North Korea (DPRK) state-affiliated hackers and threat actors were responsible for more than $2 billion in crypto losses in 2025, a 51% year-over-year increase, despite fewer attacks carried out by the group, according to cybersecurity company CrowdStrike. <\/p>\n
DPRK hackers represent the \u201clargest\u201d threat group targeting cryptocurrency users, as measured by the dollar amount of assets stolen<\/span><\/a>, according to the company\u2019s 2026 Financial Services Threat Landscape report<\/span><\/a>. Crowdstrike added:<\/p>\n \u201cStolen proceeds are almost certainly laundered to fund the regime\u2019s military programs. Compared to 2024, DPRK-nexus adversaries conducted fewer campaigns but achieved significantly higher returns by prioritizing high-value targets.\u201d <\/p><\/blockquote>\n The DPRK hackers and scammers focused on targeting Web3 projects and cryptocurrency exchanges because the stolen funds could be \u201ccashed out\u201d and transferred with a greater degree of anonymity than in the traditional financial system, CrowdStrike said. <\/p>\n The countries most targeted by DPRK hackers. Source: CrowdStrike<\/em><\/p>\n The report highlights the growing threat of state-affiliated hacking groups targeting cryptocurrency users and industry companies through cybersecurity threats and social engineering scams<\/span><\/a> designed to steal funds and sensitive information.<\/p>\n Related: <\/strong><\/em>US sentences \u2018laptop farmers\u2019 tied to North Korean IT worker scheme<\/strong><\/em><\/span><\/a><\/p>\n In April, the Ethereum Foundation, the organization that oversees development of the Ethereum ecosystem, identified 100 DPRK-backed hackers<\/span><\/a> and threat actors who infiltrated crypto projects.\u00a0<\/p>\n Typically, these threat actors are remote hires; however, in April 2025, the Drift Protocol decentralized crypto exchange was infiltrated and compromised<\/span><\/a> by DPRK-affiliated technology workers, who met with the Drift Protocol development team.<\/p>\n The Drift Protocol team said<\/span><\/a> that they met the threat actors during a \u201cmajor\u201d cryptocurrency industry conference and built a working relationship with them over six months.<\/p>\n Source: <\/em>Drift Protocol<\/em><\/a><\/p>\n During the collaboration, the hackers deployed malware, which compromised Drift Protocol developer machines and caused $280 million in losses<\/span><\/a>.\u00a0<\/p>\n \u201cIt is important to note that the individuals who appeared in person were not North Korean nationals,\u201d the Drift team said, adding, \u201cDPRK threat actors operating at this level are known to deploy third-party intermediaries to conduct face-to-face relationship-building.\u201d<\/p>\n During that same month, Onchain sleuth ZachXBT also documented a group of North Korean information technology (IT) workers who were making $1 million per month<\/span><\/a> working at technology companies.<\/p>\nNorth Korean hackers infiltrate crypto projects online and offline <\/h2>\n
![\"\"](\"https:\/\/resizer.ctmedia.io\/cdn-cgi\/image\/width=960,format=auto,quality=80,onerror=redirect\/https:\/\/s3-images.ctmedia.io\/media\/content\/screenshot-2026-05-14-at-124246-pm.png\")
<\/figure>\n