Notifications
Clear all
Topic starter
11/07/2026 8:42 pm
TL;DR: North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase that pushed their cumulative total to $6.75 billion, while using fewer incidents, more IT worker infiltration, and executive impersonation to reach higher-value targets, according to Chainalysis. The pattern shows that access governance, signatory controls, and laundering detection now matter as much as transaction security.
NHIMG editorial — based on content published by Chainalysis: the 2026 crypto crime report on North Korean crypto theft and laundering patterns
By the numbers:
- North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase.
- Over $3.4 billion was stolen in the cryptocurrency industry from January through early December 2025.
- The top three hacks in 2025 account for 69% of all service losses.
Questions worth separating out
Q: What breaks when recruiters or contractors can reach privileged systems too easily?
A: When recruiter or contractor access is treated as low risk, attackers can use social engineering to obtain trusted credentials, source code exposure, or VPN and SSO sessions.
Q: Why do standing access and reusable signatory roles increase crypto theft risk?
A: Standing access gives attackers a larger window to harvest or abuse credentials, and reusable signatory roles turn one identity compromise into many possible authorisations.
Q: How do security teams know if laundering-aware detection is actually working?
A: Look for reduced time between theft indicators and the first confirmed trace, fewer missed bridge or mixer events, and faster escalation when unusual transfer tranches appear.
Practitioner guidance
- Harden recruitment and contractor identity checks Verify applicants, recruiters, and third-party intermediaries through out-of-band checks before any systems access is granted.
- Separate signatory access from routine operator access Require distinct identities, distinct devices, and distinct approval paths for transaction signing, wallet administration, and day-to-day platform work.
- Instrument laundering-aware detection playbooks Create alerting around bridge usage, mixer interactions, and unusual tranche sizing after compromise indicators appear.
What's in the full report
Chainalysis' full crypto crime report covers the operational detail this post intentionally leaves for the source:
- A deeper breakdown of the Bybit compromise and how it distorted annual theft totals across service and wallet categories.
- The article's transfer-pattern analysis for Chinese-language services, bridges, and mixers, including the observed 45-day laundering cycle.
- Wallet-by-wallet and network-by-network victimisation data that can help investigators understand where individual-user risk is rising fastest.
- The report's discussion of why DeFi losses stayed comparatively suppressed even as total value locked increased.
👉 Read Chainalysis' 2026 crypto crime report on DPRK theft and laundering patterns →
DPRK crypto theft tactics in 2025: what changed for defenders?
Explore further
11/07/2026 9:12 pm
Access governance, not just wallet security, is the real control plane in crypto theft. The article shows that North Korean operators are increasingly winning before any blockchain transaction is visible, by using recruiting fraud, insider-style access, and executive impersonation to reach privileged systems. That means the practical boundary of security sits in identity proofing, session control, and privileged workflow design. For practitioners, the lesson is clear: control who can reach the signer, not only what the signer can do.
A question worth separating out:
Q: Who is accountable when executive impersonation leads to privileged access exposure?
A: Accountability usually sits with the organisations that own the onboarding, approval, and privileged access workflows, not only with the victim of the impersonation. Governance frameworks such as NIST CSF and control families focused on identity and access management make it clear that approval design, verification, and offboarding are control responsibilities, not optional process details.
👉 Read our full editorial: North Korea’s crypto theft model is shifting toward fewer, larger hits
