North Korean hackers have intensified their attacks on cryptocurrency platforms, executing a record number of heists in 2024.
A Chainalysis report, reveals that using advanced malware, social engineering, and exploitative tactics, these hackers siphoned billions in digital assets to fund Pyongyang’s military ambitions, including its ballistic missile and nuclear programs.
The scale of these operations poses a significant challenge to global security, prompting increased scrutiny from U.S. and international authorities.
In 2023, North Korean-linked cyber actors were responsible for stealing an estimated $660.50 million across 20 incidents. However, 2024 saw an unprecedented surge, with $1.34 billion stolen in 47 attacks, marking a staggering 102.88% increase in value stolen. These incidents accounted for 61% of the total crypto thefts worldwide.
Notably, cyber intrusions by North Korean operatives have grown more frequent, particularly in high-value attacks. Exploits exceeding $50 million, and even those surpassing $100 million, occurred at an accelerated pace compared to the previous year. This represents a shift from earlier patterns, where the majority of heists netted under $50 million.
Meanwhile, a rising number of smaller-scale breaches, often around the $10,000 mark, suggest an increasingly diversified approach to cyber theft. In 2025, North Korean hackers were reported to have cashed out hundreds of millions from a $1.5bn ByBit hack. The criminals unidentified as Lazarus Group, swiped the huge haul of digital tokens, marking one of the largest thefts in digital asset history.
Experts say the hackers are highly sophisticated, operating 24/7 in what is believed to be a state-backed effort to fund North Korea’s military and nuclear programs.
A significant concern is the infiltration of crypto and Web3 firms by North Korean IT operatives. These individuals, often disguised under fake identities and hired through third-party intermediaries, have successfully embedded themselves in various organizations, compromising security and misappropriating funds.
A recent U.S. Department of Justice indictment revealed that 14 such individuals secured remote IT jobs at U.S. companies, collectively generating over $88 million through data theft and extortion.
Interestingly, while the first half of 2024 witnessed an aggressive wave of cyber heists, a noticeable drop in North Korean-led attacks occurred after mid-year. This shift coincides with the late June meeting between Russian President Vladimir Putin and North Korean leader Kim Jong Un in Pyongyang, where the two nations solidified a mutual defense agreement. Since then, Russia has released frozen North Korean assets and deepened military cooperation, with Pyongyang supplying ballistic missiles to Moscow and seeking advanced military technologies in return.
A comparative analysis of hacking trends before and after July 1, 2024, reveals a 53.73% decline in funds stolen by North Korean-affiliated cybercriminals, while non-DPRK-related cyber thefts increased by approximately 5%. Although the correlation between this decline and Russia’s renewed alliance with North Korea is unclear, shifting geopolitical priorities and increased focus on military cooperation could be influencing cybercrime strategies. However, experts caution that the year-end period, particularly around the holidays, often sees a resurgence in cyber threats.
The need for stronger crypto security
The rise in stolen crypto in 2024 underscores the need for the industry to address an increasingly complex and evolving threat landscape. While the scale of crypto theft has not yet returned to the levels of 2021 and 2022, the resurgence highlights gaps in existing security measures and the importance of adapting to new exploit methods.
To combat these challenges effectively, a collaborative approach between the public and private sectors is essential. Data-sharing initiatives, real-time security solutions, and advanced tracing tools. Targeted training can empower stakeholders to quickly identify and neutralize malicious actors while building the resilience needed to safeguard crypto assets.
Additionally, as crypto regulatory frameworks continue to develop, the scrutiny of platform security and customer asset protection will likely intensify. Industry best practices must keep pace with these changes. Ensuring both prevention and accountability.
By fostering stronger partnerships with law enforcement and equipping teams with the resources and expertise to respond rapidly, the crypto industry can reinforce its defenses against theft. Such efforts are not only critical for protecting individual assets but also for building long-term trust and stability in the digital ecosystem.
