How North Korea Stole $3 Billion in Crypto and Why It’s Still Happening

Between 2017 and 2025, North Korean hackers stole more than $3 billion in cryptocurrency - and that’s just the confirmed amount. The real number could be much higher. These aren’t lone criminals or random cybercriminals. This is a state-run operation, carefully planned, highly coordinated, and directly tied to funding Pyongyang’s nuclear weapons program. And it’s getting worse.

How They Do It: From LinkedIn to Millions in Stolen Crypto

North Korea’s hacking teams - like Lazarus, TraderTraitor, and Slow Pisces - don’t break into systems with brute force. They walk right in. The most common method? Fake job offers on LinkedIn.

In early 2024, hackers posed as recruiters from a fake tech firm. They reached out to employees at Ginco, a Japanese company that builds enterprise crypto wallets. The pitch? A simple Python coding test for a new position. The test? A malicious script hidden in a GitHub link. One employee downloaded it. That was all they needed.

Once inside Ginco’s system, the attackers waited. For weeks. They studied how employees accessed wallets, when transactions happened, and what approvals were needed. Then, in May, they hijacked a live session cookie. That gave them the same access as the employee - no passwords, no two-factor authentication needed. They didn’t need to crack anything. They just impersonated someone who already had the keys.

From there, they manipulated a real transaction request from DMM, a Japanese crypto platform. A legitimate user asked to send funds. The hackers changed the destination address. $308 million in Bitcoin vanished. No alarms. No red flags. Just a quiet, calculated swap in the background of a normal business day.

This isn’t an outlier. In 2023, the same group stole $100 million from Atomic Wallet by tricking users into installing a fake wallet app. In another case, they hacked CoinsPaid by compromising a third-party vendor’s login. Every attack follows the same pattern: find the weakest link - a person - and use them to get to the money.

The $1.5 Billion Bybit Heist: A New Level of Scale

Nothing prepared the crypto world for what happened in February 2025. North Korean hackers stole nearly $1.5 billion in Ether from Bybit, a major Dubai-based exchange. That’s more than all the crypto stolen in 2024 combined.

Chainalysis, a leading blockchain intelligence firm, confirmed the attack was orchestrated by the same North Korean group behind earlier heists. But this time, they didn’t just steal. They moved fast. Within hours, they converted large chunks of Ether into Bitcoin and other tokens using decentralized exchanges. They scattered the funds across hundreds of wallets - some newly created, others dormant for years.

Why? To make tracing impossible. Each transfer, each bridge between blockchains, added another layer of confusion. Law enforcement could see the money moving - but not who owned it, or where it ended up. By the time investigators caught up, most of the funds were already laundered into untraceable pools.

This wasn’t just theft. It was a financial warfare tactic. The goal wasn’t to get rich. It was to bypass sanctions, fund missiles, and keep the regime alive.

Why North Korea? Why Crypto?

Sanctions have choked North Korea’s ability to earn foreign currency. Traditional exports - coal, textiles, seafood - are banned. Banks won’t touch them. But crypto? Crypto doesn’t care about borders.

Cryptocurrencies operate outside the traditional banking system. There’s no central authority to block a transaction. No government to freeze an account. Even if you know where the money went, you can’t stop it unless you control the entire network - and no one controls Bitcoin or Ethereum.

North Korea realized this early. In 2017, they started small. A few million here, a few million there. By 2023, they were stealing $660 million in a single year. In 2024, that jumped to $1.34 billion. And in February 2025, one attack wiped out the entire previous year’s haul.

They’re not just lucky. They’re systematic. The UN Security Council reported in December 2024 that North Korea has carried out 58 confirmed crypto thefts since 2017. Each one was more sophisticated than the last. And they’re not slowing down.

Who’s Responsible? The Groups Behind the Attacks

There are five main hacking units linked to North Korea’s crypto thefts:

• Lazarus Group: The oldest and most notorious. Responsible for the 2017 WannaCry ransomware attack and multiple crypto heists.
• TraderTraitor: Focused on wallet software and exchange vulnerabilities. Hit Atomic Wallet and CoinsPaid in 2023.
• Jade Sleet: Specializes in social engineering and phishing campaigns targeting employees.
• UNC4899: Known for exploiting software supply chains - like the Ginco attack.
• Slow Pisces: Masters of laundering stolen crypto through DeFi protocols and cross-chain bridges.

These aren’t separate teams. They’re parts of the same machine. Lazarus handles the initial breach. TraderTraitor exploits the system. Slow Pisces hides the money. And Jade Sleet finds the people to trick along the way.

Why the Crypto Industry Can’t Stop It

You’d think exchanges would learn. After all, they’ve lost billions. But here’s the problem: the attacks don’t target the technology - they target the people who use it.

Most crypto platforms have strong security. Multi-signature wallets. Cold storage. Audit logs. But if an employee clicks a link, or if a vendor’s system is compromised, none of that matters. There’s no firewall strong enough to stop a human being who’s been fooled.

Even worse, many smaller platforms still don’t train their staff on social engineering. They assume hackers can’t get past their tech. They’re wrong.

And when a breach happens, the fallout is brutal. Insurance premiums spike. Users flee. Regulators crack down. Some exchanges shut down entirely. The cost isn’t just the stolen money - it’s the loss of trust.

What’s Being Done? And Is It Enough?

The FBI, Japan’s National Police Agency, and the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) have all issued public alerts. They’ve named the groups. They’ve published blockchain addresses linked to the thefts. They’ve even offered rewards for information.

But here’s the catch: you can’t arrest someone if they’re in Pyongyang. You can’t freeze a wallet if it’s been split across 500 addresses. And you can’t stop a country that has nothing left to lose.

Some exchanges have started using AI-driven blockchain monitoring tools. These tools flag suspicious transfers - like large amounts moving from known laundering wallets. But the hackers adapt. They change tactics every few months. One day, they use a DeFi bridge. The next, they route funds through NFT marketplaces.

The only real defense? Training. Constant, realistic training. Every employee, every vendor, every contractor needs to know: a job offer on LinkedIn isn’t real if it asks you to download code. A “technical test” from a stranger is a trap. A message that says, “Quick, approve this transfer,” is a lie.

The Bigger Picture: Crypto as a Weapon

This isn’t just about money. It’s about power. North Korea has turned cryptocurrency into a weapon of national strategy. For every dollar stolen, they buy parts for a missile. For every Bitcoin laundered, they fund a nuclear test.

The world watches. The U.S. condemns. The UN imposes more sanctions. But the attacks keep coming. Why? Because crypto gives them a loophole no one has figured out how to close.

The $1.5 billion Bybit heist wasn’t just a record-breaking theft. It was a message: If you try to starve us, we’ll steal your digital economy. And we’re better at it than anyone else.

What You Need to Know

If you’re using crypto, here’s what matters:

• Never download code from strangers - even if it looks like a job test.
• Always verify requests for fund transfers with a second person or method.
• Use multi-signature wallets for large holdings - don’t rely on a single key.
• Know your exchange’s security practices. Do they use cold storage? Do they monitor for known laundering wallets?
• Assume every unsolicited message is a threat. Especially on LinkedIn, Twitter, or Telegram.

The $3 billion stolen isn’t just a number. It’s a warning. North Korea isn’t waiting for you to get better. They’re already ahead.