Topic starter
10/06/2026 10:31 pm
TL;DR: North Korean hackers stole $2.06 billion in cryptocurrency in 2025, accounting for 60% of all crypto theft losses and showing how high-value targeting, human manipulation, and rapid laundering now define the threat model, according to SumSub research. Identity programmes fail when trust and verification at the human boundary are easier to impersonate than to prove.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “North Korean Hackers Linked to 60% of All Crypto Theft Losses in 2025”.
By the numbers:
- North Korean hackers stole $2.06 billion in cryptocurrency in 2025, accounting for 60% of all crypto theft losses that year.
- More than 86% of the stolen ETH in the Bybit case was laundered into Bitcoin within a month.
Key questions
Q: What breaks when attackers can impersonate trusted counterparties in crypto environments?
A: The trust chain breaks before technical controls even see the attacker.
Q: Why do North Korean crypto theft campaigns cause such outsized losses?
A: They focus on high-value workflows instead of high-volume noise.
Q: What are the warning signs that human manipulation is being used to reach crypto assets?
A: Look for unsolicited recruitment or investment contact, pressure to move off normal communication channels, unusual verification exceptions, and urgency around wallet access or withdrawals.
Practitioner guidance
- Tighten human verification for high-risk access Require video interviews with liveness checks and background verification for roles that can reach custody, treasury, or signing workflows.
- Apply zero-trust policies to external workers Treat remote freelancers, contractors, and vendors as untrusted until they are continuously verified, with scoped access and explicit approval for privileged activity.
- Add withdrawal delays to transaction workflows Insert approval holds or time delays before withdrawals can leave controlled paths, so social engineering cannot immediately convert identity abuse into irreversible loss.
Bottom line: North Korean crypto theft in this article is driven by manufactured trust at the human boundary, not just by technical compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:35 am
Human manipulation is now a first-class identity attack, not a side tactic. CertiK’s findings show that North Korean operators do not need to break crypto systems first. They first break trust by convincing staff, recruiters, or vendors that the attacker belongs inside the workflow. That means identity programmes must treat proofing, liveness, and role validation as security controls, not admin steps. Practitioners should reclassify social engineering as an access-path problem, not just a fraud awareness issue.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when a manipulated identity authorises a major crypto transfer?
A: Accountability sits with the organisation that allowed the identity path to collapse. If a manipulated person, contractor, or vendor could reach transfer authority without step-up checks or segregation of duties, governance failed before the transaction occurred. Frameworks such as NIST CSF and Zero Trust expect verifiable access decisions, not trust by default.
👉 Read our full editorial: North Korean crypto theft shows the identity cost of human manipulation
12/06/2026 4:09 am
Human manipulation is the real identity primitive in modern crypto theft: the attacker does not need to break authentication if they can manufacture trust at the human boundary. In this pattern, identity assurance fails before a login ever occurs because the organisation treats social plausibility as a proxy for legitimacy. The practitioner conclusion is that human verification and access approval must be governed as one trust chain, not separate controls.
A question worth separating out:
Q: When should organisations delay withdrawals or settlement in crypto workflows?
A: Use delays whenever a transfer depends on a recently verified identity, a new third party, or an unusual approval path. Delays create a containment window that can stop a successful social engineering event from becoming immediate asset loss.
👉 Read our full editorial: North Korean crypto theft shows the identity cost of human manipulation
This post was modified 1 day ago by NHI Mgmt Group