North Korea's hackers now account for more than three of every four dollars stolen in cryptocurrency breaches this year. According to TRM Labs, the country's share of stolen funds reached 85% so far in 2026, a sharp increase from 7% in 2020.
The trend shows consistent growth over the past six years. North Korea's share of stolen crypto was under 10% in 2021, climbed to 22% in 2022, rose to 37% in 2023, and reached 39% in 2024 before jumping to 63% in 2025.
TRM Labs reports that North Korean hackers have stolen a total of $12.8 billion in cryptocurrency since 2017. Eleven governments have stated that the stolen funds support the country's weapons programs.
2025 Theft Figures and Scale
In 2025 alone, hackers attributed to North Korea stole at least $1.65 billion in just nine months, according to the same group of governments. This amount equals 3.5 times the country's annual legal export earnings.
The FBI attributed the $1.5 billion Bybit hack in February 2025 to North Korean actors. The US Treasury has stated that the hackers operate in units controlled by the country's main spy agency.
Named Hacking Groups
Multiple named units carry out these attacks. The FBI linked the Lazarus Group to the $620 million Ronin hack in 2022. A separate group, identified as TraderTraitor, has been connected to the Bybit, DMM Bitcoin, and Binance thefts.
A third group, Andariel, faces separate allegations. One alleged member has a $10 million US bounty related to ransomware attacks on hospitals.
Broader Hacking Activity
North Korean hacking activity extends beyond cryptocurrency. Governments have blamed the country for the 2014 Sony Pictures attack and the 2016 theft of $81 million from Bangladesh's central bank. The WannaCry attack, attributed to North Korean hackers, affected approximately 300,000 computers across 150 countries, including the United Kingdom's National Health Service.
A 2024 US indictment documented breaches of NASA and two US Air Force bases by hackers linked to North Korea. Authorities have continued issuing sanctions and indictments against the country's hacking units, though the pace of cryptocurrency thefts has not slowed.
