to $2.06 billion. This dominance extends into 2026, with North Korean hackers accounting for 55% of global crypto losses since the start of the year. Social engineering is the “dominant attack vector,” according to the report’s author Taylor Monahan, following incidents such as April’s $285 million Drift Protocol hack, in which DPRK hackers spent six months infiltrating the DeFi platform by posing as a quantitative trading firm.
Perhaps most concerning is the speed at which stolen funds disappear, with North Korean hackers leveraging a “large-scale laundering infrastructure” including decentralized exchanges and cross-chain bridges to rapidly obscure the money trail. In one major case, CertiK noted, 86% of funds were laundered within just one month. The findings paint a picture of North Korea’s crypto theft evolving into a “primary state revenue mechanism,” systematically draining billions from the crypto ecosystem while staying ahead of law enforcement efforts.