CertiK's report reveals North Korea's organized state operation for cryptocurrency theft, amassing $6.75 billion since 2016.
Recent findings by CertiK reveal that North Korean hacker groups have systematically organized cryptocurrency theft into a state-sponsored operation, complete with a sophisticated money laundering network and specialized IT personnel.
Since 2016, DPRK-affiliated actors have stolen an estimated $6.75 billion through 263 crypto-related incidents. In 2025, they were responsible for 60% of all stolen value, despite representing only 12% of total incidents.
— CertiK (@CertiK) May 12, 2026
From 2017 to early 2026, North Korean entities have reportedly pilfered over $6.7 billion in digital assets. Analysts suggest that the actual figures are likely higher, as they exclude numerous smaller attacks on individuals and projects in the nascent years of the crypto sector.
In 2025 alone, these groups inflicted $2.06 billion in damages, indicating a significant impact on the industry.
Strategic Evolution
CertiK's report highlights a tactical shift among North Korean hackers, moving from chaotic operations to more structured approaches with designated roles. Certain units are now dedicated to social engineering, while others focus on exploiting infrastructure vulnerabilities and laundering stolen funds through specialized teams.
Researchers noted distinct phases in attack strategies:
- Hot wallets (2017-2019) — Targeting exchanges like Bithumb and Coincheck due to lax security.
- DeFi protocols and cross-chain bridges (2020-2023) — Targeting systems like Ronin Bridge as centralized security improved.
- Supply chains (2024-2026) — Shifting focus to third-party infrastructure instead of direct attacks on exchanges, exemplified by a $1.5 billion hack linked to Bybit.
- Physical infiltration (from 2025) — Combining social engineering with IT agent infiltration in crypto firms, leading to significant losses like the $280 million Drift Protocol hack.
Money Laundering Tactics
Following the Bybit hack, where approximately $1.5 billion was stolen, about 86% of the funds in Ethereum were quickly converted to Bitcoin. The laundering techniques utilized included:
- Rapid transfers across different blockchains (chain hopping);
- Cross-chain bridges;
- Crypto mixers;
- Over-the-counter brokers;
- Underground banking networks in Asia.
Analysts stress that the money laundering framework has become as crucial as the theft operations themselves.
IT Workers as a Threat
Additionally, researchers have linked North Korean IT specialists who pose as remote workers in Western firms to a separate threat. These agents can:
- Access internal systems;
- Engage in code development;
- Embed malicious components;
- Gather intelligence for future attacks.
Some have even used AI and deepfake technologies to successfully pass job interviews.
In response to these allegations, the North Korean Foreign Ministry has dismissed claims of involvement in crypto theft as "absurd slander" and a "political tool" employed by the U.S.
