TL;DR: North Korean-linked hackers stole $2 billion in crypto in 2025 and $6 billion cumulatively, with $1.46 billion taken from Bybit and roughly 30 additional incidents making up most of the rest as attacks increasingly target individuals and smaller organisations, according to Swarmnetics. Custody controls now need identity verification, endpoint trust, and social engineering resistance, not just exchange hardening.
At a glance
What this is: North Korean-linked hackers are shifting part of their crypto theft campaign from exchanges toward individuals and smaller organisations, while laundering speed makes recovery harder.
Why it matters: IAM, fraud, and endpoint teams need to treat high-value crypto holders as identity targets, because social engineering and device trust are now part of custody risk.
Context
North Korean crypto theft is no longer just an exchange security problem. The article describes a shift toward individuals and smaller organisations that hold meaningful crypto balances, which means the attack surface now includes identity verification, social engineering resistance, and endpoint trust assumptions as well as platform controls.
That matters because these campaigns blend human-targeted deception with technical intrusion paths. When attackers can impersonate trusted contacts, deliver fake updates, or exploit weak device assumptions, the boundary between fraud prevention, account security, and operational security starts to disappear.
Key questions
Q: What breaks when crypto custody relies on informal trust paths?
A: Informal trust paths fail because attackers can impersonate contacts, send fake updates, or socially engineer approvals without defeating the wallet technology itself. Once a transfer decision depends on chat history, familiarity, or a hurried prompt, the control boundary moves from system authentication to human judgement, which is much easier to manipulate.
Q: Why do social engineering attacks against crypto holders become so hard to recover from?
A: They become hard to recover from because the theft can be converted and dispersed within hours. If defenders do not detect the compromise quickly, funds move through exchanges and mixers before freezes or tracing can take effect, which sharply reduces the chance of recovery and increases the need for immediate escalation.
A: Look for impersonated contacts, fake software update prompts, unusual messaging-based requests, and attempts to move users off established verification channels. Those signals indicate that attackers are using identity and trust manipulation rather than direct exchange compromise, so fraud controls and endpoint governance need to engage early.
A: Accountability should sit with both security and asset owners, because crypto custody is part identity assurance and part transfer governance. Security teams need the verification, endpoint, and monitoring controls, while the business side must define who can approve transfers, recovery steps, and wallet changes under abnormal conditions.
Technical breakdown
Why individuals are becoming viable crypto targets
Large exchanges still offer the biggest single payouts, but individuals and small firms often have weaker layered controls, less mature fraud monitoring, and fewer incident response resources. That makes them attractive when attackers can use reconnaissance to identify who controls funds and which channels can reach them. In practice, the value is not only the wallet balance but the likelihood that a target will trust a request, install something, or authorise a transfer without enterprise-grade verification.
Practical implication: treat high-value crypto holders as high-risk identities and apply stronger verification and transfer controls around them.
How social engineering and malware work together in these campaigns
The article shows a blended model: social engineering for individuals and technical exploitation for platforms. Fake Zoom updates, impersonated contacts on messaging apps, and staged interactions create the trust context needed for malware delivery or credential capture. NimDoor is important here because it illustrates how commodity-looking user workflows can become the entry point even on Apple devices, which many users incorrectly treat as inherently resilient.
Practical implication: assume messaging, updates, and meeting links can be delivery mechanisms and validate them through separate trusted channels.
Why laundering speed changes the incident window
North Korean operators do not need to hold stolen crypto in one place for long. The article says they move funds through wallets, exchanges, and mixers quickly, often converting to Bitcoin or Ether soon after theft to make freezing harder. That compresses the defender’s response window and shifts value from slow investigation to immediate containment, alerting, and wallet tracing.
Practical implication: build rapid detection and escalation paths for wallet compromise so response starts before funds are dispersed.
Threat narrative
Attacker objective: The objective is to steal crypto and move it beyond recovery quickly enough to support North Korea-linked illicit programs.
- Entry begins with reconnaissance on individuals or smaller organisations to identify who controls crypto holdings and which communication channels they trust.
- Credential or trust abuse follows when attackers use fake contacts, job offers, or software updates to deliver malware or obtain the access needed to move funds.
- Impact occurs when stolen crypto is rapidly converted, split across wallets, and laundered through exchanges or mixers before defenders can freeze it.
Breaches seen in the wild
- Bybit hack 2025: Hijacked AWS session tokens from a Safe{Wallet} developer's laptop let attackers alter signing code and steal about $1.5 billion from Bybit.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Targeting has shifted from pure platform compromise to identity-led crypto theft. The article shows that North Korean operators are now optimizing for the weakest human or operational trust path, not only for the largest exchange breach. That matters because once the target is a person or small firm, the control problem extends into identity verification, device trust, and fraud detection rather than staying inside exchange security. Practitioners should treat crypto custody as an identity governance problem as much as a wallet security problem.
Speed of laundering is now part of the threat model. Recovery is no longer only about finding the theft, but about acting before conversion and distribution remove the asset from reach. This changes how teams should measure resilience: alerting, escalation, and wallet tracing speed are now governance controls, not just operational conveniences. The practitioner conclusion is simple: if detection is slow, the asset is already gone.
NimDoor is a reminder that endpoint assumptions remain fragile on Mac environments. Attackers do not need to break every control if they can exploit user trust in software updates, messaging apps, and familiar collaboration flows. The broader lesson is that endpoint trust cannot be inferred from device brand or operating system alone. Security teams should govern update channels and messaging-based workflows as potential identity attack paths.
Crypto custody now sits at the intersection of fraud, IAM, and NHI governance. People who control funds behave like high-value identities, while the wallets, keys, and session flows they use behave like non-human identities with direct asset access. That means organisations need lifecycle control over privileged wallets and stronger assurance around who can trigger transfers. The practitioner takeaway is to align custody workflows with the same governance rigor used for privileged access.
What this signals
Identity and custody are converging. When attackers target the person who can authorise a transfer, the control problem becomes one of high-risk identity governance rather than only wallet security. Teams should assume that fraud, IAM, and endpoint controls now need to work together around crypto-holding users.
Laundering speed is a security control in reverse. The faster stolen assets are converted and dispersed, the less value defenders get from traditional investigation timelines. Practitioners should redesign escalation paths around minutes and hours, not days, when crypto theft is plausible.
For practitioners
- Harden high-value holder verification Require out-of-band verification for any transfer, software install, or recovery action involving high-balance crypto accounts and privileged staff wallets.
- Separate messaging trust from execution trust Block direct action on requests received through chat, email, or social platforms unless the request is confirmed through a second trusted channel.
- Treat software updates as a control point Verify update provenance for collaboration and wallet-adjacent tools, and train users to reject prompts that arrive through impersonated contacts.
- Accelerate wallet compromise response Pre-stage incident paths for freezing, tracing, and escalating suspicious transfers so defenders can act before funds are converted and split.
Key takeaways
- North Korean-linked crypto theft is expanding beyond exchange breaches, which means individuals and smaller firms now sit inside the threat model.
- The main operational challenge is no longer only preventing theft, but detecting trust abuse and laundering before funds disappear.
- Crypto custody needs stronger identity verification, trusted update channels, and faster incident escalation to reduce loss and improve recovery.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on trust abuse, access acquisition, and movement through crypto workflows. |
| Recommendation — Map the attack path to credential access and lateral movement so detections cover trust abuse before fund movement. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article highlights who can authorise crypto transfers and how those authorisations are abused. |
| Recommendation — Tighten access permissions around transfer approval and wallet control under PR.AA-05. | ||
| CIS Controls v8 | CIS-5 — Account Management | High-value crypto holders and privileged staff require careful account governance and offboarding discipline. |
| Recommendation — Apply account management controls to privileged wallets, approvers, and recovery contacts. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article depends on the weakness of user trust and the control of authentication artefacts. |
| Recommendation — Manage and revoke authenticators quickly for accounts tied to crypto custody and recovery. | ||
Key terms
- Crypto Custody Model: A crypto custody model defines how an organisation stores, protects, authorizes, and recovers access to digital assets. The model must align with business risk, jurisdictional requirements, and operational maturity, because weak key handling or unclear responsibilities can turn custody into a direct loss event.
- Social Engineering: Social engineering is the use of deception, urgency, and authority to persuade a person to reveal information or take a risky action. It targets human decision-making rather than software defects, and often turns legitimate identity workflows into the attack path.
- Trust Laundering: Trust laundering is when untrusted content gains trusted authority simply by passing through a tool that assumes the source is safe. In AI-assisted development, that can happen when repository files or hooks silently shape what the model sees, turning evidence selection into a security control.
- Endpoint Trust Assumption: An implicit belief that a device, app, or update channel is safe because it appears familiar or runs on a preferred platform. Attackers exploit this assumption when they use fake updates, impersonated contacts, or malware that looks legitimate to the user.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity controls to the broader security and resilience decisions that high-value workflows depend on.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org